We Should Teach Media Literacy in Elementary School - <AUTHOR> https://blogs.scientificamerican.com/observations/we-should-teach-media-literacy-in-elementary-school/ <comment><USER3> _We Should Teach Media Literacy in Elementary School_

We learned it when I was in elementary school. Through endless drills, the nuns taught us how to separate fact from opinion, and to read between the lines and spot what are now called "weasel words."

While it's a noble goal, I'd say that the two classes that should be brought back are civics and geography.

Geography so we can start having adults who understand their role in the world, and civics so they know how it works and how to change it.

I think if people knew how things (politics and government) worked, more ordinary people would run for office and the halls of power wouldn't be the exclusive domain of the rich and their lawyers.

<comment><USER4> _While it 's a noble goal, I'd say that the two classes that should be brought back are civics and geography._

Did we really get rid of those two classes? I honestly don't know, and have no children to know what is being taught these days. I graduated high school in the early 2000's but to this day my favorite class was "Law and Government", so much of this had to do with my teacher's genuine enthusiasm for the subject matter. We did mock trials, a few of which I won as a fake public defender.

That class was wildly informative looking back, you really do have me wondering what the state of that sort of curriculum is like these days.

(random addendum but a few years back I ran into the gentleman who taught that class, at the voting booth-he was volunteering his time as a poll worker. Just as civic minded as I remembered him)

<comment><USER5> I was at a pretty typical city public school ~>15 years ago. Even then we didn't really have "civics" as it were. There were "world history" courses and things in that vein, mostly focused on europe and asia, with a gloss over the other countries. (laughably so, looking back). There was a large course in american history, but it was almost all rote, and had nothing to do with how I would phrase "civics" in terms of pragmatic participation and impact. Similar statements could be made re: learning about "the economy" in history and "home finances" (writing a check) in home-ec but nothing about pragmatic long term planning, college loans, any of that stuff.

I shouldn't sell it entirely short, if you took some more esoteric extracurriculars/AP courses you could get some exposure but it was still very academic and VERY niche.

To stop beating around the bush, speaking at least for my school (even around when you graduated) had very little to prepare someone to actually be an informed participant in society. This likely varies heavily by school however, but polling my wife as well, she echos an even more bleak story. (private Jewish school)

<comment><USER4> _I was at a pretty typical city public school ~ >15 years ago. Even then we didn't really have "civics" as it were._

Interesting contrasts we have here, eh? I went to a public HS in a hyper-rural area in the deep south. Law and Government I & II were classes required by juniors and then seniors respectively.

My expectation was that city schools would _definitely_ have these courses, it's interesting to learn in your case they didn't.

<comment><USER6> It's state-by-state, usually. The curriculum in GA and NV (both states I went to High School in) in the 90s required a US history course and a civics course. In NV it was "US Government", a senior course (typically). In GA it was, in my district, just "Civics" and was one semester, sharing the year with a baby Economics course (which was really more personal finance than economics).

School districts have some leeway to add additional courses, or to alter the typical order of them. For instance, that civics course in GA could've been a one year senior level course in a neighboring district. But the civics course was required across the state at the time.

</comment></comment></comment></comment></comment><comment><USER7> Despite having a great elementary and high school system, I learned critical thinking (at least in any obvious way) from exactly one class.

It was a Home Ec class in junior high. (7th grade had both Home Ec and Shop, 8th grade you picked one). We had just finished "how to order from a catalog" (because I'm old) and the teacher passed out magazines and we were to find an ad, then list 5 ways it was deceptive.

The first few were easy. Showing money, attractive people, fast cars, happiness...but then things got subtle.

Once we did, we shared with the class. I don't recall my ad. I DO recall the lesson that clicked for me. It was an ad for Bayer aspirin. "4 out of 5 doctors recommend", the ad said, something I had seen on countless commercials. "Who picks the doctors?" asked the student.

Blam. Mind Blown. I had never considered that particular aspect. This opened up that "clinical studies prove..." doesn't mean anything. Awards, certifications...the idea that I could be told words that were technically true but misleading went from something that could be told to me and that I could recite back to something REAL, that I applied on my own.

I don't know that you can teach critical thinking, but I know that you can push opportunities for it to 'click'. This was one day of one class out of thousands of days of schooling. I learned lots of lessons in school, both factual and personal, and while there were likely many other more subtle lessons about critical thinking, this was a real moment of change for me, and it feels like it could have so easily slipped by.

We should absolutely push students to be ready to accept evidence while also questioning what is presented. Repeatedly. over and over again, because you never know how many times it will take to suddenly start working.

<comment><USER8> It wasn't that long ago I realised that the company "voted best SME" or whatever just bought that award in many cases, sometimes they created the "Society for Careful Scrutiny" (!) that gave the award.

Want a certificate from an official body? If you've got money create the official body in order to get the award. People seldom look past the austere logo anyway.

</comment></comment><comment><USER9> Is there any evidence this will be effective?

Critical thinking, analytical thinking and systems thinking are things that should be taught throughout school, in all classes. Those are general skills. But what exactly is media literacy?

 _article > More worrisome, contrary to the perception that the fake news epidemic is a conception of malicious online news-bots, there is evidence that suggests the public actually craves fake news._

Well, exactly. There are some people who have trouble figuring out what's true. But in a lot of cases false information spreads simply because people _want to believe in it_. This is less about critical thinking and more about underlying psychology and sociology.

<comment><USER10> I doubt it will achieve much. Actual, professional journalists don't seem to be able to refrain from spreading bogus viral claims on social media so long as it fits their biases. It's surprisingly hit and miss as to whether they even manage to catch the ones which are outright disproved by the very source being linked to.

</comment></comment><comment><USER11> I remember one of my teachers senior year of high school showed us a bit for Bowling from Columbine, and then demonstrated how clips from completely different NRA events had been cut between to make it sound like something was said right after Columbine which, had, in fact, been said at an entirely different time in an entirely different place. There's a few articles online about the other tricks Moore used in the documentary.

But yeah, I'd say the one time in school I was educated on how biased media can be misleading was as a senior in high school, and I definitely think it should be earlier than that.

<comment><USER12> Sadly, Michael Moore isn't the only one using this technique.

</comment></comment><comment> compiler-guy Any proposal like this should include, "And we should cut topic X to make room for it."

Media literacy is absolutely a good thing to have, but schools don't have unlimited time to teach every subject

Granted, some topics can be integrated into others, but piling things on is not a sustainable thing to do.

<comment><USER13> And we should cut cursive handwriting to make room for it. No need to prepare kids for the 20th century when you can already sign documents with emoji.

<comment><USER14> They cut cursive handwriting a long time ago.

<comment><USER15> Maybe in your area, but definitely not universally in America.

</comment></comment></comment></comment><comment><USER16> I had this when I was in public elementary school between 2000-2005. It was part of the library classes, and we were also taught information retrieval on Google and some of the Google competitors at the time. Everything from how to find sources and evaluate if they were trustworthy. It was obviously simplified, but it's one of those things that I think really stuck with me.

</comment><comment><USER17> Maybe what should be taught is "don't trust anything you read". That goes for everything from textbooks to newspapers. Instead children are often taught to memorize and obey, which leads to issues when you have to tell your child that the teacher was wrong, and that a teaching certificate doesn't make you magically all-knowing.

<comment><USER18> Which is kind of what I was thinking. As soon as you start teaching kids not to be swayed by "agenda-driven sources," what happens when they start realizing that their _textbooks_ and their _teachers_ are also "agenda-driven sources"?

Which is why this proposal will never fly.

<comment><USER19> Lots of kids realize the limitations of their teachers' intellects at some point. Once you realize how dumb your teacher is, it's a short step to realizing how dishonest she is. As long as smart kids can still be civil in class, it isn't usually a problem. They just make their peace with the fact that while their fellows learn in school, they have to find somewhere else to do that. After all, a judicious combination of wikipedia and reddit is bound to be more enlightening than a public school class.

</comment></comment></comment><comment><USER20> I've been thinking about literacies a while ago and recently put together a proposal for a talk on just this (mostly with regards to 'fake news'):

In order for students to know who and what to trust and not trust on the internet, and develop the ability to spot fake news for themselves, it is crucial that we don't just provide them with the conventional toolkit and heuristics for spotting misleading information like paying close attention to authorship, peer-review, and something's scholarly nature, but instead grow their technical literacy to encompass a functional understanding of how content flagging, search ranking, and content recommendation work in order to h ave a more general and transferable understanding of why fake news can, in fact, be seen as real news to some.

</comment><comment><USER21> I had critical thinking and current events classes all throughout elementary school.

Was a private school but never thought about its utility or the idea that may have been an exceptional part of the curriculum till this very moment.

</comment><comment><USER22> Some schools do as part of the library/media time. Librarians rule!

</comment><comment><USER23> I'd go a step further and suggest that a curriculum like this should also teach responsible handling of digital content overall, use of technical devices, privacy, and some related topics, a sort of maker space in the classroom if you will.

Mobile devices seem to become the norm for young children on how to interact with software and hardware, and the locked down and consumer-oriented design leaves very little room for tinkering.

</comment><comment><USER24> When I was in high school (which wasn't that long ago), I had a dedicated class on critical thinking, and a unit on critical thinking in another. It has helped me very much in my adult life in spotting bias and emotional manipulation in the media.

It's unfortunate that I'm unable to find a source that doesn't manipulate language to achieve a desired emotional state in their readers.

</comment><comment><USER25> I think things are going fine as it is. The more ridiculous question the media becomes the more discredited it gets and less people pay attention. Media is inherently flawed since it seeks to monetize views. Newspapers, while still relied on readership had less invasive ways of monetization. If you ask me, the current cycle of distrust in media is well deserved. When you have all but a few people controlling the worlds attention, we need to be highly skeptical of anything we come across. Real news can be found on actual news source sites, we don't need political angles, spun opinions or clickbait titles to get actual news. Things have a tendency to resolve themselves so let's not shove it down our kids throats at an early age. If we need something useful to teach them how about we start with personal finance- you know, things that actually matter to your life.

</comment><comment><USER26> Such a course should include memetics and cognitive biases. I have long been pondering what a memetics course for elementary students should look like. I want to inoculate children against marketing, advertising, religion. I don't think that would be politically viable in a lot of places in the world.

<comment><USER27> Exactly. It's a good idea, but there are way too many opportunities for its implementation to be heavily skewed towards some bias or belief. If you believe something is true because it is in some religious text, it'll be very hard for you to teach children to question any news which appears to condradict it, even if that news is factually (and technically) correct.

<comment><USER26> I was thinking that, for religion, the most politically acceptable path is to teach as many religions as practical to children. If they know the details of many religions at an early age, they might be inoculated against one of them being presented as the truth.

<comment><USER28> You're describing using the government in a capacity to directly undermine the religious teaching authority of a child's parents. That's probably not legal if that's actually the stated goal of your plan, and it's not going to sit well with parents.

<comment><USER26> Certainly it would be legal, that the First Amendment is incompatible with the First Commandment is not legally challenged. Lots of schools teach about the world's religions in some way. One cannot understand world politics without describing religion.

I'm not saying such a course would be politically viable, nor am I interested in interfering with the indoctrination by those parents already infected. I am exploring ways to protect those who have a choice.

</comment></comment></comment></comment></comment><comment><USER29> I had to teach nurses media literacy in grad school (I was a TA for a class called Nursing Informatics, essentially a course about evidence-based practice, using EMR and information systems, etc. The instructional part of the course was entirely online, and I had to administer labs in person and do all of the grading and feedback, so I was their primary point of contact while they never even met the actual professor). One of their labs was to pick a site from a predetermined list, and evaluate whether or not the information presented was reputable. The results were quite disheartening, particularly because many of these people were adults that were re-training for new careers.

</comment><comment><USER30> I took a course in advertising which was invaluable. Recognizing different sort of marketing appeals and strategies, etc... I've been trying to teach that to my kids too.

</comment><comment><USER31> My favorite course from college was called "Reason, Language, and Argumentation". The teacher was amazing, and the content & class discussions were vibrant. The central theme was learning about various logical fallacies and then watching the news, reading articles, etc, spotting the fallacies, discussing it together as a class, and so on. I could see this general structure working at the elementary school level.

</comment><comment><USER32> Media literacy, or more broadly critical thinking skills, is good to teach but hard to apply in practice when it comes to the news. This is because we get our news so fast, and in so many places, it's hard to slow down and evaluate pieces in-depth.

Pardon the self-serving comment but given the relevance, I hope it's useful.

My startup has built tools to simplify the evaluation so people can focus on harder questions like "why did the media construct the message this way". Here's a blog post we published today on why this is important.

[https://blog.civikowl.com/making-it-easy-to-apply-media- lite...](https://blog.civikowl.com/making-it-easy-to-apply-media-literacy- guidelines-every-day-a5a92653b6f9)

</comment><comment><USER33> How much are we going to teach kids in the future?

Every elementary kid should learn: programming, philosophy, Quantum physics, Media Literacy, Civics, etc;

If we teach it to adults, the kids can learn it at home.

</comment><comment><USER34> Pushing this onto the entire populace is a cowardly way to govern. What ought to be done is simple, even if how it ought to be done isn't: _ban_ fake news.

We don't expect people to discern what foods and drugs are dangerous, so neither should we expect people to have to discern what is true or not. If it's untrue, someone should be able to bring a libel case.

<comment><USER35> People can bring libel cases in the case that it's actually libel. Apart from that, America doesn't protect the ability to give out poison in the Constitution, it protects free speech.

<comment><USER34> As I understand it, libel (and slander) only apply when someone's reputation was damaged. I'm saying it could be made a crime to mass-broadcast false information.

</comment></comment></comment><comment><USER36> We used to do it in the UK. Certain newspapers campaigned to have it removed from the curriculum.

<comment><USER37> > We used to do it in the UK. Certain newspapers campaigned to have it removed > from the curriculum.

When was that?

</comment></comment><comment><USER38> Media Literacy can be discussed and taught in current education structure, but performance goals for teachers and schools have moved the focus from critically thinking about a topic to getting enough students to remember one correct answer. In elementary school, we learn that you should only speak if you have the right answer and that being wrong is shameful. If the goal is to get people to understand the five pilers of Media Literacy (access, analyze, evaluate, create and act) we have to start by saying right and wrong are not the only fields upon which you can play. My ideas about watching tennis are different than your ideas but because you hold a different view of sport does not equal one party is right and one wrong. Teaching kids to look at big pictures can help them in media literacy. If one child hits another on the playground, we want to hear the reasons behind the altercation but also want the kids to understand that pain is uncomfortable and actions, even inaction, have/has consequences. In this way, we tell them that all sides of the story need to be considered (access). The person hit has one story, the kid doing the action has another and the onlooking parent another (analyze). We express that while the child felt justified they would not like it if someone hit them given that same reason followed by bringing up other alternatives to the action (evaluate). Then we encourage them to, in the future, find different ways to settle differences and/or communicate more effectively(create). The kids then go on their way, and we repeat this process as necessary, or the kids display different actions in similar situations(act). Later in life teachers ask kids how things make them feel, this is important in analyzing media because when we can pick up on emotional cues, we are better able to discern emotionally deceptive advertising. Teachers also encourage kids to express themselves but look at what others are saying. These are great but usually only last a short time before governments, districts, and the like force teachers to cram facts and figures into kids heads so that enough kids fill in enough correct bubbles that will compel the government to provide schools funding they desperately need. Young people are brilliant. When presented with a concept, like deception in advertising, they pick up on countless ploys and manipulative language. We should encourage kids to go beyond asking "What is Shakespeare trying to say in Macbeth Act I Scene V" and also have them do this with print advertising around their town. Studying news clippings published during WWI and then also having them pick apart current news reports about Armistice Day. I sit here knowing that these are hopeful ideas because of the funding structure for the American education system. A more realistic option is for adults to talk to young people like adults. Age does not limit your ability to grasp difficult concepts, lack of conversation about these topics does. Be fearless and call deception as you see it. Watch a movie with questionable morals with your niece? Start the discussion. Two news anchors fighting about a trade war? Mute the TV, express that international trade deals are complicated but shouting doesn't make someone correct. Should media literacy be taught in schools? In some capacity it already is, what will help a great deal is to encourage and promote critical thinking. When we encourage people to tackle big topics, ideas, and analysis we are permitting them to challenge presented convention so that they can establish their own informed opinion. Which is the goal of media literacy.

</comment><comment><USER39> I'm teaching it to my kids already:

Lesson #1: Everything you see, hear, or read is someone else's agenda.

</comment><comment><USER40> The amount of adult human beings who, when asked for a reference, cite wikipedia (rather than the reference wikipedia uses, if it has one) shows that we should teach media literacy per-se - primary school would be ideal, but so would anywhere.

<comment><USER40> Not complaining about the downvotes, but this is interesting - <USER2> themselves recommend not citing wikipedia, as it's not considered a primary source.

I've never heard anyone argue in favour of citing secondary sources, merely not doing it out of ignorance - but obviously people seem to disagree.

<comment><USER41> For non academic non controversial things I highly recommend citing wikipedia. Citing wikipedia transitively cites multiple usually high quality sources, provides verification that the sources actually more or less represent the consensus on the topic instead of being someone fringe idea, and is really easy to quickly find.

Incidentally, Wikipedia insists you site secondary (third party) sources on Wikipedia itself [0,1]. Wikipedia would be a tertiary source [2] though so I think this is language thing and not a real disagreement between you and Wikipedia's policy.

[0] [https://en.wikipedia.org/wiki/Wikipedia:Tutorial/Citing_sour...](https://en.wikipedia.org/wiki/Wikipedia:Tutorial/Citing_sources)

[1] [https://en.wikipedia.org/wiki/Secondary_source](https://en.wikipedia.org/wiki/Secondary_source)

[2] [https://en.wikipedia.org/wiki/Tertiary_source](https://en.wikipedia.org/wiki/Tertiary_source)

<comment><USER40> > I think this is language thing and not a real disagreement between you and > Wikipedia's policy.

Yes, in wikipedia speak, I mean wikipedia want you to site a secondary sourc,e and not wikipedia itself (which is considered a tertiary one).

> citing wikipedia transitively cites multiple usually high quality sources

Sometimes. Other times it transitively cites _nothing_.

</comment></comment></comment></comment><comment><USER42> While teaching media literacy sounds good in theory, in practice it may be helping to radicalize people. The problem is that while the media is often-to- usually wrong, when people try to fact check what they're reading some percentage of them end up surfacing even more dubious information and then go on to literally become nazis.

Danah Boyd gave a good talk on this: [https://www.youtube.com/watch?v=0I7FVyQCjNg](https://www.youtube.com/watch?v=0I7FVyQCjNg)</comment>


Homo sapiens - <AUTHOR> http://www.iucnredlist.org/details/136584/0 <comment><USER3> Georgina Mace, the redlist author, was just on BBC radio's _Life Scientific_

"Georgina Mace has devoted her Life Scientific to trying to limit the damage to our planet's bio-diversity from this alarming loss. For ten years she worked on the Red List of Threatened Species, developing a robust set of scientific criteria for assessing the threat of extinction facing every species on the planet. When the list was first published, she expected resistance from big business; but not the vicious negative reaction she received from many wildlife NGOS. Her careful quantitative analysis revealed that charismatic animals, like the panda and the polar bear, are not necessarily the most at risk."

[http://www.bbc.co.uk/programmes/b07jys1h](http://www.bbc.co.uk/programmes/b07jys1h)

</comment><comment><USER4> My home is infested with humans. They're loud, they're smelly, and they leave the toilet seats up.

<comment><USER5> Yeah, you've got to watch out for that. Once they reproduce, it can take _decades_ to clear them out.

<comment><USER6> Surely the police can take them away after just 18 years?

</comment></comment></comment><comment><USER7> Full Account -> Classifications -> Uses:

      Food - <USER2>

     Local : check

      Sport hunting/specimen collecting

     Local : check

D:

<comment><USER8> Habitats - All "Suitable" except:

       0. Root -> 6. Rocky areas (eg. inland cliffs, mountain peaks)
        Suitability: Marginal

</comment></comment><comment><USER9> Humans have the widest distribution of any terrestrial mammal species, inhabiting every continent on earth (although there are no permanent settlements on Antarctica). A small group of humans has been introduced to space, where they inhabit the International Space Station.

<comment><USER10> Wouldn't mice be everywhere humans are? Dogs too? Except the iss of course.

<comment><USER11> Are there dogs at the antarctic research stations?

<comment><USER12> Not anymore, apparently the dogs were attacking the penguins.

</comment></comment></comment></comment><comment><USER13> > Two countries, China and India, hold approximately one-third of the entire > human population alone, with 1,318 million and 1,312 million people, > respectively. The United States of America is third with 302 million.

This sort of "breaks the fourth wall" for me, using national boundaries defined by human culture/civilization in a biological definition of humans.

</comment><comment><USER14> > currently no major threat to humans

Id say global nuclear war is a very real and very tangible threat to humans and many other species around.

<comment><USER15> Why are humans so obsessed with 'the end of the world'? In times of yore, we predicted it using religious texts as evidence. Now we use science.

I'm not saying the science is wrong, just that there's a constant thread throughout human history of worrying about it.

<comment><USER16> I don't mind it, as long as it's based on logic and actual possibilities instead of a supernatural event that happens on a dat coming out of books if you look at them in an adequately convoluted manner.

Global nuclear warfare would've happened by now if it wasn't for both the fear of mutually assured destruction and global nuclear conventions, I think. And sheer luck.

And preparing for an extinction-event sized asteroid isn't a bad idea either; the chances of it occurring in our lifetime is small, but the chances of it occurring again is 100%. The chances of people being able to detect it early enough and do something about it are actually pretty high, in part due to the fear of it happening again. Detection could still be better, of course.

<comment><USER17> > Global nuclear warfare would've happened by now if it wasn't for both the > fear of mutually assured destruction and global nuclear conventions, I > think.

More like pure survivor bias on your part!

</comment></comment></comment></comment><comment><USER18> I love how this and the Wikipedia article have such neutral, scientific tones. I understand why, but it makes it sound like an alien wrote it, and it's amusing.

</comment><comment><USER19> I was sort of hoping they'd also have some of the other, extinct, species of humans. But a search for _neanderthalis_ didn't turn up anything.

</comment><comment><USER20> Disappointed by the 'Image and External Links' tab, I was expecting porn.

</comment><comment><USER21> Sounds like an invasive species.

</comment><comment><USER22> Just drop a [https://en.m.wikipedia.org/wiki/Thermobaric_weapon](https://en.m.wikipedia.org/wiki/Thermobaric_weapon) in Antarctic ice sheets. You'll drown the world. [http://qz.com/651615/a-melting-antartica-might-make-the- seas...](http://qz.com/651615/a-melting-antartica-might-make-the-seas-rise-by- much-much-more-than-we-thought/)

</comment><comment><USER23> I didn't know about the Red List, just signed up with them - thanks for sharing!

</comment><comment><USER17> In the interests of conserving biodiversity, should it not also list the different subspecies/ethnic groups, and report on their threatened status in their native habitats?

<comment><USER24> Technically, all living humans are of a single subspecies, Homo sapiens sapiens.

<comment><USER17> I suspect that if we studied and classified humans in the same way we studied a species of bird or beetle, we'd have no trouble identifying tens of different subspecies based on fairly distinct phenotypes and geographic distributions.

<comment><USER24> I'm sure a proper taxonomist would be able to speak more authoritatively, but I rather doubt it. Subspecies tend not to interbreed for whatever reason, whether geographic isolation, sexual selection, or other factors, whereas humans rather enthusiastically behave in the opposite fashion. I don't think one could convincingly argue that humans are geographically isolated, either. You might be able to make an argument that human races are akin to pet breeds, but my understanding is that zoologists don't really consider pet breeds as subspecies.

<comment><USER25> >whereas humans rather enthusiastically behave in the opposite fashion.

What are the worldwide rates of interracial marriage? I see in the US (a country where the majority race makes up about 60% of the population) that it's now around 10% for new marriages, and has historically been much much lower. If your statement were true, wouldn't we expect to see much higher rates of interracial marriage than 10% in the US? Wouldn't we expect that the historical rate was also much higher?

<comment><USER26> Please don't confuse interracial marriage (a social construct, and prevented by law in many places in the US until 1967) with interracial breeding (the thing that would matter for biological definitions). They can have very different rates, and surely did in the US in the 18th and early 19th century.

<comment><USER25> I'm not suggesting they're the same thing at all. They're just the best approximation I could quickly find any decent statistics for.

What were these higher rates you refer to? Were they as high as would be expected if humans 'enthusiastically' interbred, or even as high as would be expected if humans had no preference one way or the other?

<comment><USER26> OK, here's one sort of relevant statistic. 1910 census at [http://www2.census.gov/prod2/decennial/documents/36894832v1....](http://www2.census.gov/prod2/decennial/documents/36894832v1.zip) and you want 36894832v1ch02.pdf in there, page 5 in the PDF (which is page 129 of the actual census document). I got there via [https://www.census.gov/prod/www/decennial.html](https://www.census.gov/prod/www/decennial.html) if you want to look up other years.

According to that document, in 1890 (I chose that year because the document actually clearly describes the classification criteria for that year, unlike other years it mentions), the "Negro population" was 7.5 million, of which 1.1 million were "Mulatto" and 6.3 million were "Black" (there are some rounding errors here; see document for more exact numbers). The definition used in that census was that "Mulatto" only included people with at least one white grandparent; this would obviously include the ones with a white parent as well. This doesn't directly tell you anything about interbreeding rates per se because there may have been systematic differences in the numbers of children different types of couples had. But it does indicate that even in the 19th century a fair number of children who had at least one black parent also had a white parent. Somewhere between 1/14 and 1/7, if I'm running the numbers right (the former corresponds to a "mulatto" having one "white" grandparent and three "black" ones, while the latter corresponds to having a "white" parent and a "black" parent).

<comment><USER25> 1/7 to 1/14 is incredibly low for a race that had been in close proximity to another for over a hundred years. If there were no preference, or if there were a positive preference for interbreeding, you'd expect by that time nearly all descendants of the initial minority race to trace most of their ancestry back to the majority race. That 6/7 to 13/14 of the members of the race can trace back the vast majority of their heritage to the initial minority race is proof that not much interbreeding was taking place.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> phew</comment>


Piano in 24 lines of JavaScript - <AUTHOR> http://jsfiddle.net/c62Pe/1/light/

<comment><AUTHOR> Original: [http://habrahabr.ru/post/202646/](http://habrahabr.ru/post/202646/)</comment>


Ask HN: What will the hot Win8 Mobile Apps be? - <AUTHOR>

Let's talk about the coming app market for Windows 8 Touch. What are the demographics of the early customers? Will we see a predictable patterns of App sales based on iPhone and Android?<p>I'd like to know which application categories are big enough for a single developer, writing their first application, to have a chance at significant sales. <comment><USER2> Touch-based gaming goes without saying (but I said it).</comment>


Chrome-To-Android Extension: Awesome, Deadly - <AUTHOR> http://techcrunch.com/2010/05/23/chrome-to-android-push/ <comment><USER2> Looks like two people have already produced firefox addons for this: <https://addons.mozilla.org/en-US/firefox/addon/161940/> <https://addons.mozilla.org/en-US/firefox/addon/161941/>

</comment><comment><USER3> Anyone else notice the spelling mistakes? "For example, if you looking at a page on your computer than you want to take on the go (something I do all the time), you can now just use a Chrome extension and with one click, it automatically appears on your phone." you're, then.

<comment><USER4> Actually: you're, that

</comment></comment><comment><USER5> Definitely a cool feature but I don't get the "deadly" part. You need to be logged into your Google Account in order to send remote commands. It seems that pop-ups on your phone would be the least of your worries...

</comment><comment><USER6> Does not seem to work with Google Apps account (

</comment><comment><USER7> Strangely, I get a server error in the browser every time I try to use this. Also, Windows (7) has taken to asking me if I want to give the browser admin privileges every time I launch.

<comment><USER8> I'm having the same problem (server error, but on a Mac) - it's good to know we're not the only ones.

My phone is registered using a custom domain, but I switched the account to a GMail address and ensured I was signed in using a standard Google account when installing the extension. Perhaps it's an issue with phones tied to GAFYD accounts. Is yours?

<comment><USER7> I think my problem was tied to an underlying flaw in the Java runtime, because I had several new problems after installing the C2P thing - starting Chrome would ask for admin permission every time, apps couldn't be enabled and so on. New JRE + uninstall and reinstall of Chrome and everything's fine now. Gotta love browser sync.

Now that it's working, it's pretty fast and effective; I look forward to seeing what else can be done with it. For example, it could be very handy for trip planning and so forth.

</comment></comment></comment><comment><USER9> Similar idea but implemented w/ a bookmarklet:

<http://pagestackandroid.appspot.com>

<comment><USER10> Ha! I was at Google IO during the demo and I was like, that looks familiar!

</comment></comment><comment><USER11> amazing. before I had to text the link and then click it. But now I just have to send the link and no click needed.

yeah, thanks, but no. having things sent from the network launching on my phone seems not worth avoiding the work of touching the screen.

but I will try it and see for myself.

<comment><USER12> The big deal here is that you can launch intents from your browser. This is really similar to what we used to do back-in-the-day with SMS interception. It was a really useful technique.

This gives us something really similar on Android phones. It's not really just about getting something to open in your browser. You'll eventually see this deeply integrated into actual apps, and that's really cool.

</comment></comment><comment><USER13> Bookmarks : I already do this with Firefox / Delicious and it goes both ways and to every computer I use and anyone who is interested.

Maps : I already do that with Google's My Maps Editor and any Google Maps compatible browser. I sit at my desk and update pins to my hearts content and when I want to see them on my G1 phone I just run the My Maps app, including single clicks to Street View etc.

One feature I actually want is 'reply by voice message' like Nokias have. I think it is an under-explored area. I've oft wondered why store-and-forward voice messages aren't more widespread. Scroll to a contact, click 'send voice msg' say what you want, hit send.

<comment><USER14> How do you get Delicious to work with the Android browser?

<comment><USER4> There are various Delicious apps. The beelicious app works pretty well, but it lacks the ability to view bundles (which is only a problem if you depend on them).</comment></comment></comment>


A Diagnosis (2014) - <AUTHOR> https://www.lrb.co.uk/the-paper/v36/n17/jenny-diski/a-diagnosis <comment><USER2> I tried to read that.

<comment><USER3> What prevented you from succeeding?

<comment><USER2> Reading it gave me a strong and growing sense I'd rather be doing almost anything else.</comment></comment></comment>


Your Technology Sucks - <AUTHOR> http://aaron.vegh.ca/2012/06/your-technology-sucks/

<comment><USER2> Reading this blog post feels like it was written about me, the only difference is that I have two kids and my wife buys tons of shoes instead of clothes but I guess shoes are a form of clothes :)

When I was in college I used to build computers for friends and family to make some money on the side (ala michael dell) and offered free tech support along with those computers. Well it wasn't always free, my grandmother always insisted on paying something so I charged her a dozen cookies that she would mail to me in college and I would share them with my friends.

Anyway, I quickly learned that the free support was killing me, and I didn't have much time to support this stuff in college, so I started recommending that people buy dell computers, because back then, they had the best customer support and there products were pretty good.

It didn't take long before Dell shipped their customer support folks over seas and people started coming back to me for support. By that time I was out of school, and I didn't mind helping out my friends and family. Soon enough I got married and had a couple of kids.

Once that happened I stopped having all this wonderful free time I used to have in my youth, and as the guy in the blog post mentions, I had better things to do with my time, and I ended up buying my first mac, after a couple of my friends talked about how much they loved developing on it.

When I first got my mac, I was surprised how great it was for developing software. I mostly develop with open source software, so having the shell there with all the wonderful goodness made it great to get up and running quickly. This compared to all the hacks and work arounds you needed to do on windows (cygwin anyone?).

After using the mac for a little while and then having to go support the friends and family with windows, was really hard, because stuff that just worked on a mac, was a PITA on windows. I started recommending mac's to my relatives and a wonderful thing happened. My aunt who used to call me once a week stopped calling me. I hadn't noticed that she didn't call for a while until I saw her at a family event and I asked how she liked her new computer. She was so happy, she said it took a little bit of getting used to, but she should have done it years ago. The crazy printer and scanner that she always had problems with in the past, just worked when she plugged it in, no configurations, no printer drivers nothing to install, it just worked. In the past few years I think she has only called me once, and that was because she wanted to know what model macbook she should by her daughter for college.

The other great thing about apple, is that there is an apple store at the local mall, and my relatives can go in there and get their questions answered in person, and take classes. Best of all the phone support for apple is bar none, if you haven't used it before, which some people haven't because the apple products are pretty reliable, then you are missing out. There is rarely a long wait on hold, and the phone call is really clear and quiet, they aren't sending you to a big call center where everyone is in the same warehouse using cheap voip phones. If they are, they are using great headsets with noise reducing microphones :)

I have a couple of friends that have switched as well, and one of them is a big time windows fan and gamer, and said he would never switch because mac's aren't good enough to play video games. He has a machine he built just for games, and it is true that mac's don't have all the same games, but he says that the games that they do have on Mac run better on the mac, and he thinks it is because the underlying OS is much better on a mac so the games are more stable.

My brother in law, who for some reason always hated apple, has recently bought an iPad and replaced his huge android phone with an iPhone. He said he always avoided the apple products because he didn't want to be called a fan boy, but when he actually sat down and used one, he was surprised how good they were compared to what he had been using. He just needed to give it a chance.

Some people complain about the price difference, and now a days the price isn't as big a difference as the past. But, I use the following argument when people bring up the price difference. Kia's and BMW's, are both cars, the BMW is more expensive, but it has more features, and is more fun to drive. You don't need the BMW but if you can afford it, you won't be disappointed you bought one. If the world bought everything according to price, then everyone would be driving Kia's. Life it short, spend your time on earth enjoying the products you own.

So for me, the apple products just work, and they are a major time saver, both with my software development and for dealing with support. If these same products were made by different companies I would still buy them, it has nothing to do with the fact that they are made by apple.

</comment><comment><USER3> An Apple computer is just a computer. And the market for computers is an old, big, diverse market. So there are functional equivalents for every Apple product. And Apple products do have their own flaws and complexities, which one learns by using them, the same as any other thing of nontrivial complexity.

What Apple is really killer at is cultivating this kind of brand loyalty. The fact that Apple fans couch their reasoning as 'Apple products are just the best' does not indicate that they are the best, it just indicates that said fans are completely convinced.

Which is not to say that they are wrong - any more than the guy who smokes Camels instead of Lucky Strikes is wrong. Familiarity contributes a lot to your comfort and efficiency with a tool, and it's important to be happy with what you have.

Many of the things you like about Apple products are bound to be true. There's nothing wrong with buying Apple products, they are just fine. But it is just wrong to say that there is something wrong with people who choose the non- Apple alternative (like that they are just cheapskates, or poor, or nerds who don't value their time). These things aren't true.

It's just that most brands do not have the same hard core of extremely pushy, inflexible evangelism on display here. I don't question that Apple products are just fine. I question the idea that there are no viable alternatives, and that you are what you buy.

</comment><comment><USER4> Reads like an apple ad campaign to me ;)</comment>


Disclojure: all things Clojure - <AUTHOR> http://disclojure.org/ <comment><USER2> I would have gone for fulldisclojure.com -- a little longer but seems to better represent the intent. Still, nice job.

</comment><comment><USER3> Thanks!</comment>


Dropbox: Focus on Future Value, Not the Current Valuation - <AUTHOR> http://www.forbes.com/sites/jlim/2015/11/12/dropbox-focus-on-future-value-not-the-current-valuation/ <comment><USER2> "This speculation is like playing fantasy football without statistics." Really like this quote from Drew Houston, in response to those commenting on the companies valuation.</comment>


What if I don't find a job? - <AUTHOR>

When you learn that most of the guys you graduated with haven't found a job, you start to think that maybe you weren't the problem, but the system is. (Schools say "there are plenty of job ads out there!", employers say "But you weren't taught anything useful at school!"). I'm actually one of the luckiest of the bunch because I do have a few opportunities and I'm confident I can turn one of them into a position - I'll know more about that at the end of the month. Until then, my anarchist/rebel/artist side can't help but wonder: what if I couldn't find a job in the IT field? Life is extremely pricey here and unemployment services aren't going to give me anything. On the other hand, I don't feel it's my mom who should financially suffer from this. I'm 25 and I see a lot of people of my age still at their parents'. In my case, though, my mom deserves some rest. Given that one of my websites brings from $400 to $600 a month (and has for a few years) and that I have a few thousands in my bank account, I'm wondering if I shouldn't move to a peripheral area of a more affordable country (I'm thinking Portugal) and live very simply over there, as I know broke students have done in Berlin or Austin? I don't need more than a computer and books to entertain myself. I wouldn't know where to start except for airbnb.com, though. Does anybody have any advice to give me, a story or useful links to share? Thanks. PS: this is just my mind wandering and I'm probably never going to do this, but still, I'm interested. <comment><USER2> The first advice I would give you: Be patient. I spent a good time of my tweenties working as skiing instructor, soundtecnician, bartender, soccorista etc. Now I'm SWDev now and really can enjoy the benefits of a good paying job, but I couldn't if I wouldn't have lived out these punkrockdays. So I think it is totally ok to not have a complete lifeplane with 25. You'll get right some time, I promise.

Next you want a job, look for one. Check google for softwarecompanies in your area and just apply for a job. You can code? That's great, most companies, I know in my area are looking desperatly for developers. You can't code you still can get a job in Support,Testing, Documentation(well obviously not me, not a navtive speaker...). Don't be afraid of the requirments they put in their application forms, that's BS from HR. While we are at it, avoid HR and recruiting staff/companies, if you can get involved with one of the techguys ask them for a job. My first job in SW i got through a ScrumMaster of a company, I had to supply my CV 2years later when I was promoted and HR never realized I didn't hand them in.

I know being in a situation like yours is exhausting, I've been there,others have been there [https://www.youtube.com/watch?v=MbnFJVgBcw0](https://www.youtube.com/watch?v=MbnFJVgBcw0)

Keep on trying

<comment><USER3> "I had to supply my CV 2years later when I was promoted and HR never realized I didn't hand them in."

I hope you submitted a one-page CV listing two years of experience with their company. ;)

</comment></comment><comment><USER4> I don't see how NOT "moving out" is a bad anything.

It's a cultural agenda pushed by some folks, but there is absolutely nothing wrong with living with your mom and taking care of her like she took care of you in your younger days.

Combining your 2 incomes, you could quickly move out of debt, make a smart property investment together with your mom and through that, set her up for a decent retirement income on top of any pension she receives.

You may not get to live out "experiences" like all the hipsters that promote that lifestyle, but life will carry on as normal (unless you decide to relocate yourself and your mom to a place with better weather and cheaper living).

In the end, take my advice with a pinch of salt, but don't forget your mom and what she has done for you.

</comment><comment><USER5> Check out [https://nomadlist.com/](https://nomadlist.com/) for a list of the best places to go to do this kind of thing.

If I was in your position I'd book a flight to somewhere like Chiang Mai in Thailand (cheap, traveller-friendly, lots of English spoken, way more comfortable than you might expect).

With your budget, AirBnB if you can find somewhere cheap, otherwise bunk in a hostel dorm (hostelworld.com).

Check out Punspace (or whatever local co-working space is available where you are), go to meetups there, you'll meet several other "digital nomads". Tell everyone you meet that you can code and you're looking for remote freelance jobs. Best bet is to meet successful remote freelancers, they will almost always have clients or know clients who need more work.

</comment><comment><USER6> Wish I knew. But if it were me I'd be leery of moving too far away from "where the jobs are," even if I had to live somewhere more affordable on the periphery, or with family as many do/are.

This has also been a point of consideration in taking a remote job and living...remotely. Or that job in a dream locale without a strong marketplace --what if it doesn't work out?

OTOH this (and essentially all) advice is meaningless, and you should do what you want. Maybe one person plays it safe and stays comfortably employed yet miserable, while another moves to some far-flung destination, earns little but has a blast. Who knows?

</comment><comment><USER7> Where are you located? Get involved in Meetups - that's really the answer.</comment>


Israeli troops filmed watching idly as settlers throw stones at Palestinians - <AUTHOR> http://usarawpolitics.com/israeli-troops-filmed-watching-idly/ <comment><USER2> Not sure why this is on HN, but I will say that having been to Israel I did observe a pervasive contempt for Palestinians, to that point that some openly talked of them as being less than human. I'm sure there's plenty of hatred going the other way as well. I would speculate that both governing entities find it useful to create a culture where people feel entitled to revel in this hatred. It makes me depressed for the chances of peace. How on earth can you get people out of their entrenched positions when neither side appears to be trustworthy?</comment>


Sure, it can backflip – but can a robot hold down a desk job? - <AUTHOR> https://aeon.co/ideas/sure-it-can-backflip-but-can-a-robot-hold-down-a-desk-job <comment><USER2> Some robots can physically hold down a desk, so that's half the battle.</comment>


Human Sperm Gene Existed For 600 Million Years, Says Study - <AUTHOR> http://www.northwestern.edu/newscenter/stories/2010/07/sperm-gene-600-million-years-old.html <comment><USER2> Relevant paper: <http://dx.doi.org/10.1073%2Fpnas.131090498>

PubMed search: [http://www.ncbi.nlm.nih.gov/sites/entrez?Db=pubmed&DbFro...](http://www.ncbi.nlm.nih.gov/sites/entrez?Db=pubmed&DbFrom=gene&Cmd=Link&LinkName=gene_pubmed&LinkReadableName=PubMed&IdsFromResult=66037)

</comment><comment><USER3> _"This is the first clear evidence that suggests our ability to produce sperm is very ancient, probably originating at the dawn of animal evolution 600 million years ago,"_

That is pure guesswork. You only have to read the whole article to see it is a "theory".

<comment><USER3> I would also add...cool none the less.</comment></comment>


Ask HN: Applied for startupschool weeks ago, when should I expect to hear back? - <AUTHOR>

Should I expect a reply whether I have a seat for startupschool or not? I am in Austin, TX and need to plan for the trip if there is a seat for me. <comment><USER2> Did you send your application here too? I'd understand why you haven't received anything...</comment>


GitHub Enterprise SQL Injection - <AUTHOR> http://blog.orange.tw/2017/01/bug-bounty-github-enterprise-sql-injection.html?m=1 <comment><USER2> Although I am impressed by the work, I dislike these writeups.

In similar bug bounty posts, a user will post all this brilliant setup code, these tools I never heard of to decompile binaries, view source, get through obfuscation, etc.

Then, when you get to the meat and bones, they just go "Ok and vulnurability is here, and you exploit it like this. Ta data."

It's very anti-climatic, and I don't learn much in the process. I would like to learn more about what your thought process is like after you get the code. How did you narrow your focus on ActiveRecord? Did you just know from seeing it? I would love to learn more. Do expert pen-testers have this checklist of exploits they try?

Sorry if it sounds like whiny, I would just love it if these had more meat in the actual finding of the exploit as they did the setup.

<comment><USER3> It's a bit of both. It's not so much a checklist as a classes of bugs, but close enough. That includes vulnerabilities like SQL injection, command injection, stored and reflected XSS, et cetera. The WAHH (Web Application Hacker's Handbook) is a good place to start here; it walks through a lot of these standard classes of web app vulns.

Something WAHH touches on, and experienced pentesters get a feel for, is more complex interactions. Often that means chaining several not-so-bad bugs together to build something really exciting. Sometimes they're just obscure consequences of say, a rather complex authorization system. These are typically a lot harder to find, and may involve simultaneous code audits. Ideally, your long-term in-house security people find these, because any attacker that does is in the 95th cleverness percentile.

So, TL;DR: start with WAHH; then go find some vulns, and start thinking about what the app does in terms of alternative things a program could do that a reasonable programmer who was just trying to get it to work might not have thought about.

If you're looking for tools to play with, you can do worse than downloading Kali and running it on a VM. If nothing else, it'll give you a pretty big catalog of tools to start looking at. I think WAHH covers basic Burp Suite usage, but Kali has some other tools like sqlmap and BeEF that aren't too tricky to get started with.

WAHH: [http://mdsec.net/wahh/](http://mdsec.net/wahh/) Kali: [https://www.kali.org/](https://www.kali.org/)

<comment><USER4> Also want to mention Web Hacking 101 [0], which is written specifically for newbies in vulnerability searching, with real cases and explanation of how certain bugs are or could be found.

[0] [https://leanpub.com/web-hacking-101](https://leanpub.com/web-hacking-101)

</comment></comment></comment><comment><USER5> It still boggles my mind that sql injection is a thing in 2016, let alone in a modern codebase from a great software company with amazing engineers.

Somehow we (the programming profession) are doing this whole thing wrong, and I'm not sure why.

<comment><USER6> I find it hilarious how people think there are all these "amazing engineers" around. Sometimes it even seems like hero worship. The reality is that the vast majority of engineers are mediocre even at high-profile tech companies and hot startups. That's not a bad thing and I don't mean it as a criticism; modern civilization has largely been built by mediocre engineers. And even the best engineers make frequent mistakes.

<comment><USER7> This sentiment is simultaneously terrifying and comforting.

</comment></comment></comment><comment><USER8> Props to OP for finding the vulnerability without knowing Ruby on Rails.

<comment><USER9> Interesting that this is a standard use-case for ActiveRecord [0] and does not include any built-in protection against SQL injection. You can pass a hash of symbols into the method, but there is no safe way to pass string arguments with sanitizing them yourself.

[0] [http://guides.rubyonrails.org/active_record_querying.html#or...](http://guides.rubyonrails.org/active_record_querying.html#ordering)

<comment><USER10> God, IMO this should be reported as a bug in rails; in my opinion it ActiveRecord should _never_ accept strings for this without parsing them.

<comment> grey-area This is probably incredibly common for things like order params in many web apps and also relies on silly conversion rules in MySQL. Any time you see order=name in params you should be suspicious. Better to use numeric enums. There are similar problems with column names, this site has some great examples which apply to many ohms, not just rails:

[http://rails-sqli.org](http://rails-sqli.org)

The lesson is you should _always_ strongly assert the type of user input (where you can, convert to known good values which is even better), and never magically convert types as rails/ MySQL does here. It's less convenient but safer.

<comment><USER11> Django for example will throw an error if an ordering parameter does not correspond to a database column.

If you have to specify all the columns of a table in Rails, then ActiveRecord ought to be able to restrict the order params to only column names.

<comment><USER12> I imagine some ORMs don't have this so people can do order by computed columns like "order by assets - liabilities"

To your point it probably makes sense to have an order method that verifies column names and an order_raw method that takes a string so the caller understands the risk, while protecting the usual case.

</comment></comment></comment></comment></comment></comment><comment><USER13> It's hidden way down at the bottom, but I found the Timeline to be my favourite part :)

Edit: Can't see to format it correctly, just check the original source.

<comment><USER14> This one?

      2016/12/26 05:48 Report vulnerability to GitHub via HackerOne
      2016/12/26 08:39 GitHub response that have validated issue and are working on a fix.
      2016/12/26 15:48 Provide more vulneraiblity detail.
      2016/12/28 02:44 GitHub response that the fix will included with next release of GitHub Enterprise.
      2017/01/04 06:41 GitHub response that offer $5,000 USD reward.
      2017/01/05 02:37 Asked Is there anything I should concern about if I want to post a blog?
      2017/01/05 03:06 GitHub is very open mind and response that it's OK!
      2017/01/05 07:06 GitHub Enterprise 2.8.5 released!

Or this one?

      Day 1 - Setting VM
      Day 2 - Setting VM
      Day 3 - Learning Rails by code reviewing
      Day 4 - Learning Rails by code reviewing
      Day 5 - Learning Rails by code reviewing
      Day 6 - Yeah, I found a SQL Injection!

</comment></comment><comment><USER15> For those that this website is marked as dangerous [http://webcache.googleusercontent.com/search?q=cache:z7yyaxI...](http://webcache.googleusercontent.com/search?q=cache:z7yyaxITRoAJ:blog.orange.tw/2017/01/bug- bounty-github-enterprise-sql-injection.html+&cd=1&hl=en&ct=clnk&gl=uk)

<comment><USER16> Is there a specified reason for it being marked as dangerous? It comes up fine for me. Granted it doesn't support SSL it seems (get that fixed, Orange!) so maybe you're using a plugin that marks non-SSL as dangerous?

<comment> slipstream- The website seems to be a blogspot blog on a custom subdomain...

</comment></comment></comment><comment><USER17> I'm curious if the author decompiled binaries generated from C code. In that case, I understand how one could "dis assemble" binaries, but generating readable C code, is that possible?

<comment><USER18> Decompilers exist (like Boomerang), but it is more likely the author used something like IDA Pro, which has a code flow graph feature.

[http://boomerang.sourceforge.net/](http://boomerang.sourceforge.net/)

<comment><USER19> Hex-Rays is a pretty good decompiler plugin for IDA Pro: [https://www.hex- rays.com/products/decompiler/index.shtml](https://www.hex- rays.com/products/decompiler/index.shtml)

</comment></comment></comment><comment><USER20> Glad to see the communication between Orange and GitHub went great. Both did the right thing after discovering the flaw. Orange reported it and GitHub fixed it and allowed Orange to publish a blog post. I have to admit I'm a bit of a fanboy of HackerOne.

The custom SQL query is something that is hard to prevent. It is still hard to use ActiveRecord/Arel for everything. I'm sure GitLab is not immune to it.

GitHub chooses to encrypt their source code to prevent modifications. Our experience at GitLab is that customer modifications don't cause a lot of extra load on our support team. But of course that might be caused by having different architectures and customers.

<comment><USER21> It's amazingly easy to prevent for high value target type web apps use stored procedures only. The web app db user should only have permissions to execute appropriate stored procedures.

<comment><USER22> Stored procedures aren't a panacea for SQL injection. The real answer is to use parameters for any user input.

Otherwise if you're concatenating strings to invoke your stored proecedures you're in the same boat.

<comment><USER23> As a side note, it's not always possible to use parameter binding for all parts of a SQL query. :(

For example, when querying user uploaded databases (not a typical use case), the SQL query needs to include the table name. At least with SQLite (unsure about PostgreSQL), table names can't be bound in a parameter. They need to be part of the non parameterised query string, thus string smashing.

Field/column names are probably similar too, though I haven't checked (yet).

<comment><USER22> If you're doing anything that esoteric hopefully you understand proper identifier escaping. If not, there's bound to be much worse throughout your app.</comment></comment></comment></comment></comment>


Ask HN: How do you teach problem solving skills to software engineers? - <AUTHOR> More often than not, I get people who have decent work experience and seem suited for a role but fail to unlearn and re-learn new ways of doing things. A lot of these people tend to come from a service company background where they do not dive  deep into solving problems with code and instead try to cut-paste from across the internet which is good enough for projects that might not ever get completed or used only internally.<p>How does one re-train people who might have learnt computer science fundamentals at some point but have lost track of how to solve problems over the course of their earlier work experience? <comment><USER2> Ask them to write instructions on how to tie their shoe.

Chances are, someone will say that they just bend over and tie them.

Point out to them that it isn't quite that simple - once they see that a problem can be broken down further to the point that you're telling your hand to put the lace against your index finger's first knuckle and the point of the middle finger, they begin to understand - then introduce your methods which they happily embrace.</comment>


Russian space leader suggests engineers test spacecraft Stalin's way - <AUTHOR> https://arstechnica.com/science/2018/11/russian-space-leader-contemplates-stalin-mode-for-spacecraft-design/ <comment><USER2> At least part of the impossibility to launch before 2023 is the choice of the yet undeveloped Soyuz-5.

To be fair, they _could_ launch flight hardware on suborbital flights with existing Soyuz hardware to find any glitches in launch and reentry, but I guess it's pointless if they don't know the flight profile of the new so far imaginary rocket.</comment>


Show HN: Motion tracking clothing for full-body immersion in VR - <AUTHOR> http://www.enfluxvr.com <comment><AUTHOR> Move into a new world! EnfluxVR, the ultimate motion tracking clothing, is now available to developers. EnfluxVR is a Lululemon-style shirt and pants for full-body immersion in VR and gaming. We're releasing the first 20 developer kits July 1 for $249 each, then we'll be making more based on demand. We are seeking the best VR and game developers to create amazing content. 16/20 are taken as of June 21, including some very influential customers. For more info and to place an order, check out www.enfluxvr.com. Contact email@example.com to ask about a developer discount.

<comment><USER2> Can you briefly describe technology/physical principles that power your VR suit?

I'm not able to see it on the website, maybe I'm just not looking good enough.

<comment><AUTHOR> Yes, thank you!

-It is a shirt + pants with 10 embedded IMUs -Each IMU is a 3-axis accelerometer, 3-axis magnetometer, 3-axis gyroscope. -As a developer, you get real-time filtered orientation angles (Roll, pitch, yaw) from each IMU in a Unity API (10ms latency, within 2 degrees of accuracy) -Functionality to link data from clothing to your own skeleton -It's fully mobile, transmits via Bluetooth to mobile or desktop</comment></comment></comment>


AlterEgo Shows Off Incredibly Realistic 3D Animated Faces - <AUTHOR> http://www.techeblog.com/index.php/tech-gadget/feature-incredible-3d-tech-demo-shows-realistic-facial-animations

<comment><USER2> The pictures are nice, but the text of the "article" made me laugh out loud. A choice snippet:

 _Called Alter Ego, this software basically takes advantage of blend shapes to copy facial idiosyncrasies and produce emotive life-like 3D character animations._

Wow, that's so insightful! Could you copy-n-paste more of the press release, please?

</comment><comment><USER3> Those faces are deep, DEEP in the uncanny valley, but they're not falling in, they're climbing out.

<comment><USER4> Facial animation in _The Normals_ looks even better:

<http://www.youtube.com/watch?v=Pyhf3JmODHE>

</comment></comment><comment><USER5> I like the flexibility in the animations, but the mannerisms of each expression doesn't seem to fit well with the person. I wonder if this software will take advantage of characteristic expressions and not use the same animation points to produce expressions and actions.

</comment><comment><USER6> They eyes still need _lots_ of work. That's going to be the final frontier of the "uncanny valley". The eyes move, change focus and refract light differently hundreds of times per minute. It will make rendering realistic water look like an Amiga rendering a bouncing ball in 1989.

</comment><comment><USER7> wow, I'm curious how long those took to render.

what do you think, another two decades till actors are obsolete? ;-)

<comment><USER8> "Its flexibility allows for the software to be used in real-time game cinematics, pre-rendered projects, and even game trailers."

They might be able to run in real time, though the videos are probably pre- rendered.</comment></comment>


It took a long time for de Gaulle to become 'de Gaulle' - <AUTHOR> https://www.spectator.co.uk/2018/06/it-took-a-long-time-for-de-gaulle-to-become-de-gaulle/ <comment><USER2> On the international stage, de Gaulle had a strong drive to have France stand on its own, following the humiliation of the capitulation during WW2. As a result, he pushed for some policies whose impact we still feel today:

\- During Bretton Woods, he directed his delegates to maximize the allowance France had to buy back gold with American dollars, and use it to its full extent. This eventually led to Nixon abolishing the Gold Standard, turning the dollar a fiat currency. [1] To this day, France is the 4th largest hoarder of gold.

\- He pushed for nuclear development, founding the CEA (Nuclear Energy Commission) in 1945, and pushing for an independent nuclear deterrent against the USSR. Today, nuclear power provides 40% of France's electricity needs.

[1] [https://en.wikipedia.org/wiki/Nixon_shock](https://en.wikipedia.org/wiki/Nixon_shock)

<comment><USER3> Surprisingly, France has the worlds third largest nuclear arsenal at 300 weapons.

<comment><USER4> Why is that surprising? Until the 90s France had a nuclear triad, but the land component was dropped. We used to have more warheads, but still need quite a few to keep global coverage through submarines and aircrafts...

<comment><USER3> It's surprising because China has a billion people and a bunch of competing regional interests. Since WWII, the PRC has been at war or had armed conflict with India, Vietnam, the ROC, the UN (Korean war) and the USSR. There are also the ongoing territorial disputes in the South China Sea and continued border unrest on the Indian border.

France doesn't have any significant regional disputes around territory and hasn't been to war with its neighbours in about 75 years.

Yet France still has more nuclear warheads than China (officially, at least).

<comment><USER5> China is not surrounded by rivals, its also never been conquered. The chinese do not have the same existential fear that france does.

</comment></comment></comment></comment></comment><comment><USER6> FYI: the book reviewed here is called _A Certain Idea of France: The Life of Charles de Gaulle_ in the British edition [1], but simply _De Gaulle_ in the American one.[2]

In both cases, the book is by Julian Jackson.

[1] [https://www.penguin.co.uk/books/178767/a-certain-idea-of- fra...](https://www.penguin.co.uk/books/178767/a-certain-idea-of-france/)

[2] [http://www.hup.harvard.edu/catalog.php?isbn=9780674987210](http://www.hup.harvard.edu/catalog.php?isbn=9780674987210)</comment>


How to read an RFC - <AUTHOR> https://www.mnot.net/blog/2018/07/31/read_rfc <comment><USER2> Writing is hard. Writing clearly is harder. Writing clearly in a way that won't run the reader out of the room is harder still. So my hat is off to anyone writing an RFC.

Now there were a couple of fertile points in the article that could bear more development in another piece.

1\. An RFC sometimes focuses on the sender, without then turning to the receiver. For example, suppose it says that the Foo header must not contain Bar. So if a sender sends a header of "Foo: Bar" then it is clearly "nonconformant." But what is the recipient to do? Ignore it, send a certain error message, what? This is especially pertinent given that the Robustness Principle advises that you "Be conservative in what you do, be liberal in what you accept from others" ([https://en.wikipedia.org/wiki/Robustness_principle](https://en.wikipedia.org/wiki/Robustness_principle)).

The takeaway is, I think that the IETF should work it explicitly and prominently into the RFC template. In the editor's guide or whatever for how to write an RFC, it should call out this very problem and say something like, "For every rule you lay down, be sure to address how the recipient should handle it when the sender breaks the rule."

2\. RFCs should remember that readers are humans. For example, "In the example above, whitespace isn't allowed around the semicolon, but you can bet that some people will put it there." Right. Some people will put it there because for 20 years in everyday writing they have seen semicolons followed by whitespace. It is part of being a writer to not just put your claim in "grammatical English" but also to take into consideration the reader's culture and background. You can't say, "Well, there clearly is no whitespace in the Backus–Naur form that I painstakingly laid out for you." Humans are not computers. They are not functions. They do not always return the same output for a certain input. This is because they are always entertaining several streams of input, most of which you don't have control over.

</comment><comment><USER3> The favicon is a green lock: [https://www.google.com/s2/favicons?domain=www.mnot.net](https://www.google.com/s2/favicons?domain=www.mnot.net)

that's diabolical haha

<comment><USER4> Maybe Google should use their image recognition tech to detect and punish this.

I'm only half-joking, browser developers tend to take a very dim view of such misleading techniques.

</comment></comment><comment><USER5> Archive: [http://archive.fo/KHier](http://archive.fo/KHier)

Personally I think the most important thing about reading RFCs is to do it in the first place. Note that Arch Linux users can install the 'rfc' package to get them in /usr/share/doc/rfc/txt/.

<comment><USER6> Debian (and derived distros) also has several RFC packages. Principally: doc- rfc, doc-rfc-experimental, doc-rfc-fyi-bcp, doc-rfc-informational, doc-rfc- misc, doc-rfc-old-std, doc-rfc-others, doc-rfc-std, and doc-rfc-std-proposed.

[https://packages.debian.org/search?keywords=rfc](https://packages.debian.org/search?keywords=rfc)

<comment><USER7> Better link:

[https://packages.debian.org/source/sid/doc- rfc](https://packages.debian.org/source/sid/doc-rfc)

<comment><USER6> Thanks.

The full set can be large and isn't necessarily useful. Pulling subsets may be preferable.

</comment></comment></comment></comment><comment><USER8> Here is a site which does pretty print of RFCs - [https://pretty- rfc.herokuapp.com](https://pretty-rfc.herokuapp.com)

Also, while reading RFCs, following is handy -

MUST (absolutely required)

MUST NOT (absolutely prohibited)

SHOULD (highly recommended)

SHOULD NOT (highly not recommended)

MAY (meh)

<comment><USER9> I much prefer the [https://tools.ietf.org/html/rfc3986](https://tools.ietf.org/html/rfc3986) interface, I think it's pretty much perfect.

<comment><USER10> It isn't for printing though. The parent site looks way better in print preview.

</comment></comment></comment><comment><USER11> To address the elephant in the room: this is a repost, but it's really useful for newer programmers looking to familiarize themselves with the (still ubiquitous) RFC format, and there are always new programmers browsing HN.

<comment><USER4> You're imagining the elephant. There is no elephant.

Reposts are totally okay, explicitly said in [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

We need more reposts of cool submissions that were overlooked, not fewer!

The mods have even implemented _two_ systems to "rescue" submissions: invitations to repost with a bonus and auto-repost. And I'm also working on that, most of my submissions are reposts. :-)

</comment></comment><comment><USER12> Inspired by this topic I asked the question on how to read documentation [1] (I searched for it, it didn't seem to be there). I really could improve my documentation reading skills but don't know where to effectively search for it (I normally search on HN for quality content on technical topics).

[1] Ask HN: How to read documentation? -- [https://news.ycombinator.com/item?id=17670431](https://news.ycombinator.com/item?id=17670431)

</comment><comment><USER13> I already know the difference between "MUST", "MUST NOT", "MAY", "SHOULD", "SHOULD NOT", "Obsoletes", et al, but I still feel like there's an RFC code that I haven't cracked.

</comment><comment><USER14> the DHCP RFCs are some of my favorites (2131 and 2132) for clarity and ease of reading</comment>


Stored XSS in GMail for iOS - <AUTHOR> http://roy-castillo.blogspot.ru/2013/10/google-mail-hacking-stored-xss-in-gmail_11.html <comment><USER2> Nice to see a company deal with a security flaw with such grace.

It also shows that there isn't a blame culture inside the team, otherwise people would be looking to cover up this kind of report.

</comment><comment> mike-cardwell I found a similar vulnerability in Fastmail.FM last year. They weren't escaping filenames of email attachments, so you could inject script. Unfortunately they don't have a bounty program.

<plug> The flaw was discovered automatically by one of the tests in a web application which I authored: [https://emailprivacytester.com/](https://emailprivacytester.com/) </plug>

EDIT: I've added a new test to the tester, for hiding a script payload in the onerror attribute of an img tag in the From header of emails.

</comment><comment><USER3> It seems so simple and straight forward to do this attack, and the $5k pay day is a nice bonus too. But finding things like this must take a lot of time to discover. I would love to know about methodologies on how you can start to do penetration testing.

Does anyone have any recommended resources ? TIA !

<comment><USER4> [https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...](https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project)

[https://www.owasp.org/index.php/Top_10_2013-Top_10](https://www.owasp.org/index.php/Top_10_2013-Top_10)

[http://www.nsa.gov/ia/_files/support/I733-034R-2007.pdf](http://www.nsa.gov/ia/_files/support/I733-034R-2007.pdf)

[http://www.nsa.gov/ia/_files/factsheets/TSA-13-1019-FS.pdf](http://www.nsa.gov/ia/_files/factsheets/TSA-13-1019-FS.pdf)

[https://code.google.com/p/skipfish/](https://code.google.com/p/skipfish/)

[http://google-gruyere.appspot.com/](http://google-gruyere.appspot.com/)

[http://www.google.com/about/appsecurity/tools/](http://www.google.com/about/appsecurity/tools/)

[http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w...](http://googleonlinesecurity.blogspot.com/2010/11/rewarding- web-application-security.html)

[http://www-01.ibm.com/software/tivoli/governance/security/ap...](http://www-01.ibm.com/software/tivoli/governance/security/application- security.html)

[http://www-01.ibm.com/software/tivoli/products/security- netw...](http://www-01.ibm.com/software/tivoli/products/security-network- intrusion-prevention/web-application-security.html)

[http://msdn.microsoft.com/en- us/library/ff649874.aspx](http://msdn.microsoft.com/en- us/library/ff649874.aspx)

[http://msdn.microsoft.com/en- us/library/ff649461.aspx](http://msdn.microsoft.com/en- us/library/ff649461.aspx)

Source: typing "web application security" into google.com

You could probably also search for "Hacking Forums" or something similar and find lots of black hat resources.

<comment><USER3> THANK YOU !

</comment></comment></comment><comment><USER5> Why is he using Google Analytics for sending the XSS?

<comment><USER6> There are two options:

1) He is using Windows and is not using Burp or ZAP proxy for modifying http requests. With Windows you can't use <>"= in a filename.

2) Gmail is handling emails from Google Analytics a bit different. (I don't think so)</comment></comment>


LuaJIT: New Garbage Collector (2012) - <AUTHOR> http://wiki.luajit.org/New-Garbage-Collector <comment><USER2> Previous discussion, with comments from Mike Pall and Patrick Walton:

[https://news.ycombinator.com/item?id=4053969](https://news.ycombinator.com/item?id=4053969)

Github issue, which Mike said "is up for takers":

[https://github.com/LuaJIT/LuaJIT/issues/38](https://github.com/LuaJIT/LuaJIT/issues/38)

<comment><USER3> FYI: from 4.5 years ago

</comment></comment><comment><USER4> Mike Pall is a super hero. Not sure what his secret identity is, but the origin story is [http://www.pagetable.com/?p=656](http://www.pagetable.com/?p=656)

</comment><comment><USER5> IIRC this project was abandoned after Mike Pall stepped down from LuaJIT maintenance.

<comment><USER6> What does he do right now?

<comment><USER7> What's his day job? Internet is dark about this guy.

<comment><USER8> I've met Mike Pall in person. I've worked with him some since I helped facilitate a sponsorship from Google ([https://opensource.googleblog.com/2010/01/love-for- luajit.ht...](https://opensource.googleblog.com/2010/01/love-for- luajit.html)). A lot of his work on LuaJIT has been supported by various sponsorships (see: [https://luajit.org/sponsors.html](https://luajit.org/sponsors.html)). This gives him a lot of freedom to work the way he wants to, instead of working as part of a larger organization.

Also note that the sponsorship page says that Mike is currently working on "unrelated projects", so apparently things besides LuaJIT are keeping him busy now.

<comment><USER9> What did he work on before LuaJIT? Seems like he could have been involved in CPU design? He thinks more like a hardware guy than a C programmer.

<comment><USER8> I don't know that much about his background. I didn't get much of a chance to talk shop with him (which is too bad, I would have loved to pick his brain about all sorts of things). I also assume from the lack of info about him on the Internet that he's a somewhat private person, so I definitely wanted/want to respect that.

</comment></comment></comment></comment></comment></comment><comment><USER10> Project updated as recently as June. [http://wiki.luajit.org/latest_changes](http://wiki.luajit.org/latest_changes)

</comment><comment><USER11> Is there something about lua that makes it amenable to the performance of luaJIT? In priciple, would it be possible to get comparable performance out of something like pypy?

In other words: is getting pypy to perform like luajit "just" a matter of time/money/expertise, or are there technical considerations?

<comment><USER12> Mike Pall said,

 _Well, nothing really. It 's just a matter of engineering, i.e. man-years put into the VM and the compiler._

He has a few posts on Reddit regarding this subject: [https://www.reddit.com/user/mikemike](https://www.reddit.com/user/mikemike)

<comment><USER13> That quote was in context of

 _What in your opinion keeps LuaJITs performance away from C /C++, i.e. what other "hard" things need to be solved?_

<comment><USER11> TBH that was the spirit of my question. I was wondering if there was something special about Lua (the language), and it seems like the answer is a resounding "no".

So basically, I should donate to pypy...

<comment><USER13> I'm not sure I could call that "resounding" \- for one a PyPy dev disagreed with him in a sibling thread.

> Yes, you can go a long way without extra APIs etc, but sometimes there is > info that's available, that's simply not there, because it's only in a > programmers head.

[https://www.reddit.com/r/programming/comments/19gv4c/why_pyt...](https://www.reddit.com/r/programming/comments/19gv4c/why_python_ruby_and_js_are_slow/c8owc5t/)

</comment></comment></comment></comment></comment><comment><USER14> _The new garbage collector should be based on well-researched and proven algorithms, together with a couple of thoroughly evaluated innovations, where appropriate. The real innovation should be in the specific mix of techniques, forming a coherent and well-balanced system, with meticulous attention to detail and relentless optimization for performance._

Sometimes I feel there's an inverse correlation between the strength of claims for the future and the end result.</comment>


Computational and Inferential Thinking – The Foundations of Data Science - <AUTHOR> http://www.inferentialthinking.com/ <comment><USER2> From here you can download this as .pdf .epub or .mobi [https://www.gitbook.com/book/ds8/textbook/details](https://www.gitbook.com/book/ds8/textbook/details)

</comment><comment><USER3> Can someone recommend some books that would pair up nicely with this? Or like maybe the next two books to read after this.

<comment><USER4> David MacKay: Information Theory, Inference, and Learning Algorithms

Kevin Murphy: Machine Learning: a probabilistic perspective.

Christopher Bishop: Pattern Recognition and Macine Learning

<comment><USER5> These three are all excellent, but I'm not sure they pair well with the OP's book, which is written purely from the frequentist perspective. The books practically speak different language.

</comment></comment></comment><comment><USER6> Thanks a bunch, I've been looking around for a good data science text to read to get an intro to the field, and this seems like a good place to start.

</comment><comment><USER7> Should I import an extra library? The first code example uses a function called read_url(), that's not a native python function.

</comment><comment><USER8> via: [http://www.inferentialthinking.com/chapter1/observation- and-...](http://www.inferentialthinking.com/chapter1/observation-and- visualization-john-snow-and-the-broad-street-pump.html)

> _Snow used his map to convince local authorities to remove the handle of the > Broad Street pump. Though the cholera epidemic was already on the wane when > he did so, it is possible that the disabling of the pump prevented many > deaths from future waves of the disease...Snow's map is one of the earliest > and most powerful uses of data visualization. Disease maps of various kinds > are now a standard tool for tracking epidemics...Though the map gave Snow a > strong indication that the cleanliness of the water supply was the key to > controlling cholera, he was still a long way from a convincing scientific > argument that contaminated water was causing the spread of the disease._

I like the treatment the book gives to Dr. Snow's statistical reasoning, so I am surprised to see it give this kind of weight to his cholera-dot-map (canonization by Tufte, notwithstanding).

Other scholars seem to think the map was largely incidental to Snow's investigation -- he was not the first to use such a technique. Furthermore, others had used it to argue exactly against what he sought to prove:

> _What sort of medical cartographer was Snow? Today a considerable part of > his reputation hinges on his role in mapping the Broad Street outbreak, so > it is essential tial that the historical assessment be accurate. When Snow > modified his original map for the CIC, he introduced a substantial > cartographic innovation by explicitly indicating cating the line of > equidistance among the pumps. (Ironically, his CIC map is much less well > known today than the more common and less accurate version of the map in > MCC2.)_

> _Overall, however, Snow viewed his mapping activities as a minor aspect of > his investigation of cholera. He never used his map as a true investigative > tool, unlike Cooper and von Pettenkofer, whose theories of cholera > transmission are today day discredited. The structure of MCC2 makes clear > that Snow intended his south London study to be the centerpiece in > supporting his theory. In essence, the Broad Street investigation was merely > preparation for the main event. It is due largely to the connection between > Broad Street and a visually appealing icon, the map, that today 's reader > often gets it backward and attributes to the Broad Street investigation an > importance that Snow never assigned to it in comparison with the much more > extensive and conclusive study of the south London data._

Peter Vinten-Johansen;Howard Brody;Nigel Paneth;Stephen Rachman;Michael Rip;David Zuck. Cholera, Chloroform, and the Science of Medicine: A Life of John Snow (pp. 336-337). Kindle Edition.

> _As for influence, it's pretty to think of John Snow unveiling the map > before the Epidemiological Society to amazed and thunderous applause, and to > glowing reviews in The Lancet the next week. But that's not how it happened. > Its persuasiveness seems obvious to us now, living as we do outside the > constraints of the miasma paradigm. But when it first began circulating in > late 1854 and early 1855, its impact was far from dramatic. Snow himself > seems to have thought that his South London Water Works study would > ultimately be the centerpiece of his argument, the Broad Street map merely a > piece of supporting evidence, a sideshow._

Johnson, Steven (2006-10-19). The Ghost Map: The Story of London's Most Terrifying Epidemic--and How It Changed Science, Cities, and the Modern World (p. 198). Penguin Group US. Kindle Edition.

Here's a blog post that sums up the main points: [https://petewarden.com/2010/10/21/visualization-myths- around...](https://petewarden.com/2010/10/21/visualization-myths-around-snows- cholera-map/)

It's not that the map is trash -- it correlated with what Snow postulated. And besides being accurate, it happens to be the easiest way to be introduced to his work and theory. But it's not the map that caused him or his contemporaries to make that link. He was already persuaded by his past research. And giving so much weight to the map somewhat diminishes the amount of investigative work he did to find the data for that map. Visually, the map was not a conclusive argument for Snow's theory and could have been used just as well to argue the miasma theory.</comment>