Smart people don't think others are stupid - <AUTHOR> http://sivers.org/ss <comment><USER2> _There are no smart people or stupid people, just people being smart or being stupid._

The same could be said about almost all behaviors, such as courage, promiscuity, or whathaveyou. However, over time people tend to display consistent patterns of behavior. As a consistent picture emerges, we tend to switch from thinking of people as _acting_ a certain way, to thinking of people as _being_ a certain way. Whether you want to say someone is acting stupid all the time, or someone is being stupid is just semantics.

<comment><USER3> _> As a consistent picture emerges_

I've found that the length of time most people take to form a "consistent picture" of someone else is very short. Generally, it is whatever is the shortest length of time required to determine "are they acting in accordance with my desires or not?".

If the person is generally helping to make things happen which you want to have happen, you form a favorable impression of them quickly.

If they are unhelpful, you tend to think negatively of them. There is rarely a deep consideration of who the person actually is, or what might motivate them to behave the way they do.

Of course, if they are not only helpful, but are creating new opportunities, we call them "visionary" or "leaders". Great people.

If their actions are opposed (directly or indirectly) but very obviously to what we think our needs and desires are, we label them "enemy" and push them into that definition.

I'm having a hard time articulating what I want to get across, but it boils down to this: after a while, we stop acting on information that might change our perception of who someone is. We just think of them as _"being a certain way"_ and observe all behavior from there on out as solidifying that definition in our minds.

I think a truly "smart person" is someone who is always staying open to the possibility of people changing radically, however unlikely that may seem.

<comment><USER4> > I've found that the length of time most people take to form a "consistent > picture" of someone else is very short.

Indeed. I believe this is called the illusion of asymmetric insight: [http://webcache.googleusercontent.com/search?q=cache:youaren...](http://webcache.googleusercontent.com/search?q=cache:youarenotsosmart.com/2011/08/21/the- illusion-of-asymmetric-insight/&strip=1) (cache since the site seems inaccessible).

<comment><USER5> Thanks, that was an awesome read. I'm going to get the book. While this post was short & to the point, I felt there was a lot of generalizing going on... I mean, what the heck is "smart" and "stupid" anyways? Don't we all define that in our own minds? Asymmetric insight; now that's some serious stuff to reflect on...

</comment></comment></comment></comment><comment><USER6> Smart people don't think others are stupid _merely because of the beliefs they hold_. That is, being a [Southerner, Northerner, Republican, Democrat, Indian, American, Christian, Muslim, Atheist, Tauist, Piist, vi user, emacs user, ...] does not mean a person is stupid. There are smart people who really have thought things through and ended up at each of those positions for good reasons.

But smart people might conclude some specific individual is stupid because of _consistently erroneous patterns of thought and analysis which do not improve with experience_. There are a few individuals who I've spoken to on a variety of topics over the course of years who, as a rule, develop beliefs based on sketchy evidence and then retain those beliefs even in the face of mountains of contrary evidence. Even when they hold essentially the same views as I do, it's often for bad reasons; there isn't really a coherent thought process or a body of evidence that got them to that point. Such people really are stupid.

<comment><USER7> _Even when they hold essentially the same views as I do, it's often for bad reasons_

I noticed this too, and for a long time it bothered me. But I recently read Jonathan Haidt's book _The Righteous Mind_ , and in it he points out that a lot of people appear to hold believes about a wide array of issues (politics, religion, consumer products, and so forth) that they don't really hold based on logic and evidence, but to signal group identification and affiliation.

In addition, he points out that, on a wide array of issues, people tend to have gut, intuition-based reactions first, _then look for evidence to support their intuition_ , while a lot of us assume or want to assume that it works the other way around.

I probably learned something from _The Righteous Mind_ on every page, and I say this about very few books; I also wrote at more length about it here: [http://jseliger.com/2012/03/25/jonathan-haidts-the- righteous...](http://jseliger.com/2012/03/25/jonathan-haidts-the-righteous- mind-and-what-were-really-arguing-about) .

(BTW, I agree with your basic point and think it's well put.)

<comment><USER8> To your first point, some scientist believe it is hard wired in our DNA to associate with any form of group (as this played a role in evolution). Here's a related interesting talk on TED that I recently saw: [http://www.ted.com/talks/lang/en/jonathan_haidt_on_the_moral...](http://www.ted.com/talks/lang/en/jonathan_haidt_on_the_moral_mind.html)

<comment><USER7> . . . that scientist is Jonathan Haidt, who wrote _The Righteous Mind_.

</comment></comment></comment></comment><comment><USER9> Sometimes people appear to me unskilled, sometimes they appear unknowledgeable, sometimes they're thinking in twisted ways that they picked up from their environment, sometimes they're falling prey to cognitive biases, sometimes they're making one of a hundred other mistakes I happen to recognize.

And sometimes, so far as I can tell, they're stupid. Sorry.

Original article's error: The fact that a conclusion sounds nice does not save it from being patently false.

<comment><USER10> As a rule people are a lot smarter than they may appear to be at first contact. And people that think they are very smart are typically smart along some fairly narrow field and then extrapolate their smartness in that one area to all areas.

Thinking is interesting that way, if you're 'smart' it usually means that you know a lot about some subject but that isn't actually being smart. Being smart means that you can use the knowledge you've got in creative ways when presented with unforeseen problems or situations.

And there are plenty of people that would not normally be called smart that excel at that.

Being smart or not has nothing to do with making mistakes or falling prey to cognitive biases. The first is typically evidence of people trying things a little bit outside their envelope of experience, in turn they'll acquire new knowledge because of this. Guilty as charged, I make mistakes _all the time_. Your environment has nothing to do with you being smart or not either. Otherwise, how would you ever be able to recognize someone from a society with different levels of development as smart.

The fact that someone does not appear smart in a way that you recognize does not mean they are not.

<comment><USER11> My favorite thing to learn is to recognize a cognitive bias in myself. I might know one, theoretically, but if I recognize it consciously when I fall victim to it, I feel like I've grown a bit.

<comment><USER12> I have this link on my bookmark bar. I do the same thing.

<http://en.wikipedia.org/wiki/List_of_cognitive_biases>

</comment></comment></comment></comment><comment><USER13> He's right - smart people _know_ others are stupid.

Seriously though, people do Stupid Things. And I call them stupid when they do them. Change lanes without signaling, without looking - maybe you're not an idiot all the time, but at that moment you're acting like an idiot and endangering other people.

<comment><USER14> I think the point is that we vigilantly distinguish "that was stupid" from "that was a stupid person". Judging someone as stupid means we've stopped thinking about possibilities. Derek wisely says there's always more to the story (reminded me of this: [http://garrysub.posterous.com/what-does-it-feel- like-to-be-s...](http://garrysub.posterous.com/what-does-it-feel-like-to-be- stupid-an-anonym))

Labeling people is nearly always a substitute for thinking and empathy (both hard things).

<comment><USER13> Lest I forget, there is also ignorance-- willful cluelessness; can't be bothered to learn something; won't have a reasoned discussion. I do label these individuals "stupid." Don't get me wrong, it's not immediate prejudice, but it doesn't take much time talking to some people to learn that they are willful in their efforts to remain uninformed.

</comment></comment></comment><comment><USER15> That's provably wrong. In the first place, both his definitions of "smart" and "stupid" are wrong according to the dictionary. You can't just redefine words so that they suit your argument. If that's an acceptable approach, I can just as easily say all living humans are stupid by defining "stupid" as "not Einstein".

Secondly, even if we allow that his private definitions be used for the purposes of this argument, he's still wrong. People do exhibit consistent behavioral tendencies, after all. Some people consistently think things through, while others consistently jump to conclusions. So I think there is pretty good justification in applying the heuristic of thinking a person is stupid if he consistently jumps to conclusions.

I hate to say this, because I have much respect for Derek Sivers, but this post was pretty stupid.

</comment><comment><USER16> I used to think people are stupid.

Then I stopped being a teenager and realized that, hey, most people are actually pretty cool. When they're being stupid it's usually just a lack of information and when you educate them a bit, they get better.

But then the internet reminded me that there are, in fact, stupid people all over the place, they just don't live in my IRL filter bubble.

Evidence: <http://notalwaysright.com/> <http://clientsfromhell.net/> <http://textsfromlastnight.com/>

</comment><comment><USER17> Perhaps OT because of the age involved, but... as a kid, I was 'gifted' (not sure if that label is still used today or not). I would get people (adults or other kids) saying "you're so smart", and I would naturally try to deflect/downplay that - was never really told how to react to statements like that as a 7 year old. "Thanks" just sounds so bland, but, I didn't even think that far ahead.

Instead, I would usually protest some - "no, I'm not really". But eventually I adopted the attitude that yes, there was a difference between me and many other kids in my classes, but it wasn't that I was smart - it was that they were dumb. Relative to me, most of them were. But it wasn't so much a 'dumb' as in 'you're a lesser person', it was just hard for me to realize people didn't retain as much info as I did, nor could they make mental connections like I could, nor as fast.

I do remember having that line of thinking for a few years, and it wore off by early high school age.

<comment><USER18> This, except I'm in college now and it works that way. At times, I still have to consciously remind myself that X is not completely obvious to everybody.

<comment><USER17> It will probably go away in time. As I get older, it's more apparent to me how much I don't know any more, and my expectations for others knowing things I consider obvious has tempered some.

</comment></comment></comment><comment><USER19> Indeed, for only a smart person can come up with a twisted and convoluted rationalization that a person with an IQ of 75 is not stupid and a person with an IQ of 125 is not smart. You'll find some of the most passionate arguments about the problems of IQ testing from people with IQs over 115. If you really think it doesn't matter, well, I'm sure there are some interesting ways to knock down your IQ quite a bit that you might want to try as a personal experiment. As a safer experiment, find someone with an IQ in the 90s or less (do you know anyone with sub-100 IQ?) and try to teach them Haskell.

Of course, we're all _intelligent_ on a species-scale, but that's a separate distinction.

<comment><USER20> I heard that learning to "game" IQ tests is a common exercise in psychology classes. According to my friend it's fairly easy to get very high scores with the appropriate preparation.

A very good old friend of mine is a professionally trained waiter and never had "advanced" math classes. His knowledge of math was limited to the rule of three.

One day I tried to teach him functions, quadratic equations, basic analysis and other stuff. He grocked it immediately. Much much faster than most of my class mates when we had to learn these topics back at school.

I think it is important to distinguish between "knowledge" and "intelligence".

A good life lesson was given to me by my English teacher in high school. He always told us that when you notice that you have more knowledge in area than the person you are talking to, then it is your job to adjust your way of communication. Not the other way round. It's of no good to be smug. In fact if you fail to communicate your ideas, you might not be as smart as you might think.

<comment><USER21> Related: <http://xkcd.com/1053/>

</comment></comment></comment><comment><USER22> The dictionary defines stupid as: _Adjective: Lacking intelligence or common sense._

and intelligence as _The ability to acquire and apply knowledge and skills._

Perhaps the author does not often meet people who lack _the ability to acquire and apply knowledge and skills_ but that doesn't mean they don't exist.

</comment><comment><USER23> I can't imagine anything more apt than a conversation about this subject on a forum made up of people who hold their own intelligence in a high regard.

I assure you that your definition of "stupid" is short-sighted. I've pre- judged a good many of people in my life as such and have been proven wrong almost every time, provided I'd spent enough time to try to understand what makes that person think the way they do.

We all have our methods. You might call them madness - or stupidity - but the moment you do, your ignorance becomes your bold weakness.

tl;dr: Get over yourself.

Downvotes... Let's continue the point...

"Sometimes, so far as I can tell, they're stupid. Sorry." [1]

"people do Stupid Things. And I call them stupid when they do them." [2]

"Smart people also triage their time so as to not waste it going down likely unproductive avenues." [3]

"Maybe politically correct people don't think others are stupid, but smart or not, there are definitely some morons out there." [4]

"Define usually. More often than not when I hear "I don't know" it is offered as an excuse/explanation for laziness and shirking responsibility" [5]

"Odds are that the all of the people from the article, and the author, are relatively stupid." [6]

"Smart people don't think others are stupid as the truely smart know that others are stupid." [7]

"at LEAST 15% of the world is stupid. That's just getting started." [8]

1: <http://news.ycombinator.com/item?id=3985594>

2: <http://news.ycombinator.com/item?id=3985040>

3: <http://news.ycombinator.com/item?id=3985265>

4: <http://news.ycombinator.com/item?id=3985575>

5: <http://news.ycombinator.com/item?id=3985050>

6: <http://news.ycombinator.com/item?id=3985118>

7: <http://news.ycombinator.com/item?id=3984894>

8: <http://news.ycombinator.com/item?id=3985224>

</comment><comment><USER24> >So when someone says "They are so stupid!" - it means they've stopped thinking.

Don't listen to this !!

If you don't stop thinking , pretty soon you'll be deconstructing socio- economic behaviour of wage employees, thrashing between cultural/societal programming and why that is so, then you will move on to swarms surviving and problem-solving in groups and why programming is necessary for this, then you will proceed on to variety in nature, and degrees of freedom and 'coincidental' interlocking of such degrees of freedom of various entities leading to formation of stable ecosystems of assemblies of moving parts . By this time your soup would've gone cold and the opportunity to tell the establishment that this is not what you ordered would be far gone.

</comment><comment><USER25> Maybe politically correct people don't think others are stupid, but smart or not, there are definitely some morons out there.

I for one, do not need to be PC to be smart. I don't claim to know everything, but that doesn't mean there aren't people who know less who also decided a long time ago to stop learning/embracing new ideas.

</comment><comment><USER26> Therefor, according to his own rules, the author of this a article is stupid.

Before someone concludes the obvious about my comment I'll point out that those are not my rules.

</comment><comment><USER27> Interesting choice including Republican and Democrat, there.

I don't think they're stupid, but if someone identifies themselves as "a Republican" or "a Democrat", as opposed to "the Republican party best fits my views", or "I'm a registered Democrat", I pretty much write off any chance of having a decent political discussion with them.

A large segment of the population follows politics the way they follow football, except without even watching the games, just the commentary and opinion pieces afterwards.

Smart people also triage their time so as to not waste it going down likely unproductive avenues.

But it's just a numbers game; there are invariably going to be people a level above me intellectually who this will filter out. But I can live with that.

<comment><USER28> Well, one argument is that politics _is_ essentially a football game. The stakes are far, far higher, but fundamentally it comes down to all the institutions of a society self-organizing themselves into coalitions for the assumption or protection of power. "Reason" amounts to a way to mask rhetorical flourishes to convince dupes that they're morally better or smarter than the other side.

And if you're turning to the Wall Street Journal or New York Times to learn about the finer points of Nozick's critique of Rawlsian liberalism... well, then you're the dupe, even if it's of a "pox-on-both-your-houses" variety. Thinking too hard about whatever outrage-of-the-day Mitt or Obama has done is a similar waste of time--it's not that there isn't conceivably some correct position about whether eating a dog or strapping them to your roof reflects worse on your character, it's just that it's all a smokescreen.

Given that, I'd say you have to pick a side. If you end up rejecting politics because it isn't the Oxford debating society, you've essentially let the other side deprive your own side of a valuable resource. It might suck that you're stuck in a game not of your own choosing, but if someone's kicking you on the ground, you don't quietly accept it because they're not following Marquees of Queensbury rules.

<comment><USER29> I agree with your first two paragraphs. The position you advocate in the third would make sense if political affiliation conferred a tangible benefit or our participation in the process affected the outcomes. But neither of those is true, and it undermines your case.

Affiliation is rife with intangible benefits of a vaguely religious character: believing that you're right, believing that you're benefiting the righteous and confounding evil, etc. But there is no 10% discount for Democrats at the Toyota dealership, and Republicans don't get a $1500 tax deduction simply for being Republicans. The only tangible benefit to affiliation is the ability to vote in the primary—a benefit so dubious we all personally know people who affiliated opposite their beliefs just to muck up the process.

<comment><USER30> > The only tangible benefit to affiliation is the ability to vote in the > primary—a benefit so dubious we all personally know people who affiliated > opposite their beliefs just to muck up the process.

OT: I don't know anyone who's done that, but I've long wondered if the most effective way to get the result you want is to simply destroy everyone opposing it, rather than promoting the result directly. It seems that it'd be much easier to manipulate the system (and the people) using a negative influence than positive. It's definitely not _right_ , but seems like it could be _effective_. Then again, as I write this I realize that this is half of what happens already.

</comment></comment></comment></comment><comment><USER31> In an ideal world with infinite time for arguing with... well, I'll avoid an ad-hominem when responding to an argument about ad-hominem attacks, but... in an ideal world it would be worthwhile to drill down through the onion layers of rationality, irrationality and emotion which drive any argument we disagree with, every time.

Sometimes this spelunking is both constructive and instructive.

Sometimes though, dismissing the assertion that the earth was created 6000 years ago or that the world will be ending next month with a quantitative assessment of the intellectual capacity of the asserter is a completely appropriate shorthand.

The key is judicious application. ;)

</comment><comment><USER32> Isn't this the crux of infamous "ad hominem" argument: attacking the person instead of their reasoning?

Even smart people sometimes make stupid arguments.

And good arguments can be made by anyone.

It's very difficult to be right 100% of the time.

It's also quite unusual to be wrong 100% of the time.

Evaluate the reasoning, not the author.

Stupid argument, not stupid person.

Look at what Alsup said to Boies.

Still, this is easier said than done.

</comment><comment><USER33> It is more accurate to say that the difference between stupid people and smart people is that smart people can be proved wrong.

<comment><USER34> you mean smart people are more open to be proven wrong?

<comment><USER33> I am implying that stupid people don't listen to rational arguments.

</comment></comment></comment><comment><USER35> Sorry but no. Most people are cattle. Utter retards. The only thing missing them is drooling on the floor and making feces. They're little more than animals that can speak. Anyone even remotely smart knows most people are stupid compared to himself.

Of course, smart people don't go around whining about it. But they do KNOW they're surrounded by retards.

<comment><USER10> > Of course, smart people don't go around whining about it. But they do KNOW > they're surrounded by retards.

Indeed...

</comment></comment><comment><USER36> I disagree. Labels are sometimes derived of prejudice and bigotry. But if someone is obese, and I call them fat - it's not a label that I invented because I'm "not thinking" and "I don't realize the possibilities". I am thinking, and I do realize the possibilities, and the person is still fat and the person might be me looking at the mirror. And if I don't _know_ I'm fat because I'm afraid that by admitting it; I've jumped to a conclusion, which would in turn mean that I've avoided thinking and have jumped to a conclusion - wait, I mean stupid -- then how am I ever going to know that I can do something about it? Bleh. Fallacious logic is not logic at all.

</comment><comment><USER37> _"That's why saying "I don't know" is usually smart, because it's refusing to jump to a conclusion."_

Define usually. More often than not when I hear "I don't know" it is offered as an excuse/explanation for laziness and shirking responsibility.

<comment><USER38> When a smart person says "I don't know", It's usually followed with a "give me a second to figure it out." or "let me look that up real quick.".

<comment><USER39> I've given up on 'I don't know'. I only say that when I'm at the end of the line and there's nowhere to go.

Instead, I usually use anything else that indicates that I'm going to make inquiries. "That's a good question. I'll have to look into that." comes out of my mouth a lot now. Sometimes without "That's a good queston." at the start.

</comment></comment></comment><comment><USER40> In my experience, I think smart people often think others are smart. And that's sometimes a problem-- because they believe that others are smart as well, they should think everything through the way they do (Also, I'd really like to say we here, but pride is never good karma :-))

Then you start wondering why they are doing something so obviously unwise, and then tend to rationalize it with some enormously complicated theory. Perhaps, this is the reason why Hanlon's razor is useful and recognized-- without it smart people are kinda lost.

</comment><comment><USER41> Generally I agree. But there is a huge weasel clause in this whole line of thinking: Ultimately, I could always end up with "they haven't done the research or connected the dots because [insert something reasonable that is stopping them] so they are not stupid, just lesser informed or emotional" but essentially there will always be reasons that people do hard drugs or get involved in scams or get in fights at bars but "they are just so stupid" can sometimes suffice.

</comment><comment><USER42> The article should maybe have been titled "Smart people don't _assume_ others are stupid". But even then the argument is wrong.

It seems to me that what this comes down to is: is it justifiable and appropriate to categorise a person according to their behaviour (including the holding of opinions)? The author doesn't seem to deny that people can exhibit stupid _behaviour_ , but argues that its wrong to categorise a person who exhibits such behaviour because you will (inevitably) never have enough information about the person or situation to make a judgement about the intrinsic qualities of the person. This might be true in some theoretical sense, but it doesn't really sit well with human nature or needs. We all have finite lives and stuff to be done in those lives. Making judgments about people is necessary to avoid a frustrating life spent (as in 'used up') dealing with people who behave stupidly.

And really, how long do you have to evaluate someone's behaviour before you are no longer 'jumping to conclusions' about them? Strangely, the author doesn't say. At some point you have use the history of a person's behaviour to decide[1]. A purist might say that such a decision should always be tentative, but in reality I think they soon become fixed. We are talking about people here.

For what its worth, my approach is that if I decide to think of someone as being stupid (or smart) then I try to be conscious and mindful of the decision, allow myself the opportunity to change my mind (while recognising that I probably won't), and always respect their dignity as a person.

[1] I suspect that how soon this happens will mainly depend on the social relationship between the people involved.

<comment><USER43> I would argue that personal effectiveness includes the life skill of being a character judge, and then having the courage to take action based on those judgements.

Ie, if you judge someone to be a dishonest time waster, then politely brush them off and don't have anything to do with them. This is true whether in a work situation or a social situation.

Taking it even further, it means leaving a job or an area if it dawns on you that you're surrounded by people who are either stupid or lazy and going nowhere.

As you say, life is short. Learning to sort the wheat from the chaff is a way of spending better time with more interesting people.

</comment></comment><comment><USER44> Nearly 15 percent of people worldwide believe the world will end during their lifetime and 10 percent think the Mayan calendar could signify it will happen in 2012, according to a new poll.

[http://www.reuters.com/article/2012/05/01/us- mayancalendar-p...](http://www.reuters.com/article/2012/05/01/us- mayancalendar-poll-idUSBRE8400XH20120501)

^at LEAST 15% of the world is stupid. That's just getting started. That's one poll, about one thing.

<comment><USER45> All evidence suggests that the universe/world will end upon my death in any sense that matters to me. Once my brain has stopped functioning it will be impossible to ever receive stimulus from pysical phenomenon again for all eternity. So, if you can agree with that then you could agree that the world will end sometime during most people's lifetimes assuming I don't outlive them. So from my point of. View they are right, but for the wrong reasons.

</comment></comment><comment><USER46> The author makes an interesting point; however, he seems to make the same assumptions that he is actively protesting. If smart people do X, then would not doing X mean people are not smart?

This generalization that can be inferred from the article--as well as demonstrated in this comment section--seems to fall into this same trap.

As a reader of "The Seven Habits of Highly Effective People", I think there is a better way to go about this. Rather than "smart people do X [therefore if you do not do X, you are not smart]"; it should be: people do X, which is smarter than doing Y.

People can change. If they have a consistent ability to do stupid things, it just means they are acting in poor judgement and possibly could use help. If they fail to accept help, or are too headstrong/temperamental/can-never-be- wrong then it just means that their behavior and mindset should change [in order to be more productive].

Although, I would sometimes choose a less-intelligent person that is of no fault of their own, than a willingly ignorant person who should know better, but does not act it.

</comment><comment><USER47> Can we find better things to write about than this? It is getting really boring reading about how other people think we should all behave.

<comment><USER48> Um, what kinds of things do you want to read about? (Completely serious question. Honest.)

<comment><USER47> I like to read about new ideas, advances in science and technology, and political developments, especially where the Internet is concerned. I accept that people have different lifestyles and viewpoints, and if variations on those sorts of things are presented as "hey, here's a different way to live", then that's alright. On the other hand, if the message is "hey, do it this way because I'm right" then I'm inclined to stop reading.

<comment><USER48> Thanks. I like to write about personal hacks -- debugging the wetware, fixing health issues at their roots that doctors claim cannot be fixed, effective parenting for challenging children. So you are probably not my target audience. Trying to think such things through for myself, I guess. I agree with your distaste for what amounts to lecturing. I have a half formed thought for a piece about that which might get written, or at leasted started, today.

Thank you for the feedback.

</comment></comment></comment></comment><comment><USER49> Sivers has it right, and I'm disappointed by the reaction here. People are smart. This should be your baseline. From there, people may do or say stupid things. It may become pathological. But the person has not lost his capacity to be smart (barring some physiological damage). It may have atrophied, like an unused muscle, but the capacity is still there.

But even this is getting ahead of yourself--how would you know they _are_ stupid? _Acting_ stupid is at least multi-dimensional: the act+stupid. It's a limited claim. To _be_ stupid, though, now that's a very broad claim, to reduce things to a position on a single axis. And that is pure hubris, an intellectually indefensible position, an argument from apathy: "well I don't care about all those things, to me the guy's just dumb". Ah well thanks for clearing that up!

And there's the inverse: you casually judge others as stupid, and you have shown yourself to have poor judgment. You are _being stupid_ with judgment.

<comment><USER50> I completely disagree with the conclusion.

If I go along with the premise that people are merely "acting" stupid, that is all the more reason to casually dismiss them. I can have patience with people that have limited capabilities, but people who _choose_ to act stupid?

Being semantically correct isn't particularly relevant. It's how you deal with consistent stupidity (and I'm not talking about the occasional brainfart or error of judgement).

Whether or not casually dismissing stupidity is the right thing to do depends completely on the context, not on whether you use the correct semantics to do so. I people are being viciously stupid (as in "gay people shouldn't have equal rights"), I will dismiss them as stupid, and I don't give a flying fuck if they are _acting_ or _being_ stupid.

And on the flip side there are also situations in which it is useful to figure out why people do or say stupid things. It's context that determines if my judgement is poor, not semantics.

<comment><USER49> _I can have patience with people that have limited capabilities, but people who choose to act stupid?_

You assume it's a choice, as if at the brink of decision, someone says, "I'll do the stupid thing." But in real life, you see people motivated by ambition, pride, fear and desire. And if that drives you do stupid things, to argue for stupid positions, does that make you stupid? Well, if limit ourselves to "stupid" always being contextual, if we understand "is stupid" as "acts stupid in a given context", then sure.

Likewise, if someone doesn't care about the things you care about, and consequently doesn't focus their attention on them to the same degree you might, does that make them stupid? Or just uninterested?

It's not a semantic issue. You are dismissing people outright, you are creating an alternate universe in your mind that through hubris drifts further and further from reality. Invariably, there's something else going on, something more interesting and more true to reality than just "he's stupid", and you miss that. I'm not arguing that you necessarily should _engage_ with such people, but neither should you box them off with pat pronouncements on intellectual capacity.

</comment></comment></comment><comment><USER51> Very good post. In fact, thinking in terms of smart / stupid is fairly pointless. Firstly, there are numerous forms of intelligence (as the first phrase of its wikipedia entry confirms). Secondly, sticking to the IQ kind of intelligence, most tasks require only a sufficient amount of it (say, more than 90 or so), more of it doesn't necessarily help. The guy with the highest IQ I ever met (180 or something) had a junior job (at 40yo) as a statistical analyst in a bank. This applies also to developers: for instance, getting things done is more important than being IQ-smart. Thirdly, and I think this is the poster's point, the form of intelligence I came to admire the most (and I find most useful) is the one that makes you humble enough to know what you don't know, and capable of listening to and appreciating people who think differently from you. Hard to really learn anything new without that one.

</comment><comment><USER52> I think others are stupid. Oh noes, I guess I'm the stupid one then.

Jokes apart, there's a consistent pattern in how I judge intellect. The people who I consider smart _get logic_. Some of them do it intuitively; Some of them are familiar with formal theory. The most common logical error made by those I consider stupid is a non-sequitur [1] Ex: "He doesn't use vim. He must be stupid". The biggest mistake you can make is judge people by knowledge, rather than intelligence. Ex: "A is really good at programming. He's definitely more intelligent than B who's a singer"

[1] <http://en.wikipedia.org/wiki/Non_sequitur_%28logic%29>

</comment><comment><USER53> This is absolute BS. Odds are that the all of the people from the article, and the author, are relatively stupid. Maybe one or more of them isn't, but the odds are against them - that is just how it works.

<comment><USER54> I totally disagree. I get a lot of people saying crap to me about being smart or intelligent, I even got bugged into joining MENSA by other members. I still hold that I'm not really smarter than other people.

Most people are average, I get a lot of attention for things I do that people don't understand. But I'm not really a smart person, I just like puzzles and I do them quite often. There plenty of situations where I appear like a bumbling idiot.

Heres how I see it. People who have an interest in something invest lots of energy into understanding it. Judging someone by there ability not to understand something that they have invested a lot of time into doesn't make you smart, it makes that person a jerk.

And heres the reason. Calling someone stupid is an insult, a way of asserting a dominant position i.e. "I am better than you because my understanding is more advanced." Guess what, thats one hell of arrogant position to have.

As someone who usually runs teams I'd probably ask to someone who used statements like that to be transferred. If said person held an attitude like that, its not helpful to the team, potentially damaging to someone trying to get up to speed, undermining confidence. And lastly it wrecks of someone who would hold a something over someone else to look better rather than cooperate, build needlessly complicated code that half the team couldn't work on at a decent speed.

Anyway theres a quote attributed to Einstein I'm sure you've heard which sums it up nicely for me "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid."

</comment></comment><comment><USER55> Pedantic nonsense. What exactly is the difference between "he's stupid" and "he's acting stupid"? The only one I can spot is the latter avoids labeling the person while still condemning them for the act. PC nonsense without substance, IMNSHO.

However, he does touch on something Dan Kahneman in his 'Thinking, Fast and Slow' talks about: most people stop thinking at first intuitive answer (aka System 1) and don't bother engaging in the tiring deep thought (aka System 2).

</comment><comment><USER56> Love the title of this post. Smartness and stupidity are a matter of motivation and interest in the subject. Most times being stupid is doing what you are not meant to do / reasoning about what doesn't truly interest you.

There are many activities that meant to be done by "smart" people like math or high stakes poker or programming. But most people are just scared of these things because they don't know they are smart enough to succeed.

</comment><comment><USER57> Calling others stupid is just a toxic thinking which tricks our brains to rely on easy and quick-fix pseudo "feel-good" but it is an addictive dangerous practice for our mental and general health in long term.

[http://blogs.psychcentral.com/relationships/2011/07/seven- to...](http://blogs.psychcentral.com/relationships/2011/07/seven-toxic- thinking-patterns-to-break-how-pseudo-feel-goods-trick-your-brain-2-of-3/)

</comment><comment><USER58> I recently graduated from college and found a job. My manager is one of those people who is a brilliant programmer but doesn't help the greenhorns like me adapt to the working world.

I believe I have potential to be a great programmer, but it's difficult when you're being told your code is "all sorts of wrong."

This was exactly what I needed to read right now. Thank you for posting it.

</comment><comment><USER59> Although not a fascinating topic nor anything new, I think the main point of the article is a good one, and one that everyone should consider before name- calling, yelling, or interrupting for that matter. Many use these _techniques_ to supposedly win arguments just because the other shuts up, or is offended.

</comment><comment><USER60> One doesn't need to be smart to find stupidity (in others or in our own). "Stupid is as stupid does."

</comment><comment><USER61> I don't know I like to think I'm of above average intelligence and I would generalize and say that some religious groups are "just so stupid."

Then again, religion is a great way to cope with the paradoxical and absolutely absurd reality we live in so maybe they aren't that stupid...

</comment><comment><USER62> I agree on the most part, however there are certain situations where you just get sick of explaining stuff (see: Feminism 101) to people who have done no research or have ignored the research because they are so headstrong about their issues.

</comment><comment><USER63> This has quite a bit of information on the subject: <http://wiki.lesswrong.com/wiki/Map_and_Territory_(sequence)>

</comment><comment><USER64> Very few people act without good motivation to do so. So when most people see someone engaging in an act that is "stupid" they are generally failing to see their motivation for the act.

</comment><comment><USER65> "Everybody is a genius. But if you judge a fish by its ability to climb a tree,… it will live its whole life believing that it is stupid." — Albert Einstein

</comment><comment><USER66> No.

<http://www.joelonsoftware.com/articles/HighNotes.html>

</comment><comment><USER67> But insecure people do see others are stupid.

</comment><comment><USER68> Smart people don't think others are stupid as the truely smart know that others are stupid.

Thinking is not 100% knowing. Think about that.

Also there are two types of stupid, those that are naturaly gifeted in such arts and those that work at it. It is the later that are truely stupid and the former who are just limited.

</comment><comment><USER69> This article will resonate with stupid people's feelings.

</comment><comment><USER70> You know, I've been teaching my dog a few tricks, and when I do I always think about how smart EVERYONE IS. Man, humans are so smart. If this were a human - really, practically any human that isn't currently comatose, even a baby, I would be done by now.

Smart means smart compared to something. Everyone is very smart - compared to a dog. But when you use the word smart about people, it means smarter than other people. Does that make other people stupid? In actuality, it _has_ to.

When you say "smart people don't think others are stupid" either you are really saying "smart people never know they're smart. They think everone is just as smart as them". (This is a possibility.) Or, you are saying, "Smart people never acknowledge the fact that they're smart. Even thought they know others are not as smart, they never mention this fact."

This second possibility is probably closer to the truth. When I'm trying to get my dog to realize it can step over its own leash when it's tangled in it, it doesn't help me to think about how much smarter I am and how I never get tangled in anything.

I think smart people know very well that they're smart. Sometimes they just have better things to worry about than pointing this out. (Sometimes they don't. Linus Torvalds was quoted here calling someone a moron a few days ago. Obviusly, he's still a smart guy.)

</comment><comment><USER71> A total opinion piece with nothing backing it up. You can just type some things in bold letters and make it true. Show us the data.

<comment><USER72> :-)

<comment><USER73> Was thinking that the smiley face was not much of an addition, but then clocked that you are probably the author of the piece, in which case the smiley face was probably fairly tactful.

<comment><USER17> We certainly know he doesn't think adviceonly is stupid :)

</comment></comment></comment></comment><comment><USER74> I think it's a good attitude to take, particularly when dealing with peers. Giving others the benefit of the doubt and not assuming that everyone should know everything you know goes a long way toward making the world a better and more tolerable place. Also, when discussing matters of principle it's extremely valuable to be able to understand and argue _for_ the opposition, rather than merely dismissing opposing views as 'stupid'.

However, the author is fundamentally wrong. There _are_ stupid people. I didn't believe it until I got out of my college/career track and met a few of them.

</comment><comment><USER75> Human brain capabilities differ, just like computer processors. Failing to realize that is stupid.

<comment><USER76> Right, but brain capability is not a one dimensional quantity, and measurements of it are time-varying and noisy. This suggests that one shouldn't jump to conclusions before careful measurement, and that it is not trivial to compare measurements from different people along just one axis.

</comment></comment><comment><USER77> So according to him, if you think others are stupid, then you are stupid. What irony.

<comment><USER78> No, try reading it again. "So if you decide someone is stupid, it means you're not thinking, which is not being smart."

"Not being smart" != "is stupid" is exactly the distinction he is making.

<comment><USER77> I'm well aware of the words he chose. I am referring to his actual meaning.

The fact is that there are stupid people on this planet. The fact is that we can know there are stupid people. The fact is that we can identify a stupid person. And it is utterly stupid to pretend otherwise. He's made a very stupid generalization based on the behavior of the masses -- yes, most people who call others stupid are themselves stupid. But that doesn't mean we can't know who is stupid nor does it mean that it's wrong to call someone stupid.</comment></comment></comment>


Proxy.app Lands In App Store - <AUTHOR> http://blog.websecurify.com/2014/05/proxy-app-lands-in-app-store.html <comment><USER2> To replace Burp, you need at a minimum a proxy that reliably works at high speed on a huge variety of sites, a UI for capturing, altering, and resending requests, and a "fuzzer" that will transform a template request according to a ruleset.

This turns out to be a pretty difficult thing to build well. Every pentester who can code that owns a Mac wants to rewrite Burp; I myself have died on that hill several times. But rewriting Burp is a bit like rewriting Microsoft Word; so much of the value is in the details, and there are so. many. details.

<comment><USER3> I think its important to say _why_ it's difficult. The individual components of a web proxy/fuzzer range from easy to more challenging. At the extreme edge, they can get pretty hard:

HTTP proxy - Fairly trivial, annoyingly harder if you want to generate certs to MitM SSL.

Scaling it out - not too bad. fuzzing is highly parallelizable. How your parallel tasks work together is more challenging, (think rotating cookies) but do able, and you need to really do this right to maximize requests/seconds.

The audits themselves - If you actually want pre-built attacks, basic attack+response regexs (ala Nikto) are very easy, though building the DB is time consuming. Multi-request tests (looking for stored XSS, etc) are harder because an audit thread need to share state, or become somewhat sequential.

Dealing with the modern web - Harder. You need a JavaScript interpreter. I used Spidermonkey years ago, PhantomJS and the like more recently. Also means you need to support different packaging formats like JSON, MVC-style path parameters, etc and the associated escaping.

Keeping state - Harder. What does logged out look like? How do you detect this? (and no, don't make the user supply a Regex...) Has you audit screwed up your account so that "logged in" is all jacked up? Was there Stored XSS, but another audit clobbered the payload before your sweeper found the reflected value? (think updating your address on one page, displaying it on another, all while multiple things are auditing that update address form...)

All that said, I have found the main challenge people overlook when writing web pen test tools is the UI/UX. A shitty UI/UX ruins a tool because it ruins your flow. How do I specify what to fuzz with what rules? Can I resuse and reapply settings easily, how are results reported? Can I easily mark something as a false positive? But can I do that in a general way so that all issues matching on this host, or this file, or this URL frag are ignored? etc etc etc.

Please, if you are going to go down this path, think about how people are going to use the tool, and focus on maximizing their throughput.

<comment><USER2> I don't use bleeding-edge Burp, but whatever the version I run is, it doesn't have a Javascript interpreter, or for that matter a modern HTML engine. I'm also considering only the parts of Burp that are valuable for developers in general; things like stored attack vectors, like Nikto uses, are generally verboten on our team anyways.

So, if you asked me what the hard parts of getting Burp right when I took a stab at replacing it in Cocoa, and more recently in ko.js and Riak (more successfully):

* There is just a whole lot of UI involved in making a navigable proxy with the breakdowns you want, and, in particular, with editing and annotating raw requests and having those views do the "right thing" as the user edits the request and flips back and forth between views.

* Storage of requests is hard, because it's not intuitive how they need to be stored. The proxy wants long-term storage with indexes; the repeater wants rapid writes; the fuzzer wants to generate a shitload of requests (multiplying one request by 20k isn't rare), and a request from one part of the system can bounce through all the other parts.

* The proxy wants realtime communication/control with the UI, because some of your requests need to be intercepted and modified before delivery; in Burp, that UI shares most of the controls of the Repeater, which is surprisingly complicated.

Network performance is the _easiest_ part of this to get right. Just don't use Java threads, and use a real timer library. But getting the network performance to cooperate with persistent storage is harder, unless you just let storage and memory explode.

We wanted fine-grained control over all of the tools so that we could automate retesting and regression. Like I said, we had a lot of luck hoisting the components of Burp into a series of web applications and backend systems backed by Riak (and Postgres, for search, index, and UI). We replaced Intruder with a command-line tool written in Golang that has a small specification language for the rules, instead of Burp's clunky interface, but there's still a whole lot of UI involved in parsing a request, automatically finding the places to template-ize, and then allowing the user to alter those selections.

When I took my stab at doing this in Cocoa a few years ago, I made a beeline for NSWebView; having a real webkit render is an enormous win. We do something similar to you with headless webkit now. This is a place Burp is genuinely constrained, due to Java.

Unfortunately, replacing Burp is a bitch.

<comment><AUTHOR> Interesting. We have those libraries already written so if you let us know what you are building we may be able to help.

<comment><USER2> I'm sorry it sounds like I'm running you down; I don't mean to, and I really hope you succeed, because as much as I respect Burp, I respect it the same way I respect Microsoft Word: as something I would like to use less of.

It just happens that this is a conversation that happens semiweekly at Matasano. :)

</comment></comment></comment></comment></comment><comment><USER4> Would you be able to give any examples, aside from being "native" (which I'm assuming means its built on AppKit+Cocoa) as to what your app does differently or better than Charles? I use Charles pretty frequently but my co workers haven't gotten on board yet.

As an aside, IMO claiming that Charles isn't native is a little disingenuous. Yes it's built with Java, but I wouldn't dismiss it as non-native (unless you're using native in the purest of ways, meaning that its "natural" \- e.g. Cocoa - to the system). I consider tools like Eclipse and IntelliJ "native" even though their UI may be poor compared to Xcode.

<comment><AUTHOR> Good questions. While Charles and other proxies are doing a fine job our dev team is also frustrated by the way they integrate with OS X. This is what we mean by native experience.

The application is in effect a single binary and makes use of various Apple frameworks which are optimised to run flawlessly on apple hardware. Only one platform is supported which means that there is less chance for bugs and platform-specific oddities. Proxy.app works as a sandbox application on OS X, distributed by Mac App Store and makes use of other native components like Keychain, etc.

Under the hood the tool is only making use of Apple frameworks. We believe that in the long term this will provide more stability and performance enhancements. Right now it takes just a moment to launch the application and there is zero friction when switching between different project files. We believe that it just works in the same way OS X applications are supposed to work and this in effect makes Proxy.app more pleasant to use.

<comment><USER5> I'll vouch for this. I've used Charles extensively, and while I haven't used Proxy yet, the most annoying things about Charles are always related to it not using proper UI paradigms, components, etc. I'd love something that was a proper Mac app for this.

As for the comparison with Burp, I have much less experience with Burp, but the pro version has a huge amount of functionality. Things like plotting the distribution of cookies so you can see if they are backed by a good RNG. It doesn't look like this is quite that advanced yet, but those are the sorts of features that only real pen-testers would be using. For most developers who just need to test stuff, this looks excellent, I really look forward to trying it out.

<comment><AUTHOR> Hi danpalmer,

Some tools are much more useful in the browser - and not in the proxy. As for the session management security - you will rarely need this functionality these days unless you do security research. This tool was useful years ago when everyone was implementing their own session management systems. These days most of these sub-systems are part of the core web frameworks and therefore already tested - we hope. That being said, there are still bugs to be found but this falls into the realm of security research.

<comment><USER5> "we hope"

It's also something that is tested on the CREST Certified Web Application Tester exam: [http://crest-approved.org/information-security- testers/certi...](http://crest-approved.org/information-security- testers/certified-web-application-tester/index.html)

</comment></comment></comment></comment></comment><comment><USER6> It would be good to get a demo of this. I'm unsure of the benefits over Charles at the moment is it just native? I'm happy to pay for software that _looks_ better but I'd like to try it out first.

<comment><AUTHOR> We have no demo for this at the moment. We are not prepared to issue these kind of binaries at this stage. We will update as soon as we can.

</comment></comment><comment><USER7> Burp Suite has a pretty rich feature set. How does this compare? For example, is something scriptable like Burp Intruder included (or planned)?

<comment><AUTHOR> Burp Suite is one-size-fits-all type of solution. Indeed, it comes with a lot of other tools which are primarily used for penetration testing.

On the other hand, Proxy.app is just a good proxy and already comes with many of useful features. It is faster, feels native and available at the fraction of the cost of Burp. It is more general purpose proxy tool than a general purpose security testing framework. The tool can be nicely complemented by some of the other tools from Websecurify.

<comment><USER2> Burp has a lot of features, but at it's core it's four things:

* _Proxy_ records, categorizes, and makes searchable and navigable all the requests you make through Burp, and includes an internal CA to generate on-the-fly SSL certificates.

* _Spider_ crawls websites and discovers new pages.

* _Repeater_ takes requests from any other part of the tool (or, if you're masochistic, requests you write from scratch), delivers them to the target application, and renders their results. Repeater includes Burp's UI for breaking requests into keys and values for quick editing, and a small battery of fixups to make sure that edited requests are (if you want them to be) valid HTTP requests.

* _Intruder_ takes a template request and a series of rules to transform that request, delivers the permutations rapidly to the target, and records and classifies the responses they generate.

Of these four tools, only the "Spider" is really particular to penetration testing. The other three tools are incredibly valuable for day-to-day debugging and testing. Intruder, in particular, is criminally undersold to web developers.

There are a bunch of other things in Burp (the Burp Scanner, for instance, is a second-tier web application security scanner that nobody I know relies on; I justify pulling it out of the core four features because it's also a recent arrival to Burp). Some of them are given whole tabs in the UI, but are really simple features --- the "Decoder", for instance, simply does character decoding. In any case, even penetration testers don't use them often.

<comment><AUTHOR> Hi tptacek,

Indeed security tools should be part of the developer's workflow but not necessarily the way they are presented in Burp. We are yet to see a horde of developers who can spend spare time fiddling with requests in order to find bugs in their own code. There are not only time constraints but also this type of thinking is not natural to everyone.

Websecurify is working hard to find out better ways to enable developers do the minimum security testing without getting in their way.

<comment><USER2> I'm not saying developers should use security tools to do security testing (although that is also a good idea).

I'm saying that in terms of the day-to-day workload of developers building web apps or APIs, a tool like Burp is as valuable or more valuable than a debugger is to a C programmer.

</comment></comment></comment></comment></comment><comment><USER8> I just downloaded it, and it is not intercepting anything? what setups should I do for it? Charles works out of the box!!

<comment><AUTHOR> Hi ahmadeus,

Don't give up on us. :) It is probably something very simple. Just contact us via our contact form and we will get it sorted. [http://www.websecurify.com/desktop/proxy.html](http://www.websecurify.com/desktop/proxy.html)

<comment><USER9> I can't seem to find a contact form on that page?

<comment><AUTHOR> Just use the ASK US button on your left-hand side.

</comment></comment></comment></comment><comment><USER10> I use Charles very often, but I use it to see requests coming from a mobile device. Can I proxy SSL connections from mobile with this? Will it let me use a custom self signed cert to do the SSL proxy?

<comment><AUTHOR> You can intercept any http connection from the iOS simulator quite easily. For intercepting stuff on an actual device you require more extensive setup. We will publish docs how to do that soon.

<comment><USER11> > We will publish docs how to do that soon

Looking forward to this. I've just bought the app and being able to monitor e.g. what my iPad is doing would be great.

</comment></comment></comment><comment><USER12> That's a great news. We have been using fiddler inside a windows virtual machine just to do that.

I know everyone is asking the same kins of question but how does it compare to fiddler?

Our use case is kind of simple. We are building APIs in top of websites that don't have APIs. So a lot of "spying" is required. We have to use fiddler because it was the only one to correclty handle flash forms, file upload forms and to be able to globaly search for a particular token in every requests has been so much of a life saver.

<comment><AUTHOR> Hi hartator,

Thanks for the support. Both fiddler and Proxy.app are proxies. Forms, JSON and XML are handled without a problem. At the moment there is no support for AMF if this is what you are referring to. We did not wanted to add this initially because it is not a standard and it requires creating a parser and serialiser from scratch - it is on our todo list though.

<comment><USER13> I don't know how feature complete it is, but I don't think you need to build one from scratch: [https://github.com/nairteashop/CocoaAMF](https://github.com/nairteashop/CocoaAMF)

<comment><AUTHOR> Thanks a lot. We will look into it for future releases.

</comment></comment></comment></comment><comment><USER14> I was only introduced to Burp at Scot Ruby conf last week as a tool for web security testing. If Proxy.app is targeting the same domain, it seems to provide none of the tools that Burp does.

Burp was a pain to setup (OS X makes installing and using java from the commmand-line a ridiculously complicated process) but it looks 1000x more useful than Proxy.app is.

On a marketing note, you might want to think about who your market is and what job they use a proxy for. It doesn't seem to offer anything for a security researcher but maybe there's enough there for a web developer.

<comment><AUTHOR> This tool follows slightly different philosophy. We could have bundled all Websecurify security testing frameworks inside this app and make it more penetration testing friendly. Instead we thought that a different approach would be to create just a good proxy and add enough integration capabilities to be used side-by-side with other tools including the security tools we distribute elsewhere. In effect, it is a bit like the unix design which also closely matches the iOS application philosophy.

That being said, dumping more tools inside is not an issue. We already have the frameworks to support it but we are not sure if this will be a good thing to do from usability point of view.

<comment><USER15> I like the Unix philosophy: Do one thing, and do it well.

</comment></comment></comment><comment><USER9> Bought it, installed it, launched it. Then nothing happened. The iconography isn't clear (I have no idea what the first mode, the broken triangle icon, does) and has no tooltips on hover. It never prompted me for an Admin password, which probably explains why it's not actually capturing anything, since it probably can't automatically change the Mac OS X proxy settings on my network connections, unlike Charles.

<comment><USER9> Ok, sure enough, if I manually go into my Network settings and add the HTTP proxy, stuff starts to collect. Nice. Wish it were automatic. Wonder how anyone will find this to do it when there's no docs?

But still can't get it to proxy HTTPS. The MitM certificate provided seems to be invalid: [https://dl.dropboxusercontent.com/s/0z8khpq5p4guf9f/2014-05-...](https://dl.dropboxusercontent.com/s/0z8khpq5p4guf9f/2014-05-21%20at%2012.19%20PM.png) && [https://dl.dropboxusercontent.com/s/6efwllajcnbpjvs/2014-05-...](https://dl.dropboxusercontent.com/s/6efwllajcnbpjvs/2014-05-21%20at%2012.22%20PM.png)

I _really_ want this tool to work, since I agree there's a big need, but frustrating so far...

<comment><USER16> I just bought it as well and was also trying to get HTTPS proxying to work. I am not a security guy, so I could be incorrect, but I think there are two things going on here:

1) the certificate generated by Proxy is 512 bits which OS X doesn't support; and

2) i'm not sure that Proxy will work with sites that use HSTS -- you might be able to clear the HSTS database in Chrome, but still for sites like Google, I think the certificate information is hard-coded.

<comment><AUTHOR> Hi, on point 1 you are correct. We have overlooked this and we feel stupid because of this. However, the good news is that this is already fixed. We are awaiting for Apple's approval.

On point two - unfortunately this is how Chrome works. However, you can control HSTS via chrome://net-internals/#hsts. Unfortunately, this will not work for preloaded entries.

We will be issuing guides soon.

</comment></comment></comment></comment><comment><USER17> Any significant advantages of using this over mitmproxy?

<comment><USER5> As far as I can tell, mitmproxy is very capable, but requires a lot of configuration to use effectively, and the interface isn't exactly brilliant. I've been using Charles for a while instead of mitmproxy just because it's quicker to set up, I'm much more productive with it. Looks like this app will be similar.

</comment></comment><comment><USER18> Is this mostly for monitoring, or does it have other uses? I'm unclear based on the app store and linked pages.

<comment><AUTHOR> you can monitor and also intercept requests and responses and modify their contents.

</comment></comment><comment><AUTHOR> Hi everyone. I just wanted to let you know that we started pushing the documentation here: [http://learn.websecurify.com/help/proxy/](http://learn.websecurify.com/help/proxy/) \- soon to be bundled with the app itself.

</comment><comment><USER12> Ha! Another question, do you plan to be able to filter by applications?

When you have a lot of tabs open, there is always pollution that get added to what actually matters.

<comment><AUTHOR> Hi hartator,

That is a feature we are thinking about from day one but unfortunately to do this we either have to run multiple proxy servers and allow you to configure them individually or do process monitoring to understand who is connecting to the server. Both are on our todo list but we think that the second one have no chance to get approved by Apple due to the sandboxing limitations. We are currently researching this.

<comment><USER12> Okay, thanks for your response! Sandboxing seems to give ypu guys a hard time. I think the noise issue can be very problematic if you are using it on a real machine with plenty of web requests and not a virtual one.

Do you know if there is a way to setup the proxy manually? This way we can setup an instance of firefox doing the requests that matters but also monitor our ruby scripts that replicating these requests. It will make comparison so easy for our use case.

<comment><AUTHOR> Unfortunately at the moment we cannot think of any sensible way to do this. You can proxy both through the same proxy but we do not have capabilities to differentiate between the two types of traffic. This looks like a useful feature though so I have added it to the list of things to research.

</comment></comment></comment></comment><comment><USER19> Has anyone done a comparison to find the best mac equivalent for Fiddler?

</comment><comment><USER20> When it comes to me, nothing beats Wireshark, but this app looks neat.</comment>


Epilogger Pivots to New Direction: Unicorn hunting. - <AUTHOR> http://blog.epilogger.com/features/epilogger-pivots-to-new-direction/

<comment><USER2> Add it to the other lists of april fools jokes?</comment>


1938 in 2010 - <AUTHOR> http://www.nytimes.com/2010/09/06/opinion/06krugman.html?_r=1

<comment><USER2> I'm surprised that USA newspapers mostly support Keynsian theory. That's maybe 10th article I've read that agitates to increase spendings.

Is it universaly believed in America that the only way out of recession is by going deeper into debt? Examples from Europe (German, Greece) and China seems (IMO) to contradict that there are similarities between Great Crisis of '20 and this?

<comment><USER3> There are many examples from our own history as well, such as the great depression.

The reason is that the media in the us is very heavily influenced by government and the political parties. It is much easier to publish interviews, opinion pieces from political partisans like krugman and government press releases than it is to go out and dig up news, consider an alternative perspective and write about it with some depth.

</comment></comment><comment><USER4> This whole "double-down" strategy is a bit terrifying to me. But it could work. The real key though, I think, is that it would only work if the stimulus money put people to work on projects that would increase the Nation's competitive edge: green infrastructure, broadband, better schools. Dumping the stimulus into tax cuts for home buyers--which serve only to pull demand forward--that strikes me as a useless wealth transfer.

Any stimulus spending should both create jobs now (to distribute consumption dollars and ease consumer fear) and should pay dividends in the future by creating an atmosphere where the average worker can be more productive. The WWII stimulus obviously had a major impact because, by winning the war, we emerged with a huge competitive advantage. Unless we're going to rebuild that advantage by bombing our competition back to 1944, which I hope we aren't considering (...), we've gotta find another way to construct that advantge. That's the challenge.

<comment><USER5> The problem is this is self-evidently political money, and it's allocation is _always_ , pretty much by definition (well, outside of a war) going to be political. That was true for FDR and has been true for Obama.

You and I disagree on how it should be spent (I think "green infrastructure" is a mirage at best, unless you're also e.g. serious about nuclear power, broadband could use _some_ money but really needs a different regulatory regime and the "spend more money on schools" approach has been tried for _half a century_ with highly negative results) ... but I guarantee you neither of us would be happy with how it would actually be spent.

Heck, even if it's spent in a totally partisan pro-Democratic Party way, based on the last stimulus it would sure look like it would be a bad investment; then again, Dave Obey has decided to spend more time with his family after this Congress (he's the Chairman of the House Committee on Appropriations and writing the stimulus bill was delegated to him).</comment></comment>


Advertising an Android game: Facebook vs. AdMob - <AUTHOR> http://www.war-worlds.com/blog/2014/01/advertising-an-android-game-facebook-vs-admob

<comment><USER2> I work at Facebook on the mobile app ads team.

Like a lot of other commenters here, I think the OP didn't run an mobile app install ad which is meant exactly for this scenario - which would show up only on mobile inside newsfeed.

OP - would love to help out and dig in further. Can you email me (I'm firstname.lastname@example.com)?

<comment><USER3> what's the general CPI you're seeing for US users on facebook atm? i know this can vary hugely, but a ballpark figure would be nice

</comment></comment><comment><USER4> I'm not sure what makes the OP think that you can run a conclusive experiment with a $20 ad budget… you're not going to get any conclusive numbers out of that. With click-through-rate and install-rate both typically in the low single digits, you're likely to get, if you're lucky, a handful of install for a thousand impression. In order to have a sample size big enough to make conclusive statements like this, you'd need at least 500 installs - ie. an ad budget of $1,000 for each network.

Disclaimer: I work at Chartboost, now the largest mobile gaming ad network.

<comment><USER5> That may be true, but I _did_ get a noticeable increase in install rate with the AdMob campaign, with the same budget.

With a bigger budget, I might have been able to get more of a boost from Facebook, but I'm an indie developer and I really don't have the time or budget to spend hours and hundreds of $ tweaking a campaign.

<comment><USER4> I think you're missing my point. I wasn't trying to say that the ROI would be better on Facebook with a bigger budget (though, I guess anything is greater than 0%). I'm saying that your budget is too small to make the numbers you're seeing anything else than statistically insignificant luck.

Imagine taking a coin toss and trying to figure out whether heads or tails came up more often, but only tossing the coin three times. Imagine you get HHT, and conclude that head is a better bet than tails.

This is essentially what you're doing, by concluding that one option is better than the other, based on a single-digit install sample size.

Now, I'm not saying you should be spending massive ad budgets, and spending a lot of time tweaking your campaigns, I'm merely pointing out that you don't have enough raw data to make conclusive judgements about the effectiveness of these two networks.

Being a major player in this industry, I can tell you that the numbers I'm seeing seem to indicate that Facebook (and Chartboost) are in fact much more effective ways to buy installs for mobile games than AdMob, with a properly set up campaign. Feel free to contact me directly if you'd like more insight regarding this.

</comment></comment></comment><comment><USER6> Why did you buy desktop ads to try to get mobile installs? Of course you're going to get a ton of impressions and hardly any actual installs: no one browses Facebook's desktop site via their android phone, and people on desktop aren't looking to install an app.

Also, your Google ad is significantly better looking than your Facebook ad, and is also much more likely to be seen while people are on their mobile phones.

<comment><USER7> Not to mention the complete lack of conversion tracking. He's measuring success of the mobile app ad by monitoring game activity WoW which is laughably unscientific.

Facebook supports conversion pixels as well, so conversions through his signup flow could have been measured. Instead we just get a vague disappointment in WoW signups

<comment><USER8> If you install the Facebook SDK, you get to track conversions directly.

<comment><USER9> Only if you use a "partner" analytic service. If you use your own, or a 3rd party like Mixpanel, you cannot track where an install comes from.

</comment></comment></comment></comment><comment><USER10> It's hard to tell from the included screenshots, but both based on the dimensions of the Facebook Ad (it looks like a "Right Hand Rail" ad and not one that run in the newsfeed) and the fact that a Mobile App Install statistic was not provided, I think its fairly likely that the Facebook Ad in question might not have been the Mobile App Install [1] format. That type of ad can be targeted only to people who are consuming Facebook via the Facebook client for your desired Mobile OS (in this case Android) and the call to action will be direct install. It will also indicate precisely how many install occurred via the Mobile App Install conversion stat. The add in question would have been a link to the play store via the web -- even if the user is not on a mobile device.

If I am correct (I can't be sure given the article), the results are not surprising. A properly run Mobile App Install Campaign can yield sub $2 installs depending on the app being advertised, but that assumes requires some experience running online ad campaigns.

[1] [https://developers.facebook.com/docs/reference/ads- api/mobil...](https://developers.facebook.com/docs/reference/ads-api/mobile- app-ads/)

</comment><comment><USER11> This just seems silly. The Facebook ad pointed at the game webpage while the AdMob ad pointed to the appstore.

Obviously ads that point to the appstore are going to convert at a higher rate.

<comment><USER12> I think that's uncharitable. What I, as a non-expert take away is that online ads are complicated and counterintuitive and that even seemingly conservative strategies ("buy from Facebook") can fail badly. The appropriate tale treatment for problems like that is blog posts like this one and the discussion they produce.

</comment></comment><comment><USER13> Your Best result is from Hacker News for $40 you spent on Facebook Ads and Admob Ads I Assume?

$20 on each platform is by no means real test.

<comment><USER14> Front page of HN is 10k views last time I got it, definitely a big win for him.

That said, the results are hardly surprising. I showed AdMob ads in a game once and they paid almost nothing compared to other networks. They have a huge glut of apps showing ads for almost nothing.

<comment><USER5> So I'm the developer here. I've been posted on HN before and while HN posts land lots of eyeballs on my website, there's been no noticeable uptick in game installs at all :)

</comment></comment></comment><comment><USER15> From experience spending extremely large amounts of money: If done right Facebook will win every time. Use targeted mobile app install campaigns, Facebook's bread-and-butter.

Your main problem is going to be that the game is sci-fi themed. They are very hard to marketing. If any perspective developers are reading this, don't make sci-fi themed mobile games.

</comment><comment><USER9> Because Facebook doesn't let you get the install referrer, their mobile app install ads are nearly useless to me.

There is no way to correlate a user who installed via FB with your revenue, if you have In App Purchases.

</comment><comment><USER16> I'm not surprised that facebook ad is a complete waste of money. First, lots of people block ads in facebook newsfeed. Second, who would click on ad of a game when people are busy posting baby's pictures?

</comment><comment><USER17> I would re-run your test with the following:

1: a better mobile specific Facebook ad 2: the same admob ad 3: a budget of $350 each to be spent over 7 days

That will provide a much more conclusive test.

<comment><USER5> I wish I had $350 to spend over 7 days :)

But I'm definitely going to try a mobile-specific FB ad, I didn't even know those were possible!

</comment></comment><comment><USER18> tl;dr: Comparing conversion rates (a metric which is usually in range of 1-3%) using a sample size of n = 60 clicks, by just looking at the total number of registered users.

Even if you had amazingly high conversion rates, with sample of that size, the total number of conversions could be just about anything. Simple variance.

Well done on releasing the game with good reviews though. That's a great achievement. Just spend a bit of time just thinking about advertising :)

</comment><comment><USER19> There was no conversion tracking for the Facebook ads? If I ran this campaign I would be mainly interested in how much each conversion is worth to me and what each one cost.</comment>


Castlevania's Producer Emerges from the Wreckage of Konami - <AUTHOR> http://www.wired.com/2015/05/koji-igarashi-bloodstained-kickstarter/

<comment><USER2> The kickstarter campaign already has over $1.3 million in backers. [https://www.kickstarter.com/projects/iga/bloodstained- ritual...](https://www.kickstarter.com/projects/iga/bloodstained-ritual-of- the-night?ref=nav_search)</comment>


Ask HN: Practical book about modern front end dev? - <AUTHOR> Frontend design is totally overwhelming for a backend guy. Yes, Bootstrap is a good start, but as soon as JavaScript enters the room, everything gets totally complicated. There are simply too many tools and abbreviations and I always get stuck quickly. I wish there was a book with a step-by-step project to follow that shows and uses a consistent set of tools (and does not compare tools which do a similar job). I want it to be as practical as possible.
I like VueJS and have a feeling that Webpack might help with many problems, but am actually open to everything that shows good practices and advancing with a project that interacts with an API of some sorts from simple to advanced.
I checked a couple of books, but did not find them to be fitting:
- Frontend Fundamentals, https://leanpub.com/front-end-fundamentals - Introduction to Modern Front End Development, http://shop.oreilly.com/product/0636920043195.do, not even a book - Book of Modern Frontend Tooling, http://tooling.github.io/book-of-modern-frontend-tooling/ <comment><USER2> For me, the place to start with wound up being POJ [plain old javascript]. Earlier I dabbled with [insert javascript library here]. I thought about [insert javascript framework here]. Last year I tried a few other starting points that seemed to hold promise: Elm, ClojureScript, Rails, ASP.MVC.NET, etc. Eventually, I realized that each effort was a way of avoiding Javascript because the barrier I ultimately hit was not understanding the underlying Javascript.

When I decided to learn Javascript I bought the thickest best book I saw: _Javascript: the definitive guide._ And the most important thing I've learned I learned from the Table of Contents.

Javascript means two things. The obvious one is the language. The non-obvious one is the browser's Javascript API. Google a something about javascript and you will get a suspension of one in the other or vice versa...and it's actually worse because Node means that you will also get things that pertain to the server as well.

The other resource I constantly use is MDN. Again, written around POJ.

Javascript is the lingua franca of the front end, and here 'javascript' means the API not the language. But the language matters because the best most accessible writing about the API uses javascript the language. The most popular framework or language or library of the week may abstract away many details I don't care about, but as soon as I hit one I care about, I need to understand the javascript API to know why what I am doing doesn't work.

Maybe later when I can understand what they're over, I'll pick up somebody else's abstractions. But even then, I 'm not sure I want to try to sort through the exponential combinatorics of possible toolchains built on other people's code.

Good luck.</comment>


Update to Security Incident - <AUTHOR> https://stackoverflow.blog/2019/05/17/update-to-security-incident-may-17-2019/ <comment><USER2> I think this is one of the best sets of responses to a security incident I've seen:

1\. Disclose the incident ASAP, even before all facts are known. The disclosure doesn't need to have any action items, and in this case, didn't

2\. Add more details as investigation proceeds, even before it fully finishes to help clarify scope

The proactive communication and transparency could have downsides (causing undue panic), but I think these posts have presented a sense that they have it mostly under control. Of course, this is only possible because they, unlike some other companies, probably do have a good security team who caught this early.

I expect the next (or perhaps the 4th) post will be a fuller post-mortem from after the incident. This series of disclosures has given me more confidence in Stackoverflow than I had before!

<comment><USER3> One major advantage SO has stems from its userbase: we are much less likely to panic than the typical user of a system not focused on software development.

<comment><USER4> You say that, but the second highest comment on the HN thread for the initial update was less than gracious:

[https://news.ycombinator.com/item?id=19936315](https://news.ycombinator.com/item?id=19936315)

<comment><USER5> You can please some of the people some of the time.

</comment></comment></comment></comment><comment><USER6> Can't help but wonder - how obvious did the bug have to be that it was deployed on May 5th and an attacker gained access the very same day? That's pretty crazy - and there was only one attacker who poked around for 6 days without the bug being subsequently noticed by anyone else? If I were to speculate, it seems like the work of an insider or someone close to the project.

Of course, this is based on nothing but wild guesswork and it could be just coincidence. But in their shoes, I would really want to make sure no one else gained access and did anything more to hide their tracks, since it seemed like such a quickly found exploit.

<comment><USER7> It doesn't say the bug was deployed on May 5th.

<comment><USER6> I'm looking at the following from the post:

> The intrusion originated on May 5 when a build deployed to the development > tier for stackoverflow.com contained a bug, which allowed an attacker to log > in to our development tier as well as escalate their access on the > production version of stackoverflow.com. > Between May 5 and May 11, the > intruder contained their activities to exploration

To me, that reads "we deployed a bug on May 5th that allowed intrusion, and it was exploited the same day." If that's not what they meant - I certainly recant my criticism - but "on May 5th when a build deployed contained a bug" is difficult for me to interpret differently.

<comment><USER8> Exactly. If it wasn't deployed on May 5th, instead of writing, "when a build deployed to the development tier", I'd expect something along the lines of, "The intrusion originated on May 5 in the development tier".

</comment></comment></comment></comment><comment><USER9> I am impressed with the way Stack Overflow is handling this, but I would appreciate details about how a bug in the development tier gave an attacker the ability to escalate their access in production. Does the development tier have production keys? Did the attacker learn about some other bug through access to the development tier? Is the development tier sharing a privileged private network with the production tier? Hopefully the security community can learn from this incident to improve best practices.

<comment><USER10> This is obviously speculation, but development does not require direct access for a pivot to production. CI-Systems might be reachable from dev and I often see CI-Systems that are less well secured than prod. Pivoting from an owned CI to a prod system is often comparatively easy: inject code in the next build, the artifact is implicitly trusted (hey, it's from a known-good source) and bang! Prod owned. Or developers expose their ssh keys via agents to dev systems, the same key works for prod and you might be in.

I share your curiosity :)

<comment><USER11> Which is why best practice is now to start with CI in production - it needs limited access to dev, and the access from development environments into it can be literally just enough to collect the latest artifact.

</comment></comment></comment><comment><USER12> I find it concerning that access to the dev tier made it possible to escalate into production.

Should dev not be sandboxed from production?

"The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com. "

</comment><comment><USER13> > contained a bug, which allowed an attacker to log in to our development tier > as well as escalate their access on the production version of > stackoverflow.com.

Why are the credentials for production granted to development systems?

</comment><comment><USER14> > As part of our security procedures to protect sensitive customer data, we > maintain separate infrastructure and networks for clients of our Teams, > Business, and Enterprise products and we have found no evidence that those > systems or customer data were accessed.

I sure wish more companies did this. Such peace of mind.

<comment><USER15> More targets to defend, more chances to slip up. It's a mixed bag.

<comment><USER16> Uh, no. You need infrastructure to handle each anyway, dividing it in separate realms makes sense.

</comment></comment></comment><comment><USER17> 250 users affected? Sounds like a targetted attack rather than a spray-and- pray. I wonder who the victims and attacker are and what the motive was.

<comment><USER18> Could also be that the attacker made a set of random API calls that returned private data, e.g. to test that his permissions are working, and received whatever that API returned at that time without targeting any specific users (or caring about that specific data).

</comment></comment><comment><USER19> As it happens, this incident was discovered by a curious user who had a script watching for new accounts with staff privileges, who brought the attacker's account it to the company's attention (in chat) because it looked unusual.

Stack Overflow seem to be following a very responsible incident response procedure, perhaps instituted by their new VP of Engineering (the author of the OP). It is nice to see.

<comment><USER20> > As it happens, this incident was discovered by a curious user

Some recognition would have been nice instead of saying "we" quickly found out.

<comment><USER21> Maybe the user doesn't want to be named?

</comment></comment></comment><comment><USER22> I would be having a close look at whoever checked in that bug.</comment>