Today's peak crypto arbitrage spreads for 26 pairs – BTC/USD 10.98% - <AUTHOR> https://www.tokenspread.com/spreads/top-price-spreads <comment><USER2> I remember a classic MIT problem set in computer science where we reduced the problem of finding a "profitable arbitrage loop" in a directed graph to a shortest path problem: imagine a graph where nodes are currencies and edges are exchange rates: we're seeking to find some loop of nodes U,V,W,...U such that the cumulative product of the edge weights is greater than unity.

The trick is to transform the graph by taking the negative log of the edge weights, which turns problem of finding a cumulative product > 1 into one of finding a negative sum loop. Then, you can just run the Bellman Ford algorithm and if it detects a negative cost cycle in the transformed graph, this corresponds to a positive arbitrage cycle in the original graph.

I always thought that was a neat application.

<comment><USER3> It's nice to do that to banks that didn't set their trading prices to avoid arbitrage (did it couple of times myself).

For cryptocoins it's nearly impossible. Because in most cases there's no idea when the actual transfer will be executed (if arbitraging between exchanges).

<comment><USER4> The trick is to have the currencies already there so you dont need to do a transfer (well you will want to do one afterwards to get ready for another round, but it isnt that time sensitive).

<comment><USER5> That just pushes the problem to the next trade. Even if you diligently keep your accounts funded, you'll need to rebalance them after most trades (by definition of arbitrage), so your velocity will eventually be limited.

Concretely, imagine if every ten minutes you made an arbitrage buy on GDAX, and sell on BitFinex. As long as GDAX remains the "buy side" of the arbitrage, you will need to keep refilling your fiat funds at GDAX. You could "keep it filled," but this becomes more unsustainable as you deplete your bankroll. You will eventually need to rebalance which will affect your velocity.

Disclaimer: I am not a financial professional.

<comment><USER6> Not entirely true. If you wait for the arbitrage opportunity to occur in the reverse direction, you can rebalance. But you take the risk of waiting days/weeks for a reverse dip opportunity.

Source: I tried to make money arbitraging BTC back in 2015. I made a 2x return, entirely because of inflation, realized I didn't understand anything I was doing and pulled my 8k out. If only I had kept it in :)

<comment><USER5> I would expect that the same exchanges tend to be on the same side of arbitrage spreads, for various reasons that could include lack of liquidity.

<comment><USER6> If you plot them, you will see the spreads intersect now and then.

However, all the same risks apply e.g. with orders not being processed enough.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> One of the upsides of BTC is that it is supposed to be costless and frictionless to sell across the globe, yet 1k+ arbs exist across exchanges. So much for that argument. Maybe segwit2 will help, or another altcoin will actually remove friction.

<comment><USER8> When there is a spread between exchanges in the BTC/USD price, doing arbitrage requires requires not only moving bitcoin but also USD in the opposite direction. USD transfers are usually still a lot slower, so the bitcoin transfer speed is not the bottle neck here.

<comment><USER7> Which makes BTC purchased via exchange the Hotel California of Assets. You can check in any time you like but you can't ever leave.

Something is amiss here. Selling BTC to USD should be instantaneous even if cash withdrawal isn't no? Can you not look at the bid/ask and get executed at the bid on these exchanges?

I should be able to buy "cheaply quoted BTC" on Exchange A. Transfer to wallet at "higher quoted BTC" at exchange B, and executed a sale at the bid, even if I can't pull my USD into my actual bank account for a couple days.

<comment><USER8> Yes, if you have USD on an exchange, you can instantly buy bitcoin, and quickly move it to another exchange, and again instantly sell it there.

The problem is that after this sequence of events, your USD is at the exchange with the higher priced BTC, while you need it at the exchange with the lower priced BTC to repeat the process. This requires moving the USD back via the traditional banking system, which is slow. The bank wires are the bottleneck.

Crypto-Crypto trading pairs don't have this problem, which is why the ETH/BTC spread for example is much smaller. The spread there probably just reflects fees and custodial risks that put a slight break on arbitrage.

</comment></comment></comment></comment><comment><USER9> Most of the big spreads seem to be caused by cex being much more expensive than the other exchanges... Does that indicate something is happening with cex?

<comment><USER10> A high price on an exchange is a symptom of problems withdrawing national currency. In order to get around this issue, users will spend their on- exchange national currency by purchasing e.g. bitcoins, and then transfer these to their wallet or to another exchange (where they can sell and withdraw the proceeds). This buying pressure pushes up the price, as measured in national currency.

<comment><USER9> I guess it doesn't necessarily need to indicate that the exchange is having problems with fiat withdraw, but if they did your scenario could definitely make sense.

I think it could also just indicate a lack of arbitrage being executed that keeps the price in line with other exchanges, meaning as a separate market the price is free to move higher / lower than other markets without necessarily indicating some sort of problem at the exchange. Normally this would be sort of synchronised to some level by arbitrage.

It seems like the arbitrage opportunity here is real and at least someone recently managed to profit ~10% from it:

[https://www.reddit.com/r/BitcoinMarkets/comments/7kitks/arbi...](https://www.reddit.com/r/BitcoinMarkets/comments/7kitks/arbitrage_and_cexio/drmhhiy/)

Although of course it is a bit slow which exposes you to lots of risks, so if you really wanted to do it you would need to hedge your exposure with other types of trades (shorts, etc) to try to limit the amount of risk.

I guess what I am thinking is just it could also be the exchange is operating fine, people are able to withdraw fiat, but it's just not worth the risk / effort to run arbitrage (or people just aren't doing it) and that could at least explain some price difference without there needing to be some sort of systemic problem at the exchange. There of course could be.

</comment></comment></comment><comment><USER11> How is this being calculated? In didn't see anything.

\- You want to look at the order book, not just the last trade to compare the bid on one against the offer on another venue. The bid-offer spread can be very wide on some of these.

\- Fees should be included.

\- You still aren't pricing in counterparty risk, the biggest risk in crypto trading.

\- I don't see CME and CBOT. The most reliably venues (you can replicate the spot with a multileg trade).

<comment><USER12> >\- I don't see CME and CBOT. The most reliably venues (you can replicate the spot with a multileg trade).

since those are futures, arbitraging them brings a bunch of other problems. mainly, keeping your (futures) account with enough cash to prevent liquidation (if there are drastic price swings). this is easier said than done because a short position requires 100% margin (afaik).

<comment><USER11> Maintenance margin is 40%, I believe.

<comment><USER12> except for short on cme, which requires 100%. [http://www.cmegroup.com/education/cme-bitcoin-futures- freque...](http://www.cmegroup.com/education/cme-bitcoin-futures-frequently- asked-questions.html)

<comment><USER11> I think you are reading that wrong. Initial margin is 100% to 110% of maintenance margin (44%) depending on how they classify you (almost everybody here is a speculator not hedger).

Current maintenance margin is about $34k on a single contract (5 BTC).

</comment></comment></comment></comment></comment><comment><USER13> Is this actually feasible to make money or will you still get killed on transaction fees?

<comment><USER14> Most of the reason for the spreads is counterparty risk. So you might have a lot of trouble getting your money out of the exchange or the exchange might go completely under.

<comment><USER15> > _Most of the reason for the spreads is counterparty risk_

This "arbitrage" is a classic picking-up-nickels-in-front-of-steamrollers trade.

<comment> wc- To be fair, all arbitrage is? You are picking up a nickel against a price move with no real guarantee you can execute the other leg successfully.

<comment><USER15> > _To be fair, all arbitrage is?_

You are correct--there is no such thing as "risk free". By convention, we mark our zero point at the risk of sovereign bonds. It is the smallest risk everyone in our economy agrees on a level for. It still contains "risk". But it's a convenient--and practical--reference point.

The analog in Bitcoin would be getting your transaction committed to the blockchain. It's still "risky". (Quantum computers could break the encryption!) But it's a convenient--and practical--zero. (You'll notice the advantage of a currency backed by a debt-like obligation. Interest rates come as a first-class function. There is no "risk free" borrowing rate in Bitcoin.)

Between these zeros, an arbitrage would require, simultaneously, committed transactions on the Bitcoin ledger and immediately-available funds in an FDIC- insured (or analogous, _e.g._ SIPC) account. That is not something exchange- based trading, which involves depositing U.S. dollars and/or Bitcoins with the exchange in exchange for an IOU, permits.

<comment><USER16> That's actually a bit of a loaded argument... we assert that all arbitrage profit must be at least counterbalanced by various kinds of risk (including liquidity risk, counterparts risk, _& cetera_) because we're _assuming_ that we're operating in an efficient market. We should actually reason the opposite way around: analytically evaluate all sources of risk, compare it to the expected profit, and if the latter is no greater than the former, deduce that we are in an efficient market.

<comment><USER15> > _we 're assuming that we're operating in an efficient market_

Arbitrage is, by definition, the refutation of a strong-form efficient market [1].

> _liquidity risk, counterparts risk_

The presence of these risks betrays the absence of a true arbitrage. A pure arbitrage involves simultaneous execution, thereby negating liquidity risk. It also involves instantaneous settlement, thereby negating counterparty risk. In the real world, I've only seen it in specialized real-time foreign exchange and money markets.

The risk you can't get rid of is the "risk-free" risk. If the U.S. government blows up, you will not make money on your triangular arbitrage [2].

> _analytically evaluate all sources of risk, compare it to the expected > profit, and if the latter is no greater than the former, deduce that we are > in an efficient market_

This is an interesting area of theoretical finance [3]. It is practically useless. There is no list of "all sources of risk," much less any way to price it.

[1] [https://www.investopedia.com/terms/s/strongform.asp](https://www.investopedia.com/terms/s/strongform.asp)

[2] [https://en.wikipedia.org/wiki/Triangular_arbitrage](https://en.wikipedia.org/wiki/Triangular_arbitrage)

[3] [https://en.wikipedia.org/wiki/State_prices](https://en.wikipedia.org/wiki/State_prices)

<comment><USER16> I used my terms woefully imprecisely and you were right to point those inaccuracies out.

Incidentally, [3] is very close to my field of research back when I was doing postgraduate studies in economics, but as you mention, it has close to zero applicability.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Any website that does it for you but just needs your funds?

<comment><USER18> yeah just send bitcoin to 1111111111111111111114oLvT2

<comment><USER17> Sent bro, can you confirm your account number and sort code? :D

<comment><USER18> they are both somehow 1BitcoinEaterAddressDontSendf59kuE

dont ask

</comment></comment></comment></comment><comment><USER19> Given all the withdrawal issues with cross-exchange arbitrage, would something like triangular arbitrage within a single exchange be better?

</comment><comment><USER20> How does this work in practice when it takes days to transfer coins and the clearing fees are high still

<comment><USER21> LTC is often higher on GDAX than most other exchanges and the coin takes about 15-20 minutes to send. Sending Bitcoin back can take a while but that has more to do with GDAX/Coinbase actually posting your transaction to the blockchain than Bitcoin itself (though, yes, Bitcoin transactions themselves can take a while). The longest I've had to wait was 8 hours total. But 5-10% profit in 8 hours is, um, pretty good.

The last time I did this about a week or 2 ago, there was an 8% difference between GDAX and Bittrex. At the end of it, after fees and all that, I made 6%.

<comment><USER22> Stupid question: what about doing more limited, "pseudo arbitrage"? Where you just maintain balances in USD and cryptocurrencies on each exchange and "buy low sell high" without actually completing the loop, and only later even out your balances across exchanges until you're ahead?

That is, if LTC is higher on exchange A than B, then you buy all you can on B and sell on A. You've made free money, but aren't strictly better than before because you have a different allocation across exchanges. But then you can later do a slow transfer that evens them out.

<comment><USER21> That requires holding a balance of LTC on different exchanges which is great if you really like LTC but personally I don't since you can't really trade that much with it other than BTC and USDT/EUR. Ethereum on the other hand has a ton of trading pairs on many exchanges so I would consider your strategy with it. Only issue is, arbitrage opportunities with Ethereum come around a lot less often than with LTC so I'm unlikely to hold ETH just waiting for that. To make a long story short, my base currency for trading is BTC so that's what I like to hodl. When an opportunity for arbitrage comes up, I take my chances buying, transferring to another exchange, selling, then transferring the BTC back. Successful trading is predicated on the probabilities being in your favor and a >5% arbitrage spread, usually (not always) works out. At least it works out enough to make it worth your while.

<comment><USER22> LTC was just an example of a cryptocurrency; I was asking about the strategy in general.

<comment><USER21> In that case, then yes, it is a good strategy. Find a currency you like holding and have some of it on as many exchanges as you want. When the price gets out of whack, sell on one exchange and buy on the other. Square up when it's convenient.

</comment></comment></comment></comment></comment></comment><comment><USER23> Would be great to be able to filter some exchanges. Personnally I would not trade on CEX.IO

</comment><comment><USER19> I don't see Binance on here either.</comment>


How to interview a designer with the perfect design exercise - <AUTHOR> http://www.designstaff.org/articles/how-to-interview-a-designer-2011-12-29.html

<comment><AUTHOR> I hope you like the article. I'm interested in how similar/different this is from engineering interviews.</comment>


I Am SO Done with Windows 2.0 - <AUTHOR> http://www.satiritron.com/2010/12/27/i-am-so-done-with-windows-2-0/

<comment><USER2> I declare that you don't have any good reason to complain about something that's really your fault. If you use any outdated OS the amount of features are about the same.

You could honestly spend $100 on craigslist and get a computer with XP on it.

</comment><comment><USER3> That wasn't very funny.

</comment><comment><USER4> Windows 2?! I'm still on Windows 1!

It's too bad there aren't any free operating systems...

</comment><comment><USER5> It's true - satire is at its worst when it's blatantly labelled as such.

</comment><comment><USER6> I bet that runs screamingly fast on a modern PC.

<comment><USER7> I bet it doesn't run at all.

</comment></comment><comment><USER8> Is this satire? What is the underlying message... I feel it's gone over my head.

<comment><USER9> I suspect this is targeted at people who are giving Microsoft a hard time over problems in Windows XP and prior- For instance, people still joke about Windows Bluescreens, but they are a _very_ infrequent occurrence in Win7.

<comment><USER10> BSODs once a day or so with the high-end Windows 7 64-bit boxes.

More often, if they try to run backups with them.

Yes, diagnostics have been run, etc.

Microsoft has problems with the permutations and the qualifications and all the anti-malware stuff, unfortunately; they're phenomenal with dealing with all that, and phenomenal is just holding even with the complexity they have to deal with.

<comment><USER11> Most often BSODs are caused by third party device drivers.

<comment><USER12> Solution: Eliminate third-party drivers.

Apple solved this problem years ago.</comment></comment></comment></comment></comment>


Ask HN: How to Multitask Effectively? - <AUTHOR> I have full time job. I spend my free time during the weekdays and weekends on my side projects. But I am finding it difficult to progress effectively in both of the areas.<p>Has anybody solved similar issues if yes how should I solve it. <comment><USER2> So, your "free" time is on side projects, that is plural.

Two things come to my mind, are you aware of the necessity to relax and take your mind off of things to work efficiently? "Spare time" is essential for working, and in some countries you are prohibited from working on the side for that reason.

How do you feel about your side projects? Do they help you take your mind of work, or are they more work? Don't feel bad about not progressing with your side projects, if they are hobby. For me, some side projects were relaxing and helped me to disconnect from work.

My advice, limit your working hours. Your side projects count as work, if you they feel like work to you. If they relax you and you look forward to it, do them when you feel like it. But try to be honest to yourself about it. No need to impress someone with your "work-ethics", not even yourself.

People are bad at multitasking, you might overload yourself with things to keep in mind. Schedule time for wrapping your work up in writing, so when you finish for the day/week/... you are finished with it, until you pick it up again.

Prioritise: What is the point of multiple side projects?

<comment><AUTHOR> Thank you for the advice

</comment></comment><comment><USER3> Check out "Deep Work" by Cal Newport if you want to improve the quality of your work (to progress effectively). Quite a few good tips in there.</comment>


Ask HN: Review My Startup, TagtheBird - <AUTHOR>

Hi Everyone,
I've seen how helpful answers to "Ask HN" requests have been in the past, and now that I've released the first version of web I've been working on, I figured I would make my first post to HN to ask for some feedback from you all.
TagtheBird is a site where you can do  some things that you can't do on twitter. I copy paste what we say in about us page:
We love Twitter. We can follow interesting people, but sometimes we do not want to know everything they do in their private lives.
On TagTheBird users can post tweets from Twitter and tag them. Users can indicate their interests and can see tweets that match them. This will eliminate "noise" and gives a new perspective: interests.
For example, if you like basket and video games, you can indicate this on TagTheBird and by clicking on My interests we will show you tweets related to basket and video games.
TagTheBird gives you the chance to find interesting tweets from users you do not follow.
You can see top voted, most commented and most retweeted tweets of the day, week, month, year and all time.
You can vote for tweets and you can comment on tweets without having to answer to the author. More than 140 characters are allowed. You can paste a tweet link, an image link or a youtube link.
If you are a Twitter user, you can know how community values your tweets through the votes, comments and retweets.
I'd love to hear what you all think. Website is http://www.tagthebird.com/
Thank you for your feedback. <comment><USER2> \- Managing interests was a bit hard too find \- Adding an interest tag is not that intutive as I would click Submit button instead for hitting Enter key to make it a tag first \- Despite setting up a few interest keyword nothing gets found

<comment><AUTHOR> Thank you for your feedback.

You are right. I am working to solve these problems.</comment></comment>


Just Cause 4: How designers blended crazy tornado and grappling hook physics - <AUTHOR> https://venturebeat.com/2018/12/02/just-cause-4-how-designers-blended-crazy-tornado-and-grappling-hook-physics/ <comment><USER2> q2dm6 anyone?</comment>


Ask HN: Funding/investment for a hardware startup in Canada? - <AUTHOR>

Me and couple of friends are currently working on a hardware project with a goal to release it as a product. We applied for funding with the CMF but were rejected because they prefer software more. Therefore, we are now looking for other resources. Can anyone recommend a good place to apply for funding/investment?<p>Thanks <comment><USER2> Prototype it up and hit kickstarter/indiegogo. If you've truly got a winner, the market will support you. If not, you've saved yourself and potential investors money and time.

Hardware is increasingly going this route due to the significant investment required into getting to market. Crowdsourcing is a great way to set up a pre- order program without the cost of development.

If you have any questions you can look at the pebble watch, qtar, or Ouya gaming platform as examples of successful hardware campaigns.

Best of luck.</comment>


Build a Vue.js Website in 4 Steps - <AUTHOR> https://carsongibbons.com/build-a-vuejs-website-in-4-steps <comment><USER2> This is a full blown advertisement for cosmic.js (which also happens to be down). Although I like the idea of the service, I hate the misleading title/article. And the fact that the service is down doesn't make it any more attractive.

</comment><comment><USER3> I've been using a combination of Wordpress with custom-type-ui, advanced- custom-fields(pro) and acf-to-rest-api to create admin areas and vue in the public part of the website (with a homemade prerender service).

To us this works really well because we can abstract most of wordpress weirdnesses via the rest api, and reuse vue components from some other bigger projects that don't use wordpress.

<comment><USER4> As someone who also spends a lot of time abstracting WordPress weirdness, I'd love to know more about your process. Any public writings about it?

<comment><USER5> This might be a bit outdated now (in a time when backbone was still cool), but you might find the story from QZ interesting:

[https://vip.wordpress.com/2014/08/28/building-qz-com-full- tr...](https://vip.wordpress.com/2014/08/28/building-qz-com-full-transcript/)

They were working on this problem before the rest API.

</comment></comment></comment><comment><USER6> This seems to be an alternate URL as the submitted URL is timing out:

[https://hackernoon.com/build-a-vue-js-website- in-4-steps-56d...](https://hackernoon.com/build-a-vue-js-website- in-4-steps-56dc5db8012b#.eea8w15ku)

<comment><USER7> This seems to be about some website builder, not about vue.js library, or am I wrong?

<comment><USER8> You're right -- this is astro-turfing. No content specifically about Vue.js. I propose changing the title to something like "Deploying a Cosmic JS Website in 4 Steps".

</comment></comment></comment><comment><USER9> Website is hosted with GoDaddy - many GoDaddy websites are down today.

Though that does not give me confidence, as Cosmic JS seems like a hosted database/api layer.

Which highlights reason why I could not use them on a project. Can not build a service that is reliant on another service in such a way.

Open Source or go home.

</comment><comment><USER10> 504 Gateway Timeout :(</comment>


Introduction to MongoDB - <AUTHOR> http://www.thebitsource.com/featured-posts/introduction-to-mongodb/ <comment><USER2> Just wonder who have hosted data that is larger than RAM with MongoDB, and what's the performance characteristics?

<comment><USER3> This happened to Foursquare, and resulted in a lengthy outage. See [http://groups.google.com/group/mongodb- user/browse_thread/th...](http://groups.google.com/group/mongodb- user/browse_thread/thread/528a94f287e9d77e) for the full details (including why recovery took so long).

<comment><USER4> FWIW, Foursquare's situation was kind of unique. They have a need for all of their data to be in RAM. In most applications, you can define a working set of data. As long as you can keep that working set and indexes in RAM, you'll be fine.

</comment></comment></comment><comment><USER5> This needs some serious proofreading.

<comment><USER6> Sorry, it was posted before I actually finished due to a communication error. I tried to fix some of the problems & I apologize.

</comment></comment><comment><USER7> The correct URL For info on BSON is <http://bsonspec.org>

</comment><comment><USER8> I graduated in 2010. I wonder how long it will be until they start teaching NoSQL in school.</comment>


Bitcoin Payment Processor BitPay Loses $1.8M in Phishing Hack - <AUTHOR> http://www.americanbanker.com/news/bank-technology/bitcoin-payment-processor-bitpay-loses-1m-in-phishing-hack-1076722-1.html <comment><USER2> 1\. CFO is using Gmail without 2-factor authentication

2\. CFO enters his Google credentials on a random website

3\. CEO takes CFO e-mail as valid without checking for the existence and verifying a PGP signature

4\. CEO sends Bitcoin for an existing customer to a new address he got by e-mail rather than to the established one

On the positive side, the CEO eventually sought confirmation from the customer.

</comment><comment><USER3> So many screw ups here because of bad or no company policy. It's hard to feel bad for these guys. No live/voice confirmation between the CEO and CFO during the transfer of _$700,000 worth_ of Bitcoins? No confirmation with the purchaser? No two factor authentication on their Google accounts?

Sorry for your loss BitPay, but that's on you.

<comment><USER4> The phishing attack on the CEO to sign in to "google docs" subverts two factor.

<comment><USER3> How? That's exactly what it's for. The attacker would attempt to sign in on their machine and would be prompted to enter a code.

<comment><USER5> 2 factor doesn't protect against phishing. It's trivial for a phishing site to ask for a 2fa code, and then immediately use that to sign in on your behalf.

<comment><USER2> I think Google asks for 2-factor only when you are connecting from a new browser/device, so it would be highly suspicious to see that happening randomly.

Of course, the fact that he's asked for a password while being already logged in on Gmail is also suspicious, but less so since other sites do that.

<comment><USER5> It's definitely suspicious. However, often it's not enough to trigger any alarm bells. It's fairly easy to mindlessly type in password/2fa codes into a website ("stupid google asking for my password again") rather than automatically think about a potential phishing attack.

While I haven't see it reported whether or not they had 2fa enabled, we can hope that they had taken this very basic security measure.

Actually one of the best preventions against this is using a password manager. I was nearly caught by a phishing site once, and I only noticed because 1Password was refusing to autofill the password field.

</comment></comment></comment></comment></comment></comment><comment><USER6> The legal case about whether the insurer must pay the claim is pretty interesting. The insurer's position is that hack was pure social engineering and that no systems were compromised - everything operated as it should.

That's correct, but the effect was the same as a system hack.

<comment><USER7> Seems like someone needs to develop a "Social Engineering" insurance.

<comment><USER8> Oops, I got socially engineered and sent all my money to this Bitcoin account that totally doesn't belong to me or my brother in law _wink_. Please double me up, Mr. Insurer.

Come on.

<comment><USER9> Insurance fraud is a crime. They already insure against technical hacks, which I would think would not be much harder to fake if you wanted to.

<comment><USER8> Crime or no crime, if you make something profitable and easy to get away with, people will do it. For all we know, this _was_ an instance of insurance fraud.

I wouldn't touch insuring Bitcoin hot wallets with a twelve foot pole. Cold storage, maybe, but only if I had my experts set it all up and maintained control over all private keys.

</comment></comment></comment></comment></comment><comment><USER10> You would have thought they would have had systems in place to ensure that it would take more than just a simple email from the boss to transfer thousands of bitcoins.

<comment><USER8> This. This has little to do with social engineering and the compromised email account and everything to do with a company where standard operating procedure is to manually send $700,000 around based on an email.

</comment></comment><comment><USER7> I've used bitpay and liked their service. Seems like these social engineering hacks can happen to most anyone. Although Im suprised such emails wouldnt require a two-factor authenitication or at least a PGP-signature.

<comment><USER11> Good luck getting anybody else to use PGP. I've been trying for years and to date not a single person has ever sent me an encrypted email. The only company that bothers is Facebook, and I'm not sure their pilot program is going to last much longer.

<comment><USER8> We use PGP for sensitive internal emails at Coinbase as well as for signing releases on some of our open-source client libraries.

Keybase makes it pretty easy. You can see all of our keys here: [https://keybase.io/coinbase](https://keybase.io/coinbase)

</comment></comment></comment><comment><USER12> Been going through their compliance process recently and all of a sudden no response. Looks like they have their hands full. Can anyone recommend any alternatives to BitPay?

<comment><USER13> Coinbase is often recommended as a BitPay alternative. Unlike BitPay it's not a specialized processor but an online wallet, but much like PayPal you can use it to collect payments as well.

</comment></comment><comment><USER14> Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.

<comment><USER5> To be fair, this isn't just a problem with Bitcoin. Spear phishing attacks leading to fraudulent wire transfers are fairly common.

<comment><USER15> Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.

<comment><USER16> No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.

<comment><USER15> OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.

<comment><USER16> It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people.

Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin.

It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.

</comment></comment></comment></comment></comment></comment><comment><USER17> I don't believe the story.

</comment><comment><USER18> I know it's kind of sad and I honestly wish all the luck to the BitPay guys - it's not an easy situation. However, this is why we've built Mycelium Gear: we don't hold merchant's money at all and anyone who wants to accept Bitcoin and cares about privacy and security should consider using it: [https://gear.mycelium.com](https://gear.mycelium.com)

<comment><USER5> This doesn't really have anything to do with holding customers funds, given that this attack was related to OTC Bitcoin trading.</comment></comment>


Show HN: PrivacyAngel – Better protect your privacy online - <AUTHOR> https://privacyangel.com/ <comment><AUTHOR> I created PrivacyAngel to help people protect better their privacy when using popular services online. Nobody has time to read privacy policies and sometimes it's hard to quickly understand what's at stake for your privacy when using a service.

PrivacyAngel gathers 800+ popular products. I read dozens of privacy policies in order to help you understand how your privacy is protected (or not!) when using those products and how to protect better your privacy.</comment>


Why you don't want to work for a government department - <AUTHOR> http://blog.jgc.org/2007/08/why-you-dont-want-to-code-for.html

<comment><USER2> Great point to expose some of the challenges you may face working in any job burdened by an institution, but I don't think this is the best anecdotal evidence. Also, in the roughly 5 years since this was written, there have been numerous efforts by governments to become more tech relevant.</comment>


Show HN: Rocket – Automated delivery as fast and easy as possible - <AUTHOR> https://github.com/astrocorp42/rocket <comment><AUTHOR> Hi,

Here is the GitHub: [https://github.com/astrocorp42/rocket](https://github.com/astrocorp42/rocket)

It started with the need to automate assets uploading for github relases for go binaries but then it appeared that it could be awesome to add other providers like Heroku, Firebase, Netlify, AWS S3 to simplify and automate the process of software delivery.

rocket is the D in CI/CD: It allows to easily deliver software to a large range of providers from any CI pipeline.

It should be as easy as possible to use, Any feedback is welcome : )</comment>


Apology after Japanese train departs 20 seconds early - <AUTHOR> https://www.bbc.co.uk/news/amp/world-asia-42009839 <comment><USER3> How does the Japanese system live with the stuff that plagues Western transportation systems?

For example in Munich there is nearly every day one or more huuuge delays due to:

\- people on the track (sprayers, drunkards, people whose phone fell down)

\- animals on the track, ranging from stray dogs over wolves to deer - and in some cases, entire herds of sheep... one caused an ICE to derail and destroy a huge amount of tunnel track in the progress once.

\- suicides (1.000 suicides in Germany per year, and that's only the successful ones)

\- accidents on street crossings (okay, that's eliminated on the highspeed tracks, but regional traffic and metro rails suffer often enough)

\- kids letting balloons loose in the underground sections, where they shorten out the power line, sometimes causing major destruction - and occasionally it's a bird that does the same and ends up grilled

\- absolute morons who do not make room for people trying to exit the train

\- people with disabilities (wheelchair users, but also old people who simply have problems moving!), who sometimes need to be attended by the conductor, e.g. to put out a ramp

\- technical breakdowns

However, in Japan this seems to be nearly unheard of.

<comment><USER4> IIRC the relatives of people who commit suicide on Japanese railways are charged for the disruption caused.

<comment><USER5> This is one of those things that I heard on QI[1] that _seems_ really plausible -- thus I did not fact check it -- but I'm not sure if it's just because of my Western cultural bias and prejudices.

Is it well attested/documented?

[1] Which, I think, should mostly be considered "entertainment" rather than particularly correct, though I do believe that they actually do strive for correctness. It's more that it has turned into a sort of "twist the words" game -- which is a shame.[2]

[2] It seems to have gained a little bit of a second wind with Toksvig in the current season -- as a sort of a more chat-about-random-things-prompted-by- question-X type thing. Which is nice. (Disclaimer: Only 2 episodes in.)

<comment><USER4> I found this Irish Times article:

[https://www.irishtimes.com/news/health/families-fined-for- su...](https://www.irishtimes.com/news/health/families-fined-for-suicides-in- japan-1.1104002)

as well as this 88-page study:

[http://digitalcommons.macalester.edu/cgi/viewcontent.cgi?art...](http://digitalcommons.macalester.edu/cgi/viewcontent.cgi?article=1012&context=anth_honors)

Apparently the fee is usually around $2 million.

<comment><USER5> $2 million. Wow.

I guess that _would_ discourage anyone who's desparate enough to commit suicide (and still cares about their family) to look for other methods.

I'm not quite sure why, but I somehow find it very strange that a railway company[1] can administer a "fine" to people that may never even have interacted with it. Am I alone in this?

[1] Are they private entities in Japan?

<comment><USER6> 2 Million yen, about $10-14,000 depending on exchange rate.

</comment></comment></comment></comment></comment></comment><comment><USER7> When I took the train from Narita into Tokyo the train would sit at stations for often 5 minutes and leave exactly when scheduled. Well over half the boarding passengers arrived in the last 30 seconds. Leaving 20 seconds early is a HUGE screw up in a system like that.

<comment><USER8> Fascinating. Are the passengers walking to the station and know exactly how long the walk takes? Or is it some closely timed transfer from another source?

<comment><USER9> > some closely timed transfer from another source

Often when different lines meet the tracks are organised such that the trains pull up together on either side of a platform: a so-called cross-platform interchange[1]. The passengers on either train then have 30 seconds or so to board the other train if they wish to change. Obviously this has to be precisely timed - if one train is late or the other departs early, the transfer can't take place.

It really is an amazing system, a wonder of the world. There's one part of the yamanote line that runs parallel to the keihin-touhoku line. In this section, the K-T line acts as an express, whereas the yamanote generally stops all stations. So as the lines meet, you'll have a bunch of people get off the yamanote onto the "express" keihin-touhoko - they arrive synchronously, then the keihin speeds past a few slow poke yamanotes, before arriving _in sync again_ with a yamanote a few trains ahead of the original one, so people can switch back before the keihin diverges and goes off on its route. It's unbelievable, choreographed like a steel ballet. The best train system in the world bar none.

[1] [https://en.wikipedia.org/wiki/Cross- platform_interchange#Tok...](https://en.wikipedia.org/wiki/Cross- platform_interchange#Tokyo)

<comment><USER10> Are the trains all automated or manually run? Or some mix of the two?

<comment><USER11> It's not fully automated. The drivers are very disciplined ([https://youtu.be/xzkU6tmdImY?t=639](https://youtu.be/xzkU6tmdImY?t=639)) although I don't know to what extent they have automation helping them.

<comment><USER12> Wow that's fascinating. Thanks for sharing!

</comment></comment></comment></comment></comment></comment><comment><USER13> The train guys all compete with each other in Japan to be as close as possible to exactly arriving and leaving at the scheduled time.

You will often have a train/subway stop before it gets to the platform, just a 200 or 300 or so meters away, then start again.

I heard this was so that they would arrive at exactly the time they were supposed to arrive.

It's one of the things I miss most about Japan, a simply amazing dedication to their craft.

<comment><USER14> Well, that's nonsense: if you just arrive early and stand longer at the platform, everyone wins.

<comment><USER15> @gpvos - That doesn't always work. Sometimes a train will arrive early, but another train is scheduled to arrive before them, so they have to wait until the other train arrives and departs before they can enter the station, or they'll screw everything up. The train system in Japan isn't a single-line system, like the ones that exist in many cities. It is extremely complex, with express trains and trains that stop at every station all using the same platforms. The arrivals and departures have to be precise for the whole system to work.

<comment><USER14> Well yeah, I'm assuming the platform is free. Otherwise the train has to wait, obviously; that's the way it works in most places.

</comment></comment></comment></comment><comment><USER16> Progression:

In Japan, people are nervous if a train departs early/late by 30 seconds.

In Switzerland, people are nervous when a train is 2 minutes late.

In Germany, people are nervous when a train is 10 minutes late (unless you are passing through Frankfurt, where you can expect 30 minutes)

In Italy, people are happy a train shows up (hello Naples).

<comment><USER17> To be honest, a train leaving early is a _lot_ worse than leaving late. It means you show up at the right time, and you lose it - not cool at all.

<comment><USER18> Yes, by some quirk of fate I used to do navigation prompting for bus timed- course competitions; professional drivers on an unfamiliar route with a precise schedule to achieve. I'd shout-out current location, upcoming hazards and traffic controls, distance and time to next stop etc

They'd be penalised ( say ) 2 points for each late arrival but 8 for early arrival, and the same for being seen to stop ahead of the specified location.

I only did it for a couple of years but it was very interesting to watch the pros and made me appreciate the difficulties of maintaining schedules.

</comment></comment></comment><comment><USER14> In the Netherlands, several years ago they changed the rule for closing the doors: the rule used to be that (if the train is on time, which is actually the case about 90% of the time here) the train doors didn't close before departure time, so what happened was that the whistle was blown just before the departure minute and the doors started to close at the top of the minute or a few seconds after it. Now the rule is that the train should depart at the top of the minute, so everything is shifted about 10 to 15 seconds earlier. A change that really has no benefit for anyone. But I wonder what the rule for this is in other countries?

<comment><USER19> In my part of the UK the system is that the guard closes every door except the one he's leaning out of, typically around 5 to 10 minutes after the scheduled departure time. Someone then looms in to view at the other end of the platform upon whom the guard takes pity but inexplicably refuses to open the other doors and the passenger is compelled to run the entire length of the train to board at the guard's door.

<comment><USER14> Minutes or seconds? I'm talking about the case where the train is basically on time. Although from what I've heard, people in the UK don't have much experience with that... (j/k)

<comment><USER20> Seconds. Intercity trains might close the doors 30 seconds before departure, or 60 in some cases (like the starting station if it's a major one). Otherwise, 15 seconds is about normal, with one final door closed by the guard immediately before departure.

> Although from what I've heard

Don't believe everything you hear. After drinking tea, moaning is Britain's favourite pasttime.

Railways in Britain are very similar to the Netherlands:

[https://www.bcg.com/publications/2017/transportation- travel-...](https://www.bcg.com/publications/2017/transportation-travel- tourism-2017-european-railway-performance-index.aspx)

</comment></comment></comment></comment><comment><USER21> One thing I want to point out is that if I am reading the reports correctly, the JR system is actually a very profitable corporation.

What would it take to get a profitable train system in the US?

<comment><USER22> Massive population density increases.

JR also has a decent income from real estate. Train stations are in prime locations, and have a lot of foot traffic, so they build malls around them.

<comment><USER23> I suspect it's more of a cultural/political problem than a density problem. NYC has a considerably higher population density than Tokyo and has an abysmally expensive/inefficient rail system.

American public transportation systems, even here in the densest part of the country, are easy political whipping boys. Blame whatever you'd like (cars, highways, unions, politicians, etc), it appears that Americans don't care too much about fixing their transportation infrastructure if those fixes don't involve cars.

<comment><USER24> > NYC has a considerably higher population density than Tokyo

It's the other way around, Tokyo has higher population density:

New York City: Land area: 784 km2 Population density: 10,431 ppl / km2

The Special Wards of Tokyo: Land area: 619 km2 Population density: 15,146 ppl / km2

<comment><USER25> This comparison seems a bit unfair -- the special wards are the most densely populated parts of Tokyo. You should compare either New York City <-> Tokyo Metro Area, or Special Wards of Tokyo <-> Manhattan.

<comment><USER26> _" This comparison seems a bit unfair"_

It's not just unfair, it's completely absurd. Tokyo sprawls like crazy, and a big percentage of the population lives in the outer wards. The special wards are high density, but expensive.

As soon as you go outside of the Yamanote line, the population density of Tokyo falls dramatically (probably to Brooklyn levels). Take the train 10-15 minutes outside of _that_ , and you find lots of detached houses and open land. Yet it's all "Tokyo", and this land area is counted when you see the huge population of the city referenced online.

Tokyo has become a fantasy for people in America who think that urban density solves all problems. Most of these people have not ventured outside of the tourist regions of the city.

<comment><USER27> To be fair, NYC technically includes Long Island. It isn't obvious how to compare the two cities at all.

<comment><USER28> Only a small part of Long Island. Are you thinking of Staten Island?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Japan is adorable. In New York, we're grateful to have trains that work at all.

<comment><USER30> That's the only thing I pay big taxes to NY for - the convenient trains (what else is NY useful for?). And they can't even get that right!

<comment><USER31> I empathize with the MTA a bit. It's an old system that is probably underfunded and operated by a very strong union which costs a lot of money. There are still parts of the system that no manufacturer builds for anymore requiring staff machinists to custom make parts.

The signaling system is ancient and any real effort to modernize it (like on the L line) is fought by the union which considers modernization a threat to jobs.

Lastly, it's a system that runs 24 hours a day which almost no other train system can claim. finding times for the appropriate maintenance is very difficult and requires all the rerouting you tend to see on the weekends. People litter so much more in NYC than they do in other major cities across the world in my experience and litter on the tracks causes so many issues. And there's little to no time to clear litter daily off the tracks.

The system is underfunded, oversubscribed and outdated.

<comment><USER30> Totally understand. I can appreciate that, and acknowledge the difficulty of maintaining such a legacy system.

Just don't have the nerve to increase my taxes if you give that excuse though.

</comment></comment></comment></comment><comment><USER32> The part that I admire is that they noticed the early departure and issued an apology without receiving complaints.

That demonstrates a lot more integrity than the operators of the public transportation network in my city, where they claim that declining ridership is a natural consequence of them improving their service.

</comment><comment><USER33> It's kind of funny to think that in the west we're only ever likely to match the punctuality of Japanese humans by replacing our humans with Japanese robots.

</comment><comment><USER34> The London train system is one of the worst in the world.

\- It's very expensive.

\- Different parts of the network are managed by different companies which creates a lot of confusion around tickets and smart cards.

\- The stations are relatively ugly.

\- Signs are confusing if you're not used to the system.

\- Trains from different lines often share platforms. Sometimes two trains that have the same destination might stop at different stations and it's not obvious which train corresponds to which line.

\- The underground trains themselves are often narrow; difficult to stand straight.

\- They are often crowded so you often do end up having to stand up.

\- Delays are common and trains don't come very often considering how many people live in London.

<comment><USER35> haha, this is very funny as having used both the London tube and the NYC system, I dream about the tube. It's better in every way. Trains are nicer, stations cleaner, people are much more courteous.

NYC is almost guaranteed standing on many lines at all times of the day.

</comment></comment><comment><USER36> I love this.

In a slightly less dramatic variation, I was on holiday in Italy once and a local train arrived in Rome about 3 minutes late. As we came into the station, the loudspeaker offered Trenitalia's apologies in no fewer than three different languages.

Here in the UK, I think trains have to be at least 17 hours overdue before they're considered late, approximately 2 lifetimes overdue before you get any compensation, and somewhere around the death of our sun before you'll see anything done to make good any resulting harm beyond the price of a ticket...

</comment><comment><USER37> Such things are funny until they're not any more. See [https://en.m.wikipedia.org/wiki/Amagasaki_rail_crash](https://en.m.wikipedia.org/wiki/Amagasaki_rail_crash)

</comment><comment><USER38> In most public transit systems that run according to published timetable departing early is taken as more serious issue than departing late. It might seem counterintuitive, but inconvenience caused to passengers by arriving/departing late (small additional wait time) is significantly smaller than by departing early (missing the connection entirely and having to wait for the next one).

IIRC in Prague's transit system drivers are fined for not observing the timetable without external cause and the fine for departing even one second early is same as for being several minutes late (and is relatively significant fraction of their monthly salary).

</comment><comment><USER39> My BART train this morning was stuck in the transbay tube for about 40 minutes this morning because a train in front of ours had someone get stuck in the door. Our conductor spent those 40 minutes of us sitting in a hot train bitching at us for someone else getting stuck in the doors. There's literally just zero professionalism/pride in your work from so many people nowadays.

</comment><comment><USER40> These guys time the door to close to match the time of departure, I.e if the door and the warning tone takes 5 seconds, they'd press the close button 5 seconds before the time of departure, and the door motors are calibrated to be precisely to close in a certain speed always. They have timers to make sure they are not off. So that's why 20 seconds to them is like an embarrassment

</comment><comment><USER41> Whilst this is a lot of fun, and the Japanese transport system is certainly something to be generally admired and imitated, unless I'm the only one here, just wanted to point out that there is a dark side to this also: [https://www.japantimes.co.jp/opinion/2007/01/09/editorials/d...](https://www.japantimes.co.jp/opinion/2007/01/09/editorials/driving- a-train-under-pressure/)

      Takami apparently was worried about being punished for overrunning Itami Station. In the past, he had received punitive education three times for errors and had his wages and bonuses docked. JR West's education program, which included writing "soul searching" compositions, was known to be humiliating.

</comment><comment><USER42> There was a minor EARTHQUAKE when I was in Japan. A very apologetic lady working at the ticketing booth told me that there will be a delay.

I asked what the delay will be and it was something less than 2 minutes (1 minute and 20 seconds or something).

</comment><comment><USER43> It's a cultural thing because "It's painful to be caught between the closing doors. Even more so are the eye of those looking at you."

[http://www.rifters.com/crawl/wp- content/uploads/2014/05/door...](http://www.rifters.com/crawl/wp- content/uploads/2014/05/doors.jpg)

</comment><comment><USER44> There is a danger to this punctuality. In the 2005 rail crash, with 100 deaths, it was found that "a contributing factor in the accident was the JR West policy of schedule punctuality". [https://en.wikipedia.org/wiki/Amagasaki_rail_crash](https://en.wikipedia.org/wiki/Amagasaki_rail_crash)

</comment><comment><USER45> As someone who lives a couple of minutes of biking away from the train station, a train leaving 20 sec early would be extremely annoying and would cause me more delay than a train leaving 25 minutes late. I'd appreciate an apology.

</comment><comment><USER46> To be fair, I've made connections (not in Japan) with seconds to spare due to prior train delays. I'd be pretty annoyed if I missed one due to a train leaving early, even when such punctuality isn't generally expected.

</comment><comment><USER47> Shoutout to all my Melbourne people who experience Metro trains on a regular basis.

</comment><comment><USER48> Conversely, if the train are late in Japan - even by a minute or two - <USER2> conductor will give you a paper note that you can show to your boss to prove that you were late for reasons beyond your control.

</comment><comment><USER49> WOW! I wish the DOT in Los Angeles was like this.

</comment><comment><USER50> This is why I keep buying Lexus/Toyota cars. Their production system is the reason for making most reliable vehicles on the road today. Period. This apology is just a reflection of how they approach their jobs (with pride). High Quality speaks volumes.

</comment><comment><USER51> In the UK a train being approximately on time would merit a news item.

</comment><comment><USER52> Japanese trains and metro are all carefully orchestrated. Just one minute is enough to miss a connection. It really screws up people's routine.

</comment><comment><USER53> "Repent, Harlequin!" Said the Ticktockman

</comment><comment><USER54> Meanwhile, New York Subway (MTA): "We sincerely apologise for the inconvenience of arriving on time"

</comment><comment><USER55> I just use pyup ([https://pyup.io/](https://pyup.io/)) for Python projects and it works like a charm. It not only show vulnerabilities but also updates and Python 3 incompatibilities.

</comment><comment><USER56> How do they work out around impossibility to perfectly synchronize clocks at a distance due to special relativity?

<comment><USER57> They work around it by having the stations not move with respect to each other.

<comment><USER56> Well, I was joking... Obviously, microseconds don't matter there.

By the way, stations do move with respect to each other due to Earth rotation. Nevertheless, it's still theoretically impossible to perfectly synchronize two clocks even if they don't move with respect to each other. It's tightly coupled to problem of measuring speed of light in one direction. We cannot do that, we can only measure there-and-back speed, and then divide it by two.But there's no way to show that those are actually equal legs.</comment></comment></comment>


6502 simulated at transistor level in Javascript - <AUTHOR> http://www.visual6502.org/JSSim/index.html

<comment><USER2> At the transistor level? I assume this means that each transistor is simulated digitally, as a pure switch, and not as an analog component, which I imagine would be near impossible to do in Javascript on current hardware.

Not the most practical way to emulate a CPU, but surely a good exercise in learning how a processor works from the component level on up.

<comment><USER3> _I assume this means that each transistor is simulated digitally, as a pure switch, and not as an analog component, which I imagine would be near impossible to do in Javascript on current hardware._

Thought this for the longest time, too, but reality can't be simulated on a computer. Only a simplified model can.

<comment><USER4> Maybe not exactly, but you can get pretty damn close. The digital audio guys are the ones who are really into this. It's the only way to get the exact feel of old audio gear.

<http://www.simulanalog.org/>

An amp is much simpler than a microchip but the ideas are there:

<http://dafx.labri.fr/main/papers/p169.pdf>

<comment><USER3> > Maybe not exactly, but you can get pretty damn close.

Pretty different things those two, if you consider chaos theory.

Still, computers are by design created in a way which can be easily modeled.

</comment></comment></comment></comment><comment><USER5> Now _that_ is a hard core obsession; with retrocomputing or JavaScript, I'm not sure which.

</comment><comment><USER6> I put on a hat so I could take it off again. Very impressive. Now I know what do to do with those old Atari game cartridges which have been sitting in a box by my desk for 5 years.

Also, this seems like it should have a unit to itself on any CS course, not to mention serving as a platform much further research. Maybe I should take up 6502 Assembler as a hobby. Their SigGraph slides are well worth a look: <http://www.visual6502.org/docs/6502_in_action_14_web.pdf>

<comment><USER7> I might be biased as a retrocoder hobbyist myself, but I feel like 6502 assembly would still be very useful in the classroom as a teaching tool, with it's small and (IMO) relatively straightforward instruction set - in some ways it's sort of like the 8-bit RISC-before-there-was-RISC processor. Plus there's great retrocoding potential once you learn it! ;)

<comment><USER8> We could call it "LISC". The instruction set was never reduced, but its growth was limited by what Peddle and hist folks could fit on the chip.

And yes. I learned to program on a TI-55 calculator. Limiting complexity is a very useful tool to introduce someone to programming.

</comment></comment></comment><comment><USER9> This is pretty cool.

It reminds me of 6502-sim for my Apple ][ - it was a 6502 application (Sorry Captain Obvious), but it was cool as it was showing how each instruction worked.

This goes beyond it :)

</comment><comment><USER10> Amazing.

It runs at 27hz (not 27Mhz)...

And some people are willing to simulate the brain? Good luck!

<comment><USER11> That's the Python sim. "The JavaScript sim is only a few hertz, limited by drawing the chip parts."

By contrast, the Apple II ran at 1 Mhz.

</comment></comment><comment><USER12> Wow. It's beautiful.

</comment><comment><USER13> The 6510 (C64 6502 with extra ports) has secret opcodes, basically holes in the circuitry, which emulators have to support because they're used in demos for extra speed (eg, write to x what's in a).

I wonder if this simulation also has secret opcodes?

<comment><USER14> I thought TAX was one of the standard 6502 opcodes?

<comment><USER13> Couldn't think of a decent example off the top of my head.

Also, proper term is 'undocumented opcodes' for further searching.

Try

"AXS __* (SAX) AXS ANDs the contents of the A and X registers (without changing the contents of either register) and stores the result in memory. AXS does not affect any flags in the processor status register."

<http://www.ffd2.com/fridge/docs/6502-NMOS.extra.opcodes>

</comment></comment></comment><comment><USER15> Non-CS majors who want to dig deeper might enjoy:

But How Do It Know? - The Basic Principles of Computers for Everyone <http://amazon.com/dp/0615303765>

</comment><comment><USER16> chip-u-licious! kudos to the creators. i'll check out the Python one tonight. old time 6502 hacker here...

</comment><comment><USER17> Can you imagine what a contemporary CPU or GPU would look like if displayed like this?

<comment><USER18> For a modern CPU, it would have about as many transistors as there are warp/weft crossings on a bedsheet.

<comment><USER14> A standard double-size bed is 4 ft 6 in by 6 ft 3 in (<http://en.wikipedia.org/wiki/Bed#Bed_sizes>). A standard cotton sheet is 150 thread count, which means 75 threads per inch of warp and 75 threads per inch of weft (usually) (<http://en.wikipedia.org/wiki/Thread_count#Thread_count>). That gives about 4050 threads by about 5625 threads, omitting the part of the sheet that tucks down around the edge of the mattress, for a total of about 23 million thread crossings.

The Intel Core i7 has about 781 million transistors (<http://en.wikipedia.org/wiki/Intel_cpus#Core_i7>), which is about the number of warp/weft crossings in 34 standard bedsheets, omitting the stuff around the edge of the mattress. I thought maybe ARM chips would be smaller, but [http://www.geek.com/articles/mobile/arm-introduces- cortex-a8...](http://www.geek.com/articles/mobile/arm-introduces- cortex-a8-chip-design-2005105/) says the Cortex-A8 has over a billion transistors. (Although there are certainly low-end microcontroller ARMs that are much smaller. And of course the C18 is smaller still; is it "modern"?)

If you're talking about bigger beds and finer sheets, you might get the number down to less than 10 bedsheets per CPU.

But that doesn't mean you could make a diagram of a modern CPU that was only the size of ten to forty bedsheets, with the transistors the size of warp/weft crossings in a bedsheet. If I remember correctly, only a minority of the chip area typically consists of transistors and other active devices.

</comment></comment></comment><comment><USER19> Awesome ... how long before someone can use this to run NES games ?

<comment><USER20> I nearly expect it to have already been done, given that there's a gameboy emulator in JS: <http://www.codebase.es/jsgb/>

<comment><USER21> NES has been done as well: <http://benfirshman.com/projects/jsnes/>

</comment></comment></comment><comment><USER22> Wow, hot!</comment>


Over 25% of the UK likely to have had Covid-19 already - <AUTHOR> https://www.manchester.ac.uk/discover/news/over-25-of-the-uk-likely-to-have-had-covid-19-already/ <comment><USER2> That's extremely unlikely to be true (from someone in the UK)

<comment><USER3> Yeah this is just extrapolation and not based on actual tests. There is no way the number is as high as 25%.

I mean just look at New York or other hard hit areas, from the actual antibody tests performed the upper limit on the number of people who have had Covid19 is no where near 25%

I expect it's more around 5% and even that would feel high.</comment></comment>


Paradoxes of Material Implication (1997) - <AUTHOR> https://legacy.earlham.edu/~peters/courses/log/mat-imp.htm <comment><USER2> Let me copy/paste my reply from the same discussion yesterday ([https://news.ycombinator.com/item?id=18531650](https://news.ycombinator.com/item?id=18531650)):

There's another "solution" to this paradox: if we assert something we are guided by a set of "conversational principles". For example, asserting "X implies Y" if we know that X is false is inappropriate. If X is false, "not-X" would be the appropriate assertion.

According to this theory, there's nothing wrong with the truth-functional meaning of "X implies Y". We just need to take into account what is implied by asserting "X implies Y", rather than e.g. "not-X", or "X and Y".

Same with disjunction: "X or Y" is true if we know that X is true. However, if we assert "X or Y", it is implied that we're not certain that X is true, otherwise we would have used "X", which is the simplest way to convey what that fact.

This is known as Grice's Pragmatic Defence of Truth-Functionality.

</comment><comment><USER3> The claim that the material implication analysis preserves the validity of valid arguments is pretty questionable. Consider the following argument:

        No student will succeed if he goofs off
        Every student will succeed
        |- No student will goof off

Analyzing the 'if' in the first premise of the argument above as material implication, we get:

        For every student x, it's not the case that [x won't goof off or x will succeed].
        = For every student x, x will goof off and x won't succeed.

The following argument is valid only trivially, as the premises contradict each other (assuming the existence of at least one student):

        For every student x, x will goof off and x won't succeed.
        Every student will succeed
        |- No student will goof off

I suspect it's quite easy to construct other similar examples involving quantifiers where validity is not even trivially preserved.

(It's easier to find examples of the material implication analysis failing to preserve the invalidity of invalid arguments.)

<comment> a-nikolaev

      No student will succeed if he goofs off
       =
      Forall x: (GoofOff(x) -> not Succeed(x))
       =
      not Exist x : (GoofOff(x) and Succeed(x))

<comment><USER3> Sure, but then you're doing violence to the structure of the original sentence. (How did the negation get into the consequent?) If you're allowed free reign to paraphrase, then you can always get the right result.

"No student will succeed if he goofs off" is a standard example discussed in the semantics literature, by the way. What you're pointing out, in effect, is that this sentence seems to mean "No student who goofs off will succeed". The problem is that it's unclear how to get to that interpretation given the actual syntactic structure of the sentence. In other words, you can't get there just by following a direction to interpret if...then... as material implication.

<comment> a-nikolaev I agree that you cannot just mindlessly parse "if ... then ..." as implication, especially in the context of other things going on in the sentence and hope it will automagically work out as a correct interpretation of the sentence meaning.

<comment><USER3> Right, but that means that material implication can't be used as an analysis of the meaning of "if...then..." in English. If you have to make ad-hoc adjustments for different kinds of sentence, then you don't have an actual theory of the interpretation of "if..then..." \-- you just have a toolbox of techniques for paraphrasing it. Note that it is possible to do much better than this, so it's not an unreasonable goal to have in mind. See e.g. [https://dspace.mit.edu/handle/1721.1/95781](https://dspace.mit.edu/handle/1721.1/95781) for an overview of modern approaches to the semantics of conditionals in natural languages.

On the preceding point, virtually everyone agrees. I was questioning even the weaker assertion that analyzing "if...then..." as material implication always preserves validity.

<comment><AUTHOR> Trying to map natural language onto logic is a mug's game, although the converse - mapping logic _into_ natural language - is possible.

Leibniz was perhaps the first to understand that the solution to this was to abandon natural language and replace it was an artificial, perfect language, where connectives and grammar had one and only one clear meaning: the calculus ratiocinator and the characteristica universalis. Although Leibniz didn't succeed in his lifetime, he inspired Frege to write the Begriffsschrift[3] which was an early and very complete presentation of what today we would call predicate calculus.

One of Frege's insights was that quantification ("there exists x such that..." and "for all x...") needed to be explicit and could only be made unambiguous if the exact order and name of each quantification was used consistently - hence the idea of "bound variables." Without explicit quantification, it is impossible to determine the meaning of a statement such as:

        "All mice fear some cat."

Does this mean that for every mouse, there is some nearby cat which that mouse fears? Or does it mean that there is some kind of King Cat, feared by every mouse in the world? Natural language is ambiguous on this point. (Note also that this particular example is one which _appears_ to be a syllogism, but which cannot be fully analyzed using Aristotelian logic.) However, if we use explicit quantification, we write either:

        ∃x ∀y My ∧ Cx ∧ yFx    (1)
        ∀y ∃x My ∧ Cx ∧ yFx    (2)

Or, in the stilted yet precise jargon of mathematicians:

        There exists a cat x such that for all mice y, y fears x.  (1)
        For all mice y there exists a cat x such that y fears x.   (2)

The __only __difference between (1) and (2) is the order of quantification, and this is not something English or other natural languages is careful about tracking. This is why you feel like you have to butcher sentences to rewrite them in this form, and also why this re-writing cannot be done by rote but requires human judgement and understanding: because this critical information is in fact missing from the original natural language sentence!

These are not particularly contrived or unusual examples, by the way. One of the fundamental notions in real analysis is that of the limit, which is defined as follows:

      the limit of the sequence a_n as n goes to infinity is C if and only if for every delta > 0, there exists N such that |a_n - C| < delta for all n > N.

Such a thought cannot even be precisely _articulated_ unless one has the necessary language to talk precisely about statements involving multiple quantifiers and bound variables. Which is why early presentations of Calculus (Leibniz, Newton) relied of unsatisfactory notions of "fluxions" and "infinitesimals"[4] while later mathematicians (Weierstrass, Cauchy,) armed with a more sophisticated mathematical language were finally able to give a satisfactory foundation to calculus.[5]

We see the same category of problem when we try to interpret "if... then..." as the material implication of formal logic. Not only do we have the problem of conversational implicature[6] but we have the so called paradoxes described in the original article. Similar problems exist for common words like "or" which is often taken to mean "exclusive or" rather than the inclusive "or" favored by logicians, and even simple words like "is" don't necessary map purely onto the Law of Identity[7] the way logicians and philosophers would like them to.[7]

The way I see it, the fault lies fully on the side of natural language, which is too squishy and imprecise and overloaded to be useful to convey precise formal arguments. But that doesn't mean you have to learn an artificial language like Lojban[8]. Mathematicians do quite well by speaking in a kind of restricted subset of English (or whatever native language they're used to) simply by giving exact and precise meanings to certain words and formulations like "if and only if" or "implies."[9] When a mathematician says "implies" in a paper or lecture, you can be quite sure he or she is speaking of material implication.

But as for pining down the meaning of natural language in the wild, as it is actually spoken... well, that's a rather more difficult problem, don't you think?

[1] [https://en.wikipedia.org/wiki/Characteristica_universalis](https://en.wikipedia.org/wiki/Characteristica_universalis)

[2] [https://en.wikipedia.org/wiki/Calculus_ratiocinator](https://en.wikipedia.org/wiki/Calculus_ratiocinator)

[3] [https://en.wikipedia.org/wiki/Begriffsschrift](https://en.wikipedia.org/wiki/Begriffsschrift)

[4] [https://en.wikipedia.org/wiki/History_of_calculus#Newton_and...](https://en.wikipedia.org/wiki/History_of_calculus#Newton_and_Leibniz)

[5] [https://en.wikipedia.org/wiki/Limit_(mathematics)](https://en.wikipedia.org/wiki/Limit_\(mathematics\))

[6] [https://plato.stanford.edu/entries/implicature/#GriThe](https://plato.stanford.edu/entries/implicature/#GriThe)

[7] [https://en.wikipedia.org/wiki/Law_of_identity](https://en.wikipedia.org/wiki/Law_of_identity)

[8] [https://en.wikipedia.org/wiki/Lojban](https://en.wikipedia.org/wiki/Lojban)

[9] [https://en.wikipedia.org/wiki/List_of_mathematical_jargon](https://en.wikipedia.org/wiki/List_of_mathematical_jargon)

<comment><USER3> >Trying to map natural language onto logic is a mug's game

Not really. Modern linguistic semantics has done a pretty good job. Check out the link to the overview article that I posted in the grandparent, or the von Fintel & Heim textbook here: [http://web.mit.edu/fintel/fintel-heim- intensional.pdf](http://web.mit.edu/fintel/fintel-heim-intensional.pdf) (sections 4.3-5 in particular). It's possible to give precise logical analyses of natural language conditionals to a pretty significant extent. It's just the material implication analysis that doesn't work.

> because this critical information [about quantifier scope] is in fact > missing from the original natural language sentence!

You're moving a bit too fast there. The information can't be recovered from the sequence of words, but that doesn't mean that it isn't present in the structures that underly interpretation. A precise logical analysis can be given for each of the possible interpretations of an ambiguous sentence. Semanticists treat quantifier scope ambiguities using such mechanisms as quantifiying in [1], quantifier raising [2], type shifting [3], or even continuations [4].

No-one is suggesting, by the way, that formal logical analyses of the meanings of English sentences are useful _for the purposes of doing math or logic_. But the "paradoxes" in the original article relate to the use of material implication to gloss the meaning of "if...then..." in English. This naturally raises the question of whether there might be better analyses available.

[1] [http://www.coli.uni- saarland.de/projects/milca/courses/comse...](http://www.coli.uni- saarland.de/projects/milca/courses/comsem/html/node96.html#sec_clls-scope.qi)

[2] [https://dspace.mit.edu/handle/1721.1/16287](https://dspace.mit.edu/handle/1721.1/16287)

[3] [http://lecomte.al.free.fr/ressources/PARIS8_LSL/Hendriks- TCS...](http://lecomte.al.free.fr/ressources/PARIS8_LSL/Hendriks-TCS.pdf)

[4] [http://www.nyu.edu/projects/barker/barker- continuations.pdf](http://www.nyu.edu/projects/barker/barker- continuations.pdf)

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> I created the "allsome" quantifier to reduce the risk of some of these confusions. Details here:

[https://dwheeler.com/essays/allsome.html](https://dwheeler.com/essays/allsome.html)

</comment><comment><USER5> Graham Priest's book is great: [https://www.cambridge.org/ie/academic/subjects/philosophy/ph...](https://www.cambridge.org/ie/academic/subjects/philosophy/philosophy- science/introduction-non-classical-logic-if-2nd-edition)

</comment><comment><USER6> Original title: " _Paradoxes of Material Implication_ "

<comment><USER7> About the example given with teh number 3, I prefer this even more absurd form: if the number 3 is not the number 3 then the number 3 is the number 3. It's true!

</comment></comment><comment><USER8> Descendants of Aristotle still find limitations of the system amusing, that's amusing itself.

I hope to live to the day when philosophical advancements of 20th century (or re-discovery of 2500-old Indian logic, if you like), formalized in accessible forms, get widespread acceptance, could leave plenty of people who'se job it to juggle limited abstractions with the need to pick more useful jobs.

No pun intended, these are terribly useful abstractions we've built our world on, but they barely hold up against thorough reality check and leave out a lot as 'paradoxes'.

<comment><USER9> Please add some substance, or I will make your argument for you.

Yes! We all need to get on board with constructivist mathematics [0][1] already. Construction is very similar to computation, and it is not inconsistent to take "all reals are computable" or "all functions are continuous", the same rules Turing discovered, as axioms if we like. We can therefore move computer science fully onto a foundation that is _more_ rigorous than typical maths.

[0] [https://plato.stanford.edu/entries/mathematics- constructive/](https://plato.stanford.edu/entries/mathematics-constructive/)

[1] [https://www.ams.org/journals/bull/2017-54-03/S0273-0979-2016...](https://www.ams.org/journals/bull/2017-54-03/S0273-0979-2016-01556-4/S0273-0979-2016-01556-4.pdf)

<comment><USER8> You've made far better one than me below. Hats off.</comment></comment></comment>


New "Efficient XML Interchange" W3C Standard - <AUTHOR> http://www.nytimes.com/external/readwriteweb/2011/03/10/10readwriteweb-new-xml-standard-for-super-fast-lightweight-11658.html?ref=technology

<comment><AUTHOR> Here is a link to the W3C spec: <http://www.w3.org/TR/2011/REC-exi-20110310/></comment>


Can Mars Be Made Habitable in Our Lifetime? - <AUTHOR> https://blogs.scientificamerican.com/observations/can-mars-be-made-habitable-in-our-lifetime/ <comment><USER2> No. We're not capable of making Mars habitable.

If we _were_ capable of that, we'd also be capable of fixing the Earth's trends which are making it become less inhabitable. (excess atmospheric CO2, loss of snowpack which reduces fresh-water river flows, oxygen-poor 'dead zones' in the sea, etc, etc.)

<comment><USER3> I always wondered, what are we doing to the Earth that is so bad that Mars is expected to be more habitable? Has anyone _looked_ at Mars' atmosphere lately?</comment></comment>


Insulin pump hack delivers fatal dosage over the air - <AUTHOR> http://www.theregister.co.uk/2011/10/27/fatal_insulin_pump_attack/print.html <comment><USER2> What is the simplest solution to this problem from a non-technical user's perspective? Maybe: "hold the '+' button for 3 seconds to initiate a sync."?

I don't fully understand the problem. Are these things always open to wireless communication? My friend's syncs with USB.

<comment><USER3> Different models will work differently, the ones this guy worked on are apparently always open, despite the manufacturer's intent.

The simplest solution that doesn't make ridiculous assumptions about the time and place is to just do HMAC + replay prevention, as has already been mentioned.

Don't do infosec half-assed, they'll just get in through the other cheek.

</comment></comment><comment><USER4> A bit frightening, and then you realize that this is _entirely_ unsurprising. Why would they spend the money to develop it, drain the battery more quickly, and complicate the whole setup to make it secure when people aren't going around exploiting them?

It's just capitalism at work, people. Even if someone does use this to kill off a handful of people, the cheaper devices might just have saved 100x more before secure models start appearing. Is it a fair trade-off? People haven't been demanding their insulin pumps be secure, so apparently they think it is (edit: yes yes, ignorance - they don't _have_ to be, ya know. I'd get to know the thing keeping me alive, personally).

<comment><USER5> It needs not have a full-blown PKI/TLS stack. In fact it does not need the encryption, it only needs authentication of the exchange and the replay protection. These are as simple as numbering messages with increasing IDs and HMAC'ing them with pre-shared key (that in turn can be generated on one side and passed to another during the pairing sequence). This is _cheap_ in terms of CPU usage.

I doubt the lack of security provisions is due to the $ matters. It is far more likely to be just the developers' ignorance on the subject... which _is_ entirely unsurprising, totally agree here.

<comment><USER6> How many "see, capitalism makes people take short cuts!" can be explained better by "the company was just ignorant about this case"?

<comment><USER4> How many ignorance cases can be explained better by delegation in the face of cost? They're essentially one and the same most of the time - unlimited time / money lets you be infinitely careful, but you have competitors. But yes, capitalism tends to encourage people to make cuts where they will be least noticed - like this one, until _one person_ got it in their head that they might be hackable. They were fine for _years_ prior to that occurrence.

</comment></comment></comment></comment><comment><USER7> That's disturbing, to say the least.

<comment><USER3> No, it was disturbing 20+ years ago when the possibility was first raised of these kinds of attacks. Today it's just expected. And depressing.

The sectors that need to understand information security the most are the ones that have absolutely no grasp of it.

I see no sign of that changing. Every time an improvement is made to the security of one system, somebody pops up with a new one that has utterly failed to learn the lessons of the last one.

<comment><USER8> Add to that "shoot the messenger-ism" (pointing out an exploit is the same as exploiting it nefariously; punishment as follows), plus a good dose of information paralysis (we can't add that security feature, we can't prove its safe), and finally a dash of "the device we have now is already approved, we'd have to do it again and it took _8 years_ last time"... You've got a recipe for some choice badness.

</comment></comment></comment><comment><USER9> You an check out Barnaby' previous work on hacking ATMs: <http://www.youtube.com/watch?v=htDMu7USsZQ>

</comment><comment><USER10> I find it deeply disturbing that there isn't some simple sanity check that prevents the device from delivering a fatal dose.

<comment><USER11> I don't know about diabetes and insulin specifically, but what constitutes a fatal dose might not be easily calculable up-front.

Obviously, there'll be a dose that will be deadly in all cases - the LD100. But the statistical "half the people given this dose" LD50 measure could easily vary by ± 100% or more. Things like metabolic rate, body-weight, route of administration, insulin tolerance, and relative blood-sugar levels could all factor into the dosing system, and I'm guessing the whole point of having it remotely configurable is to minimise the processing effort on the embedded chunk.

<comment><USER12> I see that your self-asserted lack of domain-specific knowledge did not prevent you from giving the correct answer. Good.

</comment></comment></comment><comment><USER13> I doubt anyone will use this to kill someone, but it's good that the vulnerability was discovered so soon - the next models will have protection. Besides, people have been killing each other for millions of years - doing it with a wireless device instead of a knife doesn't change much.

</comment><comment><USER14> wasn't this debunked in the previous article on the same subject? <http://news.ycombinator.com/item?id=2849716>

<comment><USER3> Where do you see a "debunking" there? I sure don't. Just a downplaying of the risks of the previous type of attack.

This is a new, MUCH worse attack from a different researcher -- one with significant existing credibility, I might add.

</comment></comment><comment><USER15> I know security researchers must do this stuff by reflex, but this "insight" seems useless. It's not like this could happen by accident. So for this to happen, you would need someone to want to kill you, and there are simpler ways to do that.

<comment><USER16> True, but few ways to kill someone will look like a software glitch.</comment></comment>


Blogger proves Nasa wrong on climate change - <AUTHOR> http://www.timesonline.co.uk/tol/news/world/us_and_americas/article2271629.ece <comment><USER2> Before you draw any conclusions from this story, you should really have a look at Jim Hansen's explanation of the error and figures here: <http://www.columbia.edu/~jeh1/distro_LightUpstairs_70810.pdf>

Their errors have basically no effect on global temp anomalies.

</comment><comment><USER3> Remember the 2 + 2 = 5 bit in the book "1984"? That was in reference to the Soviet claims that they met all the production goals for their 5 year plan in 4 years. The slogan was something like, "We achieved 5 in 4".

The production figures were all fraudulent, of course. The industrial figures weren't just wrong, but hid the fact that Russian argicultural had been set back 40 years--not to recover until the 1980s.

Back then, "Prosperity" was the ticket. And "Prosperity" meant smokestacks. What's the best way of making more smokestacks? Everyone has a pre-packaged solution to every problem, of course, which is phrased in various ways but amounts to:

 _We_ control _you_.

IE, control of the means of production. That's the solution--and since it precedes the problem, and since it doesn't actually solve any problems anyway, it has to search around pretty hard looking for a reason. Back then, the crisis was "Not enough smokestacks". In later years?

Umm. Poverty? Inequality? Pollution? Global cooling? Global Warming? ... The solution to "Global Warming" is of course "We need fewer smokestacks". Since people aren't likely to shut their smokestacks off willingly, the REAL solution is,

 _We_ control _you_.

...after seizing the means of production.

<comment><USER4> So doing something about global warming is just like communist Russia?

I think you're in the running for the "reddit hyperbole transplant award".

Even republican economist Greg Mankiw, of Harvard, suggests a carbon tax as an efficient, market based approach to correcting the negative externalities of carbon usage:

[http://gregmankiw.blogspot.com/2006/10/pigou-club- manifesto....](http://gregmankiw.blogspot.com/2006/10/pigou-club- manifesto.html)

</comment></comment><comment><USER5> Climate change is one of Rupert Murdoch's pet projects. The motivation for this article is nothing more than a positive performance review for David Byers.

Consider the first line "America's top scientists have admitted that the calculations ... were flawed" It's phrased as though the scientists were activly hiding the truth, pushing some secret agenda, rather than making a mistake. Line 2, "Climatologists ... have been forced to revise their estimations". what? at gunpoint?

Science is great because of objectivity. Any random guy can point out mistakes, and "Climatologists at Nasa's Goddard Institute of Space Science" will listen to him. The timesonline is nowhere near objective. Beware this article as a source, Its internal bias will mess with your ability to consider the quality of evidence.</comment>


The FBI Is Classifying Its Tor Browser Exploit - <AUTHOR> https://motherboard.vice.com/read/the-fbi-is-classifying-its-tor-browser-exploit <comment><USER2> If the exploit is classified, how can it be verified that the exploit actually extracted the evidence claimed? That is, how can the FBI prove that it did not obtain the evidence by other, illegal means (as they have instructed other agencies to do)? Provenance of evidence is everything in criminal cases.

<comment><USER3> The FBI has two different, and sometimes opposed, missions. The primary mission is security - it's supposed to stop terrorists from terrorizing, spies from spying, saboteurs from... well, whatever.

After-the-fact law enforcement is secondary. It may be this is a tool they intend to use to attack spy and terrorist networks where breaking up the network is more important than getting prosecutions.

<comment><USER4> > The primary mission is security ... After-the-fact law enforcement is > secondary.

I'm not sure that's true. Where do you get that?

<comment><USER3> [https://www.fbi.gov/about-us/quick-facts](https://www.fbi.gov/about-us/quick- facts)

</comment></comment></comment></comment><comment><USER5> The FBI and other government institutions often ask for the help of the tech industry, and act like they want to build bridges but actions like this show a double standard.

They are like your annoying needy friend. Always asking you for stuff but never bothering to return the favor.

<comment><USER6> > show a double standard

No they don't. Assistance that industry would provide would also be classified and honestly a penalty would probably be levied if the found issues were ever fixed.

So they found it on their own, results classified so they can't be fixed.

Needed help finding it, threaten penalties if the issue is ever fixed.

They're not trying to build bridges, they're trying to gain control of another source of information.

</comment></comment><comment><USER7> Why is Tor Browser still using FF instead of Chrome or something?

A sandbox is necessary, and I'm 100% sure there are a ton of 0-days in all browsers.

<comment><USER8> Chrome is not even open source. They can't use it.

If you're referring to Chromium, well, what makes you think it's more secure than Firefox?

Also, don't you think that the developers of the Tor browser are pretty security-aware? That they might make very well informed decisions?

<comment><USER9> Chromium is a magnitude more secure than Firefox. If you find a 0day in the Firefox renderer, bam, code execution with full user permissions. A 0day in Chromium renderer code is pretty much worthless.

Firefox has zero additional layers of security. Chromium has a battle-tested sandbox which kills 99% of all exploits in the absence of an additional kernel exploit.

Also note how none of the recent Flash 0days was exploitable on Chrome.

</comment></comment></comment><comment><USER10> So write a bot that browses bad sites on tor and see what infections it picks up, then examine what vulnerabilities they exploit.

</comment><comment><USER11> Contrary to my usual opinion about the US Federal Government's "cyber- tactics," this actually seems like a good thing.

I'd rather that fewer people understand how to break tor, as opposed to more. There's a middle ground which may be better, but on the open-source/classified spectrum I'm a little right-leaning on this one. Thoughts?

<comment><USER12> It should be patched. Am I wrong?

The entire reasoning behind using tor is for anonymity, and we don't know what this exploit is exactly or how serious it is.

<comment><USER11> I remember reading an doctoral paper from MIT about it, and the general principal involved a combination of large swaths of man-in-the-middle tor nodes, combined with algorithms resembling physics formulas which use statistical mechanics to model fluid dynamics.

If that's the case the exploit is intrinsically linked to the way tor works, and there may be no patching possible.

I'ma need someone to fact-check me because I'm semi-busy right now and I don't have the article on-hand.

<comment><USER13> This is described as a Tor Browser exploit -- a vulnerability in the browser that people normally use with Tor -- rather than a vulnerability in the design of Tor or a way of performing traffic correlations. This vulnerability can probably be fixed permanently for all users with a tiny software patch.</comment></comment></comment></comment>


Slide Rulers Rule - <AUTHOR> http://www.eeweb.com/rtz/slide-rulers-rule

<comment><USER2> See <http://news.ycombinator.com/item?id=2250858>

<comment><AUTHOR> Thanks for pointing this out. My thought is that the system handles relevant vs irrelevant content.

We certainly get a good number of people reading our strip from our HN posts. The majority of posts submitted to HN don't get voted up or commented on - does this mean they are not good posts?

Our comic is for a technical audience so we're submitting this to a technical audience.

Also, how many of the posts on the front page of HN are gamed?

Regards...

<comment><USER2> I started to reply in detail, but it all just started to sound like I was attacking you, and that's not my intention. I've just observed that it feels like you're spamming the site with stuff that almost never gets upvoted, and hence feels like it's just not a good fit for this crowd.

But hey, that's your call, and I was just hoping to let you know what impression you're giving.

<comment><AUTHOR> I appreciate the sincere reply.

1.) We try to pick out the most relevant content from our community, but of course that is subjective. My thought is that the system and community decide the best content. I wish there were "downvotes" for our posts so we have an indicator of the value of our content. Your comment is certainly a valid "downvote" in my book, so great feedback.

2.) We are a desert Island in the sky, so getting some leads in through the HN Community and finding the correct demographic is important for us.

This is the first comment from HN I've read regarding our content falling under such classification.

<comment><USER2>
      > I wish there were "downvotes" for our posts so
      > we have an indicator of the value of our content.

Do you not find it relevant that you get pretty much no comments at all?

But basically, my observation is this: Your material might be great for some audiences, but you get no upvotes, and no comments. Perhaps for thie HN audience you need to adjust your content to increase the positive effect you get.

And good luck with whatever you try.

<comment><AUTHOR> One test I've used to check relevancy is to follow our posts on twitter. A lot of our posts are aggregated on various HN twitter feeds. Some, more than others. I've been using this to determine the quality of the post and understand what various HN tweeters find valuable.

There's so many great posts on HN that get zero comments or up-votes. I'm convinced there are a small number of posts that get enough momentum from a very select group of voters, and once these posts are "blessed" so-to-speak, they then get some frontpage exposure - which gets them to some valid threshold allowing the community give it further boosting.</comment></comment></comment></comment></comment></comment>


Build walls on seafloor to stop glaciers melting, scientists say - <AUTHOR> Build walls on seafloor to stop glaciers melting, scientists say<p>https://www.theguardian.com/environment/2018/sep/20/build-walls-on-seafloor-to-stop-glaciers-melting-scientists-say?CMP=Share_AndroidApp_Submit_to_HN <comment><USER2> Sounds like another "job" for Elon Musk...</comment>