Should States Spend Billions to Reduce Class Sizes? - <AUTHOR> http://fivethirtyeight.com/features/should-states-spend-billions-to-reduce-class-sizes/

<comment><USER2> Well, it depends.

You could have a classroom with 70 highly motivated students, and love it. You find this in Africa were teachers are scarce and respected, children are abundant and want to learn.

I went to visit a female friend that leaved everything in Europe(executive in a bug multinational, a good house) to help and teach poor children in Africa. After going there and seeing it myself I understood: those kids were the best students ever and they loved their teachers so much.

On the contrary in wealthy countries it is common to find someone in each class that does not want to study and does not want anybody else in the class to study too. That makes teaching a bad experience.

<comment><USER3> Do wealthy countries like Iceland have this problem? They have very small class sizes and high-ranking school systems.

<comment><USER4> Extrapolating anything from Iceland seems dubious. Since it is tiny (300,000) and so culturally and racially homogenous (84% of Icelanders apparently belong to the official state Luthern church).

[http://en.wikipedia.org/wiki/Demographics_of_Iceland](http://en.wikipedia.org/wiki/Demographics_of_Iceland)

</comment></comment></comment><comment><USER5> The extensive research by John Hattie shows that reduced class sizes has a small but positive effect on student achievement but relative to other factors, it is very inefficient:

[http://visible-learning.org/hattie-ranking-influences- effect...](http://visible-learning.org/hattie-ranking-influences-effect-sizes- learning-achievement/)

One explanation to reduced class sizes not having a larger effect is that teachers, given smaller classes, rarely change their practice to optimize for the new situation.

<comment><USER6> > teachers, given smaller classes, rarely change their practice to optimize > for the new situation.

Or maybe that given all of the increased rules, regulation, and standardized testing, they don't have the freedom to.

<comment><USER5> True. If I remember Hattie correctly, he argues something akin to that reducing class sizes is mostly a political move (it's certainly not research based) — and after spending huge amounts of money on that — there is no political incentive to spend at least as much on retraining teachers.

Also, if some of the money had been spent on professional development instead of reducing class sizes in the first place, his research shows that the effect of that on student achievement had been much, much higher.

</comment></comment></comment><comment><USER7> Politically, Washington is one of the more interesting places I've ever lived - there's a majority for Massachusetts-style spending, but there's also a majority for Texas-style taxation. Combine that with the voter initiative system and a cultural boundary line that has nothing to do with the state boundary line, and you get one hell of a predictable mess.

I assume the state will eventually tip demographically in favor of the coast and end up resembling California, with high income taxes and a pissed-off but powerless interior, but I've got no idea how long that's going to take.

<comment><USER4> >I assume the state will eventually tip demographically in favor of the coast and end up resembling California

So do you think that this will be a result natural population growth, migrants from California/Oregon, migrants from other U.S. states, or migrants from other countries? I tried to look up population trends for various counties, but it isn't as straightforward as I had hoped. It seems like there should be a heat map showing population growth per county, so that we could see which counties are growing fastest. Also it would be interesting to look at the population trends east and west of the Cascades. Somewhere this data must exist, I'm surprised that it isn't in an easy to digest form, or that tracking it down hasn't been simple.

<comment><USER7> I honestly haven't done the research to back up my assumption that the more left-leaning areas west of the Cascades are growing faster than the rest of the state, fueled by migrants from other left-leaning urban areas.

It _would_ be interesting to see population trends and voting behavior changes by county over time.

</comment></comment></comment><comment><USER8> >>"Hire thousands of new teachers"

If you MUST hire thousands of new teachers, I'd imagine the quality of the teachers would decrease.

I wonder if there's a point where this whole exercise becomes counter- productive. Are two bad teachers > one great teacher?

<comment><USER9> Maybe we already don't have great teachers. Maybe we're between a global max of a few great teachers and a local max of lots of not-great teachers, sitting in a global min of a few not-great teachers.

<comment><USER3> Exactly. It should be, are two mediocre teachers better than one mediocre teacher? Yes.

</comment></comment></comment><comment><USER10> > In 2012, the Washington State Supreme Court ruled the legislature had failed > to uphold its "paramount duty" to fully fund the state's educational system.

For those in other states who might be wondering why the Court would find that the legislature had a "paramount duty", it's in the State Constitution [1]:

\</comment><comment></comment><comment></comment><comment>

ARTICLE IX EDUCATION

SECTION 1 PREAMBLE. It is the paramount duty of the state to make ample provision for the education of all children residing within its borders, without distinction or preference on account of race, color, caste, or sex.

SECTION 2 PUBLIC SCHOOL SYSTEM. The legislature shall provide for a general and uniform system of public schools. The public school system shall include common schools, and such high schools, normal schools, and technical schools as may hereafter be established. But the entire revenue derived from the common school fund and the state tax for common schools shall be exclusively applied to the support of the common schools.

\</comment><comment></comment><comment></comment><comment>

[1] [http://leg.wa.gov/LawsAndAgencyRules/Pages/constitution.aspx](http://leg.wa.gov/LawsAndAgencyRules/Pages/constitution.aspx)

</comment><comment><USER11> >>"We can't operate under the premise that we're only willing to spend a certain amount of money on our children's education."

Love that! Instead we must operate under the assumption that we're willing and able to spend an _infinite_ amount of money on education!

That kind of brilliant analysis is part of how governments manage to waste tons of money ineffective programs.

<comment><USER12> You completely misunderstood that point. The real issue is when you focus on 1 number you tend to lump ineffective programs with effective programs and have no idea what to cut or what to focus on.

The important thing is not the $ spent it's the long term ROI on money spent. Consider we could replace some instruction time with high cost videos as it's not like every classroom really needs a slightly different lecture on the distributive property.

If the ROI is high enough we might be better off paying for education with loans. But if it's to low that's a sure way to long term ruin.

EX: Handing out ice cream for anyone with perfect attendance for a semester. Sure there 'cheap' but pointless = wasteful. Ramp that up to handing out ice- cream every Friday for perfect attendance and you might actually make some difference. But, the cost is probably not worth it. Again, the value is not keeping under some specific number but maintaining positive ROI.

</comment></comment><comment><USER13> > The initiative will cost nearly $5 billion through 2019, a hefty sum > considering that the state's current two-year budget for public education is > around $15 billion....Project STAR is the gold standard in class-size > reduction literature because it's the only randomized study on the issue > that's been conducted since the early 20th century...Florida's program cost > $20 billion over eight years, about the same as the estimates for the > Washington initiative. And Project STAR was estimated to cost about $400,000 > for each student who eventually went to college, compared to $133,000 for > HeadStart. "Reducing class size is one of the most expensive things you can > do in education," Chingos said.

And people keep asking whether we can afford, ethically or financially, to run randomized trials...

</comment><comment><USER14> Fire administrators, hire teachers.

<comment><USER15> I used to agree with this mentality, but I've seen first-hand how important a really good principal can be. Over the past three years my kids elementary school has turned around the direction of test scores, teacher attrition, and the overall mood and enthusiasm of the whole school staff.

One great example from last year was when the school was facing budget cuts after a bond failed. Rather than cut any teachers or staff, she was able get a massive PTO fundraising effort to bring in tens of thousands from the local community. She also worked with local businesses to donate thousands of dollars worth of paper, office and maintenance supplies, and even food for some of the fundraising events.

<comment><USER16> I'm just a layman, but I wonder if that sort of ability from a n administrator is exactly the sort of thing that would be less likely to happen with larger and larger administrative staffs?

<comment><USER17> If you're swamped by your administrative duties, you're unlikely to find the time + energy for the kind of initiatives described here.

Getting rid of the "overhead" is a cop-out. With fewer (administrative) people, you're going to get less administration done - people aren't going to magically do more work. If you can pinpoint those tasks that are relatively unnecessary, you're got a real contribution to make. However, that's often surprisingly tricky, which is why in all kinds of cost-cutting debates people pretend theres this "overhead" that's nicely pre-categorized and ready to cut.

If only it really were that simple.

</comment></comment></comment></comment><comment> jack-r-abbit > _it needs to hire thousands of new teachers, counselors, teaching assistants > and librarians._

More teachers and assistants I get. Same number of students in smaller classes means more classes which means more teachers (and their assistants). But more counselors and librarians? Those people generally don't have a dedicated class. The librarians are in charge of the library. The smaller class size isn't going to mean more students. So why would you suddenly need more librarians to serve the same books to the same students? Same with counselors. Why would you suddenly need more counselors to counsel the same number of students?

<comment><USER18> You'll likely need more schools to handle smaller class sizes or to expand existing schools. If the former, then you'd definitely need additional counselors and librarians since a new school would need its own support services. If the latter, then you only need additional counselors and librarians if the expansion to the school also brings in additional students and doesn't just spread the existing students across more rooms. On the other hand, you may need to expand the library to accommodate more classes needing access to it simultaneously. I know my high school had two libraries largely for that reason (also because it was a poorly designed building, but the space was well utilized for social studies and English courses).

<comment> jack-r-abbit Since opening a new school has far more cost than just hiring more teachers, it didn't even occur to me that it would have been the route they would take. But I do realize that a new school facility is going to need a full set of faculty to support it. That includes principals, janitors, admins, etc. I just assumed they'd be expanding existing schools with "portables" and such.

</comment></comment></comment><comment><USER3> Japan and Korea, famous for their high-achieving students, are also famous for another thing: huge class sizes. Larger than those in the USA.

Sure, classes are different, teachers are different, but the culture to push your kids to succeed is different as well. The parents are to blame for so many of the problems in our schools. I'm guessing parents in Japan and Korea don't go to a kids school and fight the teacher when they have bad grades.

</comment><comment><USER19> Even a 1:1 teacher-student ratio would not improve education if that teacher cannot respond and adapt to the needs of the student. If that teacher is bound by a common curriculum and testing regime, or an otherwise rigid administration, you might as well teach with a bunch of robots.

Bring on the anecdote. Math is taught by very different methods now than those I remember, and I shudder to think about what is being taught in class now when my child can do a homework worksheet and get every single question on it completely wrong. And the reason, as far as I can tell, is because the curriculum is sometimes using logarithms and decimal-shift operations to teach multiplication and division. They are literally teaching kids to simulate the mechanical processes behind slide rules and abacuses in their brains in lieu of just memorizing the multiplication table. The entire system seems constructed around the complete avoidance of rote memorization.

But that is how I learned to multiply. Memorization of the multiplication table from 0x0 to 9x9 was absolutely required. You could not progress at all if you could not quickly look up any of those 100 numbers. 55, really, thanks to multiplication being a commutative operation. Or 36 if you could also remember that 0xn=0 and 1xn=n.

Rather than ask kids to memorize and index those 36 numbers for quick recall, I see piles of nonsense about "compatible numbers" and "reasonable numbers" and other concepts of dubious value outside the narrow context of quickly selecting the correct answer in a multiple-choice test, without actually doing the work.

I actually had to teach my child that the exact answer to a math question is, in fact, a reasonable estimate.

To top it off, judging from Feynman's anecdote about being on a textbook selection committee, this same nonsense, or cleverly repackaged iterations of it, has continued unabated for decades. Wakalixes make it go. Wakalixes pay the bills. Wakalixes extract the tax dollars and deliver it to the rent- seeker. And the students continue to learn, or fail, largely based upon whether their individual teachers care more than the median amount.

The economics of public education create too wide of a separation between the interests of the student and the signers of the checks. No matter how hard you push on that rope, the load will barely move. Adding more money will not help when there is already very little connection between the amount spent and the observed outcomes.

</comment><comment><USER20> That is a question that should be asked directly to those that will be providing the money to be spent.

But luckily we live in a democracy and those who don't contribute a dime get to choose how much I should contribute to this. Less work for me. Less money too. But at least government employees get a nice pension so it's all worth it. Plus if we didn't do it this way then there's no other way at all - it's the government's way or the highway.

God bless democracy.

<comment><USER18> > But at least government employees get a nice pension so it's all worth it.

Educators get poor pay, somewhat decent benefits, and an ok pension. Their working conditions (especially for new teachers, and this is largely the problem with retaining them) are pretty crappy. They put in 7-8 hours of instruction time a day. After 3rd or 4th grade (in many states) they're teaching a specific subject area, so they have 100+ students they see each day. That's 100+ papers to grade, exams to grade, parents to contact for various reasons. And they have to do all that in their planning period and after school hours. That's effectively two full-time jobs that they get paid (depending on the state, for a new teacher with just a bachelor's degree) between $25k and $40k to do. They can get extra money by sponsoring clubs or coaching sports teams. But then that eats into the time they have to spend on the academics they're hired to teach, and puts them up to 2 full-time jobs and one half-time job (depending on the number of clubs or particular sport).

God bless democracy for fucking over yet another generation of students by cutting corners on education. Something we decided a few hundred years ago was one of the government's primary responsibilities.

<comment><USER21> > Educators get poor pay, somewhat decent benefits, and an ok pension

I hear this relatively frequently (my wife is a teacher and so are many of our friends), but I disagree. I think saying it is "poor" depends on what you compare it against.

The median earnings for a bachelors degree in the US is about $58k. In my county in MD, a teacher 10 years into their career makes $50k. Although, at this point teachers are required to get a masters.The masters scale goes all the way to $82k at 30 years.

IMHO, the pay is fairly well in line with the norm. If count the benefits and pension, which are better than the norm, then you could argue it is quite good.

<comment><USER18> Starting pay for teachers by state, averaged (varies district to district) [0]. DC (admittedly, not actually a state, but a separate entity so should be counted here) is the highest at $51,539. The rest are mostly well below that mark. Since pay for teachers is primarily time and not merit based, I searched for a few specific examples. In the state of GA you can find what an individual is paid by the state if you know their name. I found a friend with 9 or 10 years experience who's only making $41k (no masters degree). Another friend, same job and county, making some $47k with about 15 years of experience. Same county, elementary school teacher with 1 or 2 years experience made $30k. I've run out of teachers I know in that district.

This is, for this county, "good" pay. This is not, for the level of responsibility and time commitment required of them, good pay. They're expected to maintain their certifications on their own time. They're expected to remain current on the field they teach on their own time. They're expected to finish their masters degree on their own time and dime. All with less than $50k income and having families.

$82k for a professional after 30 years with a masters degree is not "good pay". It's ok pay. It's certainly enough to keep them out of debt, I'd hope, but it's not going to make up for the 12+ hour workdays they'll have spent most of their adult life dealing with. And it takes 30 years to get to that point in your state. Do they get tuition assistance for that masters degree? What's the average cost and how much of that pay raise is actually spent dealing with the debt incurred in paying for the degree?

[0] [http://www.nea.org/home/2012-2013-average-starting- teacher-s...](http://www.nea.org/home/2012-2013-average-starting-teacher- salary.html)

EDIT: The teachers I looked up teach in the same district so they're getting the same locality adjustments so it's an apples-to-apples comparison. Going one county north results in boosted pay, but it's simultaneously a wealthier county and scarier (violent crime in schools) county.

<comment><USER4> Another fact that many commenters on this thread have overlooked is that U.S. schools operate about 175 days per year (compare that to 240 days for 52 weeks minus 10 holidays minus 10 vacation days).

[http://nces.ed.gov/surveys/sass/tables/sass0708_035_s1s.asp](http://nces.ed.gov/surveys/sass/tables/sass0708_035_s1s.asp)</comment></comment></comment></comment></comment>


Half a Person - <AUTHOR> https://thepointmag.com/2019/examined-life/half-a-person <comment><USER3> In the interest of full disclosure, I am a middle-aged male. Although I have children, I have never borne one.

It seems to me that our discourse around abortion is _woefully_ inadequate. Tribal politics and social media are, as in many other areas, doing us no favors here. My wife and I have discussed what we would do if one of our daughters became pregnant as a teenager. Those discussions were difficult - <USER2> THEY SHOULD BE.

There are no simple answers here. And yet society is built to only want simple answers.

</comment><comment><USER4> It isn't at all what I was expecting and it's quite the good read. An excerpt:

 _I suspect that few humans have had the experience I had that day: communing with an artistic visionary while miscarrying a baby you would never know whether you wanted. Let me try to communicate to you what that is like._</comment>


Valve and HackerOne: how not to handle vulnerability reports - <AUTHOR> https://blog.jakegealer.me/valve-a/ <comment><USER2> I think Valve and HackerOne handled this poorly, but I think the author is partially at fault for repeatedly failing to communicate the issue clearly.

I worked as a penetration tester for a while, and I had trouble understanding what the author was saying. The headline should have been that the steam mobile app makes requests to the plaintext HTTP URL ([http://store.steampowered.com](http://store.steampowered.com)) instead of the TLS-authenticated URL ([https://store.steampowered.com](https://store.steampowered.com)). Without TLS, an attacker can impersonate the Steam store server and steal credit cards or trick users into installing malicious apps.

The author reported this as:

> _The vulnerability is that an attacker can perform a man in the middle > attack by spoofing an HTTP request pretending to be from > store.steampowered.com. While the client does check for an eventual HTTPS > redirect, it can redirect to an HTTPS URL._

There's so much ambiguity and missing information in that writeup:

* Who does the attacker send an HTTP request to? I think the author meant to say an HTTP _response_.

* In "it can redirect," does the word "it" refer to the "the client" or "redirect?"

* I think "it can redirect to _an_ HTTPS URL" was supposed to be " _any_ HTTPS URL."

* _Why_ is the client vulnerable? What should they be doing instead?

Also, the author's exploit scenario is to just make the Steam app load his portfolio page, which might have further muddled things. It sounds inconsequential that an attacker can trick Steam users into visiting a developer's portfolio page. It might have been a clearer report if the proof- of-concept redirected to a website that looked like the Steam store but had a warning saying, "I'm an evil copy of the Steam store that will steal your credit card number."

<comment><USER3> _> I think the author is partially at fault for repeatedly failing to communicate the issue clearly._

I disagree. The first sentence of the report includes "HTTP", "man in the middle attack" and "store.steampowered.com"

If that isn't clear to someone, they are not sufficiently trained to triage vulnerability reports. You simply cannot do that job right if you need the attacker to hand-walk you through the difference between HTTP and HTTPS and why you would use the latter for an online store.

<comment><USER4> Since I see people on HN get this wrong more than 90% of the time I want to demystify the term _Man in the Middle_.

[https://en.wikipedia.org/wiki/Man-in-the- middle_attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)

The Wikipedia article's description is correct. MITM is a cryptographic attack where an impostor is performing certificate interception and so relays encrypted traffic. MITM is not merely listening to just any traffic.

If the violation occurred over port 80 its a safe bet there is no man in the middle attack. If I were doing security triage and I saw "man in the middle" and anything about HTTP or port 80 I would not consider this a priority ticket.

This incident is just a software defect rather than a security violation from the unexpected use of a reverse proxy: [https://en.wikipedia.org/wiki/Reverse_proxy](https://en.wikipedia.org/wiki/Reverse_proxy)

An unsupported reverse proxy was only possible because the site was transmitting over HTTP instead of HTTPS.

> If that isn't clear to someone

It isn't clear merely because you used the scary term: _MITM_. A trained security professional performing triage would devalue the security ticket pending further investigation.

<comment><USER5> You are contradicting thr WP description, there is no cryptography required to meet the definition:

"In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other"

The WP definition is the commonly accepted one too, not a case of WP getting it wrong.

<comment><USER4> > "In cryptography and computer security, a man-in-the-middle attack (MITM) is > an attack where the attacker secretly relays and possibly alters the > communications between two parties who believe that they are directly > communicating with each other"

If the attack is redirecting traffic away from the server at what point does the server believe it is communicating with the user? The server cannot validate the user traffic since it does not have it.

> The WP definition is the commonly accepted one too, not a case of WP getting > it wrong.

That is the opposite of what I said.

<comment><USER5> My comment was just on the misconception of what MITM is.

That being said, I do think the article's documented report clearly demonstrated how the app was vulnerable to MITM even if the PoC didn't implement the attack all the way. And as a word of advice to the vendor, you probably don't want to train all your well meaning vulnerability researcher pals to productise their vulnerability PoCs into production quality exploits, lest they get the temptation to sell them on other types of markets...

</comment></comment></comment></comment></comment></comment><comment><USER6> Companies receive so many "First, you have to be on the other side of this airtight hatch, then you..." reports that anything that looks even remotely like it will just get summarily closed. My personal favorite ones start with some form of "I copied the user's cookies from device A's file-system, and..."

Just some suggestion on how to report these kind of things, because there is an actual underlying issue here worth fixing. It's good that you didn't mention the reverse proxy. Next, don't say "spoofing an HTTP request" in your first sentence of the report, that's an immediate red flag. If you have access to spoof something on the network, it's already not an issue for 99% of people and an instant low priority. Instead, say "Steam insecurely relies on a redirect response to upgrade the hosted content from HTTP to HTTPS, instead of directly establishing the HTTPS connection". How this can be exploited is now much more general than just being a spoofing issue, with both the problem and solution clearly stated.

<comment><USER7> I've been on both sides of this, and sadly having HackerOne/BugCrowd as intermediaries often hurts more than it helps.

On one hand I've had to sort through the never ending stream of "if you bypass the safeguards first" issues and some guy in India copying and pasting open source vuln scanner reports. I get why people don't want to deal with this and outsource it.

On the other hand, I have a legitimate exploit against GitHub that is "working as intended" for months now. No amount of back and forth is going to convince them that leaking commit messages on enterprise accounts is serious apparently.

<comment><USER8> > No amount of back and forth is going to convince them that leaking commit > messages on enterprise accounts is serious apparently.

If true, this deserves a write-up.

I'm sure a few enterprise accounts might agree, if anyone can see their dev- branch commit named "feature xyz" a month before they announce it.

<comment><USER9> Joke's on you:

        trying to fix bug
        maybe this?
        fuck
        idk
        idk
        idk
        maybe works
        k ready now

<comment><USER8> But also: "fix stupid fucking sql injection"

</comment></comment></comment></comment></comment><comment><USER10> I've reported one bug to HackerOne so far, which was a bug with Wordpress that allowed you to access the title of _unpublished_ posts. Months went by with no reply, despite clear demonstrations of how it could be exploited.

Eventually I demonstrated the attack on Techcrunch's site to a Techcrunch reporter, showing him the titles of their upcoming news stories for the coming week, including embargoed news. They got in touch with HackerOne/Wordpress and it finally got resolved a month or two later.

I don't feel like HackerOne added anything positive to the mix, other than a layer of confusion/delay.

</comment><comment><USER11> HackerOne started with such promise, but stories like this keep coming out. It makes you wonder how many people were even more patient than OP.

Unfortunately, despite all the HackerOne claims, it still seems to take public disclosure and embarrassment to make companies actually take things seriously. Seems sunlight is still the best disinfectant.

<comment><USER12> And if the claims of HackerOne/Valve trying to get out of paying a bounty, that's just terrible, because a lot of these exploits can be sold to nefarious actors for much much more.

Not paying out the promised bounty, to me, basically spits in the face of independent (and ethical) security researchers.

<comment><AUTHOR> Trying to put myself in the shoes of the Valve employee: I don't think they were trying to save their company money, but it still wasn't a smart move.

As a security team employee, I think it's easy to react defensively to every vulnerability report, to take them as critiques of the quality of your work. So it's natural for the first reaction to be jumping to "this is not a real report" or "this is a dupe".

But people in this position should think about the upside/downside of their actions.

ACCEPT - Upside: You show that your security team is responsive, you build trust with an active security community member. Downside: Your company pays out some fee (so tiny in big picture)

DENY - Upside: Your company doesn't pay out a fee. Downside: Usually a net negative for your company's reputation in security community, some chance you cause PR issues for your company.

</comment></comment></comment><comment><USER13> This HackerOne thing seems weird. It's like they looked at Google and decided "let's apply their customer service, but for security researchers." With this model, things like this blog post inevitably follow -- including the "they ignored me until I complained on Twitter, then they instantly fixed it". (Classic.)

I took djb's "Unix security holes" class in 2004 and he advocated for just disclosing the security hole immediately, things like this haven't changed my mind. I know people want the money, but it's peanuts and doesn't seem worth the hassle unless you're really young. Nobody is going to spend months looking for obscure bugs for $10,000 when they could get paid that in a week to write the bugs (accidentally) in the first place.

It all makes very little sense to me. If you care about security, you'll have a team like Project Zero. Anything else is just applying the "gig economy" to engineering work, and the results are pretty predictable. It's kind of sad.

</comment><comment><USER14> Important life lesson: drop 0days on twitter, you wont get bounties, but at least you will get recognition and job offers.

<comment><USER15> My guess is that, like the crypto wars, disclosure fights are going to happen every generation.

There was a big discussion about this in the 90s. Vendors would sit on bugs forever, frequently simply to suppress knowledge of them rather than fixing them. Hackers rebelled; some simply published what we now call 0days, others would publish on a non-negotiable timeline. Eventually, "responsibly disclosure" became a norm.

Looks like companies have once more figured out how to game the process, so their counter-parties are going to renegotiate. And the cycle of life is complete.

</comment></comment><comment><USER16> This is an overall problem at bigger companies. The machinations that decide priorities often do not understand engineering things and thus never prioritize the fixes. It's not uncommon to see engineering items that would take 30 minutes to fix get hours of engineering man hours in discussion about "should we fix it?" and "when?" .

I tend to sneak these little things into my PRs cause I cant stand to see them linger w/o cause

</comment><comment><USER17> I'd like to add a different take to this. I have contacted Valve support in the past, clearly stated my problem, and got a response that looked like they read half of my question and responded without reading the entire thing. If the same team that responds to their customer support reads this stuff, which seems crazy, they didn't bother to understand the problem before responding.

</comment><comment><USER18> I don't get the "this issue is a duplicate so we won't pay" business. If I find a serious issue that's still unpatched and someone tells me "Ops it's a duplicate sorry!" I'm still going to ask for payment. If I don't get it, it's a given that I'm going public - assuming it is legal to do so -. Why doesn't everyone do that?

I'll go even further and say that price negotiation should happen at every disclosure. If you're not satisfied with the price you're getting, go ahead and make the vulnerability public ASAP - assuming it is legal to do so -. It's about time companies that have invested nothing in security compared to their profits and their parasitic middlemen like HackerOne acquire proper incentives. Right now, they are getting away with having the public subsidize their security procedures AT MASSIVELY REDUCED costs. This has to stop.

<comment><USER19> > If I find a serious issue that's still unpatched and someone tells me "Ops > it's a duplicate sorry!" I'm still going to ask for payment. If I don't get > it, it's a given that I'm going public.

Probably because I think what you've just described could be viewed as extortion, which is illegal in many locations? Also, it doesn't really do you any favors, I think. You'll get a week or less of recognition as finding an exploit, and then the story will come out how you both sniped someone else's find and possibly caused damage on purpose for your five minutes of fame.

To be clear, it's the initial monetary request and actions because it was denied that makes this entirely mercenary and would not reflect well on you. You were obviously willing to sit on the exploit for a while for some cash, so you no longer have any moral arguments to rely on for your behavior if you release it immediately, and the fact that it's not original just makes it worse. I imagine your reputation for security matters might never recover.

There are ways to get the moral defense back, but it requires waiting a while to see if it actually gets fixed and not taking it public immediately (so it actually is for their unresponsiveness and not just because they didn't pay).

</comment></comment><comment><USER20> I do not understand why HackerOne has such good reputation. My experiences are almost uniformly bad.

<comment><USER21> The reputation was earned years ago.

</comment></comment><comment><USER22> >This means 1 of 2 things:

>They're trying to get out of paying bug bounty money: I guess this is the more extreme perspective to take here, but considering the whole experience, a definitely possible one. I wasn't here for the bug bounty money, I have work by this point, but if there's some younger child trying to get into security research doing this, this could be enough to massively demotivate them if they were promised it from the HackerOne page.

>They had someone who posted the same bug either weeks or months in advance: This means that Valve left someone else hanging for an insanely long time. This is equally messed up.

I can't understand that in the age of blockchain buzzword bullshitting companies, in one instance where the immutable public ledger would actually be useful (for instance with sha512 hash of initial report) it isn't used. It wouldn't be very complicated and it would immensely help their trustworthiness.

<comment><USER23> I've had or heard quite a few conversations about patent bounties inside of companies that love patents, and there's a very common rule (that ends up being gamed) that each of the first N contributors gets X dollars, and if more than N authors exist then they all split NX dollars.

Unfortunately such a strategy could also be gamed by a bug bounty. If I split 150% of the bounty between all people who reported the bug within a time interval, I could just tell a buddy who has moved out of town about it and end up with a bit more money between the two of us. Either in exchange for him giving me half his bounty, or by returning the favor later.

<comment><USER22> I don't think that splitting is usually necessary. If the company can prove that someone already reported it and there are not too long delays to fix the vulnerability, I would think that people would accept that this time they were not the first and they will try next time knowing that no one tries to screw them.

</comment></comment></comment><comment><USER24> I have gone thru similar issues with Valve/Hackerone recently... [https://hexpwn.github.io/2020/two-plus-year-old-steam- vulner...](https://hexpwn.github.io/2020/two-plus-year-old-steam- vulnerability/)

</comment><comment><USER25> Valve is notorious for ignoring any vulnerability reports

<comment><USER16> any other sources?

<comment><USER26> Only anecdotal, I once tried to report a persistent XSS issue on the game "hub" pages. After weeks of going back and forth with support (this was before the likes of hackerone) the ticket was closed and the issue was ignored.

<comment><USER27> On the other hand, before they started moving to HackerOne, they fixed several issues I reported either the next day or within a week or so. Their security@ was incredibly responsive.

Now it seems it takes forever (I have reports waiting to be paid from them too, even ones they have already fixed.)

<comment><USER28> Yup. Have dozens of issues reported to security@, and responsiveness was great- usually human response same day, often in hours. H1 is veeeery slow by comparison, but, hey, I've made five figures off it so...

</comment></comment></comment></comment></comment><comment><USER29> >For a simple MITM exploit that can be fixed by replacing "[http://"](http://") with "[https://"](https://"), this is simply unacceptable.

I think the author is really not understanding the complexity of updating to an [https://](https://) url inside of a mobile applicaiton. Valve is most likely using a self signed cert so that would require bundling the certification in with the app so that Apple/Android allowed it to load inside of a webview. This is not nearly as simple as just updating all of the urls in the app to [https://](https://) and the fix could very well take a few months. Furthermore, loading the store page is not necessarily a vulnerability to valve as if you are able to re-direct it, you wouldn't have access to any of the Steam user specifics, (like account data). It wouldn't be much different than putting a shady link somewhere on the internet, and people navigating to it.

<comment><USER30> Why would they use a self signing cert? They could use a real Cert. It's Steam. They can afford real certs, or just use LetsEncrypt.

There is absolutely no reason for the app to connect to a login/authentication service (or any service) over plain text, period! There should be unit tests that scan for [http://](http://) and will fail the build if found in the code or resources.

I know some things are not simple fixes, but this is absolutely a fix that can be done and we should all know how to do. It should have also been made a security priority and pushed through.

<comment><USER29> A self signed cert is a a real cert, its just not provided by an CA authority. I guarantee you this http just redirects to an https location, (just tested it on my own device), so there is no plain text transfer. In the mobile industry this happens all the time as backend endpoints grow and change.

<comment><USER31> The bottom line is, there's no reason to request the non-HTTPS connection in the first place. And there's apparently no checks in the app to make sure it's connected to their real server.

<comment><USER29> >The bottom line is, there's no reason to request the non-HTTPS connection in the first place.

The example I gave wasn't to excuse the issue, it was to maybe explain why the fix is taking so long.

> And there's apparently no checks in the app to make sure it's connected to > their real server.

I don't think you can make that statement. The description of the issue only attempts to hi-jack the session, he didn't actually try to do anything with it. There may very well be checks in place.

</comment></comment></comment></comment></comment><comment><USER32> You can't actually do arp spoofing/hijacking at an ISP level. This is because arp/mac addresses don't have much impact on traffic when crossing a layer 3 (network/router) boundary.

</comment><comment><USER33> Reading stories like this really make me hate these customer service walls we've put up everywhere. Only a couple of times in these exchanges did it seem like there was a functioning, thinking human intelligence on the other end. All of the robo-responses are depressing, including the human-generated ones. And it's even more discouraging when you have to hear about their company's internal chaos and disorganization. Really gives me a low opinion of this HackerOne organization.

</comment><comment><USER34> Just drop a line on twitter saying you've discovered a vulnerability in $popularSoftware and mention $company. Say you'll be disclosing in 90 days if $company doesn't issue a reply publicly.

Make sure to deal with an actual human and that everything is done according to best practice. You may even get publicity this way and even if it's unethical it can be sold or used to your advantage.

If they care, _trust_ me when I say they will make an effort. Most places (like Google) have effective systems in place for dealing with such queries.

<comment><USER35> > Say you'll be disclosing in 90 days if $company doesn't issue a reply > publicly.

That's blackmail. An expedient way of getting your door breached.

<comment><USER36> The idea that your would get a no knock forcible entry for disclosing a bug is appalling and potentially an indictment of our entire criminal justice system.

I'm assuming vntok's legal conclusion and claim of the type of law enforcement response is true (please do not make things up on hackernews).

In which case my former support for the police and low and order is SERIOUSLY diminished.

You have a non-violent offense, that is not an actual offense, and they are doing swat door breaches on you. wow! The priorities of these companies and law enforcement is backwards then.

I guess folks are being told to just sell it to a zero day vendor (which also happens to work for the same govt agency that will bust down your door if you disclose publicly). Pretty appalling behavior here!

<comment><USER35> "Hey, @WhiteHouse, while interacting with your systems with the intent to find security flaws and obtain unauthorized access (I wrote scanners and tools and payloads so you know I really wanted to succeed here), I've found a security flaw that allows me to launch nuclear warheads from my garage in Misouri. I will publish this info online if you don't meet my demands. You have less than a month to comply."

Yeah, that kind of bullshit won't fly in any sane criminal justice system. Now replace "launch nukes" with "download every movie you're working on" or "flash-crashing the stocks market at any time", you'll see that the argument doesn't change: it doesn't fly anywhere.

</comment></comment></comment></comment><comment><USER37> In a way, this is the same problem that we see with tech hiring & recruiting. Most gatekeepers are less technical than the most tehcnical developers they gate-keep, but still necessary because 80-90% of reports(in case of security)/applicants(in case of hiring) are unqualified. Anyone who is qualified enough to screen without false positives can probably get a better job.

</comment><comment><USER38> Responsible Disclosure does not mean waiting for arbitrary and unilateral decisions from a company just to be undervalued.

If your argument for responsible disclosure equally applies to this post, a $100 payout and to a $100,000 payout - as long as its from the company that needs to patch the exploit, then re-evaluate your argument.

</comment><comment><USER39> has there ever been good news about hackerone?

</comment><comment><USER40> I know barely anything about encryption, but this reads to me like the parties involved don't understand that public key cryptography defeats MITM attacks (at least as I understand it)?

<comment><USER41> The vulnerability is that there _was_ no public key encryption, hence allowing a MiTM to redirect the steam app to their own site.

</comment></comment><comment><USER42> Wait steam client does not even use https??

<comment><USER43> If I read it correctly, the mobile app first connects to the store page on http, which then gets redirected to the https version by their server. So probably a typo / misconfiguration in the app. The store itself uses https everywhere. If you intercept the first request you can display whatever you want to the user tho.

</comment></comment><comment><USER44> How is this a vulnerability?

<comment><USER45> The vulnerability, on the high level, is that the Steam app doesn't verify that the store page comes from Valve, meaning that if you own a Wifi hotspot you can potentially scam and cheat the users of the Steam app. This wouldn't have been possible with basic use of SSL by the app.

That's what makes this bizarre – the negligence of developers, the triviality of the fix and the complete lack of understanding from people who are supposed to be reviewing security issues.

<comment><USER46> The report could have been better worded IMO, it hardly explains the trivial issue or the trivial fix. Preferring to go at length about what if the ISP is hacked and other crazy scenarios.

It wouldn't hurt to say that they simply have a typo in the URL. http instead of https.

</comment></comment></comment><comment><USER46> How is that vulnerability? If the ISP DNS gets hacked people can intercept traffic. Seriously this is the best attack scenario he could come with with?

From what I understand. It seems the steam app is connecting to plain http [http://store.steampowered.com/](http://store.steampowered.com/) so it could be man in the middled.

Unless I am missing something, it's way overblown. Valve please fix the URL to https and send that guy a $50 Amazon voucher.

<comment><USER16> at this point they should send him $250 for having to deal with their atrocious bureaucracy</comment></comment>


Show HN: Kotlin Multiplatform Mobile – Hacker News Client App - <AUTHOR> https://github.com/sendilkumarn/top-hn-news <comment><AUTHOR> Likes:

\- Use the platform for the UI related things

\- Shared module acts as a separate backend (business logic) makes it easy to modularise the apps

\- Easy to bootstrap, run, and test apps

Dislikes

* Difficult to debug sometimes

* Maintenance might be a problem if the app grows

* Mundane manual tasks like icon setting for apps and other common functionalities

PS: It is a minimal implementation. Did just for learning:)

</comment><comment><USER2> Anyone else getting a github 404 on this?

<comment><USER3> Yap, repo probably became private? If it was moved or renamed github usually redirects.

<comment><AUTHOR> oops my bad! It was private. Changed it :)</comment></comment></comment>


3 benefits of improving your burn-down charts - <AUTHOR> http://blog.in-sight.io/3-benefits-insights-burn-down-chart-adds-to-your-pivotal-tracker-projects/

<comment><USER2> Agile stuff like this just reeks of micro-management to me. To add insult to injury I recall one presenter at an Agile conference a few years ago explain how they added a "delta" value to their velocity so they could also report on the rate of change of their rate of change... Funnily enough they stopped short of just calling it "acceleration". Ugh though.

I have yet to see this type of process and measurement add value or productivity to a project. But perhaps that's just my experience.

<comment><USER3> Yeah. My old group at Microsoft started doing "agile" and it just turned into a micromanagement field day, with PMs and middle management in meetings examining charts and calling people on the carpet for missing their estimates.

Look, they're _estimates_ . . . often made by other people than the ones doing the work.

(Oh, and having the build break for two or three weeks running didn't help the "estimates" very much. A culture of build breaking just rewards the people who are less careful than others).

I finally got the PM on our project to call our scrum meetings "status meetings" instead, because that's exactly what they were. Status for rollup into the Great Burndown Chart.

Over two years out of that garbage and I'm still bitter.

When you hear the words "Yup, we do Agile, but we have our own take on it," run away, because it's going to suck hard.

<comment><USER4> > When you hear the words "Yup, we do Agile, but we have our own take on it," > run away, because it's going to suck hard.

Agile _means_ doing it your own way. It _means_ customizing what works for the team and the particular tasks.

 _Scrum_ is a fixed methodology with a rulebook.

(A lot of time "Agile" gets used to mean "Scrum" but the two aren't the same, or even the same _kind_ of thing, though the Scrum Book is an often not- unreasonable _starting point_ for an agile organization.)</comment></comment></comment>


Ask HN: Why can't we follow HN users - <AUTHOR>

Yes, I know its very facebook/twitter, but there are occasion where I would like to follow certain people and their conversions as opposed to just following a story. What do you think? Would it take away from the essence of HN? <comment><USER2> Facility provided: <http://hackerfollow.com/>

</comment><comment><USER3> You can. Here's your feed:

<http://news.ycombinator.com/threads?id=lachlanj></comment>


Initial Covid-19 infection rate may be 80 times greater than originally reported - <AUTHOR> https://news.psu.edu/story/623797/2020/06/22/research/initial-covid-19-infection-rate-may-be-80-times-greater-originally <comment><AUTHOR> I post this curious to hear criticisms. As someone that ticked the ILI number and also tested negative for antibodies recently, really hard to know what to make of all of this.

My understanding is that I should be able to trust a negative test for antibodies. Such that I have to think there was a higher than normal ILI season. Such that, at face value, I can't trust this paper. Right?

<comment><USER2> I think given the 85 to 99% probability[1] that any particular person hasn't been infected you can more or less trust a negative result. The flip is positive results are likely to be false positives.

[1] Current preponderance of the evidence gives those numbers. Unless the person was part of an outbreak cluster in a communal living situation like prisons, cruse ships, or nursing homes. Or a work place like a big open office, meat packing plant, etc.

<comment><AUTHOR> That is my point, I know how those numbers land. Such that with those numbers, I agree I should trust it. But this paper seems to paint that as not the percentage. With the seemingly crazy story regarding blood type recently, it definitely has me doubting some.

(For a little more context, I and my entire family of six had fevers near the start of this. With me having a very hard time breathing. Was worse than when I had walking pneumonia. Like I said, I ticked the ILI number, they even sent me for an x-ray. Was before we acknowledge community spread here in Seattle, though.)

Don't get me wrong. Not doing anything "risky". Nor do I want to hurry a reopening. The narrative around all of this is hard to swallow, though.</comment></comment></comment>


What is Zuul? - <AUTHOR> http://zuul.com/

<comment><USER2> One giant flash based advert, apparently.

</comment><comment><AUTHOR> I'm actually curious, I'm not just trying to market whatever this is. No one knows?</comment>


Matt Maroon: Demo Day B and Beyond - <AUTHOR> http://mattmaroon.com/?p=267

<comment><USER2> "I think Y Combinator should always do a Boston demo day first, even during the winter session, just to give people the practice."

Pretty hilarious. Or sad.

</comment><comment><USER3> Matt, do you know where the bad poker players in Somerville hang around? I, uh, need to raise some angel money, and Seabrook is a schlep.

<comment><USER4> I don't know of anything closer than Foxwoods and Mohegan Sun.

<comment><USER3> Seabrook is closer than Foxwoods. It's in NH, and if you can't make money at their hold'em tables then it's probably time to take up backgammon. The downside is that by state law, there are no cash games available other than 2-2 limit. You can still play tournaments for higher stakes though.

</comment></comment></comment><comment><USER5> Great chutzpah setting the record straight in front of everyone. Note for presenters: Have a contingency plan if your demo breaks that involves something other than insulting a guy who's doing you a favor. Good restraint saying "I wasn't seeing any video" rather than "their demo was unrehearsed and the product didn't work".

Cambridge sounds even worse than I thought. YC should do everything in SV and just have a trip out to Boston for demo day -- although from the sound of it there's not much point, if the Boston investors are such that the East Coast bunch has to move to SV for funding anyway. Good for warmups for the SV investors, though.

If you want to give your start-up the best shot, why spend all that time in the distant-second place (Boston is #2) when you could be in #1?

</comment><comment><USER6> I wish that big chunk of bitmapped type he has at the top of every page was antialiased. The ugliness distracts from his thoughts on poker, Guitar Hero, and other profound topics.</comment>


CORS isn't just for XHR - <AUTHOR> http://remysharp.com/2013/01/14/cors-isnt-just-for-xhr/ <comment><USER2> It's also used to enable serving cross-origin web fonts.

In the case of the author, he wants to use Flickr images in an HTML5 canvas element. I would set up a server-side proxy for that (didn't see this mentioned either).

<comment><USER3> If you host on a service like Heroku, server-side proxying ties up a dyno needlessly. If you can get the host to enable CORs, you can save a lot of hosting money. I'm not sure if it's as worthwhile for self-hosted/VPS setups.</comment></comment>


A letter from Drew and Arash - <AUTHOR> https://www.dropbox.com/s/ojgr88g4h8z8ka9/FounderLetter.pdf?dl=0 <comment><USER2> The only other comment right now recounts a negative experience that is surely not common. I offer a balancing positive story of my recent experience.

Between 2012-2016 I was studying for my PhD. I kept all my files in Dropbox (as well as some other places, but Dropbox was the one place I trusted with everything at once). I was paying for a premium account at the time, and had dozens of GB of stuff stored in my account. I stopped paying for it in 2016.

Yesterday I wanted to show someone a protein model image [0] I made during my PhD. I logged into my old Dropbox account, and found all the content preserved there. I haven't paid them for two years, but they archived all my stuff and asked politely for me to reactivate the account in order to sync it again. But I can retrieve individual files if I don't pay. That's an extremely gracious and dependable service, compared to my experience of other companies.

Congratulations Dropbox on your IPO, and on creating a product used seamlessly by hundreds of millions that really makes people's digital lives easier.

Having experienced such high-trust service, I'm going to start paying them again.

0: [https://www.dropbox.com/s/1wb68r1otlqqa8u/rubisco_coloured_3...](https://www.dropbox.com/s/1wb68r1otlqqa8u/rubisco_coloured_3d_model.png?dl=0)

<comment><USER3> That's awesome. I love Dropbox too. I had created a file in the Dropbox folder and deleted by mistake and my CrashPlan failed to backup it during that period. Kinda my fault as I didn't keep the laptop open long enough for CrashPlan to index and run backup between the file was added and before it was deleted. Dropbox had a copy of it, among deleted files, when I needed it at work after some time. That's when I started paying for it upgrading from free account.

Now if only they would offer client side encryption[0] - at least optional. Maybe with slower search or some missing features or an inferior experience to those customers who want this.

It would just become even more awesome :)

[0] [https://www.dropbox.com/help/security/private- key](https://www.dropbox.com/help/security/private-key)

</comment></comment><comment><USER4> Sort of off topic: Linking to a dropbox file is a pretty terrible way of publishing what should have been a blog post instead. How can you tell whether this is legitimate or just some guy who set their display name to Arash?

The UX design (which they are usually praised for) is pretty subpar for this page in general. The "..." button seems to be broken(on firefox on linux) and there's a useless comment pane that isn't autohidden and has a grayed out "enable comments" button for no reason. (EDIT: It seems this only happened because I am on a 4k resolution monitor so I guess it's forgivable)

<comment><USER5> What about Dropbox Paper?

<comment><USER4> I don't use Paper, I was complaining about the UX of the page in this submission specifically.

... But I tried looking up Paper just now and saw that their register page, [https://www.dropbox.com/paper/register](https://www.dropbox.com/paper/register), has broken UI too:

[https://i.imgur.com/ZyZxDSK.png](https://i.imgur.com/ZyZxDSK.png) (blue text on blue background)

I really don't get why Dropbox gets praised for their attention to detail.

</comment></comment></comment><comment><USER6> That's a letter from a generic marketing drone. It would have been much more interesting to hear from these people as human beings today. I guess they can't be real people in public any more.

Sincerely, though: congrats on the IPO. I always liked the main product. The Linux support is a differentiator I appreciate.

</comment><comment><USER7> I think creating the right environment for work starts with the internal/mental environment first. And this starts with developing a new design theory.

Mindful design, as I define it, is a theory designed to preserve connection, respect/grow attention, responsible use emotion as an input, and be anti- addictive. It starts with human centered design (where innovation practices currently are, to my knowledge). From there, we add mindfulness, nonviolent communication, category theory, and computer science to hack our language so we can better communicate with each other.

I'm tired and know I'm leaving things out here, but this is where I started researching over a year ago. I'm now working on a programming language for humans to program themselves through with the written/spoken word being the only technology required for it to work. I'm looking for help from anyone interested.

<comment><USER8> I'm interested in this and may have thoughts / want to hear what you have to say.

</comment></comment><comment><USER9> I know I'm cruisin' for a bruisin' here karma-wise, but I just don't understand what they are trying to do with their company mission.

From my perspective, Dropbox actually facilitates an old, broken way of creating and sharing documents using desktop applications from the 1990s and earlier. Google, by combining drive with docs, allows users to completely escape desktop applications, which to me is really the next generation of computing. To make this more concrete, if a company adopts Google Drive, they can issue employees much cheaper computers (lowering capex) because they don't have to be able to run heavyweight OS and application software like Windows and MacOS. Dropbox isn't even an entrant into that space, and I don't really see how they could compete.

When I look at a company and find out they're using Dropbox, I always think to myself that they probably made that choice either because they've been using it for a long time, or because they didn't want to go to the effort to change their business processes to really embrace network computing. I imagine office workers running Word instead of Chrome, and that bothers me. Either way, I see Dropbox positioned as a stopgap to allow companies to _avoid_ plowing ahead with new work paradigms while still enabling sharing of files without using things like USB keys.

I don't work for either company, never have. But I remain confused about Dropbox's mission. Short of being acquired by someone, I can't see the way forward for them. But, they just raised a ton of cash, so I'm as excited as anyone to see what they try.

EDIT: I want to briefly respond to the argument in this thread that it's a _good_ thing that Dropbox doesn't tie an office suite to sharing files. I simply disagree. I don't see how that is a real concrete negative to anyone unless it's for political reasons ("I don't want Google to be too powerful"). I _do_ however see how it's a problem for the vast majority of office workers who, using Dropbox, have to either keep using desktop applications or (shudder) create documents in something like Google Docs and then reupload them into Dropbox. So, at best Dropbox's independence strikes me as neutral, but for most people it seems clearly negative.

<comment><USER10> Dropbox's core product is trying to tack on P to CA systems. The CAP theorem explains how well this will actually work out. It's good they raised a bunch of cash, because they need to diversify their product base beyond that confused core. Time will tell if they do or not. Currently, I do not view them as a good long term investment.

<comment><USER9> Thanks for the reply. It's a shame you're the only person who saw what I wrote before the yes-man crew came along and downvoted me.

</comment></comment></comment><comment><USER11> > Imagine how much better equipped we'd be to tackle humanity's biggest > challenges.This is the world we want to live in. We hope you'll join us.

"Imagine all the people sharing all the world...I hope some day you'll join us. And the world will be as one."

\- John Lennon

Drew, you picked worthy source material.

</comment><comment><USER12> As I read this it sounded a lot like what basecamp and 37 signals have been saying and doing for a while.

</comment><comment><USER13> > Imagine if every minute at work were well spent—if we could focus and spend > our time on the things that matter. Imagine how much more inspired we'd be. > Imagine how much better equipped we'd be to tackle humanity's biggest > challenges.This is the world we want to live in. We hope you'll join us.

Geez. You are a file hosting service. Stop pretending like you fixed the world's hunger or something.

<comment><USER14> They're setting out a grander vision for what they can be, _what they need to be_ in the future in a world that demands constant growth.

And in tech, if you don't keep moving forward, you get killed.

<comment><USER15> Dropbox has been standing still/regressing slowly for about 9 years, and they seem to have been doing... fine.

<comment><USER16> The site turned from a sober recreation of Explorer to an unholy Material design JS mess.

The features are all there (that I notice), but the performance has horrible. If Dropbox is about user friendliness, they can render the HTML on their server.

</comment></comment></comment></comment><comment><USER17> What does this mean, besides the corporate garbage?

</comment><comment><USER18> Fan mail induced high.

</comment><comment><USER19> Legitimate question: how is Dropbox not effectively dead in the water? Between GDrive use driven by close integration with Gmail/GSuite and iCloud having major user capture, I don't understand where Dropbox is necessary or wanted anymore. If someone sent me a link to a Dropbox file instead of uploading to GDrive, I would find that weird and might even call them out on it. This applies to most people I know across a variety of demographics. Is there some secret massive trove of Dropbox users I'm simply not aware of?

Speculation: momentum of people who were early on the cloud adoption curve who are implicitly/behaviorally entrenched by accrued data volume. That doesn't sound to me like the foundation of a solid business with growth potential (see: IBM). Those kinds of users are ultimately going to be fairly price sensitive given the substitutability of the product and therefore not marginally monetizable. They may already also perceive themselves as paying an 'inconvenience penalty' vs GDrive/iCloud.

Honestly, this looks like exactly what it might very well be: rich Silicon Valley investors dump a squeezed, has-been company into the frothy public market to tap into 'dumb' liquidity.

I should clarify I don't have anything against Dropbox itself. I do have a problem with pushing a dud into the public market at an irresponsible valuation to effectively defraud uninformed people and desperate institutional investors with low accountability who are facing a drought of good return opportunities (e.g. mutual fund and pension fund managers). You can hem and haw around it all you want ("oh they'll build new features", etc), but the growth expectation baked into their valuation is more or less predicated on extrapolating a pattern of success they are unlikely to be able to replicate. Cloud storage is commoditized and they're competing against monster platforms that are better positioned than them to capture new business and siphon their existing users (applies even in enterprise, arguably they lose against Box but certainly against Microsoft and now even Google). So they're being paid to try to tap into new verticals as very late contenders (e.g. Dropbox Paper)? There's no there there. It's wrong. In my opinion, it's fraud and only slightly less awful than the behavior surrounding the dotcom bust.

<comment><USER20> > _how is Dropbox not effectively dead in the water? Between GDrive use driven > by close integration with Gmail /GSuite and iCloud having major user > capture, I don't understand where Dropbox is necessary or wanted anymore._

\- It came first.

\- It does one thing and does it well.

\- It does it across all platforms.

\- It isn't tied to other product offering. That's _a feature_ , not a bug. It means Dropbox isn't pushing other bullshit on you, unlike GSuite/Office356, where file syncing is a second-class citizen meant to encourage you to use relevant company's cloud office suite.

\- Therefore, it's free to offer integrations between usually competing companies. It integrates with GMail just as well as it does with regular Word documents. But integrations are still a side story, they don't interfere with the core competency - being a folder that syncs.

Seriously, I'm not sure why would people use OneDrive or Google Drive, when there's Dropbox.

<comment><USER21> I use Dropbox and gsuite drive. Dropbox is for easy to access file sync and gsuite is for backing up 30TB. All hail rclone.org

</comment></comment></comment><comment><USER22> Probably wasn't a great idea to shit on Groupon, Linked in and Slack...

</comment><comment><USER23> Dropbox just deleted 4GB of design files I needed for work. Their customer support is bewildered at why it can't be restored. Build a good product before you try to inspire me with stupid garbage. You're not a thought leader. Fire your spiritual guru. I'm so tired of tech founders thinking they are somehow philosophically relevant because they got lucky & made money.

<comment><USER24> Sorry you lost your files; that really sucks. However, just because something has flaws that can affect some people, doesn't mean their product is garbage and the founders know nothing of value.

I don't work for dropbox, but they're clearly doing something right or they would not have been able to keep so many customers happy enough to keep giving them their money.

That said, just because they were successful their opinions should not necessarily be treated as gospel or the path to riches for others. Survivorship bias is something to keep in mind: [https://www.entrepreneur.com/article/287440](https://www.entrepreneur.com/article/287440)</comment></comment>


Top remote-first tech products for the remote working community - <AUTHOR> https://remote.tools <comment><AUTHOR> Hey everyone!

I strongly believe remote working is the future of work. I have been working as a remote co-founder for over a year now and have tackled multiple issues along the way. One of the biggest hurdles was to find the right combination of tools to help me work effectively. I was surprised how there was not a single resource which conclusively recommends top products for specific use-cases. Hence, I decided to take it upon myself and built remote.tools.

Would really love to hear your feedback on the product. Shout out if you like remote.tools :)

</comment><comment><USER2> Remote.tools has a great collection of tools and a couple of real lesser-known gems. Shout out to @hrishikesh1990!

</comment><comment><USER3> An entire curated list of useful tech tools for the remote community!

</comment><comment><USER4> Go-to solution for remote workers indeed!

</comment><comment><USER5> Useful tools for the remote community.

</comment><comment><USER6> Great collection of useful tools!

</comment><comment><USER7> Great set of tools :)</comment>


Git as a NoSQL datastore - <AUTHOR> https://github.com/pauldowman/gitmodel <comment><USER2> I want ACID in my databases:

      - Atomic -

Yep, but done with a global lock.

      - Consistency -

Yep. Since it's NoSQL, there's no referential checks, so this is easy. Git itself probably wants index / commit tree has to be readable, and all attributes.json files be valid. I don't see any reason it wouldn't be.

      - Isolated -

Sure, works fine, due to that global lock.

      - Durable -

Check. Once it's written, it's written.

So, git doesn't get you any of this for free, and getting Atomic / Isolated is done by introducing a big ugly global lock. I guess I don't see the appeal of using git (or even a model like git) because it doesn't get you any interesting necessary features for free. I see the backup and history thing as a secondary feature -- neat, but not worth sacrificing ACID for.

That said, cool idea -- there's not a lot of code you need to get to a reasonably small codebase.

<comment><USER3> Maybe you should just think of it as the NoSQL version of sqlite3 but with added version control.

<comment><USER4> What does that even _mean_?

<comment><USER5> I think "easy to set up" combined with "less crappy than expected". Although SQLite isn't very crappy at all...

</comment></comment></comment></comment><comment><USER6> I wrote code to do this in python for a project. The biggest problem I ran into was that if you wanted the full history of X/Y/Z.json to contain the full history of Z.json, even if it had been moved, it ended up requiring two parallel structures. One structure with directories for the tree data, one for the raw data of that node.

My intent was to use it in a document system using Operational Transforms, which side-stepped the issue of concurrent access; only the canonical representation of client data would need to be written, so it was serial writing

</comment><comment><USER7> Huh, I was half-way to creating something in the same vein, while trying to use Git as the "world-state synchronization protocol" for a distributed MOO. Back to the (much-simplified) drawing-board :)

</comment><comment><USER8> I don't think its intended to be used for frequently changed models like 'user'. It is much more suited for low change frequency document like models. For example 'content' model in a blog or cms.

having history might not be a big deal, but having branches IS!.

It is great for stuff like testing some new set of pages on a staging server and then 'adding' them to the currently running production server which kept changing while you were working on the stage. Try that with SQL!

<comment><USER9> Yes, it would be a lot more appropriate for things that don't change that frequently. I actually started writing a blogging app for coders, and then succumbed to a bout of extraction distraction by generalizing the part that read the pages/posts from a Git repo: <https://github.com/pauldowman/balisong>

</comment></comment><comment><USER3> Also of interest and in a similar sort of spirit:

Bup: Git based backups - <https://github.com/apenwarr/bup>

<comment><USER10> In the same vein: Gibak.

<http://eigenclass.org/hiki/gibak-backup-system-introduction>

<http://eigenclass.org/hiki/gibak-0.3.0>

<https://github.com/pangloss/gibak> for an improved fork (last commit in 2008, but still...)

</comment></comment><comment><USER11> I also thought about similar project. Git based active model has some drawbacks and not for every project for sure. It's not so good if there are many users making a lot of changes to data (like facebook). But it's very interesting for applications when few users make changes on site and site looks like static for rest of visitors (applications like any CMS). And we are getting a lot of cool git features for free.

</comment><comment><USER12> Well, sure, git provides an append/log-based distributed hash store. It's probably not what you're looking for, though: It doesn't have a library for efficient in-process access, so you need to spawn a git shell command per operation, with somewhat opinionated semantics. It's also GPL'd.

It's good for prototyping, though. (And I hear it's good at managing changes for source code!)

<comment><USER13> "It doesn't have a library for efficient in-process access"

<https://github.com/mojombo/grit>

<comment><USER12> Ah, via Ruby. _RUBY?!??!_ Ah. Delightful.

 _YECCH_

So, uh, can't we just make an efficient, well-designed, C library for accessing those data structures, write BSD-licensed wrappers as consenting adults, and get on with our lives? I'm speechless.

Is writing an append-only log data-structure system really that hard? Ok, then.

<comment><USER14> What's stopping you?

<comment><USER12> Git itself works fine, for my purposes. If _I_ wrote a C library for managing git's data structures, it would basically be out of spite. I may make a Lua wrapper for libgit2, though - it's more what I had in mind (though it's too bad it's GPL'd).

I have a library for managing distributed graphs on top of an append-only log file, but it's got different design trade-offs than git does - It's for a specific C/Lua project, and the semantics of the data don't match git's.

<comment><USER15> libgit2 is GPLed, but importantly also has a libgcc-style exception.

</comment></comment></comment></comment></comment></comment><comment><USER16> This could be interesting for projects where keeping revisions would be handy, for instance a note-taking or document platform.

<comment><USER17> Yes - how about Tomboy/gnote integration?

</comment></comment><comment><USER18> have you done any performance tests? how well does git scale in general for when you have billions of files and versions?

this gives me some ideas, good stuff.

<comment><USER19> i have seen that these huge deployments of git run into problems, that is why git is less than perfect as a system-wide backup tool.

</comment></comment><comment><USER20> In a somewhat related note, see also Venti: <http://doc.cat-v.org/plan_9/4th_edition/papers/venti/></comment>


Ask HN: printed presentation on a 10 minutes 1-on-1 pitch session? - <AUTHOR>

I have an argument with a friend of mine. Imagine there will be a 10 minute pitching opportunity, held in a format of a 1-on-1 meeting (in a meeting room or something like that). There is just one person representing investor and one person representing a startup company.
Investor's representative is familiar with the target market.
He will have this pitch session within a larger 1.5 hrs session of pitches (10 minutes each).
My point of view is that it does not make much sense to prepare and print a 3-4 pages presentation, but rather use time to communicate without having to turn pages (either yourself or having investor's representative to turn them) and lose eye contact with the guy whenever he looks down into the presentation; and obviously leave a one page exec summary behind.
His point is that it makes sense to attach a 3-4 pages presentation to the executive summary and generally make him see it so he'll kinda think "wow this guy is well prepared" and it will make him remember you better.
What do you think, who's right? :)
Thanks! <comment><USER2> I'd rather have a 10 pages presentation for this meeting, without any descriptions of basic things in the problem area, of course, but with a skeleton of my speech. Just chatting is the good thing, especially when it takes place in a pub, but I would like to left alt least something tangible for an investor that will help him (or her) to ensure easy returning to the subject of conversation in future. Without having such skeleton it would be quite easy to forget all we're talking about. There's nothing about how to create impression about "well prepared guys", really, it's just a practical behavior.

</comment><comment><USER3> In reality you would never make an eye contact 100% of the conversation time. I've recently read in one non-verbal behavior book, that people tend too look somewhere else when talking to others and making a point. This does not indicate they're not interested, on the contrary - this shows they are trying to concentrate. So, unless you have a plan which involves you speaking all of the time forcing the other to look you in the eye, chances are the person representing investor would make a brief look at all the pages while asking you another question.

</comment><comment><USER4> Well if you are not expecting investor to take money out of his pocket (or hat) after that pitch you surely have to prepare (a) executive summary 1-2 pages (b) slides/screenshots 1 page(can be four colorful slides on it) just because this guy might want to share something with other decision makers. Of course if you dont think that after your pitch will suddenly became beter advocate for your project than yourself ))</comment>


Ask HN: Please stop using TL;DR - <AUTHOR> I've noticed recently some people using the TL;DR abbreviation to give summaries of stories posted here. I don't like this trend because to me the point of HN is to read the articles and comment on their content, not to read a tiny summary and comment on that.
I think commenting on TL;DR will lead to poorer discussions because commenters are relying on the TL;DR being an accurate summary. It could well be that the TL;DR has an editorial slant from the person who makes the summary.
And often the point of stories on HN is not some tiny summary or moral, but a long article with many different points and data that are hard to summarize.
Also, I'd argue that reading a long piece (especially if it contains an illustrative story) is much more memorable than a summary like this. <comment><USER2> I think you missed the point of a TL;DR. I have always treated TL;DR as an abstract to a paper. It kind of sets the stage and presents the conclusion in a concise way so that if one is still interested in the full content of the paper, they can read in depth. For example, if the title is interesting enough for me to get to the page/post. The TL;DR basically packages and refines the crux of the topic so that I can get the gist of the post.

Of course, it would be plain stupid to try to get involved in a discussion without actually getting into reasoning for the conclusion but then there is no solution to stupidity.

<comment><AUTHOR> And this is why I post things to Hacker News. An intelligent reply with a useful, different perspective.

</comment></comment><comment><USER3> Like semicolons in general and abbreviations in online discussions, "tl;dr" is both mis and over used.

There is a trend among authors to use it as a stand-in for "In conclusion" and another trend among commentators to use it as an introduction for dismissive snark.

"Too long" inherently implies fault with the writing. When used by an author it is often an excuse for bad writing. Only on rare occasions is it endearing self deprication...or rather it is just possible to imagine such circumstances regardless of their actual occurrence.

On the other hand, its use by a commentator carries the negative connotation that the author's writing isn't worth reading.

tl;dr: Don't use "tl;dr."

</comment><comment><USER4> _to me the point of HN is to read the articles and comment on their content_

Hear. Hear. I think of Hacker News as a community of people who know how to read, and who appreciate good writing. Submissions to Hacker News should be from reliable sources and submitted with the original article titles in the first place,

<http://news.ycombinator.com/item?id=4624933>

so the reader should already receive a signal from the submission and its title that it is worth a read to the end, and a signal of what the article is about.

 _And often the point of stories on HN is not some tiny summary or moral, but a long article with many different points and data that are hard to summarize._

Yes. The best submissions to HN have some consideration of more points of view than just the author's point of view, and will be harder to condense to a one- line summary than the articles that need not even be submitted here.

 _Also, I'd argue that reading a long piece (especially if it contains an illustrative story) is much more memorable than a summary like this._

Agreed with this too. A pithy point embedded in a carefully reasoned article with pertinent examples and discussions of alternative points of view is actually better understood, and better remembered, than the same pithy point written in isolation.

Here's to the readers who still read writing longer than one sentence. Be bold in submitting articles that are more than five paragraphs long. Invite your fellow participants on HN to be absorbed for a few minutes in THINKING about a detailed, nuanced argument. Encourage the submission of articles with analysis and factual detail by upvoting those articles. Reward your fellow readers by submitting and upvoting articles worth reading in full.

P.S. My user profile here on HN begins with a one-liner tl;dr summary. Yes, that is a joke, although the summary is accurate.

</comment><comment><USER5> > Also, I'd argue that reading a long piece (especially if it contains an > illustrative story) is much more memorable than a summary like this.

Yes, sometimes, but ...

1\. Many people have limited reading time.

2\. Many topics can be accurately distilled to a few words with no loss of meaning.

3\. Economy of expression is highly esteemed in journalism, and it can often be accomplished with no loss of useful content.

Some tl;dr endeavors fall flat, and/or excise the meat along with the fat. Some succeed admirably.

Many submitted essays seem to have been written by someone who expects to be paid by the word, therefore the more words, the better. Such essays are often greatly improved through distillation.

So, in my humble opinion, no conclusion can be drawn -- each tl;dr effort should be judged on its merits.

I will close with my favorite tl;dr story, in which Woody Allen says, "I took a speed-reading course so I could read 'War and Peace'. It's about Russia."

</comment><comment><USER6> I'd call it TL;MWTRITAIM "Too Long; Might Want To Read If This Abstract Interests Me".

So I dislike the "Didn't Read" part only. It implies the reader can't be bothered to consume the whole piece.

</comment><comment><USER7> tl;dr Adding TL;DR to stories encourages lazy readers and might mislead them.

:) ... I see this often on very long stories and ones which are tough to read (like a nitty-gritty physics story). I don't see a problem when used judiciously. Plus the up/down-voting usually only surfaces tl;dr's when they're actually good and needed.

What's absolutely terrible are Slashdot-like forums where they give an official TL;DR for every story. I think /. quality would improve greatly if they removed these.

</comment><comment><USER8> What is a TL;DR anyway? The core of an article in fewer words, an alternative title, an excuse for laziness, a tool for busy people, a bird's perspective? Some people like writing a TL:DR, it's an attempt to reverse the article's conception, it's game-like. The problem is when we assume TL:DR to be a perfect distillation of the article and comment on it. And, do writers mind being TL;DRd?

</comment><comment><USER9> tl;dr is useful when a piece of long and bloviating, or when the piece is outright wrong and can be refuted by re-stating the thoughts of the author in fewer works.

It's also useful to other users when someone is using it to summarize a scientific or niche post which other uses might not understand, putting the story into layman's terms.

</comment><comment><USER10> I always thought tl;dr was some sort of utf 8 encoded symbol or something that didn't come across on my browser.

<comment><USER11> Same here. I've only really noticed it recently too.</comment></comment>


GED VIZ: An HTML5 tool for visualizing economic relations - <AUTHOR> http://9elements.com/io/index.php/ged-viz-data-visualization/

<comment><USER2> KeyLines ([http://keylines.com/](http://keylines.com/)) is in the same space, it's a framework for building network graph visualisations, not just those economic breakdown charts. It's got a great API and team behind it - they're based in Cambridge, UK.

It's built on HTML5 Canvas, and has fallbacks using Flash, etc. for older browsers.

</comment><comment><USER3> EconViz ([http://www.econviz.org](http://www.econviz.org)) uses visuals to describe the circular flow of income through modern monetary systems (meaning non-EURO countries).

It's based off the work of MMT (modern monetary theory) scholars such as Warren Mosler (Recently profiled in NYTimes: [http://nyti.ms/10DglvK](http://nyti.ms/10DglvK)) and Bill Mitchell ([http://bilbo.economicoutlook.net/blog/](http://bilbo.economicoutlook.net/blog/)).

</comment><comment><AUTHOR> For those interested, we've posted a follow-up with more info on the technical implementation: [http://9elements.com/io/index.php/ged-viz-making- of/](http://9elements.com/io/index.php/ged-viz-making-of/)

</comment><comment><USER4> Made me think of this: [http://www.youtube.com/watch?v=-QI1iuAvTKE](http://www.youtube.com/watch?v=-QI1iuAvTKE)

</comment><comment><USER5> Could benefit from arrows indicating direction.</comment>


Ask HN: Is it possible to locate a dog through its microchip (RFID)? - <AUTHOR> The beloved dog of a friend went missing hours ago, in San Francisco. Jackie, female boston terrier, 3 years old. We believe she was kidnapped, and it's likely that she is still in the city.
Jackie has a microchip (a passive RFID) - it usually has a very short scan range, which means that RFID readers can read the dog ID only when at close proximity.
I am not a hardware guy, but I am trying to find out if there's any way to "extend" the reading range of an RFID reader and possibly locate the dog by, well, driving around the city with the scanner in search of the right ID.
Any help is very much appreciated. <comment><USER2> Indeed it seems designed specifically for short range, so it may not be possible. [http://mwrf.com/systems/extend-active-rfid-zigbee- network](http://mwrf.com/systems/extend-active-rfid-zigbee-network)

Do you have a photo? I have a Boston Terrier and so they are salient to me (rarities in the Bay Area, everyone seems to have a doodle).

<comment><AUTHOR> Thankfully the dog has just been found (10 hours after it went missing).

p.s. I see a lot of them in San Francisco. Where do you live?

<comment><USER2> Great news! (Wondering if it was Jackie.)

Peninsula, but moving to the city shortly. Nice to hear they are more common up there. Always a delight to watch two Bostons play together.

<comment><AUTHOR> Yes, it was Jackie! I guess you saw something on Nextdoor or Craiglist or Facebook.

Sometimes in SF there are boston terrier meetup. They are great.

</comment></comment></comment></comment><comment><AUTHOR> It seems that normal RFIDs used for pet identifications have an EXTREMELY short scan range [0].

[0]: [http://www.datamars.com/products/companion-animal- id/](http://www.datamars.com/products/companion-animal-id/)</comment>