The Critical Engineering Manifesto - <AUTHOR> http://criticalengineering.org/ <comment><USER2> This has got to be the most interesting way anyone has made money off a combination of cypherpunk culture and paranoia over control of the internet.

      In the second phase of the workshop students learn to read network topologies
      as political control structures, seeing how corporations and governments shape
      and control the way we use computer networks.

      Students learn to study these power structures by tracing the flow of packets
      as they pass over land and sea.

      Macro-economic and geostrategic speculations are made.

</comment><comment><USER3> > The Critical Engineer deconstructs and incites suspicion of rich user > experiences.

I've read that a dozen times and I still have no idea what it's supposed to mean, is this meant to be a Koan?

<comment><USER4> I read it as two things: 1) Critical Engineers are skeptical that "rich user experiences" are the most effective way of interacting with systems, 2) "rich user experiences" tend to oversimplify and misrepresent systems for the sake of usability or aesthetics.

</comment></comment><comment><USER5> > The Critical Engineer looks to the history of art, architecture, activism, > philosophy and invention and finds exemplary works of Critical Engineering.

I'd be interested to hear some of those examples. Does describing a form of government or human organization count as engineering?

</comment><comment><USER6> Seems like a misguided attempt to break engineering the same way social sciences were largely broken; by embedding left-wing politics at their core so that their assumptions are not scrutinized and by substituting sound scientific method with literary analysis.

<comment><USER4> You're really missing the point if you think this document is proposing an alternative to engineering. It's addressed to a subset of artists and engineers deeply concerned with the political and interpretative dimensions of engineering.

While there is usually a technical aspect to critical engineering projects, most engage issues well beyond the scope of the "sound scientific method." See: CV Dazzle by Adam Harvey. [1] I suggest looking at Garnet Hertz's _Critical Making_ for a more informed picture of this kind of work. [2]

[1] [http://ahprojects.com/projects/cv- dazzle/](http://ahprojects.com/projects/cv-dazzle/)

[2] [https://twitter.com/criticalpdfs](https://twitter.com/criticalpdfs)</comment></comment>


Wikipedia and Amazon Own (Most) Proper Nouns - <AUTHOR> http://www.byrnehobart.com/blog/wikipedia-and-amazon-own-most-proper-nouns/

<comment><USER2> I don't find this surprising or troubling at all. The first result in a search should be the quick reference for a general audience. Wikipedia, IMBD, and Amazon all accomplish this quite nicely.

Those interested in more in-depth info will search further down. I love how <http://duckduckgo.com/> does this, pulling the info directly from wikipedia and putting it on the first page itself. The only thing keeping me from using DDG as my primary search is the lack of integration with maps, images, etc.</comment>


Microsoft Defender SmartScreen is hurting independent developers - <AUTHOR> https://getimageview.net/2020/06/02/microsoft-defender-smartscreen-is-hurting-independent-developers/ <comment><USER3> I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though.

Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?

Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs -- [https://yourbank.real-secure-website.xy](https://yourbank.real-secure- website.xy) can have a valid cert but it doesn't mean it's legitimate. What's the equivalent to the "URL bar" for software? What's the equivalent to the ACME domain validation challenge?

The SmartScreen stuff is another attempt at this -- software that's not frequently seen is flagged as a potential problem. As a developer, this annoys me greatly. As the de-facto support person for family that don't understand computers... I don't mind so much. Without this, malware gets executed directly and now you're dependent on (very imperfect) anti-virus software.

I guess the Store is another way to have "trusted" applications, but you only have to look at the Google Play or iOS store to see how well this ultimately works out (for both malware and legitimate authors).

Note this isn't even about admin vs non-admin installations. Obviously malware running as admin can do more damage that's harder to recover from, but non- admin malware is just as capable of doing bad things (think: stealing credentials, running cryptocurrency miners, ransomware), and after being hit by a randomware attack I doubt your "typical" user is going to really care much about the distinction between their account vs the entire computer being trashed.

<comment><USER4> > _What can Microsoft do, as an alternative, that doesn 't result in an > identical or worse situation?_

Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking up what I'm putting down, great. I also care about my users, so I'll happily mark my applications.

But you don't need to take $100/year from me for the right to not have thugs block access.

> _Giving out free code-signing certificates also makes it easier for malware > to get legitimate certificates._

Malware exists to make money. Therefore malware authors can easily pay for certificates as a cost of business. Megacorp software fucks people over all the time. It exfiltrates their browsing history, MITMs their secure connections, installs rootkits and backdoors. Please don't pretend that this increases security.

<comment><USER5> Not that simple to just pay. You need an EV certificate ([https://en.m.wikipedia.org/wiki/Extended_Validation_Certific...](https://en.m.wikipedia.org/wiki/Extended_Validation_Certificate)), which in turn needs a verified business address.

Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

<comment><USER4> Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations.

And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo!

The only person in this story who doesn't have a business address is me.

<comment><USER6> This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)

<comment><USER7> I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel _helpless_ to do anything about the situation.

My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is _exfiltrating_ information. Every one of them is a data leak waiting to happen. Every one of them could _take control_ at any time.

Huawei isn't doing anything different. The western governments just don't like it that they're copying them.

</comment></comment></comment></comment></comment></comment><comment><USER8> I am one of the creators of SmartScreen application reputation. SmartScreen is a reputation-based safety feature that allows 'know' downloaded software to run friction-free but interrupts the execution of 'unknow' downloaded software with a 'stranger-danger' warning. SmartScreen application reputation was first launched in IE9 (2010/2011) and then was integrated into Windows (starting with Windows 8 in 2012). It has been a few years since I have worked on SmartScreen, but I thought providing some context may be interesting.

Windows 7 made great strides in addressing software vulnerabilities. And bad guys quickly moved from software vuln exploits to socially engineered attacks. They tricked users into download and running spurious programs (using a variety of techniques - ranging from SEO to scare-ware website that tricked people into thinking that their machines were compromised to running sophisticated ad campaigns). The problem with traditional anti-virus (AV) approach was that by the time the AV analysts could get their hands on a new binary, analyze it, classify it as malicious, write a signature, and distribute it - it was generally too late. The bad guys monetized the latency between when they published a new binary on the internet and when the AV vendors were able to effectively detect it as malware.

SmartScreen tried to flip that dynamic - by using reputation. By volume, majority of downloads were benign; there was no point in warning users when the likelihood of future infections from such downloads was nearly zero. However, for software that had never been seen before - there was a significant risk associated with it - all the yet-undetected-malware resided in that set (depending on the situation and context - the risk of future malware infection could range from 25% to 75%). So, for 'known' software, SmartScreen eliminated the mostly-useless warning (that everyone had grown used to clicking through); for 'unknown' software (which the AV companies still hadn't deemed as malicious; yet-undetected-malware would be 'unknown'), SmartScreen showed a 'stranger-danger' warning. This was incredibly effective in stemming the socially engineered malware attacks. In the overwhelming majority of the cases - users did the right thing; they chose not to run the downloaded programs that were later detected as malicious. When SmartScreen was launched, nearly 7% of all downloads were later detected as malware by AV. In a couple of years, the incidence of socially engineered malware had dropped significantly (By a ton! By many orders of magnitude. Most bad actors changed their business model to bundleware - bundling unwanted, non-malicious, software with popular downloads). An important factor was that SmartScreen had expansive coverage on (knew about) all executable binaries downloaded from the Internet - in order to mitigate the risk of users getting used to ignoring the warnings if they saw those too often. Most users saw one or two SmartScreen warnings in a year. And, when they saw the warnings, the risk was significant - and users did the right thing in those cases (not run the downloaded program). SmartScreen provided highly effective 0-hour protection against socially engineered malware by helping users make the right trust-decisions.

There was some friction - for developers and advanced users (who downloaded esoteric, non-very-commonly-downloaded software more frequently). For developers, reputation came in two forms - either each individual binary that they published could 'acquire' reputation - or if they had a code signing certificate - then that certificate could 'acquire' reputation (and any binary that was signed with the certificate would inherit it; which was a better option). In either case, if the developer went rogue or published a program the was malicious - it was straightforward to deal with that problem. SmartScreen could instantaneously revoke the reputation for the certificate or the binary. There is a meaningful cost (time, behavior) that the developer incurred in order to get reputation - and it is hard, expensive, and not- scalable for bad actors to 'acquire' reputation - and if they did end up behaving badly after acquiring reputation (e.g. signing malware with code signing certs that has acquire reputation), that reputation would be lost very quickly - really hurting their ROI.

So yes - there was some friction. In many / most cases, new executables and publishers 'acquired' reputation after a short period (typically a few days) and many advanced users understood why they would occasionally see the SmartScreen warning and would make the right action choice. But the benefits to the larger ecosystem were incredibly significant and impactful.

<comment><USER9> With all due respect, you may have built an effective tool to suppress malware, but I would be more excited had you addressed the complaint in the article.

It remains difficult if not impossible for a brand new developer to coordinate a new launch or for an open source project to release unsigned binaries without triggering SmartScreen's rather opaque and user-hostile reputation block. At first glance, the dialog does not give the user any information that it is even possible to execute the program. Of course it stops malware. It brings the average Windows user to a dead stop!

Based on the number of regular people I help on a daily basis who download completely legitimate, "esoteric, non-very-commonly-downloaded software" I must say that I do not find your arguments very compelling. This tool could have easily remained in your browser where it belongs.

</comment></comment><comment><USER4> Application signing is a mafia protection racket, plain and simple.

If you aren't signed by an "authority", every user is told by default automatically that your code is unsafe until you pay money.

It is 100% analogous to thugs walking into your store saying "It would be a real shame if something were to happen to scare people away."

The message is "We Protected You" and "Unsafe". WHY? Because "WE don't recognize" it.

Application signing certificates cost money. Always. And if you're making something for free either out of the goodness of your heart or because you like making things, that money has to come out of your pocket just so the thugs don't stand in front of your door with bats. Nobody should be ok with that. AND FUN FACT: malicious or incompetent actors can and do also pay money.

<comment><USER10> First they came for the iOS developers, and I did not speak out, because I wasn't an iOS developer.

Then they came for the Windows developers, and I did not speak out, because I wasn't a Windows developer...

I sure wish I could distribute the software I write without paying some rent- collector (at least) $100 for the privilege.

<comment><USER11> The problem isn't the rent. It may be an inconvenience for an indie developer, but to Microsoft, Apple, etc. the cost of a yearly developer account is peanuts. They are not doing it hoping to make excessive amounts of money. Even if Apple has a million developers paying $100, $100M is barely a blip on their radar.

It is all about control. They get to decide whose software gets to run with and whose without annoyances.

<comment><USER4> > _The problem isn 't the rent._

Yes and no. I'm making free software for the world, not running a business, and I don't appreciate getting shaken down by a megabillion$ corporation.

</comment></comment></comment></comment><comment><USER12> The entire point of authnicode wasn't to protect users, it was to make sure software wasn't modified in flight (ala what SourceForge did), and to make those binaries accountable.

Now we're getting to the point that this feels like a protection racket. It, at least in theory, is possible for individuals to get EV certificates for websites. Worst case scenario, you can get a one man business for the paperwork.

A lot of viruses can hit via either remote code execution, or exploiting a bug when loaded through a data file. Neither of those scenarios is stopped by SmartScreen. At best, it stops someone from clicking "WannaCry.exe".

MSFT is basically doing everything to make you use the Store, and it reeked back with Windows RT, and it reeks even more now.

Unfortunately, it seems MSFT is incapable of creating a version of Windows that doesn't have live tiles, constantly tracking what applications you run. I switched to Linux years ago, but I realize that most people live in a Windows ecosystem, and that they're subject to the whims of MSFT.

</comment><comment><USER13> Dear GitHub CEO reading this message on HN: a cool feature would be a GitHub action to sign binaries _for free_.

It's ridiculous that my open source code is hosted on GitHub, the binary is created with an action but I have to pay for a certificate and manually sign it.

<comment><USER14> I guess since Microsoft through GitHub controls the build process, couldn't they also include the signed source as well as a combined signature?

Idea being that one could, in theory, download the git repo, check out the relevant commit and verify that this was the source code and this was the resulting binary, and that matches the exe file I just downloaded.

<comment><USER13> Yes! I bet there are numerous ways this could be implemented to make things easier for developers and end users.

With the current setup GitHub has more control on the resulting bits than I do.

Also, current Microsoft signature rules that a hardware dongle is required to sign the bits (all non-hardware certificates will be deprecated in time).

So, I'm supposed to take the .EXE that GitHub produced on one of their VMs running actions then certify _it 's legit_ by signing it with my certificate.

But what am I actually certifying? Well, that to the best of my knowledge this EXE is the build output of this Git commit that triggered the action.

</comment></comment></comment><comment><USER15> I recently went through this pain for an electron app. Non-EV code sign cert kept throwing SmartScreen warnings for most users. Acquiring an EV cert forced me to register a company and a hefty cert price per year, overall costing nearly $1500. Not to mention overall delay and added costs.

Meanwhile my $100/y Apple Dev subscription was enough to package the app and distribute outside App Store.

At this point I am fairly certain EV certs are nothing but rackets supported by MS.

<comment><USER16> Oof. Next time you need to renew, check the links from the msft authenticode dev website for ev certs. A couple providers are much less than $1500/yr.

Also, when I got my renewal bill for something like $1500/yr for PhotoStructure, I sent an email to their support asking to continue the low original fee, and they agreed.

</comment></comment><comment><USER9> What this really does is train users to bypass protections. As anyone who has owned a mac can attest, I now basically think nothing of the potential perils of doing "right click -> open -> ok" because I have to do it ALL THE TIME.

It's getting to the point where it's the same on windows. More info -> run anyway is becoming a useless annoyance.

I would note that at one point SSL certificates were kind of in the same boat. Users clicked through web warnings as a matter of course. The thing that changed is that we were able to reduce the financial barrier to certs to literally $0. If the same can be done for this nonsense, we will be in much better shape.

I have already made my choice on risk when I chose to download the software from the developer and execute it. A prompt for a first time trust might be the limit of what I'm OK with including, but any stronger warning or making it difficult to proceed is really only reasonable to do if some 3rd party is compromising a choice I have already made.

</comment><comment><USER17> I am guessing that they'd want you do distribute your program through their "App Store" as a UWP, which is likely subject to sandboxing and will never show the SmartScreen prompts.

Making raw Win32 .exe distribution as user-unfriendly as possible is very likely to be a goal of MS.

<comment><USER18> Honestly I am all for sandboxing by default and scary prompts for anything that doesn't subject itself to strict sandboxing or that tries to break out of it. That doesn't mean apps necessarily have to come from a MS curated store either, just that by default the run in a sandboxed context with access to dick squat on my system.

I absolutely hate when I install something like Adobe Acrobat and it installs 18 schedule tasks, a startup job to ensure those task exist, a tray icon to monitor it's services and all the other crap. No thanks.

I also don't want to have to worry about installing some random app I found on SourceForge that purports to do what I want but might come with the SF equivalent of News Gator side loaded.

Lock it all down by default in a virtual sandbox by default and if it needs legitimate access to my files, prompt me to grant it access.

<comment><USER19> MSIX tries to be exactly that. It supports the gamut of Win32 so long as they can be minimally sandboxed. Win32 apps in MSIX still have access to everything and can't be entirely trusted, but the installer will warn you about that a lot less "scarily" than the SmartScreen Defender prompt this author doesn't like.

MSIX can be sideloaded by default in every supported version of Windows (in addition to or rather than Store installed) (supported versions of Windows include 7, 8, 8.1, and 10 after the Anniversary Update). MSIX support _auto- updating_ even when sideloaded, all it takes is an HTTPS server with some simple manifests (for those that remember ClickOnce it is reminiscent but a lot easier/cleaner), or for Enterprises a file share will do.

The only caveat is that MSIX requires Code Signing Certificates for sideloading. (Note that makes Store install is a "cheaper" option with the $99/year and Microsoft handles the package signing for you as a part of the approval process.)

My biggest gripe with WinGet as a project (and no, the article is wrong it's not intended to replace the Store) is that it isn't doing _way_ more to bootstrap MSIX packages instead of "downloading and running EXEs like always before".

<comment><USER20> > MSIX can be sideloaded by default in every supported version of Windows

Is that true? I thought MSIX sideloading was only enabled by default in the recent Win10 2004 release (better late than never!). [https://www.windowslatest.com/2019/08/12/windows-10-20h1-imp...](https://www.windowslatest.com/2019/08/12/windows-10-20h1-improves- apps-sideloading-adds-msix-support/)

<comment><USER19> APPX sideloading has been enabled by default since at least the Anniversary Update. Not every MSIX will sideload if just renamed to APPX, but many will (including many Win32 applications). Microsoft has stated that every actively supported Windows 10 feature update from the Anniversary Update forward will receive updates to enable the rest of MSIX and the MSIX file extension, including sideloading.

<comment><USER21> You're both partly right - it was enabled by default in Home and Pro editions since 2016, but is just now being enabled by default in the Enterprise edition in the new version 2004 update.

</comment></comment></comment></comment></comment></comment><comment><USER22> I work for a company that develops audio software. The market itself isn't that huge so our products triggered even on Windows 7. Once we got the first reports, we've bought a code sign certificate.

But still... if your software isn't common... you'll trigger the SmartScreen.

Even if your app managed to pass SametScreen, you'll soon discover that many users got Anti-Viruses that with the same assumption about non-common app is bad.

I've ended up contacting a lot of Anti-Virus companies and I whitelist our installers also on their end.

While the process itself is much simpler than notarizing with Apple. On Windows you need to contact much more parties to make your app "just work" for the non-tech-savvy user.

</comment><comment><USER20> I asked the MSIX team about code signing at Build recently, they said they will be previewing "Azure Trust Service" this summer which makes code signing easier: [https://twitter.com/jvintzel/status/1262794128351322114](https://twitter.com/jvintzel/status/1262794128351322114)

The current code signing situation on Windows is painful. It's especially galling how the code signing requirements apply to modern _sandboxed_ Windows applications as well - an MSIX-packaged application with minimal capabilities is subject to the same requirements as an EXE that can do anything.

<comment><USER23> I think there's an argument to be made that sandboxing shouldn't exempt you from security restrictions. Unless the sandbox is entirely impossible to penetrate (making apps borderline useless), a malicious app still has many opportunities to trick the user or exploit security vulnerabilities. Revocable signing certificates are a useful tool for fighting back against hostile actors.

The certs should be much cheaper, though, and it would make sense for sandboxed applications to perhaps be _easier_ to sign.

<comment><USER20> That makes a lot of sense - I think making signing easier should be the goal, not removing signing requirements entirely.

Part of my frustration comes from this paradox: it's harder than it used to be to share a native application with others, even though we now have sandboxing that makes it significantly safer.

It feels like most of the pieces are in place, MSIX has matured to the point where it's pretty easy to distribute an application that runs in a sandbox with auto-updating. If Microsoft can just make the signing part easier, I think we'll see a much more vibrant community around native app development.

</comment></comment></comment><comment><USER24> More walled gardens. Hooray.

This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform.

Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work on their devices and operating systems, not tens of thousands of independent developers and engineers paying this price N-many times for each walled garden.

We also need to get Google's claws out of the open web (AMP, standards balkanization, etc.)

<comment><USER11> _This is why we need WASM and web-first development._

This is only going to make things worse. If everything is a web application, why would users even need access to their hardware or be able to modify their operating system? Boot from an locked bootloader that only loads a FAANG- signed shim OS, that only loads a FAANG-signed web browser. Next, disallow extensions and ad blockers and we are in the brave new web world were a small number companies more powerful than nation states continuously monitor your behavior for ad impressions.

Sure, now you can install a web browser on your Linux or BSD machine. But once they are in that position, they will make sure that it will be a miserable experience without necessary DRM, disabling or not investing in hardware acceleration, breaking random things on 'unsupported combinations', etc. Moreover, as usual on the web, any competitive player the becomes a threat will be bought by the increasingly large FAANG companies, ending their 'incredible journeys'.

Even though it will probably never happen, what we need is Linux on the desktop, with good native applications, plus a truly open mobile platform.

<comment><USER25> Interesting. How are we going to block annoying content if it is implemented in WASM?

</comment></comment></comment><comment><USER26> At least for standard apps, the user can bypass the warning. For drivers, it gets much worse.

On 64 bit versions of Windows, there is _no way_ for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard _which I lug out of the closet because my Bluetooth keyboard won 't work_. The effect only lasts until the next time I restart.

I understand that the kernel is sensitive, but this is overkill. Please let me install the software I want on my own machine!

<comment><USER27> And yet videogames can easily install Ring-0 "anti-cheat" software with no special privileges or steps required.

<comment><USER28> Because they get signed.

</comment></comment></comment><comment><USER29> Please note that EV code signing certificates are not the magic bullet they first appear. SmartScreen is reputation based. An EV code signing certificate does not grant immediate access. You will have to build reputation regardless.

There is no pay to win solution. I've learnt this the hard way.

You can however place the executable in a Zip archive to bypass SmartScreen. An unzipped file won't bear the mark of the web.

<comment><USER30> Wait really? How do you unzip your files? I thought files unzipped inside with Windows's built-in unzipper still keep the attachment manager metadata that Windows stores?

<comment><USER29> You are correct.

I've been using 7zip. It does clear the flag. Windows built-in unzipper does not.

</comment></comment></comment><comment><USER31> > "Developers, developers, developers!" was a cry from Steve Ballmer and one > of the speeches that defined him as CEO of Microsoft. These infamous words > were uttered back in 2006.

The famous YouTube video of it was uploaded in 2006, but my sources say the event in question was from Microsoft's 25th Anniversary Event in September 2000.

I could use a more authoritative source than knowyourmeme, though, so someone else is free to chime in there. There's a newsletter referencing it as early as 2001[0], so that seems to suggest well ahead of 2006.

[0][http://www.ntk.net/2001/08/03/](http://www.ntk.net/2001/08/03/)

<comment><USER32> Well the message is now "get off our platform so we can switch it off". Everything Microsoft does goes in the direction of phasing out Windows.

</comment></comment><comment><USER33> This racket and Microsoft's hostility to independent developers (and apparent attempt to force them to use their Windows store?) is one of the reasons that I just can't go along with people who think that Microsoft is a "champion of open source" now or benign actor in the business world. They are fundamentally corrupt and cutthroat.

I recently wiped Windows and loaded up Pop! OS. It works great. And I never get a message saying "this software is suspicious" just because it's not in an official Deb package or something. If I add a PPA or download a binary or whatever I do, there are basic permissions required, but it does not automatically say "this is probably dangerous so I stopped it" just because the distro doesn't recognize the software. That is ridiculous.

</comment><comment> vanilla-almond Another tale from a developer on their experience getting a code signing certificate from a certificate authority:

[https://twitter.com/hanspagel/status/1262317935898566658](https://twitter.com/hanspagel/status/1262317935898566658)

<comment><USER34> Eh, honestly, that's what getting an SSL cert used to be like 15 years ago. They can knock it all they want, but really, the process functioned pretty much as expected.

Like a lock on your front door, the purpose is not to prevent unwanted people from ever getting inside (no lock will ever accomplish that), but to both make it take long enough the likelihood of being noticed is high, and to put enough hurdles in place that the attacker looks for a more lucrative target.

This is done through time, capability, and money. It takes time to jump through the steps. This presents risk to an attacker as it leaves them exposed for much longer, and susceptible to being tracked down in various ways as they expose themselves. It takes capability to jump through the steps, requiring the attacker having compromised the target in multiple different ways (phone system, employee, etc). This increases the complexity of the attach and thus the risk to the attacker. It takes money. This helps the providing company recoup the cost of verification (and if it's anything like web SSL certs is also about insurance), but money also provides another path to racking down an attacker, and provides a cost to them that isn't just their time. It also makes it less feasible to attempt a bunch of these attacks at once, as it's expensive.

People can complain about the inconvenience all they want, but the inconvenience is part of the point, so I doubt you'll see it change all that much.

<comment><USER27> Funny how Let's Encrypt is so popular because it doesn't inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

<comment><USER5> There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.

<comment><USER34> Also, for a lot of sites they've outsourced their payment systems (which was the main reason for SSL certs in the past), so you can place less importance on the SSL cert if the payment gateway is PayPal, or Amazon, or Squarespace, and they are essentially providing the same assurance (and are a responsible party you can contact to reverse charges if you suspect fraud).

At this point, I'm very hesitant to enter any credit card info into a site itself, even if it's secured through an SSL cert. It doesn't really signify what it used to.

</comment></comment></comment></comment></comment><comment><USER35> This is really hurting Microsoft's ecosystem, I'm trying to add the latest version of QuickLook [0] to the winget package manager at the moment but because the msi installer isn't signed my pull request is doomed to failure[1].

If Microsoft want Windows to be an awesome developer platform this kind of friction with the tooling helps no-one.

[0] [https://github.com/QL-Win/QuickLook](https://github.com/QL-Win/QuickLook) [1] [https://github.com/microsoft/winget- pkgs/pull/1241](https://github.com/microsoft/winget-pkgs/pull/1241)

</comment><comment><USER36> I always tell users to Mark the file as trusted before running it, which is easier to do and less subject to difficult to navigate dialogs. I use a message like this:

> To avoid getting security warnings each time you launch the application, > right click and select "Properties". Click "Unblock" towards the bottom of > the page, and click "OK".

</comment><comment><USER37> This was a problem already a few years ago.

I was working for mid-level corp writing a C# Windows program that would be used by a few hundred people tops.

Even after going through the signing process, there were still false positives from some major anti-virus vendors.

I had to submit and resubmit to multiple vendors to get the program off the false-positives. Some smaller vendors still triggered.

Microsoft Defender was one of those that I had trouble with even after the signing.

So if you write software for a smaller audience you are going to get screwed.

</comment><comment><USER38> > By this time most users have deleted the .exe already thinking it is a > malware, but SmartScreen can be bypassed by clicking on "More info" then > "Run anyway".

What typically happens is people don't even click on more info. They redownload the files and then give up and the files are now collecting bit dust. Source: me.

Also, I think it has been going on for more than a year now.

<comment><USER19> SmartScreen Defender has been in every version of Windows 10 since launch.

</comment></comment><comment><USER39> I ran into this issue when writing a small automation tool for a friends business.

The workaround for now:

Right click .exe → Properties → at bottom of the General tab check "Unblock"

Microsoft – same wolf, different clothing.

</comment><comment><USER40> Meanwhile, all bad actors know the best way to deliver malicious code is via javascript exploits in a browser.

<comment><USER41> It might be the best way, but distributing your malware as executable - <USER2> bundled with some other app - is easy. Plenty of bad actors out there who can't pull the fancy tricks.

Smartscreen may protect against cases where somebody has for example repackaged WinSCP and distributes it with malware.

</comment></comment><comment><USER42> We have been bitten with this one, multiple times now over the years but seems to have gotten worse.

Our otherwise SaaS product requires an installable component for our customers PCs, from installation package (MSI and/or EXE) that we generate on the fly per customer -basis in order to customize data inside the installer for each tenant. For this reason, the timestamping of digital signature varies between packages as does the hash [of the content], and for _months_ after we have renewed our signing certificate we get support messages about both Smart Screen "scary warnings" as well as from some AV products as well. Despite number of downloads for runs for the package(s) signed with one and the same signature.

As the article mentions, it does not matter if you have had previous certificate; each renewal (=new certificate technically) starts this reputation process from zero. What's worse, since the signing happens on the [Windows] server as part of the product itself we really cannot use EV certificates either as those require physical USB dongles to be attached to machine doing the signing.. so we are left only with option of using regular certificate that gets this treatment. Sure, 10 year certificate would postpone the issue for a long time, but for security purposes we actually want to recycle those signing certificates with one to two year interval so the problem always resurfaces regularly.

</comment><comment><USER43> The part that is insane to me is the idea that there is no way as a developer to get a "this product was reviewed and certified clean" label to guarantee a clean installation UX, _even after buying a code signing certificate._

SmartScreen seems like a great idea for protecting the end user, but without ways to remediate "reputation" problems with some form of prior review, this makes the software ecosystem shitty _especially_ for individuals and small software outfits.

<comment><USER19> SmartScreen has a manual review submission process: [https://docs.microsoft.com/en-us/windows/security/threat- pro...](https://docs.microsoft.com/en-us/windows/security/threat- protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen- overview#submit-files-to-microsoft-defender-smartscreen-for-review)

</comment></comment><comment><USER44> As is typical for Microsoft, they again are trying to copy Apple, but failing to get the details right, turning it into a disaster. This behavior used to just be limited to their UI, but now it seems to have passed into their business practices.

I suspect this happened because they were trying to be more secure, but all the Microsoft employees have free access to signing certificates that bypass the checks, so they never ran into these problems.

</comment><comment><USER45> Can someone break down how this compares to what Apple does with Mac?

The basic gist I have is for Apple you have a yearly fee of $100(USD) but that covers all of your apps.

Where Microsoft is per app and looks to be about $100 a year (depending on how far in advance you pay) and then also have another piece on top of it regarding how often its used.

Is there more to what Microsoft is doing or areas where what Apple is doing is shady?

<comment><USER46> One big difference is that this $100/yr (ish) for MS side of things doesn't actually bypass smart screen on its own. Smart screen stops showing up if more people eventually install and use your app (black box). If you want to bypass it out of the gate, you need an EV Cert. Which are hundreds more (further down this article quotes one at $700), and require more effort on the business side of things.

</comment></comment><comment><USER47> Interesting that they aren't doing it the same way as Apple, where you pay to be part of the program and they provide all the certificates. Certainly seems cheaper at $100/yr compared to the prices of these certs.

Also why are these certs so much more expensive compared to a normal SSL certificate?

<comment><USER19> Microsoft provides an _option_ to do exactly that. Microsoft Store will handle all the certificates for you for $100/year _and_ their Store cut is smaller than Apple's if you decide to sell through the Store.

<comment><USER21> if I'm not mistaken it's a one-time (not annual) fee of $19 for an individual account or $99 for a company account (required for Win32 apps)

[https://docs.microsoft.com/en- us/windows/uwp/publish/account...](https://docs.microsoft.com/en- us/windows/uwp/publish/account-types-locations-and-fees)

</comment></comment></comment><comment><USER48> I like to think that these stupid corporations would try harder at solving the problems they create if whenever those problems are mentioned, those corporations didn't get dozens of apologists. Or maybe I'm just frustrated.

Microsoft doesn't need some oddly loyal developers defending them nor the free publicity they provide. Developers affected by stuff like this don't need some guy asking _them_ what they would do better. It's not indie developers' job to fix microsoft, it's microsoft's.

</comment><comment><USER49> I agree in general with what SmartScreen tries to do. There are a lot of non- technical folks clicking on stuff willy-nilly so adding barriers to prevent spyware / virus infections for totally unknown binaries is a good thing. A "Let's Encrypt" for code signing may be a good idea, but the cost of a certificate is itself a barrier for spyware distributors, so i'm conflicted on that... not sure what the right fix is.

<comment><USER5> The barrier is actually bigger than just money: for an EV certificate you need to prove that you are a registered business. So there is a name and an address behind it, which is kind of a barrier for malware.

<comment><USER50> What's that? An extra $50 in Delaware?

</comment></comment></comment><comment><USER51> Too bad we can't have a Lets Encrypt for desktop. Also the EV certs are effectively dead for the web.

[https://www.bleepingcomputer.com/news/software/chrome-and- fi...](https://www.bleepingcomputer.com/news/software/chrome-and-firefox- changes-spark-the-end-of-ev- certificates/#:~:text=Chrome%20decides%20to%20drop%20the,for%20release%20on%20September%2010th).

</comment><comment><USER52> walled gardens ever increasing assault on independent developers never stops. seems microsoft is following Apple's trend of shitting on indies. my take is folks develop your apps to be browser based, if you can. if we can have a browser app, like Figma. a lot of apps, could do. the ones that need to deal with os n files etc, might be non-starter. take your talents to open platforms.

<comment><USER53> I was under the impression Figma was an executable, not a web app.

<comment><USER54> it is a web app. You can run it fully in the browser. Local executable is just an Electron app iirc. I don't have it install on my work machine, but I frequently access and manipulate Figma files from Chrome just fine.

</comment></comment></comment><comment><USER41> If you click "more info" on the SmartScreen notice you should be able to bypass it (unless you are in environment where admin has blocked this).

</comment><comment><USER55> I developed some absolutely free Windows software as a hobby. I specifically didn't want to change for it because then it's a job. Smartscreen was definitely a problem; end users were absolutely afraid of my software.

Eventually a user who was also software developer offered to sign the binaries for me with his certificate and that's how I've operated since.

<comment><USER50> Lmao. We should all pitch in $20 and set up a shell company to buy 1 code signing certificate to share. It would definitely pass SmartScreen if a couple hundred apps were signing with it.

</comment></comment><comment><USER56> I can certainly empathize with the author. How many executions are we talking about though? 10, 100, 1000?

Seems like a dev w/ a new certificate could post a build of said application to a dev-friendly space to "bootstrap" the process.

Certainly not practical in many scenarios, but that's why I was curious about how many it takes.

<comment><USER26> I don't think it's such a bad system either, but the certificates themselves should be _much_ cheaper, if not free. I mean, they don't even _do_ anything until a critical mass of users lets the app through smart-screen.

</comment></comment><comment><USER57> All the open source developers/publishers here should get together and pitch in to get one long lasting certificate to sign all of their respective binaries (of course, really important that they vet each other's code, so has to be open source) Edit: typo.

<comment><USER50> AppGet or Chocolatey are already on the system and (I think) could unblock binaries from SmartScreen. AFAIK user level programs could run with zero prompts.

</comment></comment><comment><USER58> Can this be worked around with UX?

Show clear steps with images on the download page that direct them to click "More Info" to run the app. Eventually the app builds up reputation (at least until the cert expires). How effective would this approach be?

<comment><USER59> You can but you'd need to account for every OS/update combination to make sure you get the UX right. Many apps do something similar for teaching people how to click through the trust dialogs when running the installer when downloading with chrome/ie/edge/firefox/chrome-edge/etc.

Not impossible but it's definitely a hassle and probably non-trivial to get right.

</comment></comment><comment><USER60> > The digital signature racket

> The price range is wide but a certificate only valid for a year will > typically go for about $100.

This is hypocrisy, smells like Apple-fanboy trolling. MS stimulates competition on the code signing certificates and it is free to deploy through their appstore. And you can bypass Smartscreen right from the warning.

Certificates cost $59.00 at codesigncert[0], not "about $100.00". Established developers with reputation don't need certificates.

Now compare that with Apple's (much more walled) approach: only Apple sells the certificate at the price of $99,00, even to deploy on their Mac store (where they'll also take a cut) and it is not trivial to bypass their screen.

[0] [https://codesigncert.com/comodo-individual-code- signing](https://codesigncert.com/comodo-individual-code-signing)

Edit: I don't like MS codesigning implementation, but they are not the worst on this game.

<comment><USER61> $59 if you pay for 3 years, so actually $177 up front or $75 for one year, and again, this doesn't actually help bec after x years your app will need to build a reputation again.

This is ridiculous and as others have said is meant to funnel devs to using the broken Microsoft Store.

<comment><USER15> This is so true. When you renew, you get back to square one with reputation.

</comment></comment></comment><comment><USER62> Why not add a protective layer to the OS, kinda like Apparmor on Linux!? Because of the monopoly status of the Windows platform, instead of making a better product, you invent things to make more money.

</comment><comment><USER63> Completely agree. Just a rebuild of an MSI the other day turned up a false positive in windows defender and it's still stuck in smartscreen today despite MSFT fixing the AV definitions.

Cost me three days.

</comment><comment><USER64> Second instance on the front page today of false positives / false negatives, the other being the walmart shoplifting story.

Edit: possibly also the MLK one and police v journalists one...

</comment><comment><USER65> Look at this from anither angle: on MacOS it is worse. You can "buy" certificates/approval only from Apple. If Apple doesn't like you, you are screwed!

<comment><USER66> OTOH: On macOS, you pay $100/yr and you're set -- any apps you notarize will launch with a simple confirmation dialog. On Windows, you can spend hundreds of dollars on a security certificate and _still_ get blocked by SmartScreen and/or antivirus software.

I'm not aware of any situations where Apple has declined to offer a developer certificate to a developer, outside of situations where they are legally barred from doing so (e.g, for developers in countries subject to US economic sanctions, who would probably be unable to obtain a software signing certificate either).

<comment><USER65> >> On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software.

You are wrong. As described in the OP if you buy EV certificate($70) [0] you are all set.

>> I'm not aware of any situations where Apple has declined to offer a developer certificate

I can see that. Still there are such cases. Monopoly on the approval process is bad anyway. Even if acting in good faith, mistakes happen.

[0] [https://www.ssl2buy.com/comodo-positivessl- ev.php](https://www.ssl2buy.com/comodo-positivessl-ev.php)

<comment><USER50> That's an SSL certificate. Anyone who pays for that is dumb. Anyone that tries to use it for code signing is dumber.

<comment><USER65> Sorry for the wrong link. Below is the correct one to an EV Code Signing Certificate offer. For the dumb people who can't find a better price it's just $300. Enjoy!

[https://comodosslstore.com/code-signing/comodo-ev-code- signi...](https://comodosslstore.com/code-signing/comodo-ev-code-signing- certificate)

</comment></comment></comment></comment></comment><comment><USER67> How long will it be before Google, Apple, and Microsoft start pulling certificates for apps governments deem unacceptable, such as organizing protests or communicating?

</comment><comment><USER68> It's wrong to call it "malware". They should say it's unknown and you shouldn't install it unless you're certain about the creator.

</comment><comment><USER69> Welcome to the world of macOS! Both MS and Apple went insane with their creepy security imposed on "unknown" developers. Use Linux I guess...

</comment><comment><USER70> Are there any zero-cost options for code signing open source Windows apps that are free to use and will never generate revenue of any kind?

</comment><comment><USER71> Sandboxing would help a lot.

Is it this hard to publish on the Microsoft Store? Is this a play to make the Store more relevant?

</comment><comment><USER72> Apple was doing the same thing.

<comment><USER73> While there are some similarities, the key difference is that Apple doesn't impose a "reputation requirement." Signed apps and installers work the same no matter how many other users have run them.

</comment></comment><comment><USER74> It's like the JRE all over again

</comment><comment><USER75> This is clearly a warning, among others, that the bad Microsoft is back.

Using certificates and app signing is OK as long as it is done properly, with as much clarity as possible, and an inexpensive way to get our apps signed.

<comment><USER76> Back, how? I don't disagree with the gist of this article, but that SmartScreen window has looked like that for many, many years. It's not new, nothing is back. Microsoft was never fantastic.

The only thing that's new about this article is the bit about WinGet, which is so beta that it's hard to assume that its "SmartScreen means malware" behavior will remain like that.

I do agree with it btw, it's just like how Gmail's spam filters make it super hard to self host email. This is monopolistic behavior under the guise of protecting users, plain and simple.

<comment><USER77> > but that SmartScreen window has looked like that for many, many years

It changed a year or two ago. The "Run Anyways" button used to be on the main dialog. Now the user has to click the "More Info" button to see that option.

<comment><USER19> That particular dialog has been the same since Windows 10's launch, though it is "adaptive" in that _as_ the reputation slowly builds it will show the Run Anyways button at something like "medium reputation".

<comment><USER77> Ahh, that explains it. I had a screenshot of the SmartScreen dialog on my download page. After releasing a new version last fall, I noticed the dialog changed to the hidden Run Anyways option. My error, apparently, was including the major version number in the setup file name. When that rolled, the reputation reset.

</comment></comment></comment></comment></comment><comment><USER78> I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings from Windows apps, can afford $100/year for a code signing certificate.

There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to provide more signal to the systems trying to identify and block crapware.

<comment><USER79> But why even require payment for these certificates, since Microsoft according to the article doesn't actually place any value on the certificate itself. You still have to build up reputation separately. In that case, it seems entirely unnecessary to require a paid certificate.

<comment><USER78> Because it costs money to do the identify verification? Its not like a DV certificate where the volume is very high, and the verification isn't hard to automate.

I paid $400/yr for my employers first Authenticode certificate back when they were a new thing and you could only get them from Verisign. Now there's a handful of providers and competition has brought the price down, but the volume is lower than DV certs, and verification is harder, so the prices won't go down to zero.

Why do identity verification at all, you could ask? A reasonable question; if all I need to start earning reputation is a private key, the costs could go to zero. But letting the scammers make as many identities as they like at no cost changes the prior on a previously unseen identity. It seems MS isn't granting a very strong prior anyway though, so... my argument certainly is weak here.</comment></comment></comment>


First 6 years of a life of Clojure project – Jarppe Länsiö - <AUTHOR> https://www.youtube.com/watch?v=WtdegIqQbrg <comment><AUTHOR> This is one of the most entertaining programming talks that I have ever watched! Good technical content, too.</comment>


Shared Yamamoto surname stirs opposition to naming school to honor WW2 Internee - <AUTHOR> https://www.mercurynews.com/2018/03/19/palo-alto-renaming-of-schools-stirs-controversy/ <comment><AUTHOR> TL;DR: "Others acknowledged Fred Yamamoto, a 1936 Palo Alto High School graduate held in a Japanese internment camp during World War II who later joined the U.S. Army, is an inspirational figure, but said a school named after him _would just cause confusion_ among Asian-Americans (just because he has the same surname as the _unrelated_ WW2 Japanese Admiral Isoroku Yamamato)... One parent said giving a school the Yamamoto surname is akin to naming a school with Jewish students after Adolf Hitler..."

Web title: "Palo Alto: Pearl Harbor memories stir parents to oppose school name change", but the Pearl Harbor reference is falsified clickbait; the objections have _nothing to do with Pearl Harbor_ but instead stem from with I. Yamamoto's actions _in the far East_.</comment>


A Git Origin Story – Linux Journal - <AUTHOR> https://www.linuxjournal.com/content/git-origin-story <comment><USER2> That's interesting. Somehow I never heard the background story before, or maybe only small snippets of the given. Linus has got to be the GOAT developer...rocking the software world to its core like none other, not once but twice. Unreal.</comment>


Facebook shuts down applications for using Adsense - <AUTHOR> http://forum.developers.facebook.net/viewtopic.php?pid=328947#p328947 To summarize the story so far:
Back in the days, there were some small ad networks that used to run some very manipulative ads, or even popup ads on facebook applications. Since then facebook has imposed restrictions on what kind of ads are allowed. In the latest iteration, they imposed a huge list of draconian terms http://developers.facebook.com/ad_provider_terms/ . The terms seem to be designed so that no large ad provider (who is serious about its customers) can agree. Seemingly, developers will not be able to make their own advertising deals unless facebook agrees to approve it.
Google adsense was so far one of the best options for developers: they provide the safest kind of ads and their payout is much higher than the approved advertisers. Repeated attempts to get google or facebook to comment on the matter are left unanswered. Until now, developers were in limbo, as facebook vaguely suggested they are still in talks with google. Now it seems the decision has been finalized. This is basically an "FU" from facebook to its developers, depriving them of their best monetization options without providing an alternative (i.e. facebook ads revenue share). <comment><AUTHOR> To summarize the story so far:

Back in the days, there were some small ad networks that used to run some very manipulative ads, or even popup ads on facebook applications. Since then facebook has imposed restrictions on what kind of ads are allowed. In the latest iteration, they imposed a huge list of draconian terms <http://developers.facebook.com/ad_provider_terms/> . The terms seem to be designed so that no large ad provider (who is serious about its customers) can agree. Seemingly, developers will not be able to make their own advertising deals unless facebook agrees to approve it.

Google adsense was so far one of the best options for developers: they provide the safest kind of ads and their payout is much higher than the approved advertisers. Repeated attempts to get google or facebook to comment on the matter are left unanswered. Until now, developers were in limbo, as facebook vaguely suggested they are still in talks with google. Now it seems the decision has been finalized. This is basically an "FU" from facebook to its developers, depriving them of their best monetization options without providing an alternative (i.e. facebook ads revenue share).</comment>


Lessons from Gurgaon, India's private city (2014) [pdf] - <AUTHOR> https://mason.gmu.edu/~atabarro/Lessons%20from%20Gurgaon.pdf <comment><USER2> Abstract from the author's Publications page:

>In just thirty years, Gurgaon has grown from a tiny hamlet to a city of nearly two million people and it has done so based almost entirely on the private provision of public goods, including transportation, utilities, and security. In some rankings, Gurgaon is the best city in India in which to live and work (Behl 2009). Gurgaon, however, lacks important infrastructure, especially in areas such as sewage and electricity where the optimal scale exceeds that of most builders. Thus, for large-scale infrastructure, important externalities are not internalized. We examine where Gurgaon has succeeded, where it has failed, and how people are adapting to both the successes and the failures. We compare Gurgaon with other private cities built on a different model, including Jamshedpur in India and Walt Disney World in the United States. The developing world, including India, is urbanizing rapidly. We draw lessons from Gurgaon to suggest how new private cities could be built on an even-greater scale, thus internalizing externalities while still keeping the advantages of private provision.

[0]: [https://mason.gmu.edu/~atabarro/TabarrokPublishedPapers.html](https://mason.gmu.edu/~atabarro/TabarrokPublishedPapers.html)

<comment><USER3> > Gurgaon, however, lacks important infrastructure, especially in areas such > as sewage and electricity where the optimal scale exceeds that of most > builders.

I'm not sure I see how this explanation makes sense. How can a bunch of bumbling elected city councils manage to construct adequate water and sewer works, and private builders who actually know what they are doing cannot.

<comment><USER4> It's like roads. Private builders enter into agreements all the time to enter into deals with local governments where they'll expand roads or whatever right around where they're developing. If you get lucky you'll have a contiguous string of adjacent developers and you'll end up with a nice road for a few miles. If you're unlucky, you'll end up with 4 lane divided road-farm road-4 lane divided road-farm road, off and on for miles and miles and it's pretty much the worst.

Private developers don't have incentive to build a national highway system, they'll just build whatever is the minimum necessary that figures into their profit model.

<comment><USER5> Private developers will build whatever people want, which sometimes is completely unlike what people need. Sometime back, there was a recently built over-55 community discussed here. It looked just like your generic subdivision. One wonders how much misery will be there 20 years from now. Wide roads without sidewalks are not good for people with low mobility and vision problems, and there is no adequate hospital and nursing services around, not even a food store within close distance. The future in that development will be fun to watch.

<comment><USER4> > Private developers will build whatever people want

I think maybe a better way to think of it is that developers will build whatever makes them money -- a good enough proxy for wants in many cases, but not for all.

</comment></comment></comment></comment></comment><comment><USER6> I have friends that live and work there and they swear they wouldn't if they had an option. Gurgaon and NOIDA on the opposite end of Delhi grew because real estate prices were skyrocketing in Delhi. Multinational companies outsourcing to captive centers in India wanted cheap office space and therefore setup in Gurgaon. Outside of the glass and steel towers are potholed roads that never get fixed. It takes >1 hr to get to from Delhi even though it is just 15 miles because of bad traffic controls. There is no assured water or electricity. I hope people don't take lessons from Gurgaon. Older cities like Mumbai, Chandigarh and New Delhi are still better.

</comment><comment><USER7> I've spent time in Gurgaon, and I hypothesize that some of the perceived successes of the city were more about marketing and social positioning than anything else.

It is "the place to be" for the simple reason that other young, wealthy up and comers are seen there too. This is a much more powerful drawcard in certain circles than whether there are proper municipal facilities or not.

similar things have been achieved across India, EG Mumbai's Bandra-Kurla complex. Property developers well understand their target market's desire to appear a certain way and leverage this knowledge extremely well.

</comment><comment><USER8> I do not agree, this the worst place to live in haryana, "corporations putting up glass buildings" is not a good metric to measure progress.

I think rural haryana is a better than gurgaon even without 24 hr electricity, there you can at least breathe.</comment>


The Best Places to Lose Your Job - <AUTHOR> http://www.foreignpolicy.com/story/cms.php?story_id=4758 <comment><USER2> I think the best place to lose your job is the US. The economy is dynamic, people are raised with tales of startups and success, folks don't feel bound by class or caste or good taste in not rocking the boat, there's not too much credentialism, taxes are high (but not as high as elsewhere).

If you're forward thinking and interested in creating value, the best place on earth to be unemployed is the place where it's easiest to launch a new firm and have a chance of winning really really big.

<comment><USER3> I think the deeper question here is how eager are the recently-unemployed to find another job and what is the key motivating factor to get another job? I think it's highly related to how people in different countries view the world of work.

I can't speak for other countries, but in the US, I think that most people view work as a necessary evil. They don't view their jobs as opportunities to make a self-satisfying difference. It's just a place to trade 40 hours (or more) a week for a paycheck.

Most American workers feel overworked and constantly exhausted. When they lose their jobs, depending on their financial situation, they don't rush to find the next one. This is most likely because they use their period of unemployment as a substitute for the rest they didn't get while working.

Perhaps if we improved the world of work, the world of unemployment would also improve.

</comment></comment><comment><USER4> Sort of tangentially related to this is a rather fascinating look at Holland from the vantage point of a US ex-pat: [http://www.nytimes.com/2009/05/03/magazine/03european-t.html...](http://www.nytimes.com/2009/05/03/magazine/03european-t.html?_r=1&em)

Lots of interesting notes on our contrasting social systems and cultures. One of the main points that I took away from the article is that we tend to have an falsely dichotomous view of european countries generally. They're either lampooned as socialist nightmares where all of your money is confiscated by the government and nobody wants to work, or utopias where the government cares for all of your needs and you get 6 weeks vacation. the truth is rather more complex.

</comment><comment><USER5> And they have more vacations :(

<comment><USER6> I have 4 weeks vacation and I live in the US.

It is possible when living in the states.

</comment></comment><comment><USER6> I am not a fan of socialism. If you want it, go out and get it. Don't live off other peoples hard work and thats just what people in these countries do.

Yes, people need support, but don't sit at home every day playing video games at your parents house. I would expect everyone who is unemployed to fill out at least 5 applications a day for jobs.

<comment><USER7> Switzerland:

"Despite the generosity of its benefits, the country maintains a low rate of unemployed and underemployed workers."

vs. France:

"Unfortunately, because the French workforce is so cushy, it can be a very tough club to join. France has astronomically high rates of unemployment among youths -- up to 40 percent in some areas -- who've never held jobs and therefore do not qualify for benefits."

and Luxembourg:

"The government of Luxembourg, however, has recently grown fed up with wastrel youths applying for unemployment benefits while still living with their parents."

So, is this just a cultural difference, or can a government provide generous benefits while still incentivizing full employment? The Luxembourg solution:

"Anyone applying for social benefits now has to take minimum-wage government jobs or attend subsidized vocational training instead."

seems to make sense. Economic support, but with a requirement to work or get training of some sort. One trick is for the government to successfully predict which vocations will actually be in demand. Or just let the unemployed decide what to train in, with a flat cash amount to spend? You would still need checks to prevent abuse.

Of course the big Hacker News question: is any or all of this compatible with entrepreneurship? Should a government allow people to start a business venture while collecting benefits, instead of accepting the first employment opportunity?

<comment><USER8> Basic income (<http://en.wikipedia.org/wiki/Basic_income>) may be compatible with entrepreneurship.

<comment><USER7> Interesting to see Milton Friedman cited as an advocate of Basic Income. I think he championed the Earned Income Tax Credit, maybe they are referring to that?

<comment><USER8> As far as I know Earned Income Tax Credit is one possible implementation of Basic Income.</comment></comment></comment></comment></comment>


How to properly use Creative Commons images on your projects - <AUTHOR> http://gozesty.com/blog/guides/how-to-find-and-use-free-images-for-your-websites-and-projects/

<comment><USER2> CC continues to confuse me with so many options. I'd like to use a CC (non-CC0 or public domain) licensed photo as part of my blog template header. Do I really need to put the attribution and link in my template, because that will make my web site look ridiculous.. Any ideas?

<comment><USER3> Never forget that you can try to contact the creator of the image if you are unclear about such things! If you don't want to have the attribuition in your blog header, shoot them a message and ask if they'd be ok with you putting that in your "About" page or at the bottom of you sidebar or some other such place.

Also, be careful not to remove any license-pertaining metadata from the image.

<comment><AUTHOR> People I have contacted (unless they are a professional photographer) have been excited that I wanted to use their photo or sound clips. Makes their day, makes my day :)

</comment></comment></comment><comment><USER4> Use wordpress? Just install the photodropper plugin.

I'm not associated with the project, I just discovered it last week and it does exactly what I need.

</comment><comment><USER5> The funny thing is by default Flickr sets all your photos to 'copyright'... and upon realizing this I set out to make all my photos completely copyright free (not even attribution)... but then it turns out you can't even do that. At a minimum you have to have attribution. I'm just happy when people use my photos; I feel bad they have to deal with all this license stuff.

</comment><comment><USER6> How can I get that transparent inside-the-image attribution that is shown on the first photo in the post?

<comment><USER7> Inspect the code on that post. :)

Uglier but fully self-contained example [http://gondwanaland.com/mlog/2012/01/08/css-text-overlay- att...](http://gondwanaland.com/mlog/2012/01/08/css-text-overlay-attribution/)</comment></comment>


Structure and Interpretation of Computer Programs (1996) [pdf] - <AUTHOR> https://opendocs.github.io/sicp/sicp.pdf <comment><USER2> I took a one-week SICP course with 5 or 6 other professional programmers last year. It was amazing. I wrote about my personal motivation for doing so here:

[https://amontalenti.com/2018/08/26/sicp- expanding](https://amontalenti.com/2018/08/26/sicp-expanding)

As for an update: SICP was as good as I expected and definitely makes a professional programmer regain some love for the art and magic of computer science. (However, the book is a hard read without a guide. But it's really fun if you alternate between coding and reading, by using a local Racket & DrRacket install.)

One can find recorded courses from MIT with the SICP authors on YouTube, so that may be one way to do this from home.

Hal Abelson was recently interviewed about the lasting influence of the book in this podcast. It's a good conversation:

[https://pca.st/wmrdiyvq](https://pca.st/wmrdiyvq)

<comment><USER3> Does it make sense to use Clojure while reading the book?

<comment><USER4> I think it makes sense to use whatever language you want, and the ideas in the book don't only apply to Scheme.

I've been working through the book in Javascript - [https://github.com/ahuth/sicp/](https://github.com/ahuth/sicp/). Maybe I'm losing something by doing it in JS instead of Scheme, but I'm still learning a lot and having a ton of fun.

Wrote a little bit about SICP here: [https://ahuth.github.io/articles/the- first-time-sicp-blew-my...](https://ahuth.github.io/articles/the-first-time- sicp-blew-my-mind).

<comment><USER5> I think if a language has decent lambdas - JavaScript qualifies - it'll work for SICP. That said, using Scheme for it will give you a much better appreciation of an underrated language.

</comment></comment></comment></comment><comment><USER6> SICP shows up every few months on HN, and I upvote enthusiastically every single time!

I am a self-taught programmer, and survived a long time on C/C++/Java etc. I was smugly confident in my confined space.

Then I came across SICP. I discovered a world of closures, streams, object- orientation done using closures, infinite series using streams, lazy evaluation, functional programming, and so much more. It was such a sharp pivot that I registered for a PhD because I just had to know what else I took for granted. I was 42 when I registered (graduated at 48)!

<comment><USER7> Wow that is a fantastic story! Kudos for completing your PhD!

Would you mind expanding a bit more about your PhD? Which school did you go to? Did you find that your age made it more difficult to get in/stay in once accepted? How did you handle family commitments (if you had them)?

Reason I ask is because I've been considering going back to school to get a PhD.

Again, that is quite an achievement, so congrats!

<comment><USER6> Thank you much. Sorry for the wall of text, but you got me going!

I had been living and working in California, and found myself at the crest of the dot-com wave of the late 90's and early '00s. But post-SICP, I _had_ to dig deeper.

I didn't feel prepared for the schools I wanted to apply to: Berkeley & Stanford. I am totally self-taught, and not having taken an exam in any CS subjects, the subject GRE was a huge mental barrier. So I applied to the Univ. of Cambridge in the UK.

That was a miscalculation. I was expecting to sit through a number of courses before figuring out what I wanted -- the US model -- but no, I was thrown into the deep-end right away, as an independent researcher. In my earlier life, I'd prided myself in knowing a whole lot of stuff just by building things in my own time (a TCP-IP stack from scratch, a Java compiler etc). But at Cambridge, I was told the "Dragon Book" (Compilers, by Aho, Ullman and Sethi) was so 1970's! I can't tell you how inadequate and how unprepared I felt.

In just the areas I was interested in (PL, concurrency, distributed systems), I was surrounded by researchers (at the cs dept and the microsoft research lab in the adjoining building) who _defined_ world-class. Robin Milner working on Distributed Pi Calculus, Tony Hoare on separation logic, Simon Peyton Jones on Haskell and type systems, Alan Mycroft, Jon Crowcroft advising the creation of the Raspberry Pi, Ian Pratt and Steven Hand on the Xen hypervisor, Peter Sewell on a rigorous (machine-checked) definition of systems and protocols.

But me, I didn't understand any of it, at least in the first year! I had never read a non-systems paper in my life; I didn't know the meaning of academic rigor. Those four years were the hardest of my life. Age was a factor. There was a distinct difference in stamina. Later I discovered that it was more fear that stymied my progress. I used to love math in my younger days, but I realized that lately, I was putting the more formal books back on the shelf "to get back to later". In contrast, Younger kids (and particularly the ultra- bright ones who land up at Cambridge) had no such fear at all because their formative math education had been top-notch.

On the other hand, my age served me well elsewhere. I had money, I was happily married (and still am, thank you!), so half my brain wasn't stuck on relationship issues. I didn't have to impress my peers with my ability to drink. I could travel freely to conferences on my own dime. I could quit any time (or so I told myself; I'd probably have regretted it if I had quit). It helped that we didn't have kids and that my wife was immensely supportive. There was another "mature" student also with the same background and outlook as me who'd sold his company for a few tens of millions (he was on the original Pentium design team!) and come in search of knowledge. He had two kids. He had a tougher time than I did not because of his family, because of the choice of his subject (quantum computing). But ultimately, he too has done well from himself.

Any how, I knew all along I would be very glad when the program ended, on two different axes. First, that the hard period was behind me. Second, that all this learning would fundamentally change me. I'm happy to say it did. I'm happy to report that I fared well -- my dissertation was nominated for a British Computer Society dissertation award. Privately, I felt I was trained just well enough to _start_ a PhD program. That imposter syndrome never left me! I have met many many PhDs who have felt that. I wish someone had counseled me on it.

I'll leave you with this. The amount I learnt makes my toes curl with pleasure. Then there's the meta-learning. When you spend so much time reading papers and rigorous arguments, you begin to have confidence in reading a paper completely beyond your ken, and getting to its essence. That's the real value.

<comment><USER7> Thank you so much for the detailed answer! Such an inspiring story and told with such humbleness. You are inspiring.

Your note on "fear" holding you back rings a bell. As I have aged (and I have not aged that much!) I have noticed the same. And I feel like it gets worse every year. I haven't found a better solution than just jumping in outside my comfort zones, but alas, this is so hard that I find myself barely doing it.

But people like you remind me that it can be done! And this is very important because knowing that someone else did it cancels some portion of that internal discourse of "You can't do it.".

Thanks again.

<comment><USER6> Very kind of you to say this. Happy to hear that my 99% perspiration is your 1% inspiration :)

</comment></comment></comment></comment></comment><comment><USER8> The contents of the book are wonderful, but I can't stop admiring the TeX typesetting itself. It's startling how effortless it is to read this document compared to 99% of Web-based reading I do every day. The things that stand out to me most are the lack of vertical whitespace "rivers" due to the smart kerning & tracking, the small-caps for technical initialisms like 'HTML', and the beautiful beautiful Garamond of the body text. I should use LaTeX more :)

<comment><USER9> TeX isn't so bad when you use a typeface other than the eyeball-scarring, madness-inducing Computer Modern.

<comment><USER10> Computer Modern looks decent in print, which it was designed for (pick up any book by Knuth, _not_ a modern book typeset with LaTeX). It looks less good on screen, partly because on-screen output barely existed at the time it was designed, and partly because what you've seen is probably not really Computer Modern: [https://tex.stackexchange.com/a/361722/48](https://tex.stackexchange.com/a/361722/48)

<comment><USER11> A similar story happened to Courier, which, afaik, was digitized from the designs meant for printing and thus accounting for print ink gain. On its own the the font's forms look too thin too.

</comment></comment></comment></comment><comment><USER12> The authors also make the book available at MIT press, but not as PDF. Thanks!

[https://mitpress.mit.edu/sites/default/files/sicp/index.html](https://mitpress.mit.edu/sites/default/files/sicp/index.html)

[https://mitpress.mit.edu/sites/default/files/sicp/full- text/...](https://mitpress.mit.edu/sites/default/files/sicp/full- text/book/book.html)

Other versions, again not as PDF:

[https://news.ycombinator.com/item?id=13918465](https://news.ycombinator.com/item?id=13918465)

[https://news.ycombinator.com/item?id=19049834](https://news.ycombinator.com/item?id=19049834)

[https://news.ycombinator.com/item?id=3034587](https://news.ycombinator.com/item?id=3034587)

[https://news.ycombinator.com/item?id=10178544](https://news.ycombinator.com/item?id=10178544)

<comment><USER13> Thanks for the links.

> > [https://news.ycombinator.com/item?id=3034587](https://news.ycombinator.com/item?id=3034587)

This one is a link to a .mobi/Kindle version, for anyone searching.

</comment></comment><comment><USER14> The original course videos are on youtube too! I found them a bit easier to watch than reading the book:

[https://www.youtube.com/watch?v=-J_xL4IGhJA&list=PLE18841CAB...](https://www.youtube.com/watch?v=-J_xL4IGhJA&list=PLE18841CABEA24090)

<comment><USER15> I just started the first video. This guy is a phenomenal lecturer. Thank you for posting the link!

</comment></comment><comment><USER16> Anyone else feel like this book is really overrated? I've enjoyed the classical mechanics book by the same authors a lot more since it goes over a particularly good application where functional ideas shine

<comment><USER17> I do think it's a book of quality, which admittedly is a relatively rare category. But yes, I think it's _hugely_ overrated, especially when characterized as the "one true best way" or something, to learn programming.

(Note that I am commenting on the first half or so of the book, never having gotten past that. Maybe the last half of the book is the best book ever written, I do not know.)

For one thing, half of the examples are calculus. If you are an engineering graduate student with experience in fortran (which is the original intended audience, just watch the original lectures), that's a _great_ idea. For humans with little to no formal mathematical training, it's pretty poor. I once helped to lead a study group on SICP with half a dozen highly motivated junior-to-intermediate programmers, and everyone found the exercises insanely hard for this reason. (Of that group, btw, I would say one student greatly benefited, two dropped out, and the rest got some benefit.)

For second, I strongly disagree with the claim that functional is a "more natural" or "more intuitive" way to think about programming. I've helped teach hundreds of adult students to program (and become working developers), most of them with no prior experience, and I would say that less than 1% of them found recursion anything other than a crushing mindfuck. Whereas more than half of them took to imperative programming in a much shorter length of time (a few weeks, say). (None of these students were given SCIP, tho.)

Based on the perennial praise in threads like this, I concede that _must be_ those in the world for whom it's a great book, and that's great. I am firmly convinced that these people are atypical.

On the other hand, it _is_ a book that concerns itself with important questions, where IMO most books do not, so that alone makes it, as I said at the beginning, a member of a rare and distinguished category.

<comment><USER18> Not sure about the video lectures, but I'm fairly certain the original course was taught to MIT undergrads as an intro to CS and EE. See [https://people.eecs.berkeley.edu/~bh/sicp.html](https://people.eecs.berkeley.edu/~bh/sicp.html) and [https://mitpress.mit.edu/sites/default/files/sicp/course.htm...](https://mitpress.mit.edu/sites/default/files/sicp/course.html).

I don't totally disagree with you btw. Pretty sure in that interview with Hal Abelson someone mentioned above, he admitted the book leaned a little heavily on calculus because all MIT freshmen had to take that course, so it seemed a natural source for examples. Perhaps not as natural to someone who hasn't taken a calculus course in a decade (me). I still got a lot out of the book though.

<comment><USER19> > _but I 'm fairly certain the original course was taught to MIT undergrads as > an intro to CS and EE_

This is correct: The course number was 6.001 and was a requirement in EECS in those days. I took it while SICP was still only notes in 1983, and the notes ended up as a book shortly after.

<comment><USER20> Actually, the course number back then was 6.031. I only become 6.001 later on.

<comment><USER19> Must not have been clear in my post: It was 6.001 in 1983, when I took the class with Sussman and Abelson. The book was still not published, and they gave it to us as xeroxed notes.

</comment></comment></comment></comment></comment></comment><comment><USER21> I'm glad about SICP being promoted and accessible to people around the world.

Maybe 20 years ago, the authors put the full text for their textbook on the Web, as HTML. This made it more accessible to people, and set an early precedent for freely-available top textbooks on the Web (even though they presumably could've made more money by only selling print copies).

Then, since not all students' computers could run a Web browser, Lytha Ayth manually converted the HTML to Texinfo, with ASCII art of all the figures.

If one has the means to buy the printed book, doing so would seem like a nice gesture, in response to the authors' and publisher's generous sharing and example-setting.

</comment><comment><USER22> This book more than any other has made me the programmer I am. The hardest part about telling people about this books was how to find it. +1 to the guy with the short URL to this PDF.

<comment><USER23> I'm a relative late comer to programming and having read the first 3 chapters within a year or two of starting to program "in earnest", I echo your sentiments. I feel like it really taught me how to think like a programmer. I should really finish it.

</comment></comment><comment><USER24> Heavily inspired by SICP, I am co-teaching CS43 during Stanford Winter quarter.

Code: [https://github.com/stanfordhaskell/cs43](https://github.com/stanfordhaskell/cs43) Site: [https://stanford-lambda.gitlab.io](https://stanford-lambda.gitlab.io)

All of the course materials will be open-sourced @ [https://github.com/stanfordhaskell/cs43](https://github.com/stanfordhaskell/cs43) (previously Clojure, now Haskell!)

If anyone has concrete suggestions on how to improve our curricula, I would be happy to take any suggestions.

<comment><USER25> Where might I find the class materials from when you were using Clojure?

</comment></comment><comment><USER26> We read SICP back in college. I loved it but I remember a lot of moaning from my classmates. I wish I had more practical need for Lisp because I loved programming in it.

My favorite part of SICP is where a streaming lazy evaluated version of sin() is defined using cos() which is defined using sin().

</comment><comment><USER27> Pictures in the PDF are garbled. The Version built from [https://github.com/sarabander/sicp-pdf](https://github.com/sarabander/sicp- pdf) is much better.

<comment><AUTHOR> The PDF in this post is built from [https://github.com/sarabander/sicp- pdf](https://github.com/sarabander/sicp-pdf). See [https://opendocs.github.io/sicp/](https://opendocs.github.io/sicp/) for more details. If you have a direct link to a better rendering of this book, could you please share it? I would like to see which pages are rendered better in it.

</comment></comment><comment><USER28> The ebook on [https://github.com/sarabander/sicp- epub/](https://github.com/sarabander/sicp-epub/) seems to be inaccessible, trying to fetch it via git lfs gives "This repository is over its data quota. Purchase more data packs to restore access."

Does anybody know where I can/should host a copy?

<comment><USER29> > Does anybody know where I can/should host a copy?

With torrent or IPFS, perhaps? (Given the CC BY-SA license, this would be completely legal.)

Also, GitHub's behaviour wrt to LFS is really disappointing — the epub file could have been stored normally with git (its size of ~ 3 MB is far less than the hard limit of 100 MB), in which case there would have been no issues of exceeding a data quota...

For comparison, the linked PDF is normally indexed with git, despite weighing at 7.7 MB.

Since LFS is supposed to reduce total bandwidth use for the hoster, GitHub is, in effect, punishing people for reducing GitHub's bandwidth usage...

Actually, the linked PDF is originally[0] by the same author as the EPUB version you linked. However, in the original repository[0] the PDF is managed with LFS, so it's inaccessible...

[0] [https://github.com/sarabander/sicp- pdf](https://github.com/sarabander/sicp-pdf)

</comment></comment><comment><USER30> > You are probably reading it in an Info hypertext browser, such as the Info > mode of Emacs. You might alternatively be reading it TEX-formatted on your > screen or printer, though that would be silly.

I'm read a PDF :/

<comment><USER31> I guess that's talking about reading the TeX markup itself.

</comment></comment><comment><USER32> SICP = Structure and Interpretation of Computer Programs

</comment><comment><USER33> This book is both art and magic.

It is poetic in its treatment of introductory computer science.

</comment><comment><USER34> I first found out about this book from someone reposting on HN a few years ago, and decided to explore it because of discussion in the comments. It significantly influenced me as a developer, and I still point junior developers toward it as one of the main books they should read (and by read, I obviously mean go through excercises) about the craft. Thanks for reposting this again.

Please, do it every couple of months.

</comment><comment><USER35> The foreword of this book must be the only one I have ever read where I disagree with almost every statement it makes. This doesn't encourage you to carry on, but I have (first couple of chapters), and find the whole structure and direction of the thing inimical to me.

It seems to me that this is somewhat like the "dragon book" \- people were exposed to it before they had read other better books.

<comment><USER36> > The foreword of this book must be the only one I have ever read where I > disagree with almost every statement it makes.

I just went an reread the forward, and nothing struck me as controversial. Could you elaborate a bit?

</comment></comment><comment><USER37> Ohh... This was one of the books we used when I studied computer science. Great book and it brings back memories.

State is only introduced on page 294!!

</comment><comment><USER38> I read the book a while ago, It was quite an eye opener. The one thing I haven't been able to go through was the last chapter, building a "metacircular evaluator. I saved it for a time when I understood compilers/interpreters better.

Diving into codebases, like the octave and supercollider interpreters recently. might be quite interesting to re-read it.

<comment><USER39> My experience of the last chapter is: it's not as satisfying or as easy as the previous chapters where the solutions to exercises are self-contained. It's also less suited to doing outside of school, if you only have nights and weekends and must re-establish the context every time you sit down again with the book. However, it is still worthwhile, and definitely doesn't require any previous compiler/interpreter exposure (in fact, it might be an advantage to come in fresh, as a lot of what you do in chapter 5 is really easier than you might think if you have exposure to advanced compiler techniques).

</comment></comment><comment><USER40> Question: will you recommend SICP as an intro to programming book for say high schoolers?

Or, does it assume some prereqs?

<comment><USER41> [http://people.eecs.berkeley.edu/~bh/ss- toc2.html](http://people.eecs.berkeley.edu/~bh/ss-toc2.html)

Bills itself as an intro to SICP for high schoolers.

<comment><USER42> Amusingly, the author of that book (Brian Harvey) was my professor for my first CS class, in 1996, where we used this very edition of SCIP.

</comment></comment></comment><comment> r-s I went through SICP a few years after finishing my computer science degree and enjoyed it greatly. It was a great experience and I think made me quite a bit better developer. I also became a huge fan of lisp which I think is one of the side effects of this book.

</comment><comment><USER43> I would like to tackle SICP. I am a programming novice and would like to improve my skills.

The last time I did any kind of math that was more complex then simple operations was a long time ago and math was never my strong subject.

I have pretty much forgotten any kind of algebra, calculus etc I learnt. So assuming I know very little math, what is the best way/book/method to learn algebra/calculus etc to tackle SICP ? I would like to do that before I begin my SICP journey.

Any suggestions appreciated!!

<comment><USER44> [https://openstax.org/subjects/math](https://openstax.org/subjects/math) are pretty good.

Start with the Pre-Algebra book, then Algebra and Trigonometry, and then Calculus volumes, the first two volumes are more than enough for SICP.

This can take you two years depending on your time.

</comment></comment><comment><USER45> My favorite class in college, also the very first class in our Computer Science curriculum. I still use it.

<comment><USER46> When I took it at Boston University in 1987, it was my last class for the BS/CS. And one of the toughest because I had so much imperative/side-effect ridden code to unlearn.

Does the MIT Python replacement go "functional first"?

</comment></comment><comment><USER47> This is so great. I've been working from a terrible scanned copy for years.

<comment><USER48> The full text has been freely available online for years:

[https://mitpress.mit.edu/sites/default/files/sicp/full- text/...](https://mitpress.mit.edu/sites/default/files/sicp/full- text/book/book.html)

Also, the physical book is available for only $40.

<comment><USER49> Last I looked in Europe the price is more like $65, about the same as a Raspberry Pi 4 with 4GB of RAM.

I know technical books are expensive and the book has 688 pages but it seems expensive.

If somebody wants to ship their used SICP book in Romania I would love to take it. It's on my wish list since forever.

<comment><USER50> Check some second-hand online stores like abebooks (mostly ships from US so it's way too expensive) or from biblio which has more accessible shipping rates [1]

Salutari din Romania!

[https://www.biblio.com/search.php?author=&title=structure+an...](https://www.biblio.com/search.php?author=&title=structure+and+interpretation+of+computer+programs)

</comment></comment></comment></comment><comment><USER51> One of my favourite books, by some of my favourite authors.

</comment><comment><AUTHOR> Easy-to-remember short URL created with GitHub URL shortener: [https://git.io/sicp.pdf](https://git.io/sicp.pdf)</comment>