Hacker News .hnnew | past | comments | ask | show | jobs | submit | rlvesco7's commentslogin

Within home schooling communities, Singaporean style math has quite a following. Singapore also tends to score quite high on international exams. Basically, they focus on fewer topic more deeply. They also teach from concrete to abstract. I wish American schools would adopt this. https://en.wikipedia.org/wiki/Singapore_math


There is another project called JUMP math which has shown some great results, and is now getting adopted widely in Canada. Essentially the approach is to present concepts as bite-sized chunks (more scaffolded) and make students gradually work their way up to tougher problems.

If you think about it, it makes sense: if the problem in math is people get stuck at some foundational step where they are required to "get" something, and start to think they "suck at math" because they are missing this piece, then making the steps VERY small will make sure everyone can make those steps, thus making everyone "good at math."

Similar to Singapore math, it's not based on a "textbook" that you read but an "exercise book" that you write and solve exercises in. I don't have personal experience with teaching using this approach, but I have heard many good things.

books: https://www.amazon.com/s?k=jump+math (non free) samples: https://jumpmath.org/jump/en/learn podcast: https://www.cbc.ca/listen/live-radio/1-63-the-current/clip/1...


That was how I was taught, in Europe, decades ago. We didn't call it Singapore Math, we just called it Maths.

And we used Cuisenaire Rods instead of bar charts.


“I fear not the man who has practiced 10,000 kicks once, but I fear the man who has practiced one kick 10,000 times.” -Bruce Lee


Stephen Boyd is somewhat famous for his class in Linear Dynamical Systems that begins with an introduction to what DiffEq really is, and how to use computation rather than abstract rules of symbolic manipulation. I felt cheated that my classes had been nearly exclusive to the abstract presentation, which was mostly useless except for rough conceptual understanding in the rest of my engineering life.


EE263: Introduction to Linear Dynamical Systems Stephen Boyd, Stanford University

http://ee263.stanford.edu/archive/


I was shocked when I saw equations of the form:

dy = dx + 3dz + 2


The best AndOTP feature for me is the fact that it integrates with OpenKeyChain thus allowing the use of PGP keys for backups. I also wish there were more apps that use OpenKeyChain. For example something that allowed notetaking.


I think the way to achieve your goal is different. Allow non-sociopaths a fighting chance to compete. If you are parent, and you love your family, it is impossible to put in the hours. Only the broken will rise to the top and work 12 hr days. One way to minimize this is cap working hours.


Wrap it in stunnel if you can. Basically an https wrapper. Stunnel is increasingly useful for all kinds of VPN especially when you are traveling since more and more places are blocking vpn. Https is almost never blocked. Works pretty much every except China.


What works in China lately?


Buy a China Mobile Hong Kong 4G China data roaming SIM in Hong Kong airport (arrival concourse). $15USD, rechargable - and 4G unfiltered internet in mainland China.


Probably obfs4, as long as it has not been flagged or detected yet.


Tor with bridge (Azure) works, at least for me 2 weeks ago.


Shadowsocks


Yes, but they have been bypassing due process by using 3rd parties instead of going directly to telecoms. And the friendly folks at Palantir et al are only too happy to share.


The due process is basically just a rubber stamped sham anyways — the only downside is that there’s a paper trail. But it seems that as a government agency you can just lie to the FISA courts to get your warrants and there won’t be any consequences later.


Verizon has a section of their site to turn off marketing and adjust privacy settings. Notably absent is the ability to turn off location sharing. I emailed the privacy department and they totally dodged my question. I still would like, and think it's important to have, an option to opt out of all location sharing. I don't care if it's for fraud prevention since that is easily abused by companies.


For those curious, here is where/how to do this with Verizon:

Login (verizonwireless.com) > My Profile > Privacy Settings

https://nbillpay.verizonwireless.com/vzw/secure/setPrivacy.a...

"Customer Proprietary Network Information Settings" was enabled. "Business & Marketing Insights" was disabled. "Relevant Mobile Advertising " was enabled.

Note, I had to disable Customer Proprietary Network Information Settings twice after I found it was still enabled after my first attempt.


Verizon has a section of their site to turn off marketing and adjust privacy settings. Notably absent is the ability to turn off location sharing. I emailed the privacy department and they totally dodged my question. I still would like, and think it's important to have, an option to opt out of all location sharing. I don't care if it's for fraud prevention since that is easily abused by companies.


Never heard of OnlyOffice! They had a good comparison between them and libreoffice/collabora: https://medium.com/onlyoffice/onlyoffice-vs-collabora-a-crit...


That's not a good comparison. It's just an advertising piece bashing Collabora.

If it had been a good comparison, it would have listed pros and cons of both solutions, rather than only pros for one, and only cons for the other.

The "comparison" really only points out three issues:

Collabora runs an instance of Libreoffice on the server. This must be taken into account when considering resource limits when scaling, and latency and bandwidth to the client(s).

Collabora's handling of OOXML (.docx/.xlsx/.pptx) is much worse than OnlyOffice's. You must take them at their word for this!

For collaborative editing, modes (bold/italic/font sizes etc), Collabora uses the same state for all clients. You must take their word for this. I also tested Collabora very briefly (using NextCloud's demo[1]), and the toolbar is client side, which means it could very well be that modes are not shared.

Of course, none of this is particularly surprising considering it was posted by OnlyOffice themselves.

[1]: Instant trial on https://demo.nextcloud.com/


Ease of sharing is precisely why it's so powerful. I can send a link to a shared spreadsheet without the person having to login. Very little friction. Also, being able to co-edit in real time is very powerful. I think libreoffice offline is great, but for 80% of my use cases, gdocs is more convenient and useful. But I'm no longer comfortable with google having so much of my personal and business life.


Have you considered G Suite? If you are going to stick with Google Docs, at least you can get a legal agreement that bars Google from mining or otherwise using your documents.


What legal agreement? It's not like they won't weasel out of it anyway. I'm fairly certain they were scanning emails for ad targeting up until the past year or so.

GSuite is ok when it works most times, when it doesn't it's a nightmare. Google is literally the worst company I've ever done business with. In fact, over the past decade I've had to reach out to various support levels on different products and can say they stand at a remarkable 0% solve rate. (Chromium's bug tracker I've had some success with but it's not 100% a Google product)

The latest contract breech I've had with them is regarding their SLA agreement. We had a client's account become inaccessible for a week. This caused them 2 days of work downtime as their quotes and business correspondence were all tied up in the account. The SLA defines a Downtime as:

"Downtime" means, for a domain, if there is more than a five percent user error rate. Downtime is measured based on server side error rate.

We wrote about the issue, figured out the cause was likely due to an error in the half-assed rollout of the new admin panel (they currently have two in production), and yet we were not granted a half-month credit for the downtime as the SLA stipulated.


> "What legal agreement?"

This is the agreement that I was referring to: https://gsuite.google.com/terms/dpa_terms.html

Specifically, see section 5.2.

Also, Google advertises this as a feature to G Suite users: https://support.google.com/googlecloud/answer/6056650?hl=en


> I'm fairly certain they were scanning emails for ad targeting up until the past year or so.

Not a great source (it's a while ago), but I was at a talk from I think a Google AI researcher once (he might've been a VP). I remember him saying that Google hasn't actually been scanning emails for a long time now, because they're processing too many emails for even Google to parse. Too big data.


Noticed this on Monday. After registering for fraud alert, they send an email that has link to http://www.equifax.com/fcra for free credit report. This was getting hijacked. But not if you used https://


Why would they send you to a http at all if they already have https. This just seems like complete incompetence. It’s not like they have an excuse like their ad networks don’t work with https.


I know of companies with typos in their links that they email. These typos lead to scam sites. I've contacted them and they haven't yet fixed it. There needs to be a serious re-evaluation of the costs associated with failing such basic security measures like using https and just making sure you send people the correct link. Right now it isn't even a slap on the wrist.


If the site supports HTTPS, they should just preload HSTS to avoid future problems with HTTP.


Sure, but you can configure a webserver to always redirect to the https version of a site.


Someone in marketing probably didn't know that it mattered. Same with the head person who approved the email.

But don't worry, they'll have an engineer approve it next time as well!


But there are protections against this, such as HSTS. I would expect someone with as much sensitive information as Equifax to have HSTS + HPKP pinned into the major browsers. Their server should never even receive an HTTP request. It's just unrivaled incompetence.


HSTS doesn't help if it's your first visit to the site. To work around that they'd need to get into a preload list.


Which is easy if you set preload header.


This. The technology (HSTS, HPKP, Subresource Integrity, upgrade-insecure-requests) is there; sites that need it just don't seem to use it.


Normally, people in marketing don’t write URLs by hand. They copy them and check that they look nice or have a generator make them for them.

So, how did they copy an http url instead of https because they website should have redirected them to https before processing the request (and I just hope that their internal network isn’t compromised).


Probably because security is handled by the IT department, and email communication is handled by the much less tech-savvy Communications department.


The specific js that was hijacked is here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

That page pulls it in.

Edit: maybe a red herring. Sure looks shady though.


<!-- Fireclick Web Analytics - COPYRIGHT 1999-2005 ...


So was it Equifax that was hacked, or Fireclick?


Equifax. That url is Equifax controlled. It just mentions fireclick in a comment. Click the url for the js and you'll see that it does a document.write to inject a script that's an akamai cached copy from an obscure .cc domain hosted file...this one: https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/se...



This obscure .cc domain pretty obviously belongs (or used to belong, they let it lapse in 2016 and it was re-registered) to Fireclick.


Update: The whois listing for the cc domain looks pretty odd. It's a person in Thailand, using a personal gmail address. Which would be odd contact details for a California company's domain. Possible of course, but unlikely.

See: $ whois -h whois.dynadot.com netflame.cc | grep Registrant


Hmm. Perhaps not what I thought. Looks hacked and shady, but perhaps this isn't it.


Yeah, looks like a compromised ad/stats provider. That would also explain the intermittent nature of the bad download. I'd hope that the article gets updated with the facts...other companies might be vulnerable to this as well.


Looks like they just took the page down as I was poking around trying to figure out where the redirect(s) came from.

Edit: Of course the error message is truthful:

>The Equifax.com website and Equifax Member Center are experiencing unusually high volumes due to responses to the recently announced Cybersecurity Incident. We are working diligently to better serve you, and apologize for any inconvenience this may cause. We appreciate your patience during this time and ask that you check back with us soon.

/s


If you don't want to pull out your phone, throw Chrome into Responsive Design mode and you'll get the same results.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: