On path to riches, no sign of fluffy majors  - <AUTHOR> http://www.washingtonpost.com/business/economy/if-money-matters-this-report-is-a-major-deal/2011/05/23/AF7r459G_story.html?hpid=z3 <comment><USER3> Historically, the liberal arts were practiced by the rich.

Engineering, and to a lesser extent the professional fields like Law and Medicine were intended to let smart bourgeoisie bootstrap themselves.

I doubt there is anyone anywhere who has taken on an english major and said "this will make me my first $1,000,000". So why is this common sense knowledge constantly peddled around as something "new" in newspapers?

<comment><USER4> More to that point, liberal arts were practiced by the rich in societies with _rigid class structures_. If you were the scion of a comfortable fortune, you majored in the "classics" or the liberal arts because you wanted, more or less, to have the background to enable you to live an exciting and fulfilling life of leisure. To make great conversation at cocktail parties and charity balls. To provide the intellectual background behind gentleman-scholarship and amateur pursuits. To help you toy around with a novel or two. And so forth.

This isn't the way our society works anymore, and the liberal arts curricula never really adapted with the times. To some extent, liberal arts is still a valuable major for those wanting to pursue Law, and whose colleges do not have a discrete "pre-law" curriculum. Other than that, however, liberal arts is fairly impractical. Still valuable for intellectual development, but intellectual development of a sort that's not prized or valued or applicable to modern working society.

<comment><USER5> That's the typical stereotype of liberal-arts education's history, but I don't think it's that historically accurate, though it probably does describe some of the Victorian era's schooling more specifically. But the traditional liberal arts weren't greatly separated from what we now think of as the sciences, though they were indeed separated from engineering and crafts. "Amateur pursuits" typically included not only "toy[ing] around with a novel or two", but also toying around with a telescope and a beaker or formula or two; most great scientists and mathematicians before the modern era were a product of liberal-arts education.

It's also been popular in the American context, which isn't a society that has a rigid class structure. That at least used to be connected with a certain view of democracy and self-government, which held that liberal-arts education was a prerequisite for a working democratic society (e.g. Thomas Jefferson's views).

<comment><USER3> I'll grant you that---I forgot about the time period where "natural philosophy" was science.

</comment></comment></comment></comment><comment><USER6> Anecdote: I'm 22, have a successful web application business that earns more than any of those median earnings, and am scaling my involvement (and earnings) down to begin my PhD in cognitive science (under the umbrella of psychology, for most).

Why would I leave the "path to riches" to earn - at best - the same as I've made as a teenager? Meaning. Research and teaching give meaning to an otherwise dull life of emailing people I've never met about issues that no one will remember in a few years time. It's fun to work with people, fun to talk about issues that no one quite understands (language acquisition, in my case), and exhilarating to teach students who will hopefully outperform me in every way.

This community is largely driven by money. People ask "How hard is it to make an app that makes $XXXX in revenue?" at least once per week. But there are other things that provide meaning and drive in people's lives. I've forgotten it on a fair share of occasions, but I hope I never look down on someone who dedicates four years (or more) of their time to studying the arts/humanities as opposed to the "hard" sciences or engineering.

<comment><USER7> It's a lot easier to go look for meaning once you have a solid financial base.

<comment><USER8> The trouble is defining "solid".

I will agree - if you are having trouble making rent and keeping food in the fridge, you're probably not having a very good time looking for meaning in life.

But do you really need to _maximize_ your income? Do you need a $300K job in finance or a $120K job writing code?

<comment><USER7> Right. I should clarify that in my own case, that meant getting the computer science degree, working for three years to pay off my debt, and then feeling quite comfortable taking a few years off to go backpacking around the world. I knew I could come back to my trade.

I also have a degree in history, so I did pursue liberal arts at the same time. But I knew that wasn't enough for a complete life, in my case.

</comment></comment></comment></comment><comment><USER9> If I had an english degree, rather than the usual tired excuses, I'd go around telling people:

 _"The study of humanities imbues us with a rich internal, emotional wealth such that graduates do not feel the compulsive need for ultimately harmful acquisitive obsessions throughout their lives, whereas holders of science degrees are condemned by their mechanistic brainwashing to toil furiously for worthless material rewards."_

Fortunately I did CS though. Humanities students are free to license it from me.

<comment><USER10> Maybe I didn't spend enough time in humanities courses (my engineering degree allowed for only 1 humanities course in 4 years), but let's be honest - there's a remarkably large number of really stupid engineers. I don't mean stupid in the classic sense, since they can understand their discipline and perform their work, but they have zero intellectual interests or pursuits outside of their field. Try starting a discussion on politics or history or any of the other humanities topic, and you're not likely to get very far.

<comment><USER11> Incidentally, it also works the other way around. There are a lot of people in every branch of the humanities who have no intellectual interests outside their field. Try starting a discussion about anything that isn't a humanities topic and see how far you get.

Well-roundedness is not something one gets just from studying the humanities. Knowledge of science, mathematics, and basic engineering are also essential. This gets overlooked a lot in discussions where the issue is framed as "high salary versus a well-rounded education".

<comment><USER12> I agree. The term "well-rounded" is often bastardized to mean "well-versed in humanities." It is particularly noticeable in college: engineers are required to take a large number of humanities courses, but people studying liberal arts only have to take one or two technical courses. Because of this, the average engineer is exposed to both technical disciplines and the humanities, whereas the average liberal arts student only sees the humanities.

Unless we redefine well-rounded in a way that is contrary to its original meaning, engineers may very well be more well-rounded than people studying humanities.

</comment></comment></comment></comment><comment><USER13> I studied art on my own for a long period of time, and I find that it helped me understand things like information design, human resource management, and promotion strategies -- many of the "soft skills" that most engineering schools do not stress upon.

I believe that education in humanities does not incapacitate people in any way, and the "critical thinking" skill it teaches is actually an extremely worthwhile and essential skill. However, there is a perception (based on some legitimate evidence) that it is easier to "wing it" in college if you are majoring in humanities. In other words, the very best humanities graduates may indeed be all very smart, however the portion of people who winged it while in college is probably higher among the humanities majors (it's hard to get away with a wrong math answer). So if you have little people experience, hiring an engineering graduate can be a "safer" bet depending on your industry. Which leads to engineers being biased to hiring other engineers. I personally believe that both "soft" and "hard" skills are desirable (but of course I am biased myself since I believe that I possess both...)

<comment><USER14> I agree that critical thinking is an important skill, but doesn't a science / engineering education teach this just as well?

<comment><USER13> The way I see it, the difference between the main method taught in the hard sciences (the empirical or scientific method) and between critical thinking as taught in the humanities is that the latter does not frown upon "intuitive" knowledge the way the first one does.

In the empirical method, you are encouraged to put on a blindfold and pretend to be perfectly unbiased when making a decision. That works very well for things about which you can actually pretend to be unbiased. Less so for things where you have to make conclusions based on your life experience.

Critical thinking (as opposed to the scientific method) becomes important when doing things like hiring people. I cannot afford to go outside, put on a mask, randomly sample people, spend a few years with each, write down the results, and generate a correctly averaged profile of my perfect employee. On the other hand, I do have an intuitive "feeling" for what type of people I am compatible with, what type of person is most likely to be smart and productive, and I have to make decisions based on this. At the same time I have to take into account my own biases.

Critical thinking as taught in the humanities is about balancing biases, while the empirical method as taught in the hard sciences is about attempting to remove bias altogether. The latter is superior but very expensive.

</comment></comment></comment><comment><USER15> I did an undergrad in English and then went on to do grad work in CS, I definitely feel that a background in the humanities has been able to give me insights into technical problems that people with purely technical background do not typically seem to have (not to mention all the communication skills that come in handy). My personal opinion is that degrees in the humanities are excellent, but that they should be followed up with a more pragmatic graduate degree (or pragmatic skill-set if grad school isn't your interest). There is way too much of a divided between technical fields and the humanities, and most people I've known are trained to think that interest in one completely excludes interest in the other.

<comment><USER16> > I definitely feel that a background in the humanities has been able to give > me insights into technical problems that people with purely technical > background do not typically seem to have

People with technical backgrounds have insights on things which you won't have when you are beginning. More often than not, insights originate from relevant background.

Not trying to prove you wrong or anything, but can you quote one or two specific examples of these insights which you think people coming from technical background don't seem to have.

> not to mention all the communication skills that come in handy

In my experience, technical people have above average communication skills. I am talking communication skills - not social skills(how to be nice when you actually aren't). Technical people hone their communication skills the same way you do - they read and write a lot - blogs, mails, books etc. Sure they aren't going to go win a booker(neither do most of English majors; if we are talking literary achievement of that scale, you undergrad isn't going to be a significant impact) but as far as communication goes, that doesn't seem to be a problem.

Take HN for example. There are a lot of people with purely technical background here. Do you think HN crowd has poorer communication skill compared to your non-technical crowd?

> most people I've known are trained to think that interest in one completely > excludes interest in the other.

I don't know about people you know but I would rather read "Coders at work", GEB, "You must be joking, Mr Feynman" etc than Ancient Indian civilizations or romans contribution to science.

I haven't been trained not to like it. I simply have no interest or use for it.

<comment><USER17> >More often than not, insights originate from relevant background. Not trying to prove you wrong or anything, but can you quote one or two specific examples of these insights which you think people coming from technical background don't seem to have.

<https://github.com/jashkenas/> was an English major I think, his JavaScript projects are one home run after another- Docco, Underscore, Backbone, CoffeeScript.

<http://www.flight404.com> still wouldn't call himself a proper programmer, since he writes crappy code, but through his mix of art and programming he popularized a new computer graphics trend. Processing, OpenFrameworks probably wouldn't be where they are today without him.

Steve Jobs' famous example is when he took a typography course, learned the importance of proper text design. In a speech he said if he didn't include those insights in the Mac, PCs would not have them for decades, since they copied the Mac. He's probably right, programmers left to their own devices would have stuck with typography from terminals.

The Flash movement was driven by programmers interested in art.

Software engineering on its own is a pretty narrow interest. A surefire way for technological/human progress to get stuck is to focus on a single discipline. Chasing salaries in the hip disciplines makes sense for individuals but sucks for economies, imagine if we had more patent troll lawyers.

<comment><USER16> Jeremy Ashkenas writes good code, and that doesn't have anything to do with his English Major. The discussion was about being from non-cs gives you some insights which cs doesn't, which is simple, plain wrong. A person from non-cs background can have insights about cs only when he have picked up the relevant background, at which point he isn't non-cs anymore.

Look, I am not saying people who haven't majored in CS can't write good code. I am taking exception to the remark that you can do your undergrad in English, join a CS grad program and have insights about CS owing to your English program. That simply can't happen.

Mark Zuckerberg, Steve Jobs, Bill Gates et al. didn't finish college. That doesn't imply not finishing college gives you insight college doesn't.

<comment><USER17> How do you come to the conclusion that a coder's projects have nothing to do with previous experience? Docco comes straight from literate programming and the English major is a major influence at least in project choice. It's not about CS insights, it's the non-CS insights at work here. Underscore is nothing new in CS, it's just well crafted, has a good API. How come similar projects by CS majors went nowhere? I think the ugly syntax did them in.

Code quality probably isn't influenced by unrelated experience, but the decision making, what projects to choose, how extensive they should be, what's important, is heavily influenced by outside experience.

Look at the example of startups. Often engineers who start them focus on cool technology, lose sight of the business, customer needs, can't come up with reasonable product ideas etc. They need guidance from people who ran a software business, made these mistakes and understood what's important.

It's the same with any other additional discipline, if you major in English prior to programming you're better positioned to make a word processor or document startup. I think you'd also be better at designing clear APIs and readable code, documentation for others. So many CS-only majors are horrible there. If you majored in design, better at making design tools.

Sure you can pick up skills after getting a CS a degree and the startup approach could give you that. But is that a better approach than majoring in art then picking up CS?

When you have too many college grads coming into a field, taught similar curriculum and Java, you have narrow group think. A person that comes at CS from a different angle will make a bigger difference in CS than those grads. It's an outside perspective, helps in any field.

Another example who isn't a CS major is Ryan Dahl, maker of Node.js. Lots of CS graybeards laugh at his naive efforts and spaghetti, but for some reason his project is popular. Perhaps those who weren't brainwashed by college CS tend to stand out? Let's do a study on that.

<comment><USER16> > How do you come to the conclusion that a coder's projects have nothing to do > with previous experience? Docco comes straight from literate programming and > the English major is a major influence at least in project choice.

I didn't say previous experience doesn't play a part - I said his English major doesn't play a part in his writing good code. I might be wrong - <USER2> Jeremy can answer this.

And how do you come to the conclusion English major is a major influence in Docco? Knuth is credited as conceiver of literate programming and for all we know, Jeremy just liked it and ported it.

> It's not about CS insights, it's the non-CS insights at work here. > Underscore is nothing new in CS, it's just well crafted, has a good API.

From Jeremy's attributions, underscore.js is largely a port of Ruby's Enumberable and Python's itertools. The api, more or less, is loyal to the source.

> Look at the example of startups. Often engineers who start them focus on > cool technology, lose sight of the business, customer needs, can't come up > with reasonable product ideas etc. They need guidance from people who ran a > software business, made these mistakes and understood what's important.

Yes, need guidance from people who have experience in running software business and undestand what is importance. They don't need guidance from people with irrelevant background.

> It's the same with any other additional discipline, if you major in English > prior to programming you're better positioned to make a word processor or > document startup.

There are products which were designed to serve the creator and were a big success. There are products which the creators didn't design for themselves which still managed to succeed. All we have here is anecdotes. I don't agree with your definitive assertion that English majors are better positioned to make a word processor.

> I think you'd also be better at designing clear APIs and readable code, > documentation for others. So many CS-only majors are horrible there.

Pretty much everyone is horrible at designing good apis. Again, I don't follow how and why English majors would be better at designing apis.

> If you majored in design, better at making design tools.

I am not contesting relevant experience helping you being good in a particular domain.

> But is that a better approach than majoring in art the picking up CS?

To each its own; for me, majoring in CS and picking other things later is better.

> When you have too many college grads coming into a field, taught similar > curriculum and Java, you have narrow group think. A person that comes at CS > from a different angle will make a bigger difference in CS than those grads. > It's an outside perspective, helps in any field.

May be it does. But you are generalizing a lot here. CS programs aren't a narrow group think you make them out to be. To make a bigger difference, it doesn't just take someone with outside perspective - it takes someone who knows all the rule better than anyone by heart and then breaks the rules he doesn't find proper. You need to understand the inside perspective and why things are the way they are before injecting outside perspective.

> Another example who isn't a CS major is Ryan Dahl, maker of Node.js. Lots of > CS graybeards laugh at his naive efforts and spaghetti, but for some reason > his project is popular.

Ryan Dahl isn't a CS major but he clearly understands CS. I am not saying someone who doesn't have a degree in CS can't do anything proper with CS; that was never the point. From his reddit AMA, he has put a lot of work towards his CS education. He just didn't write Node.js because his non cs background gave him some unique insights.

And the CS greabeards have done a lot as well. Just that they don't agree with Ryan Dahl doesn't mean anything - both groups have done good work.

> Perhaps those who weren't brainwashed by college CS tend to stand out? Let's > do a study on that.

Again, how does CS brainwash? And how do you propose we do the study? I don't think Jeremy Ashkenas would like to come over and participate in a polarized discussion.

<comment><USER17> You'd do the study by finding out people's educational background and seeing what kind of projects they made. Popular vs large but unpopular projects for example. Popularity might not seem like a CS metric, but it's progress in another direction.

Literate programming and writing essays in English major is the connection. He appreciated Knuth's ideas enough to seriously use them.

Any large scale educational curriculum "brainwashes." It makes lots of people think the same, have the same ideas. How many CS grads make their own CMS early on?

And we're all generalizing here, these textwall discussions will go nowhere.

My point was after a certain amount of time and progress, after a certain number of people join a discipline, progress in it slows. It's a law of diminishing returns. When large numbers are attracted to an industry because of high salaries, it seems to hurt the discipline. Same idea as too many cooks in the kitchen, too many programmers on a single project, only on a different scale.

Maybe that's why CS and software hasn't made much progress this last decade. You need to add more disciplines after a certain point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I wonder to what extent studies like this have things backwards to a certain extent? It's not that an engineering degree is more lucrative than an English degree, exactly; it's that if you want to be an engineer, you major in engineering, and then you go into a more lucrative field. Does that make sense? It's not that the degree that has some major predicative power -- it's that some fields are more lucrative than others, and people who want to go into those fields choose particular majors.

I do also think that the survey is flawed in that it doesn't track post- bachelors degrees. Psychology degree holders came in at the bottom of the list, but anyone who knows even a little bit about the mental health field knows that virtually all practioners have masters degrees or PHDs. So, yeah, if you just get a BA in psychology, you probably aren't making very much, not least because you probably aren't working in the mental health field as anything other than an entry level person.

<comment><USER19> >I do also think that the survey is flawed in that it doesn't track post- bachelors degrees. Psychology degree holders came in at the bottom of the list, but anyone who knows even a little bit about the mental health field knows that virtually all practioners have masters degrees or PHDs. So, yeah, if you just get a BA in psychology, you probably aren't making very much, not least because you probably aren't working in the mental health field as anything other than an entry level person.

As a study that compares bachelor degree to bachelor degree, this is still useful. To wit, I don't know of a school that charges more for a lucrative BS in CS than a less-useful BS in psychology, nor one that charges less for degrees that can only be used as stepping stones.

That said, a study that includes post-bachelor degrees in the ranking would be interesting. What would be especially informative would be a combined ranking that factors the average cost of education in with the average earnings increase/decrease. Perhaps a masters in psychology still gets you less than a BS in mathematics, perhaps not, but it would be neat to see.

<comment><USER20> > To wit, I don't know of a school that charges more for a lucrative BS in CS > than a less-useful BS in psychology

My alma mater, a public university in Ontario, Canada does this, but it appears to have more to do with government regulation of certain programs. Per-term fees differ by faculty, with arts and mathematics (not inluding CS) being almost the same, CS being much higher, and engineering slightly above CS.

<comment><USER19> >My alma mater, a public university in Ontario, Canada does this, but it appears to have more to do with government regulation of certain programs.

Good! This is, IMO, the best approach to degree programs. People could study what interests them without mountains of debt when leaving school.

>Per-term fees differ by faculty, with arts and mathematics (not inluding CS) being almost the same, CS being much higher

Interesting. I've always heard that a proper computer science curriculum is almost indistinguishable from an applied mathematics curriculum, and that it's in computer engineering/programming/applied computer science/(yadda yadda) that the real bacon is made.

Of course, I've never taken classes in a true CS curriculum, so I really can't say.

<comment><USER20> I may be _slightly_ embittered towards my school, but I think the difference has more to do with what they are allowed to charge than with actual curriculum differences.

Here are the actual amounts, FWIW: [http://www.adm.uwaterloo.ca/infofin/students/UG%20Schedule%2...](http://www.adm.uwaterloo.ca/infofin/students/UG%20Schedule%20of%20Fees%20Current.pdf)

</comment></comment></comment></comment></comment><comment><USER21> "No sign" is classic headline overstatement. I have a bachelor and a masters in non-CS subjects but have spent most of my time programming or doing security. When someone needs to talk to the "business" people, that's usually me and it's because of the skills that I picked up studying other things. I think I probably make more than I would have if I'd studied CS. Nonetheless, the plural of anecdote is not data.

</comment><comment><USER22> I expect that there are a lot of other factors that would predict future earnings better than major. Plenty of people get degrees in philosophy or English with the intention of following it with law school. On the other hand, plenty of people major in English because they don't know what they want to do, or because they're actually majoring in football. How many people just fall into engineering or CS? Probably not as many as fall into anthro.

My guess is, the people who value making a lot of money and who major in English do just fine for themselves, the people who lack drive and ambition who major in English work at McDonald's, and the people who major in humanities because they value things besides money live in an artists' commune in Brooklyn making art and music and not really caring that they're not making as much money as you are.

</comment><comment><USER18> To put it slightly more succinctly, it's not that some _majors_ are more lucrative than others; it's that some _industries_ are more lucrative than others. You should really figure out what kind of work you want to go into, and part of your calculus for that should be how much money you'll make, if that's important to you, and then figure out an academic path that prepares you for that. If you think of college as a black box that spits out a high- paying job at the end, then you're frankly in trouble.

</comment><comment><USER23> How about Philosophy?

Here is a huge list of notable people who studied philosophy who have done quite well for themselves.

[http://healthcareethicscanada.blogspot.com/2008/12/philosoph...](http://healthcareethicscanada.blogspot.com/2008/12/philosophy- degrees-and-famous-people.html)

George Soros, Cartleton S. Fiorina, Ricky Gervais, Ethan Coen, the list goes on and on.

Also, Peter Thiel, Paul Buchheit, and Paul Graham all studied philosophy if I recall correctly.

<comment><USER11> I'm sure you can find a long list of people who've done exceptionally well who majored in any common subject. This tells us very little about what sort of money someone majoring in philosophy is _likely_ to make.

<comment><USER16> > I'm sure you can find a long list of people who've done exceptionally well > who majored in any common subject.

Or people who have't majored at all - Mark Zuckerberg, Bill Gates, Steve Jobs etc. Parent post is making rules out of exceptions.

</comment></comment></comment><comment><USER24> It is interesting to compare and contrast this article with a recent article from the NYTimes, talking about the Civil War and education: [http://opinionator.blogs.nytimes.com/2011/05/23/from-the- pla...](http://opinionator.blogs.nytimes.com/2011/05/23/from-the-playing- field-to-the-battlefield/)

Specifically, at the time of the Civil War, students were mostly studying the classics - even if engineering and other disciplines were available at some institutions. West Point, for example, was essentially an engineering school at the outbreak of war. I wonder what value students at the time saw in their degrees that we don't see now, and I wonder what has happened to change that perception / reality...

<comment><USER25> At the time of the Civil War college students were from wealthy families. They didn't go to college to get a well paying job.

</comment></comment><comment><USER26> I'd really like to see a longitudinal study that models something like:

       log(mean_realized_income) ~ log(mean_expected_future_income)

People who go into humanities don't expect to make a million dollars. Research like this verifies common assumptions, but to me they always have a sunspot study feel to them.

</comment><comment><USER27> Please note that this is an article about average people, making the headline entirely sensationalistic ("no sign"?). The average engineer has a set of skills that can easily be plugged directly into a corporate widget machine to profitable ends, and is paid accordingly. The average "fluffy major" has a set of skills inapplicable to much of anything. But what happens if you stop thinking about the average? I don't know the answer to that, but I do know plenty of fluffy major C-levels and directors.

But I also like JonnieCache's take on it in these comments; fluffy majors know better than to care about such base needs as material wealth!

<comment><USER28> These were my thoughts exactly. Any intelligent, ambitious individual will find a way to succeed, regardless of the chosen University major.

But the practical skills taught in BUS, CS, ENG etc are more valuable in a corporate setting, and hence for the majority of folks who just want to get a job.

</comment></comment><comment><USER29> No doubt some parents will use this article as "ammo" when forcing their college-age kid to major in something "useful" rather than in something the kid is actually interested in and passionate about.

There may not be enough engineers at the moment and that inflates salaries. However, the way out of this is not to encourage folks to major in engineering "for the money." Much better to have a smaller number of engineers who are intrinsically motivated.

</comment><comment><USER30> The problem with averages is that they don't tell you the distribution of salaries. Take a look at the top 1000 earners in the US and tell me what their degrees are in. Something tells me it's not going to be petroleum engineering.

</comment><comment><USER31> Completely unrelated but why in the hell does their article page show my Facebook friends' status updates

<http://cl.ly/2n0B1S2b080n3V0y3329>

Looks like a "we need more social in our business" decision.

<comment><USER32> the image doesn't render on chrome, you have to download it

<comment><USER31> used grab on OS X (creates tiff ...)

</comment></comment></comment><comment><USER33> Is it really so surprising that people who study how to make things (physical or otherwise) wind up with more money than those who study something else?

</comment><comment><USER34> Isn't there a sort of selection bias? Slackers who go to college will choose easier majors, and won't even bother with engineering. There's no reason a smart, hard-working English major can't earn a good salary.

</comment><comment><USER35> Engineers, scientists, and "business" people need more training in the liberal arts, not less.

Those 4:00 AM moments are the ones we need more education for....questions of ethics, of weighing values, of being able to see and reason from multiple viewpoints, of being able to communicate efficiently, of being able to _empathize_ accurately.

Don't get me wrong - I also wish all of us were more educated in highly abstract thought (math). It's just that many of us stop learning and questioning the day we learn to count. If "value" or "riches" is a number to us, we need what the humanities reveal more than anyone.

"Riches" is in the eye of the beholder, one supposes. I got a B.S. in biochemistry before my M.D., have fairly extensive software engineering experience and training, have a modestly low Erdos number....and yet I tell you my colleagues and I would be better docs and engineers with a strong emphasis in our early training on the humanities. In my case, I'd have been much better off turning my minor in English into a major, learning to draw and sculpt and create more, writing more, reading more philosophy/ethics/history, learning more foreign language.

We need more medical students and programmers who major in the humanities. Medical schools in particular nowadays push hard for people from the humanities (those students also need to take a relatively few science requisites) We need people who move between disciplines more easily. We need fewer specialists. Those 4:00 AM moments...when you lack data, when you lack algorithms, when you need to understand broad fields, understand and communicate with people, and make the right _ethical_ decisions require the liberal arts at least as much as our ability to count.

To paraphrase a dead poet or two, our lives ain't about laying pipe. Go read and think over poetry and literature and history and the dilemmas a thousand cultures _already_ worried over - we'll be better engineers or entrepreneurs or doctors.</comment>


Welcome to Pariahville: A City of Refuge for Sex Offenders - <AUTHOR> http://www.gq.com/story/sex-offender-community <comment><USER2> Fucking USA is scary as fuck. This is IMO a serious issue, but you can't talk about it because you will be called out as child molester or at least sympathisant. Guess thats the Freedom i heard so much about.</comment>


Why RAII rocks - <AUTHOR> http://bromeon.ch/articles/raii.html

<comment><USER2> Yes, of course RAII is much shorter than a contrived example designed to be as long as possible. Here's a much shorter version:

        int unsafe2()
        {
            A* a = new A;
            int retval = 0;

            if (a->f())
            {
                B* b = new B;

                if (b->f())
                    retval = b->g();
                else
                    retval = a->g();

                delete b;
            }

            delete a;
            return retval;
        }

I agree that RAII is a good thing, but can we please avoid straw-man examples?

<comment><USER3> How does this version handle exceptions?

<comment><USER2> It doesn't. Just like the example it replaces.

I'm not saying this is the best way to write this code - there are several reasons RAII is better. But in this case, "look how messy non-RAII code is!" isn't the reason.

<comment><USER4> The original example does actually properly deal with exceptions.

</comment></comment></comment></comment><comment><USER5> I was surprised how little I missed manual memory management when I switched from C++ to C# for everyday work.

RAII is something I do miss, though, even after years of C# I still feel lifetime management of objects is awkward.

<comment><USER6> For unmanaged resources using provides almost the same thing, the only downside I can see is it means yet more nesting.

<comment><USER7> You can forget to write a using statement. In C++ you can omit your destructor entirely if all the members are already RAII classes, whereas in C# you still need to write a .Dispose() method.

Memory management is by and far the vast majority of resource management in C++ for me, which C# takes care of with garbage collection - so I don't miss RAII too much in C#. But if you tried to give me a C++ with using blocks but no RAII (read: you gave me C) I'd scream.

RAII is no panacea[1] - I'd say C#'s manual resource burden without RAII is still less than C++'s _with_ RAII. Which is why I don't miss it _too_ much. But it'd still be a nice addition. And I missed it dearly during my initial adoption of C#.

[1] e.g. in C++, you still have to worry about reference cycles, implementing the RAII constructs in the first place if existing ones aren't suitable, ensuring parents are kept in scope while referencing children, etc..

<comment><USER8> > But if you tried to give me a C++ with using blocks but no RAII (read: you > gave me C)

If you don't care about MSVC, IMHO new C code should be using the gcc cleanup extension: [http://en.wikipedia.org/wiki/Resource_Acquisition_Is_Initial...](http://en.wikipedia.org/wiki/Resource_Acquisition_Is_Initialization#GCC_.22cleanup.22_extension_for_C)

<comment><USER7> > If you don't care about MSVC

Even ignoring personal taste: I care about MSVC. I also care about clang. GCC is the one compiler I'm able to not care about.

> IMHO new C code should be using the gcc cleanup extension

Even if I didn't care about MSVC, I'd disagree.

I'm OK with extensions that are "harmless" in that the program will still run without them working if I #if them out on other compilers - error pragmas, deprecation annotations, static analysis hints, pre-C++11 override keywords, etc.

I'm not OK with self inflicting vendor lock-in for something as important as cleanup rely on a specific compiler's extensions - especially not when we have a perfectly standard, portable, significantly better tested (and thus less likely to have bugs) reasonable alternative in the form of C++ destructors.

If I'm not using C++ destructors, it's either because:

1) I'm doing small changes to an existing C project (in which case I'd be stylistically inconsistent with it's preferred cleanup patterns for minimal gain, since it almost certainly doesn't use the gcc cleanup extension)

or

2) because I can't rely on having decent C++ compilers on my target platforms (which means I can't rely on having GCC either, and thus can't rely on the gcc cleanup extension by definition.)

<comment><USER8> For what its worth, it is only MSVC without support. gcc compiler extensions are otherwise still rather portable. To clang and icc at least.

<comment><USER7> > For what its worth, it is only MSVC without support.

How recently? I've been enough versions back that clang documented pragmas haven't been available. The cleanup attribute... I can only find docs for GCC. Although I see LLVM bugs for it, so you're right about clang supporting it - at least on HEAD.

> gcc compiler extensions are otherwise still rather portable.

Portable or not, I'd say only about half the extensions I've sought out on clang have actually been available. If that.

> To clang and icc at least.

I should note in scenario #2 above I don't have these available either, since these are decent C++ compilers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Love me some RAII. Also, why is C++ chock full of such opaque acronyms? RAII and SFINAE come to mind.

<comment><USER10> More: NRVO, Pimpl, SBRM, EBO, NVI, ODR, CRTP, STL, RTTI, TMP.

I've been using C++ for the past year at work. It's an absolute nightmare to learn.

<comment><USER11> SBRM, EBO, NVI, ODR, TMP -> care to explain those?

Anyway it does prove your point: have been using c++ _way_ longer than you and these don't immediately ring a bell. Always more to learn! (or at least, always more super subtle details you'll only encounter once in a lifetime)

<comment><USER12> SBRM = Scope Bound Resource Management ( another name for RAII ) EBO = Empty Base Optimization NVI = Non-Virtual Interface ODR = One Definition Rule TMP = Template Meta Programming

<comment><USER11> Funny. I do know all those principles but had no idea there were common abbreviations.

</comment></comment></comment></comment></comment><comment><USER13> Why would you heap allocate something that you're deleting in the same function? Isn't there some equivalent length example that isn't so contrived?

<comment><USER14> There are numerous cases when one would do exactly that, which all boil down to "this thing is too big for stack allocation." Ever done any image processing?

<comment><USER15> In addition, RAII is useful for more than just memory [de]allocation: database connections, resource handles, anything that you have to get/create and then cleanup/release.

<comment><USER16> As someone that works 90% with python and 10% with C++, that's something that gets missed in the debates about GC/manual memory management. It's a lot easier to leak resources in python programs because the whole point is you aren't sure what the lifetime is of some objects; if you knew, you wouldn't need a GC. So I end up putting a with block pretty high in the call stack holding the DB handles (most of the time) which is just a weaker form of RAII, as you can't "allocate" anything further down the call stack.

I prefer working in python to C++, I just wish I had a lot more control over things like this. And no, __del__ isn't a good solution as that opens a whole can of worms (for one, it's not guaranteed to ever be called).

<comment><USER17> Python has context managers, which were added for exactly this purpose.

      with alloc_resource() as resource:
          resource.use()

<comment><USER16> I mentioned those. They work, but they're just a weak form of RAII without any extra power.

<comment><USER17> Can you elaborate on "extra power"? A c++ constructor/destructor pair is equivalent to __enter__ and __exit__. I fail to see how this grants a significant amount of power. There's certainly differences, but the gap is probably not as large as your weasel words make it out to be.

You complain about having to put initialization into 2 constructors, but there's the flip-side with things like mutexes. In c++, you have to have 2 classes, one for the lock and one for the guard. Whereas with a context- manager, you have one class and the locking code is in the __enter__ and __exit__.

        with self.lock:
            self.do_stuff()

In that case, I would say that the context-manager is nicer.

<comment><USER16> I didn't have any example of extra power, just in with blocks you have some downsides compared to RAII but no upsides. By downsides I mean that in C++ you write the constructor/destructor and never worry about it again, but in python every caller has to use a with block, plus what I said above about exceptions being thrown before __enter__.

I haven't done much with mutexes, but doesn't having it split over 2 classes introduce a race condition? Seems like a weird way to implement it to me.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Isn't that similar to ARC in Objective-C?

<comment><USER19> ARC is (almost) purely automatic. You write your code however, and then a code analyzer goes through it to figure out where to put the memory management calls. (Also I'm pretty sure ARC still just does reference counting).

<comment><USER20> ARC stands for Automatic Reference Counting: [http://en.wikipedia.org/wiki/Automatic_Reference_Counting](http://en.wikipedia.org/wiki/Automatic_Reference_Counting)

</comment></comment></comment><comment><USER4> Welcome to 2015.

</comment><comment><USER21> Does your language have mutexes and exceptions? You NEED RAII...

</comment><comment><USER22> Rust is the answer. C++ is just soo legacy.

<comment><AUTHOR> So what? Sure, rust is the new thing, node.js is the new thing, forget about SQL since NoSQL is the current thing. Etc etc, Bla bla bla. I hate this "let's chase every new thing and everything old is shit" attitude. C++ may be old but it does a great job at what it is targeted for (just like Fortran and many other "old" things). I'd really wish more people would stop chasing "new shiney" and just get work done. C++ may be complicated and old, but it gets work done.

Old, complicated and legacy does not equal bad.

<comment><USER23> It's also caused billions of dollars in damage. Hell, even just null pointers. Saying it does a great job is very generous. Even if it is the best language for low level work, it is still barely acceptable.

We should strive for advancement and progress in our field. There is a large difference between this and chasing the latest fad JS framework.

Unless you are saying that programming is a solved problem and C++ is about as advanced as we'll ever get.

<comment><USER24> And Rust is still going through its shakedown cruise. I wouldn't yet be comfortable taking it in the deep waters where C++ currently roams.

There's still a lot of need for tooling, testing, and letting people with smaller projects (and/or non-Mozilla use cases) shake out the bugs.

Give it a few successful years post 1.0, and Rust will be in a better place to truly take the mantle from C++.

<comment><USER25> It's sort of funny that you're holding rust to a far higher standard than c++ has ever met. A more honest post would say "c++ will continue to be used because c++ is what is used and that's how we like it."

<comment><USER24> The only standard that I'm holding C++ to is that it's been around longer, which means that the big holes have been patched (or bilge pumps dispatched), and developers who use it are realistic about what they are able to achieve.

That doesn't seem like a very high standard to hold Rust to. The problem is there's still holes we don't know about, and the developers who evangelize it are all starry-eyed about "never having to deal with memory again!"

When the shine wears off a bit (on both the language and its users), the big holes can be found and patched, the bilge pumps dispatched for the small ones, and Rust can move forward with a lot more confidence.</comment></comment></comment></comment></comment></comment>


WikiLeaks suffers a DNS poisoning attack; The Guardian claims they were "hacked" - <AUTHOR> https://twitter.com/wikileaks/status/903196002202550272 <comment><USER2> No, nothing indicates it was a poisoning attack. Please check the facts. [http://www.bortzmeyer.org/observations- wikileaks.html](http://www.bortzmeyer.org/observations-wikileaks.html)

</comment><comment><AUTHOR> This looks like a typical DNS cache poisoning attack[1], which takes advantage of insecure DNS caching servers. Users of those caching servers will be sent to the wrong IP, so it is a successful attack of sorts. But there isn't much the target website can do to prevent it.

[1] [https://en.wikipedia.org/wiki/DNS_spoofing](https://en.wikipedia.org/wiki/DNS_spoofing)

<comment><USER2> What makes you tell it looks like DNS poisoning? It if were DNS poisoning, some resolvers would have been poisoned but not all, while, here, everybody saw the attacker's IP address. [http://www.bortzmeyer.org/observations- wikileaks.html](http://www.bortzmeyer.org/observations-wikileaks.html)

<comment><AUTHOR> You may be right - I was basing that information off statements that it was only some users seeing the attack. I wasn't aware of a historic data source that could show otherwise.

Your analysis looks pretty good but I disagree that DNSSEC would have stopped the attack, because many users don't use validating resolvers.</comment></comment></comment>


Unearthing Roman 'nerve centre' in Spain - <AUTHOR> http://www.bbc.com/news/science-environment-34956067 <comment><USER2> Do people not know what an administrative center or military compound is? Are analogies from neurology of all things really more accessible?

<comment><USER3> My guess is it's a translation from an idiomatic expression in Spanish. I'm not sure, but 'nerve center' is a pretty common idiom in Italian for a hub, and a cursory web search seems to confirm this phrase exists in Spanish as well.

<comment><USER4> A nerve centre could be translated to Spanish as 'centro neurálgico' which basically means administrative center. It's widely used in Spanish :)

<comment><USER2> Thanks. I don't speak Spanish. I had no idea that this was a common idiom.</comment></comment></comment></comment>


Drones ground water-dropping helicopters at critical moment in Maria fire battle - <AUTHOR> https://www.latimes.com/california/story/2019-11-01/maria-fire-drone-hinders-firefighting-efforts-as-blaze-doubles-in-size-overnight <comment><USER2> If you come across drone photos of the fire described here, in social media or anywhere, please report them to the Ventura County Fire Department at email@example.com Subject "I found someone's drone photos of the wildfire" for further investigation.

(They could be taken by licensed media personnel, so be polite about it.)

</comment><comment><USER3> I wish comments like the dead one here weren't killed. Nobody wants to consider alternative viewpoints too often around here.

I honestly feel like the officials here are just malingering to try to get drones banned because they don't like them. No way one tiny drone flying somewhere in the forest means no helicopters can do their job in the entire vicinity. It's no different than a large bird being around.

<comment><USER4> > No way one tiny drone flying somewhere in the forest means no helicopters > can do their job in the entire vicinity. It's no different than a large bird > being around.

Aircraft dropping water on fires are:

1\. flying very low,

2\. over fires that will be causing a lot of turbulence,

3\. in aircraft that are heavy loaded, making them less nimble than normal, and making maneuvering put more stress on the aircraft than normal,

4\. in conditions with poor visibility.

This makes it a very stressful, dangerous kind of flight, where if anything goes wrong the chances of the pilot recovering in time are greatly reduced. Encountering a drone could easily lead to a crash in these circumstances.

And yes, it is very different from a large bird, because large birds will be avoiding the fire.

<comment><USER5> 5\. useless in the grand scheme of things

"Air tanker drops in wildfires are often just for show" [https://www.latimes.com/local/la-me- wildfires29-2008jul29-st...](https://www.latimes.com/local/la-me- wildfires29-2008jul29-story.html)

"To professional firefighters, though, it was a prime example of a "political air show," the high-profile use of expensive aircraft to appease elected officials."

"CNN drops."

</comment></comment></comment><comment><USER6> Hasn't the US/Canada law changed to require a pilot license and radio contact for flying a drone?

</comment><comment><USER7> Rather than the boring af repetitive talk about the fake Gatwick Drone. Or all the fake sightings.

Or the one sub par test of a drone hitting a plane in a facility.

How about we talk about how we let the government take over so much of our world.

We are moving to 3D, f the government. How do they own it all?

How can we not even use toys in 99% of our world.

It's a disgrace.

The data we are collecting from drones around the world is amazing. They lets us crawl back some of what governments have taken away. Good on people filming fires, they are possibly contributing more than these grounded helicopters. Helicopters need to learn how to share the space.

<comment><USER8> Do you really think that there's a significant public value for someone to be able to "use toys" in the same place where people are actively fighting a raging fire near an inhabited area?

I think there's a lot of value to things which can be done with drones but that's about the worst area to make this argument: it's limited in both space and time, and there's a direct risk to human lives.

<comment><USER9> > _Do you really think that there's a significant public value for someone to > be able to "use toys" in the same place where people are actively fighting a > raging fire near an inhabited area?_

The kind of reactionary legislation that articles like this generate support for will not simply ban drones over fires. The collateral damage to our present freedoms to collect data and imagery will be significant.

<comment><USER10> Then don't fly drones where the authorities are desperately trying to put out a fire, thus there would be no backlash.

<comment><USER9> I don't, yet I will still have my freedoms restricted by the reactionary and unnecessary legislation passed because of fearmongering articles like this.

Your words seem to imply that people who have their freedoms taken away in bulk are somehow themselves to blame, when that is rarely the case.</comment></comment></comment></comment></comment>


Progressive Web Apps in Microsoft Edge and Windows 10 - <AUTHOR> https://blogs.windows.com/msedgedev/2018/02/06/welcoming-progressive-web-apps-edge-windows-10/ <comment><USER2> Wow, this is amazing!

"In the next release of Windows 10, we intend to begin listing PWAs in the Microsoft Store... The Microsoft Store, powered by the Bing crawler, will automatically index selected quality Progressive Web Apps"

First, Microsoft is encouraging devs to build with web technologies instead of Windows APIs. This is exactly the future their anticompetitive actions in the 90s were trying to prevent.

Now, they're now treating the desktop like a browser and their Store like a search engine. They've lost the API wars [1] so thoroughly that they're now dedicated to working for the other side.

[1] [https://www.joelonsoftware.com/2004/06/13/how-microsoft- lost...](https://www.joelonsoftware.com/2004/06/13/how-microsoft-lost-the-api- war/)

<comment><USER3> this isn't even a recent shift though. The decoupling of .NET Framework / Visual Studio / SQL Server / IIS years ago was probably indicative of where the puck was going. I was considering buying a Xbox One X to replace my Xbox One but couldn't bring myself to pull the trigger because the only four things I could see as pluses (1. I like console Diablo 3 better than PC. 2. Madden. 3. UHD Bluray Player. 4. Faster hardware) didn't really warrant $500 (and the first two are functional on XB1 regular, just would admittedly look nicer) when I have a gaming PC that can play most of Microsoft's "Console Exclusives" which is another case where they don't force you into specific decisions.

Though I agree with your point that when the writing was on the wall, the pivot happened. Unfortunately, the reverse of that has been true as well. We had an issue with a vendor platform where we tested/developed everything in Chrome and it all worked fine. Then, as we're going live with this flip, we learn that the pagination is completely broken in IE9 and I believe IE10. Reason? Their pagination was appending extra elements (? or #, can't remember as it was about 3 years ago) which was against the standard (there could be only one). So in Google's saving you from yourself, they deviated from the standard which caused the platform to function incorrectly in another browser.

Let's also not forget their weaponizing of Google services when it comes to other platforms that aren't iOS (because splitting from that amount of marketshare would be ill advised).

</comment></comment><comment><USER4> Hopefully this would get some traction so Apple would jump aboard, especially on iOS. Maybe we'd need some EU antitrust on not allowing different browser engines.

<comment><USER5> iOS is getting Service Worker support in 11.3 [1], this is one of the key foundations for PWA support, so the situation is improving. I reckon it'll be a long time before we see PWAs in the App Store though!

1: [https://caniuse.com/#search=Service](https://caniuse.com/#search=Service)</comment></comment>


BBC U-Turn on Presenter Bias After Criticism - <AUTHOR> https://www.bbc.co.uk/news/entertainment-arts-49883952 <comment><AUTHOR> Context; BBC presenter, woman of colour, gives her opinion when asked by co- presenter on Trump's "go back" comments to female Democrat politicians of colour.

BBC censures her for opining on Trump's motivation (not for saying his comments were racist) following complaint.

Protests follow (including a BAME celebrity signed letter); BBC King overrules the decision.</comment>


The 3 most important things I learned from Google (part 3) - <AUTHOR> http://googler13.blogspot.com/2011/01/3-most-important-things-i-learned-from_28.html <comment><USER2> > Traffic served by Google doubled every single month for the entire five > years (1999-2004) that I was there.

I do not believe this is true.

<comment><USER3> I too think this cannot be true. If Google had 1 hit in his first month, and traffic doubled every month for the 5 years he was there, Google would have had 576,460,752,303,423,000 hits in his last month.

<comment><USER4> he mentions traffic, which is slightly different than hits, but I agree this seems implausible nonetheless.</comment></comment></comment>


Risk-weighted Capital: Whose Model is it anyway? - <AUTHOR> http://www.economist.com/news/finance-and-economics/21665039-regulators-are-taking-firmer-stand-how-banks-gauge-risk-whose-model-it <comment><USER2> This article basically just outlines regulatory capital and (I think) avoids economic capital. In very very shorthand - regulatory capital is the capital needed to comply with local regulations (with guidance from BASEL and BIS), while economic capital is the more nuanced calculation used to calculate the risk of capital using the bank's own deduction and modelling. A great metaphor for the actual difference is "Regulatory Capital is to Economic Capital as Road Test Is to Driving" ([http://www.americanbanker.com/bankthink/regulatory- capital-r...](http://www.americanbanker.com/bankthink/regulatory-capital-road- test-as-economic-capital-actual-driving-1061908-1.html)). Good banks use both, alongside other metrics to evaluate deals.

Economic capital takes into account the particulars of individual companies, while regulatory capital takes a broad brush approach. In reality, using reg capital leads to set ratings without taking into account the actual risk of the asset to the company. I would argue that the best approach would be economic capital as the main capital calculation with review and monitoring by regulators of the model and its assumptions.

</comment><comment><USER3> I wish the article made a clearer distinction between the capital ratio and the equity ratio. In places it makes it sound as if only shareholder equity counts towards capital requirements.

<comment><USER4> But today that's essentially true. The other tiers of capital are much thiner and easier to manage. To get more equity the only way is more profits, or a right issue.

</comment></comment><comment><USER4> In the enthusiasm to raise the capital requirements there is a fundamental schizophrenia. We can't ask banks to lend more, in particular to borrowers with lower credit quality, and at the same time force banks to deleverage. We can't ask banks to hoard capital to strengthen their capital ratios and at the same time nationalise all their profits by imposing gigantic fines that are scaled more to be headline grabbing that to the actual scale of the misbehaviour.

<comment><USER5> >In the enthusiasm to raise the capital requirements there is a fundamental schizophrenia. We can't ask banks to lend more

There is no schizophrenia. We don't want more lending. The economy is already over leveraged as it is.

The banks want more lending, of course.

<comment><USER6> Some governments want more lending:

[https://www.gov.uk/government/news/new-40-million- investment...](https://www.gov.uk/government/news/new-40-million-investment- by-british-business-bank-to-support-450-million-of-lending-to-smaller- businesses)

[http://www.washingtonpost.com/business/economy/obama- adminis...](http://www.washingtonpost.com/business/economy/obama- administration-pushes-banks-to-make-home-loans-to-people-with-weaker- credit/2013/04/02/a8b4370c-9aef-11e2-a941-a19bce7af755_story.html)

</comment></comment></comment><comment><USER7> "The idea, in Europe and beyond, is to limit how far banks can adapt their spreadsheets to make their assets look less risky."

They should be required to publish live spreadsheets on their websites showing their RWAs with daily marks. SpreadServe [1] would be perfect for this job.

[1] [http://spreadserve.com](http://spreadserve.com)

<comment><USER8> The group aggregated RWA calcs for a global tier 1 bank run substantially in arrears - perhaps as much as 2 months, and IIRC are submitted to the regulators quarterly.

The author is also using the word "spreadsheet" as shorthand to mean "the entire modelling infrastructure". For the trading book, this can be non- trivial.</comment></comment>


Five new Y Combinator startups to watch - <AUTHOR> http://venturebeat.com/2010/08/24/five-new-y-combinator-startups-to-watch/ <comment><USER2> Congrats to all Y-Combinator startups.

FutureAdvisor grabbed my attention. It seems like a great idea and will work for a majority of their costumers.

Does anyone know what direction they wish to take the company? For example, are they going to expand into more types of investment? Do you think they will help manage businesses at some point?

Those types of expansions, would interest me personally. However, I bet it is still way to young and non-profitable to know if they want to go down that road.</comment>


Show HN: A runtime agnostic test suite for the WebAssembly System Interface - <AUTHOR> https://github.com/caspervonb/wasi-test <comment><AUTHOR> This probably will bomb on HN, not much marketable about a test suite for a vaugley defined specification.

But, an open call for all developers interested in WebAssembly, please help me out with this test suite, we don't have one.</comment>


How can we all write forum titles so interesting that we cancel each other out? - <AUTHOR>

No seriously I want to know. <comment><USER2> I don't get this at all. Please elaborate.

<comment><AUTHOR> Like you know, everybody's forum is so interesting that nobody reads anything else because there are too many interesting forum titles and you don't know where to begin.

</comment></comment><comment><USER3> There are no titles here.</comment>


Scaling your API with rate limiters - <AUTHOR> https://stripe.com/blog/rate-limiters <comment><USER2> Hi! I'm the author of the post and am happy to answer any questions you have.

There is also a corresponding set of code examples at the bottom that might be of interest to you: [https://gist.github.com/ptarjan/e38f45f2dfe601419ca3af937fff...](https://gist.github.com/ptarjan/e38f45f2dfe601419ca3af937fff574d)

<comment> b-ryan I'm curious what your thoughts are on implementing this via a reverse proxy in front of your services. In terms of implementation it appears to me much simpler. But it obviously comes at the cost of maintaining the proxy if you are, say, already using ELBs.

<comment><USER3> Before I read this article (having just seen the title) I assumed this was going to be covering a reverse proxy system, and started pondering how I would implement something like this myself. A very basic approach probably would be simpler than middleware, but the question I got stuck on was whether or not a reverse proxy would need to be "smart" about the content it was limiting. That is, would it need to be programmed to parse requests and understand what the intention and purpose was of each request?

For example, limiting traffic by IP address via reverse proxy is simple, but it seems like it would be more difficult to limit by request priority.

I was surprised when the article revealed it was middleware, and suddenly that made a lot more sense and seemed easier because it no-longer requires duplicating application logic to understand the content of requests. Middleware definitely seems like the better approach to me after these considerations.

What kinds of methods would one use to solve the problem of needing to parse and understand incoming requests using the reverse proxy method?

<comment> b-ryan From the bit I know, I think there are at least some options available. For example, in nginx I believe you can use the "map" module to mix and match different components of the request into your limiting.

From what I saw, HAProxy appears to be even more powerful. Its ACL concepts are completely able to create rules based on headers, IPs in the request, etc. and you can compose them into larger ACLs.

With the example of request priority, if you can determine the priority by it's URL or a header, let's say, you can achieve this with nginx. But if you need to look the user up in a DB and see how much they're paying you, you obviously have to do it in the application.

</comment></comment></comment></comment><comment><USER4> I've put fair queuing into an web API. Requests queue by IP address; if you have a request in the mill, any further requests are processed behind those from other IP addresses. This handles single-source overloads very well. It doesn't require tuning; there are no fixed time constants or rate limits. For about a month, someone was pounding on the system with thousands of requests per minute. This caused no problems to other users. I didn't notice for several days.

One would think that this would be a standard feature in web servers.

<comment><USER5> This is an interesting approach to request rate limiting - the simplicity and lack of tuning is definitely appealing.

Did you do anything to mitigate the scenario where multiple users are behind the same IP address? With this approach I would worry about locking out all users in a NAT when a single user misbehaves.

It's also scary to me to process something "last" \- under high enough load you might never get back to the (potentially briefly) abusive user? Did you attempt to guarantee some minimum passthrough rate even for misbehaving users?

<comment><USER4> As with fair queuing in routers [1], you have to avoid infinite overtaking. If someone has have a request in progress, their other requests are stuck behind that one until the request in progress is serviced. Then your next request is eligible to be processed.

[1] [https://tools.ietf.org/html/rfc970](https://tools.ietf.org/html/rfc970)

</comment></comment></comment><comment><USER6> We do the same but instead of using redis we built our own service for it currently on top of leveldb instead of using redis.

This allow us to define the parameters of the token bucket on the service instead of the application like:

      'requests':
        per_second: 100
        size: 200

Then in the app is like

      conformant = limitd.take('request', ip, 1)

I found the token bucket alg to be useful in a lot of scenarios not only for rate limiting but also for any kind of event debouncing. A common example: lets say you want to email a user everytime they trigger some condition on the system but you dont want to send the same mail more than once a day.

Our project is opensource, we still working on it:

[https://github.com/auth0/limitd](https://github.com/auth0/limitd)

</comment><comment><USER7> Many engineers discover a need of rate limiters the hard way :-).

I just wonder, do you use rate limiters just for external API or also for internal API of your microservices?

<comment><USER8> A big percentage of our internal services are near-real-time asynchronous event consumers. Writing a consumer is not all that different than writing a service. For events and consumers we have mechanisms that serve similar functions as API rate limiting, but they have a different shape.

So the answer is probably a yes?

</comment></comment><comment><USER9> Another way to add a fast, distributed rate-limiting on top of your APIs is by using an API Gateway [1] like the open-source Kong [2]. This pattern is becoming a standard since it saves time from re-implementing and duplicating the same rate limiting logic in each backend microservice.

[1] [http://microservices.io/patterns/apigateway.html](http://microservices.io/patterns/apigateway.html)

[2] [https://getkong.org/plugins/rate- limiting/](https://getkong.org/plugins/rate-limiting/)

<comment><USER10> Yeah, worth mentioning [https://tyk.io](https://tyk.io) too.

Also, do not forget about Quotas which usually comes along with Rate limits. Modern API gateways can handle so many stuff for you and help with API scaling.

</comment></comment><comment><USER11> FYI: Redis now has a module that does rate limiting for you: [https://github.com/brandur/redis-cell](https://github.com/brandur/redis-cell)

</comment><comment><USER12> Can't help but put a link to [https://www.ratelim.it](https://www.ratelim.it) in here. A rock solid distributed rate-limit was something I desperately missed when moving to a smaller company.

Primarily I use this for idempotency and throttling things like usage events. But you can also use it for locking and concurrency control.

</comment><comment><USER13> Reminds me of a website I built once (more like a side project) where I anticipated heavy loads and all sorts of nefarious users / bad situations so I spent a good chunk of time implementing and testing rate limiters into most of the critical requests.

I ended up getting maybe... 3 or 4 well-behaved visitors / day for the first two years.

</comment><comment><USER14> Great article that I expect will assist many teams that are facing scaling issues.

I thought it appropriate to plug my java based rate limiting library that implements the token bucket algorithm as mentioned in the article

[https://github.com/mokies/ratelimitj](https://github.com/mokies/ratelimitj)

</comment><comment><USER15> Very interesting, we have throttling for our customer facing API built with PHP and found this library very useful: [https://github.com/sunspikes/php- ratelimiter#throttler-types](https://github.com/sunspikes/php- ratelimiter#throttler-types)

</comment><comment><USER16> Ignorant guy here:

Wondering how the two words "scale" and "limit" go together. My only experience right now with someone's API and rate limiting is Cloudinary. They give you 500 requests/hr (free). Which can be a lot or nothing at all.

No sorry it does make sense, don't allow one person to exhaust/consume your resources.

What about using Go? I hear crazy stuff like going from 2000 servers to 2, and doing 25,000 requests per second. Or is this a bandwidth concern?

<comment><USER17> How would you handle the problem where one API user would exhaust all your resources and your servers don't melt? Other than spending an ever increasing amount of money expanding capacity you would need rate limiting. What if the API call is computationally expensive ? What if someone is trying to maliciously use your API?

<comment><USER16> Yeah I'm not disagreeing with the author here. It didn't occur to me immediately what was being done. Scaling and limiting seems like antonyms but I get the point. Especially if it's free (the API access). Even premium/paid would need limits.

For the case here, where the client insisted on keeping the 500/hr limit, I cached the query-results with a database as the values don't really change. But if they did change in the future that could be a problem, so you'd have to update the "cache".

Regarding handling overflow, that's something I haven't done yet myself, still stuck in the LAMP days, and have not done something like bench marking my server to see how many concurrent connections/requests it could handle.

note: LAMP isn't an excuse, I'm just making a note that I'm behind in using other technology that could be better. But I've heard of modular Apache configs/routing... stuff beyond me at this point.

<comment><USER16> Man I have yet to experience what people are talking about here. By that I mean actually have the traffic to worry about requests/sec. I'd be lucky to get 100 visitors per month haha, I don't really have anything. Good stuff to look forward to, glad to be able to learn from other people.

</comment></comment></comment></comment><comment><USER18> Well written. I liked the "Building rate limiters in practice" section and your advice on launching dark seems like a great idea.

</comment><comment><USER19> Great post however does anyone know how rate limiting specific users is typically implemented? For instance if you have a SaaS API with multiple subscription plans you generally rate limit users based on tier e.g free tier: up to X number of requests, paid tier: unlimited number of requests, etc. I am assuming this is typically handled in the API itself.

Thanks in advance.

<comment><USER2> Thanks! The buckets are already done per-user so it is very simple to make the constant factors be user-dependent.

For my example in [https://gist.github.com/ptarjan/e38f45f2dfe601419ca3af937fff...](https://gist.github.com/ptarjan/e38f45f2dfe601419ca3af937fff574d#file-1-check_request_rate_limiter- rb) you would just set REPLENISH_RATE to be a different value for different users.

<comment><USER19> Thanks!

</comment></comment></comment><comment><USER20> Bookmarking this so I can go back to it when we have similar issues which are a function of scale, I assume.

</comment><comment><USER21> This article kind of makes me glad we decided to build our SaaS API on top of AWS API Gateway. At least I don't have to worry about the fine details of implementing rate limiting - just outsource that hard stuff to AWS and tuck our actual API endpoint behind their gateway.

</comment><comment><USER22> Does Stripe really allow 1,000 reqs/sec, or was that just an example limit? Is that normal i.e. expected for an API service like Stripe to offer? I usually see rate limits of 5-25 reqs/sec, but maybe I haven't been looking at the right APIs?

<comment><USER23> Well Stripe is handling payments for other companies so any unserved/blocked request could cost their clients literal money/customers. Also their customers could suddenly get an influx of orders/customers following things like Superbowl commercials so their limits would need to be pretty high.

I'm guessing here but I'm guessing Stripe would actually only enforce these limits when they have some infrastructure issue or emergency and in most cases would allow all non-abusive uses of their API through.

Twitter and other such services could use much lower rate limits because its OK if a user is unable to post a new tweet for a few seconds.

<comment><USER22> Good point. That's what I figured--for example, a background job running end- of-month subscription charges for a large co. could potentially slam the API for a few hours.

</comment></comment></comment><comment><USER24> Mousewheel doesn't work for me on this website

<comment><AUTHOR> Could you send me an email with what browser and OS version you're using? firstname.lastname@example.com

</comment></comment><comment><USER25> I a bit torn here. I love Stripe, but I feel like this is awful advice for API-first companies.

If you are building a developer product where your API is your business, using rate-limiters is akin to preventing customers from giving you money. If your product is an API, you should encourage usage. The more usage you get, the more success both you and your customer will have. It's a win-win.

Because of this, I believe implementing rate-limiting strategies result in not only poor-DX for the product, but also a loss of trust (if these limits are in place to prevent your backend from failing, what other things do I need to worry about while using your product?), AND most importantly, they result in loss of business for both the API company and the customer.

IMO, if you're an API company, and you can't handle bursts of traffic from your customers, you should work on improving your backend and stop wasting time messing around with implementing patterns like this. It's a lose-lose situation for you and your customers.

I was really inspired by this recently after spending some time @ Twilio. Jeff (and the rest of the Twilio team) are hardcore about their API first product / thinking. They have a motto which is something along the lines of this: if you and your customer are both more successful and both make more money when the API usage goes up, do whatever you can to get out of the way and let the API be used as much as possible. I thought that was an awesome approach to take.

<comment><USER26> Sorry, but this is naive and bad advice. Rate limiting is a critically missing component in many service APIs, for more reasons than I can even comprehensively enumerate off the top of my head.

Scaling an API of any real value is NOT trivial, and struggling to scale an API to meet user demand does NOT necessarily mean that the backend was poorly designed. This is a naive generalization that is hazardous to the industry. Please don't spread it.

Here are some reasons why a lack of rate limiting / user auth is practically negligence. There are more, to be sure. I have experience operating a customer facing API for Bazaarvoice, so I think I know what I'm talking about. (We do thousands of requests per second and power reviews for the likes of Walmart, Best Buy, and 4,000 other retailers and brands worldwide.)

* Multi-tenancy * * client A over extends and causes client B to be unable to use the API * * client A needs scale independent of clients B-F * monitoring * * suddenly a client is making fewer than usual calls, why? * * suddenly a client is making more than usual calls, why? * billing * * want more requests / second? Upgrade your contract * * it's easier to measure how much I should charge customers per request or type of request, when I can see the rates of those requests and what it costs me * security * * DDOS attack? Start by setting the limit to nothing, or rejecting the requests * * leaking API auth info is less dangerous, if it happens

I think some other sibling comments mentioned other great reasons. The takeaway is that a valuable API will most likely be difficult, expensive or both difficult and expensive to scale, and rate limiting is extremely important.

<comment><USER27> Rate limiting, and specifically leaky bucket algorithms that spaces out requests evenly, rather than servicing them as they happens to come in was shown to improve the overall performance in a few systems I worked with.

Using a leaky bucket algorithm, and a per-customer bucket, I think it's possible to build "fair" systems that also improves the performance.

That is, you can run the system with a higher total transactions per seconds, just by queuing "simultaneous" requests a few milliseconds, as they will complete quicker.

The reason is probably that it's reducing contention and levels out the resource usage.

I thought it would be a feature in almost all web servers, since it's been known "since forever" in the telecom world, but I have not seen it. (Have not looked specifically either, so maybe there are good support for this everywhere and I missed it...)</comment></comment></comment>


Google Advertising Plus Through Full Page Spreads in India. Good Idea? - <AUTHOR> http://avocadopress.com/google-advertising-plus-through-print-in-india/

<comment><USER2> A terrible idea unless they fix the names issue first.</comment>


Ask HN: how much conversion do you loose on people signing up for your service? - <AUTHOR>

Hi HN,
I was wondering how much of you are losing significant conversion on people who have to sign up for your service. I'm thinking of building a challenging solution so people never have to face it ever, and making the web more secure, but first I would like to do a quick survey!
Thanks a lot HN :-) <comment><USER2> About 1000:1.</comment>


People in the UK have been told to wear face masks - <AUTHOR> https://www.businessinsider.com/coronavirus-uk-government-advises-people-to-wear-face-masks-2020-5 <comment><USER2> Purely advisory on TfL (the tube), the conditions of carriage have not been changed.</comment>


Spy agency taps into undersea cable (2001) - <AUTHOR> http://www.zdnet.com/news/spy-agency-taps-into-undersea-cable/115877

<comment><AUTHOR> I've written extensively on the cutting of undersea cables and how it has affected our world and who may or may not be behind things. I wanted to post this article to ask a couple questions of ourselves and technology:

In 2001, we were all okay with this being headline news, now we're not. What has changed?

In 2001, the NSA claimed they didn't even have the technology to make sense or usefulness out of such massive streams of information. What has changed?</comment>


"So the silence from Facebook over the weekend is.. deafening." - <AUTHOR> https://twitter.com/gavinsblog/status/1046717365520666624?s=12 <comment><USER3> I've seen several similar threads to this one on Twitter.

"Blah happened at Facebook and it is potentially a company ending event."

This causes me to almost immediately discredit them, as while serious, this is no where near a company ending event for an organization that is headquartered in the US.

Equifax lost the personal data of all Americans and is doing fine.

Facebook might get fined a metric ton of money, people in some portions of the world might leave it, but the company will be just fine. You see, there is no where else for those people to go. Presumably they're on Facebook for some reason so they would want to find an alternative and there isn't an alternative that is as easy to use that their friends and family will migrate to.

Like many other compromises, this one will be forgotten. There is no wordlist that will come out of it, no public artifact that will exist. People have already forgotten about Adobe, LinkedIn is fading, and this one will eventually join their ranks.

<comment><USER4> This is what climate change news feels like too.

> _" Blah happened at_ City/Nation _and it is potentially a_ planet _ending > event. "_

It's hard to take Chicken Little serious. All of the sensationalism feels like a magician waving a cloth with one hand, to distract the audience from the other hand.

<comment><USER5> I don't know what to tell you. The sensationalism is there because it's a catastrophic problem that requires major action.

There's consensus that a very bad thing is happening, its effects are already being felt, and they will get much worse over time. Scientists have tried to communicate this in every way, but people have hemmed and hawed or outright denied it for so long that it's going to be bad no matter what at this point. There are still things that can be done to reduce the impact, but the picture isn't good.

<comment><USER4> Everything is a catastrophic problem to someone. Sensationalism is about the worst way to communicate this, and is likely why so many refuse to believe. The reality of climate change is that we're trading inhospitable poles for an inhospitable equator.

Yes, this will be painful to those who have to adapt or relocate. But it is a form of NIMBYism.

<comment><USER6> There's a lot more than weather to climate change. What if there were no more fish? What if the ocean didn't absorb CO2. Read more.

<comment><USER4> Life is full of scary problems. What if your car catches fire? Life can be made scarier if you pretend that you have to solve all the problems yourself. We can do anything, but we cannot do everything by ourselves.

If fish die, surely some other life form will fill that niche, and we'll eat that. It's not as though humans are the most adaptive life form in existence.

</comment></comment></comment></comment></comment></comment><comment><USER7> Well, I assume he's out to sell something.

1) He says you should delete your facebook account. It's too late, the data is already there. Deleting does nothing.

2) "By company-ending I mean Facebook would _never recover_ from the consequences of so much user data being dumped online for all to see" utter conjecture. there are petabytes of data, dumping that online is hard. Exfiltrating unnoticed is hard.

3) "This is potentially so bad that it could be called the Great Facebook Hack of 2018. But again, we don't know how much stuff was stolen. Yet." Again conjecture. This could be called the "great facebook spotted a hack on two account and stopped it before it got bad"

This is pointless punditry from someone who literally is nothing to do with facebook, has no contact with people close to the matter, and is just guessing.

yes, that much data in someone's hands is bad, but so is google, and the legion of databrokers and ad spinner.

<comment><USER8> >1) He says you should delete your facebook account. It's too late, the data is already there. Deleting does nothing.

facebook monetizes data by using it for selling targeted ads. by not using facebook, they can't sell you more targeted ads, which is something.

<comment><USER9> While true, a vastly more useful approach is to poison the well and give them false data.

<comment><USER10> I question whether this is really more useful. You'd have to show that advertisers noticed that data was fake, and that they cared, and that they cared enough to pull FB advertising.

To do that, you'd have to get a whole lot of people putting up false data, and to do that, you'd have to make it very easy to do. Which would probably make it detectable (you think your fake data tool will stay off their radar?).

</comment></comment></comment></comment><comment><USER11> > By company-ending I mean Facebook would _never recover_ from the > consequences of so much user data being dumped online for all to see. It > would permanently end the company. Shareholders should be worried. We just > don't know how much user data was stolen yet.

Exactly. I mean, just look at what happened to Equifax. Oh wait...

<comment><USER12> There is an important distiction: Equifax's data is not voluntarily submitted by the data subjects, while most of Facebook's is.

<comment><USER13> That sounds worse for Equifax

<comment><USER12> Although I don't see this having a huge immediate impact on Facebook, the distinction is that if Equifax neglagently releases your PII there is little fallout as you are not the one providing Equifax with that data and cannot simply stop feeding them data, when Facebook does it their data subjects can choose to stop providing the data by exiting the platform. Facebook needs both the user data, and those same users patronizing their service to maintain the existing revenue stream.

</comment></comment></comment></comment><comment><USER14> This is a great example of a link that should be off-topic for HN.

There's not one new material fact in the linked tweet, nor does it make an attempt at fair analysis. It instead consists of hyperbole ("company ending") and unfounded speculation ("I imagine"). It's just not a good starting point for serious discussion of the breach.

</comment><comment><USER15> The stock is down a measly 1.5%. Nobody gives a fuck.

Compare with TSLA Musk SEC investigation which caused a 10% plunge.

A misleading tweet is considered much more dangerous by the market than a 50 mil account breach. Investors know there are no real world consequences to a massive breach.

<comment><USER16> From $219 to $160 thats "measly 1.5%" ? Maybe by Sesame Street's Yellow Bird math standards.

<comment><USER17> The closing price on Thursday was $168.84. The close yesterday was $162.44. That's a 3.8% decline.

I'm not sure where you got the $219 price from, but the stock price was nowhere near that before the breach.

<comment><USER18> $219 is the stock's high price from this summer? The fall from there was totally unrelated.

</comment></comment></comment></comment><comment><USER19> This thread is a little pessimistic. Why would facebook suffer any consequences from this whatsoever? When has a data breach actually affected the company?

<comment><USER20> As I understand it, this wasn't just a simple/typical security breach. The hackers had access to people's accounts and for who knows how long. 50 million people's private conversations and pictures being made public, for example, would be the end of Facebook.

<comment><USER21> you underestimate the nihilistic attitude towards anything facebook vs privacy related. I don't think there is anyone out there who even remotely thinks their doings on FB is private any more, including PMs.

<comment><USER22> I think you underestimate the extent to which people think their PM's aren't a big deal, until they get released and a torrent of sexting, gossip, illicit relationships, bullying, and public scandal washes over society as fallout.

"I have nothing to hide" is the mantra of fools and people too domesticated to even imagine the ways that malicious crooks and societal pranksters can have it out for them.

</comment></comment></comment></comment><comment><USER23> > "And is up there with the biggest (if not _the_ biggest) hacks of all time."

In what world is this even remotely the case? OPM, Equifax, etc are far more serious hacks than this. Yahoo's multiple breaches dwarf the Facebook hack. 3 billion vs 50 or 90 million:

[https://money.cnn.com/2017/10/03/technology/business/yahoo-b...](https://money.cnn.com/2017/10/03/technology/business/yahoo- breach-3-billion-accounts/index.html)

</comment><comment><USER24> This Twitter thread by Alex Stamos (former Facebook CSO) is a good rebut to this: [https://twitter.com/alexstamos/status/1046783533220421632](https://twitter.com/alexstamos/status/1046783533220421632). Bottom line: you can do incident response quickly or correctly, but not both.

<comment><USER25> Don't forget about "neither". That happens too.

</comment></comment><comment><USER26> Simple.

I've done a shit ton of research on Corporate Surveillance in the past and there are a lot of signs of a big discrepancy of what people think what is stored about them in TAO and what is _really_ stored about them in TAO. (For those of you who are not that into Facebook, infrastructure and/or devops: TAO is Facebook's graph database)

One of the keywords here is "shadow profiles" or the nodes and edges within the graph which are actually there but you can't directly influence as a user. A good example would be the former colleague of a close family member who never disclosed their place of work and without a current account whom Facebook decided to recommend as a "friend" to another family member who currently has a Facebook account but without an actual past or live connection between the two -- true story, I shit you not.

So it's better to stay silent than proof yet again that there is a profound case for GDPR-like regulation - like Brandon Eich recently recommended - <USER2> the United States.

</comment><comment><USER27> This thread seems to have developed learned helplessness. This reflects very badly of our confidence in the legal system. Equifax and tobacco industry needs to be punished to feel the brunt of their crimes. But we seem to have accepted the fate.

</comment><comment><USER28> I would guess the silence is driven by lawyers and PR folk.

We probably won't hear anything until we start getting leaks from the investigations of data protection regulators around the world.

<comment><USER29> It's mainly driven by investigation I'm guessing, with the FBI in tow too.

</comment></comment><comment><USER30> Why is the silence deafening? And what exactly is expected from Facebook? Today it'd say it was 50 million affected, and in a day change it to up to 90 million, and a week later it'll become 130 million, then it'll be 150 million, and then people will stop caring, as they have before, and move on.

There are three kinds of people — those who stopped using Facebook a long, long time ago when the very first privacy issues came about; those who will never stop using Facebook unless they're moving to Instagram or another hotness of the day; those who may stop using Facebook after hearing about privacy or security issues. The last category is very, very small. So is the first.

The only way to get out of this mess is to have a "new hotness" that's as good as (if not better than) Facebook and is privacy preserving, decentralized, easy to use, etc. We're still a long way away from that.

</comment><comment><USER31> "We don't know anything for certain but I'm double-dog sure you should sell all your shares and delete all your logins." There's even nonsense about GDPR in the comments.

This all stinks of shorting... And even if it's not, it's too sensationalist to take seriously without more data.

</comment><comment><USER20> Facebook, Whatsapp and Instagram went down globally for hours at the start of August. There was no explanation about this major outage as far as I remember.

Does anybody know if it was related to this data breach? If so, why were people only informed of the breach nearly a month later?

<comment><USER32> No, it wasn't. I was interning there at the time and love to regularly check the current issues page.

Also, they probably did just learn about the breach day of from the person who was going to livestream deleting Zuckerburg's account.

<comment><USER20> Thanks. Were people as panicked inside Facebook during the outage, as I was as a user trying to browse meme groups?

<comment><USER32> More exasperated, I think? If I remember correctly, it wasn't too complex to fix (maybe just a rollback), it just took sometime to push to prod.

Mostly my interactions involving the outage were just browsing memes about it in shitposting@

</comment></comment></comment></comment><comment><USER33> Is this person trying to dump FB stock for his own benefit? It makes me very skeptic that he had to tweet 11 times in a very alarmist tone. If his opinion is firm on transitioning from FB to a more private and secure alternative why not just say that in 1 or 2 tweets in a tone endorsing other platforms perhaps in a more positive manner?

</comment><comment><USER34> The amount of attention on that Twitter thread makes me think how much people really care about the issue.

Maybe I'm wrong, hoping it gets light later on.</comment>


Researcher Discloses Critical Flaws Affecting Millions of HiSilicon Chips - <AUTHOR> https://cyware.com/news/researcher-discloses-critical-flaws-affecting-millions-of-hisilicon-chips-bc25313a <comment><USER2> There was an article a few days ago about a software backdoor built by a different company that was unrelated to the actual silicon. Is this the same vulnerability, or is this one actually implemented in silicon?

<comment><USER3> The link to the PoC is the same as for this submission: [https://news.ycombinator.com/item?id=22251329](https://news.ycombinator.com/item?id=22251329)

Same vulnerability. The reason HiSilicon couldn't provide the fix is that they didn't write the firmware running on those devices, Xiongmai did. This information was added as an update to the original writeup.

<comment><USER4> More interesting info on Xiongmai if anyone's unfamiliar:

[https://krebsonsecurity.com/2018/10/naming-shaming-web- pollu...](https://krebsonsecurity.com/2018/10/naming-shaming-web-polluters- xiongmai)

</comment></comment></comment><comment><USER5> HiSilicon is a subsidiary of Huawei [https://en.wikipedia.org/wiki/HiSilicon](https://en.wikipedia.org/wiki/HiSilicon)

</comment><comment><USER6> I'm probably picking nits, but is something intentionally designed and implemented a "flaw" if it works as intended?

<comment><USER7> You're right, depends on the perspective.

From Huawei/CCP standpoint it's a feature. For everyone else, it's a flaw.

<comment><USER6> Indeed, and given that this was an intentional design tells you who they truly believe is their primary "customer."

<comment><USER3> If the intention was to allow telnet login over the internet, they'd also have added hole punching so accessing the port doesn't require bypassing the firewall.

The design is more consistent with a debug feature intended for troubleshooting by someone on the same LAN. Of course the debug interface shouldn't be so easy to access, but that's just stupidity, not malice.</comment></comment></comment></comment>


Ask HN: Does anyone have recommendations for a web based kb/help docs system? - <AUTHOR>

I'm looking to move away from our current help system solution - where we use clunky (won't name names) software to generate html/xml files of content/indexes that we then upload. It then adds basic searching. It is a beast to update, and the JS that powers it weighs in at nearly 2 megs.<p>I've been looking at http://68kb.com/. Has anyone used it? Does anyone have other, similar software to recommend? php based/mysql database is what I'm looking for, ideally. <comment><USER2> There's phpmyfaq which looks more like the specific tihng you have in mind, but I really think a wiki is a better idea.

Mediawiki is the best choice if you don't need to do funny stuff like setting up closed groups.

But like jacuesm said, the trac wiki is also nice but only if you intend to use the other trac capabilities IMO.

<comment><AUTHOR> thanks - that looks really promising.

</comment></comment><comment><USER3> That looks really nice - I like it. I've used Cerberus Help Desk in the past and it was nice. ZenDesk, Kayako, Helpspot, and more fill this gap. Check out this past link: <http://news.ycombinator.com/item?id=404963>

<comment><AUTHOR> Thanks - those looks pretty nice, but we already have separate support ticketing/live support chat systems, all of which are integrated separately on their own into our app. We're just looking for a simple KB system like 68KB. I just wonder if there are others out there...

</comment></comment><comment> d-ash We have used <http://kbpublisher.com/> It's pretty clean and powerful.

</comment><comment><USER4> I've just started using Trac after some hints here (I wanted a self-hosted solution), and it comes with a built in wiki.

</comment><comment><USER5> A wiki is really good for this, such as MediaWiki or Trac.</comment>


UUDIX: A fast, and cryptographically secure UUID (v4) generator for Crystal. - <AUTHOR> https://github.com/krthr/uuix <comment><USER2> Seeing projects like this one always puts a smile on my face, because I really like to see Crystal having a heartbeat. It might just be my personal background, but the language brings everything to the table that I am looking for in a fits-most-use-cases programming language. Crystal is _fast_, has a type system that stays out of my way as much as possible and (coming from Ruby) a really legible, expressive syntax.

Great reasoning on allocation seemed to have paid off, looking at your benchmarks. Keep up the great work and let's make Crystal a thing!

<comment><AUTHOR> I have high hopes for Crystal. I love it.

Although most of the time I'm writing NodeJS I always try to help Crystal's ecosystem grow.

Thank you!</comment></comment>