McKinsey, technocratic management, and structural inequality - <AUTHOR> https://www.theatlantic.com/ideas/archive/2020/02/how-mckinsey-destroyed-middle-class/605878/ <comment><USER3> Oh boy, another Yale, LSE, and Oxford graduate lecturing us on "structural inequalities" \-- yawn. He's also decided to double-dip and is now back at Yale Law teaching after clerking for a federal judge. Excuse me while I roll my eyes a full 720 degrees. How exactly, sir, are you _better_ than Pete Buttigieg? This is the pot calling the kettle black to the n-th degree.

My main problems with the article, apart from the above:

1\. The connection between consulting firms like McKinsey and dwindling union memberships is tenuous at best. I'm not sure that there's any causal link, and the article just kind of shoehorns it in.

2\. Wait, why are we talking about CEO salaries? What does this have to do with anything? Oh, I get it -- it's going to get The Atlantic a bunch of "controversy clicks" on Facebook and Twitter.

3\. "Whereas a century ago, fewer than one in five of America's business leaders had completed college, top executives today typically have elite degrees" \-- a century ago, we also didn't have little boxes that could access the entirety of human knowledge in about 30 milliseconds. A millennia ago, most of us were illiterate. Times change. I'm genuinely not sure what the point is here.

4\. "This is a dangerous belief. Technocratic management, no matter how brilliant, cannot unwind the structural inequalities that are dismantling the American middle class.." \-- but Yale & Oxford educated lawyers can. Got it.

<comment><USER4> I don't expect to change your mind, but I had a very different reading of this article than you did and here are my thoughts on the 4 points that you raised:

1\. I don't think it's a big secret that stamping out unions is a key part of modern management. If McKinsey and other consulting firms were management consultants, they should be even more aware of that strategy and would have been in a key position to effect that change over a large number of companies.

2\. CEO salaries are certainly relevant to the working middle class, since they are commonly seen as tremendously too high and the extra money could contribute to the middle class' wage.

3\. I think the point of that sentence is more like "the amount of effort it takes to become successful is significantly greater than it was when the system worked better."

4\. He's not trying to be the technocratic management, he's literally arguing against its existence.

<comment><USER5> > 2\. CEO salaries are certainly relevant to the working middle class, since > they are commonly seen as tremendously too high and the extra money could > contribute to the middle class' wage.

This may be how they are "commonly seen", but is it correct?

Walmart pays 5 of its executives a total of ~$70m/year [1]. Walmart employs 2.2m people [2]. Redistributing 100% of these 5 executives' salary to all 2.2m workers would be a raise of... $32/year.

The bigger issue with wealth inequality is the investor class and favorable treatment of capital (low capital gains tax rates, carried interest, shady real estate business, etc.), not salaries/wages, even extremely high salaries like those of executives. Even talking about "management" as relevant to this issue is a distraction.

1\. [https://www1.salary.com/WALMART-INC-Executive- Salaries.html](https://www1.salary.com/WALMART-INC-Executive-Salaries.html)

2\. [https://corporate.walmart.com/newsroom/company- facts](https://corporate.walmart.com/newsroom/company-facts)

<comment><USER6> > Redistributing 100% of these 5 executives' salary to all 2.2m workers would > be a raise of... $32/year.

But that's besides the point. What on earth do they need to get paid that much for? Even if you assume they're contributing 100x what line workers are doing, they'll do just fine earning under $1M/year.

Plus, you then pinpoint the bigger issue. Yeah, the investor class exists because, you know, someone shaved $32 off of everyone's salary so 5 people could get paid a total of ~$70M/year.

<comment><USER7> This is what the job is worth, if you want someone competent and responsible for thousands of employees and billions in revenue. Nobody is doing that for $1m/year when one wrong decision could end up costing 1000x more than their salary and hurting livelihoods of the workers.

Focusing on a single number is irrelevant, you must account for everything in the organization and the results.

Also nobody is stopping anyone from creating corporations with different compensation, but clearly there's a certain price required when you get to these levels.

<comment><USER8> > Nobody is doing that for $1m/year when one wrong decision could end up > costing 1000x more than their salary and hurting livelihoods of the workers.

You make it sound like they'll somehow lose out personally by losing the company 1000x their salary and hurting the livelihoods of workers, like they're somehow being compensated for personal risk.

What you cited represents no personal risk to the CEO. They already made their millions. Now maybe if CEOs were actually liable for the damage they could do to the company and economy, would it be more justified.

<comment><USER7> There is personal risk. If the CEO does a poor job they might not be hired again or have other career impacts. There are numerous Fortune 500 CEOs that have a negative reputation that impacts their future earnings.

Also corporations partly exist to shield liability so CEOs are not going to be personally held responsible outside of gross negligence or criminal acts, the same way you wouldn't be held responsible if you caused a major outage in your company that lost customers. There is an general move towards more performance-based compensation though, which I think you would agree is a good thing.

<comment><USER8> > There is personal risk. If the CEO does a poor job they might not be hired > again or have other career impacts. There are numerous Fortune 500 CEOs that > have a negative reputation that impacts their future earnings.

And if I do a shit job I might have trouble getting hired too, but I'm not paid millions for it.

<comment><USER7> Perhaps, but extremely unlikely. Who would know? I'm sure you can see there's a massive difference from a major CEO who is known publicly vs you switching jobs and not getting a reference callback at worst.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I think it's interesting how this article painted middle management as the good guys. In my experience, "intricate layers" of middle management is not a good thing- most of these "layers" do not add value and it's why companies chase a flat org chart.

Arguing that management takes the lion share of pay, and McKinsey has captured this value away from the middle class, is also a silly argument. McKinsey's revenue is small on an absolute scale- $10B last year. Companies in the Fortune 100, which they mention, generate trillions in revenue. They haven't really captured this value at all.

Here are some things that are true:

\- A typical company nowadays has slimmed down, especially in middle management, compared to 50 years ago.

\- The profits of this slimming have not necessarily trickled down.

The rest of the article feels like fluff.

<comment><USER10> > In my experience, "intricate layers" of middle management is not a good > thing

Well, the academic research paints a different picture. Here's what we know. Even within the same industries, in the same markets, there's a substantial dispersion in management practices and adherence to best practices between the best and worst firms.[1]

The firms with the best management practices have substantially higher productivity and profits than their poorly managed counterparts.[2] We also know from randomized control trials, that interventions designed to improve management practices at the organizational level have long-lasting effects on firm performance.[3]

Moreover this isn't just a case of "good management" meaning abusing employees. There's a strong positive correlation, at the firm level, between management best practices and employee satisfaction.[1]

That's a pretty strong indicator that management, at least done right, isn't just BS. That it makes a significant impact on tangible economic output. Incompetent management really is just pure inefficiency with no upside for anyone.

[1] [https://www.aeaweb.org/articles?id=10.1257/jep.24.1.203](https://www.aeaweb.org/articles?id=10.1257/jep.24.1.203) [2] [https://academic.oup.com/qje/article/122/4/1351/1850493](https://academic.oup.com/qje/article/122/4/1351/1850493) [3] [https://academic.oup.com/qje/article/128/1/1/1838606](https://academic.oup.com/qje/article/128/1/1/1838606)

<comment><USER11> This is a great fact based argument. However, it is confusing "good quality management" with "more managers". "Best management practices" does not necessarily mean "more managers". I would actually argue that the more incompetent managers you have, the more of them you need to get business done. Finding incompetent managers and highlighting them is something consulting firms can help to do.

</comment></comment></comment><comment><USER12> My first lesson in the real world after I graduated was that the big name consulting companies are in many instances just well managed brand names. They are often used by management to "objectify" decisions tat are already made. Specifically decisions that are not easy to sell to everyone like layoffs. It basically goes like this:

1) We think X people need to go

2) Hire BCG/McKinsey (the more recognized, the better so usually one of the two)

3) After an "independent" audit they recommend X people need to go (sorry we can't really do anything about it, after all this famous consulting company recommended it)

Had the same experience with technology consultants when management wanted to switch the tech stack to something they thought they needed. At a smaller company I worked for, we basically needed to add a tech consultant to all bigger projects as insurance for big companies that were our customers and that was a hot mess because they knew it and sent the most junior/inexperienced people who were usually a net negative on productivity.

I also had two cases of very lackluster big name consulting companies. One had done some of the calculations in the wrong currency which lead to interesting results and one had the classic slides with names/logo of another client on them. Back at university I strongly considered putting in some years at a big name consulting company to boost my CV, make some money and get insights into some interesting projects. It seemed like genuinely interesting work, too. Pretty glad I didn't go that route.

I'm curious if someone here has more positive experiences working with (or maybe for) consulting companies. My current mindset is...avoid at all costs.

<comment><USER13> Hi,

I have worked at a top tier consulting firm to improve a companies technology offering.

From my experience, there are two stories consultants of these companies tell themselves. One of them is the one you just told right now.

The other is where they can genuinely help with the problem at hand. Some consultants really provide objective value to the current working of a companies system and provide well needed direction to a companies strategy.

Our firm has helped change operation fundamentals for these firms at crucial points in their lifetime.

<comment><USER14> What do you think is the split between these stories? How many gigs/how much revenue fall into bucket one vs bucket two, if you had to guess?

<comment><USER13> Honestly, the people who make it big in the firm have a great knack of delivering. It's a 50-50 from what I know.

It is true consultants have less skin in the game, they can basically not deliver and the firm gets more business from other big names. But reputation is everything, one consultant that delivers splendid on a project has his reputation to maintain.

</comment></comment></comment></comment><comment><USER15> Yawn. Popular as it is to falsely attribute blame for all of the corporate world's ills on consultants, it's inaccurate and lazy.

When you've worked for a consulting company, you learn that none of them are centers of innovation. They didn't create these trends. That's not what their strength is. They're not (and weren't) the ones inventing offshoring, telecommuting, barcodes, bluetooth, etc. They only greased the wheels to help existing trends in business to happen. How could they be the leaders of important business trends? The average tenure of people in consulting is about 3 years. They get in, help do some work a company wanted to do anyway, and get out. Maybe make a few 2x2 charts while they're there to point out the obvious to the oblivious.

Don't blame the consultants for getting companies or governments to become the soulless entities they are today. Blame lazy (or malicious or incompetent) thinking at companies and governments, fueled by the desires of everyone to have things at lower price, faster, and smaller, and to not pay for it now but shirk it off as debt to be paid by the future responsible people who can't vote right now.

We're all responsible for the trends in business, every one of us in our daily civic and commercial behavior. Consultants were just some of the messengers.

<comment><USER16> Not just the world's consultants, on one particular consultant who kept getting called out, and who is presently running for office. Not that I have any particular support for the 2020 candidates, but what does this author have against that particular individual? It's like the whole thing is written to get at the candidate by convincing people that McKinsey consultants are evil and then mentioning that he used to be one of them.

</comment></comment><comment><USER17> It should also be noted that McKinsey makes a substantial part of its income from ripping off the government.

[https://www.nytimes.com/2019/12/14/sunday-review/mckinsey- ic...](https://www.nytimes.com/2019/12/14/sunday-review/mckinsey-ice- buttigieg.html)

<comment><USER18> And clueless management at large corporations. My opinion or them is very low after a few engagement in technology implementation. Maybe they are better at general consulting so your mileage may vary.

</comment></comment><comment><USER19> "...foment a stratification within companies and society" by concentrating the management function in elite executives, aided (of course) by advisers from consultants' own ranks..."

Good ole boys club. Lords, Dukes, and Earls, Senatores and Equitares. It's the same old story just repackaged slightly.

"Meet the new Boss / Same as the old Boss" -The Who

</comment><comment><USER20> I really despise McKinsey but this just feels like a strange hit piece on Pete Buttigieg.

</comment><comment><USER21> This article is a little light on the data.

Yes, the premise of trends showing union busting and falling middle class wealth levels are established, but the author seems to want to show they were caused, not correlated, by the management consulting industry. This seems to be in an effort to incriminate Buttigieg by proxy (whom I do not care about either way).

The argument seems to be willfully ignoring other factors that have contributed to the trends, the most obvious being political. As a counter: I remember protesting the breakup of the public sector unions in my state, which was lead by a Governor with a very specific anti-union agenda, not a management consultancy.

</comment><comment><USER22> This just seems like an article written to attack a viable moderate Democrat (Pete Buttigieg). The narrow characterization of management consulting companies seems disconnected from reality. And of course, there's the author's biased worldview, as he authored "The Meritocracy Trap".

</comment><comment><USER23> As a non-americas, I view these companies with wariness. They are at the center of a change that is outsourcing what wouldn't have needed to be outsourced. Of people overworking themselves and pushing that behaviour down on others.

On young people having no life experience and inflicting massive damage on other people. Maybe there are some that do good work, but there are so many consultancies, that we forgot somehow to structure businesses without making profit the one and only goal.

The sentence about profit in that article best describes the problem. Businesses should be about humans and not profit first. At least when trying to increase profit think about the consequences on society and the people.

<comment><USER24> McKinsey came into my company with a new, foreign CEO. They wrote some report that (obviously) agreed with what the CEO was planning to do.

Then it turned out all their numbers about Churn, employee engagement, profit, revenue. All turned out wrong. Quarter after quarter all their prediction are turning out to be complete bullshit, even though there was no economic downturn or any big change that happened.

They left with millions in fees, taking no credit or blame. The CEO left as well.

The rest of the company is trying to fix their mess.

</comment></comment><comment><USER25> How is it that there's no mentioning that the pipeline to get into McKinsey is hardly technocratic – and that there's little reason to believe that its management is technocratic too? The values of that world are not exactly aligned with "Hackers and Painters."

Say what you will about one value system versus the other, if you will. We don't have to judge their culture versus ours. But, cmon...

</comment><comment><USER26> The article brings up very interesting correlations and it'd be interesting to see someone dive deeper in this, but I find the subtitle "Technocratic management, no matter how brilliant, cannot unwind structural inequalities." very opinionated, fatalistic and not backed up by the article.

</comment><comment><USER27> This reminds me of the adage that if a small town has one lawyer then that lawyer is broke due to a lack of business. But if the town has two lawyers then they will have more business then they know what to do with. I want to say it is a Mark Twain quote but I can't find the reference.

</comment><comment><USER28> Regardless of whether or not major consulting groups are actually ever worth the money or as good as their reputation makes them out to be, they're still morally bankrupt organizations that have no issue helping authoritarian regimes, rich people rip off governments, or the like.

</comment><comment><USER29> Anyone who criticizes McKinsey has no idea how consulting, or real companies, or the real world, works.

These anti-Pete articles are so shallow and ignorant. Any parent would have been proud to have their son get a job there at his age.

I guess in 4 years the only acceptable prior job to being president is a lemonade salesperson.

Most people, including middle class folks, don't have the luxury of only choosing non-profit jobs or volunteering.

<comment><USER30> I think there's a perfectly valid question as to whether the best and brightest going into prestige shops for the sake of building prestige is the best use of talent in our society.

<comment><USER29> That's up to them, and the market. It is not their fault those industries pay more.

<comment><USER31> So which is it - not Pete's fault, or something to be proud of?

For the record, I grew up very poor. Lower-middle class was an unattainable aspiration for my parents. I'm doing very well for myself, and have never compromised my morals to do so. I turned down good paying jobs when it hurt to do so because the work was slimy.

You don't have to sell yourself out to make money. If you do, that's a choice.

(To be clear, I'm not saying Mayo Pete is a sell out - I don't really care enough to look, but from what I've seen he seems like a true believer in the notion that his job is to tell the proles why they can't have nice things while cutting deals in wine caves. It is easy to understand why the Democrats produce so many of these people; what is inexplicable to me is why anyone except Republicans like them.)

<comment><USER32> >...what is inexplicable to me is why anyone except Republicans like them

Might be my own bubble, or perhaps things are changing, but I haven't met a Republican that likes these people. They are usual quite hostile to them.

<comment><USER31> Because they cause internecine conflict on the other side, not as someone to vote for.

</comment></comment></comment></comment></comment></comment><comment><USER33> What a disingenuous article. To put the entire blame on management consultants for wealth inequality and then to say, btw, Pete is one of them - it reeks of agenda politics and a hit piece.

Let's talk about the actual substance of the article, which there is surprisingly little. First, the author claims that managers used to come from the working class before 1955, and that the managerial consultant class made it so that working class people could never become managers.

A more plausible explanation is that in the older days, planning capacity was more evenly distributed among the working class and as the education system in the US matured, smarter people with the capability for planning and strategy were less likely to start off as a clerk or factory worker.

Second, the author claims that the managerial consultant class is responsible for wealth inequality by systematically reducing middle management and pushing the "profits to shareholders" maxim that has dominated corporate America. He implies that America would be just as wealthy and much more evenly distributed if they didn't exist.

As much as I would love to pull out a torch and ascribe blame the way the author does (blissfully), it's just not what is happening. No one wants to hear this, but middle managers were cut out not because of an agenda but because they were over payed and inefficient, as measured by the economic system.

It's popular but unfair to say that companies benefit the shareholders at the cost of society. Companies benefit the consumer the most through better products and lower costs, which is a tenant of globalism and largely true, as we've experienced a consumption boom that we've never experienced in the history of mankind. Standard of living is incredibly high as consumers.

However, consumers are also the employees of companies, and wages have been stagnant for a long time. But it's not that smart, rich, capable people steal from poor, middle class, working people, but rather the systemic properties of capitalism make wealth unequally distributed as a byproduct of producing value efficiently. If you must scratch the itch to blame something, blame the system, not the people in the system.

This problem of growing inequality existed for a long time but the lack of visibility and ultra cheap consumption by companies exploiting global opportunities to temporarily reduce cost of goods placated most Americans. Employees (consumers) still get gains from the economy by benefitting from stuff being either cheaper or continually better quality. As long as we can continue to reduce costs or improve quality at same cost, then stagnant wages is not an issue because standard of living is still rising.

(Yes, I know standard of living as a metric has been constant or falling since forever, but you can't compare telegraphs to iPhones).

Well, after employing cheap labor from 3rd world countries and making possibly the cheapest produced goods in history from China, we've mined out all the global opportunities. Going even cheaper is no longer an option (although there is no lack of trying) - that bandaid is no more, and now people want a stronger fix - this has been the conversation topic of the election and for most America for about 5-10 years.

To do what the author does - imply that people, not systems, are to blame - <USER2> a step back in terms of discourse. It indicates to me that the author puts blame and agenda politics over a desire to understand and solve issues, and cleverly masks it by sounding intelligent.

<comment><USER33> Since it's in my head, here's a summary of the public discourse of the current economic situation:

Topic in question: the economy is unequally distributed to the point where the majority of the middle class are not getting the value gains in the economy

### 2 themes:

1) get more money into working class people's hands (via pay, social benefits, or systematic transfer of cash)

2) continue to improve cost/quality ratio of goods and services

#### In getting more money into working class people hands, there are many proposals:

a. UBI

b. Social safety net improvements, wealth tax, health care

c. Just get the bosses to pay their workers more (minimum wage)

d. Unsurprisingly, no one is saying we need to make our employees be more valued in the market by working harder or smarter, but this is an option

#### In continuing to improve cost/quality of goods and services, we've done the following:

a. Globalism

b. Entrepreneurship

c. Gig economy

d. AI / Robots

e. There's not much left that we can do here

Comes as no surprise that government intervention into the system via UBI or wealth tax is a popular topic.

</comment></comment><comment><USER34> American democracy, the left believes, cannot be rejuvenated by persuading elites to deploy their excessive power somehow more benevolently. Instead, it requires breaking the stranglehold that elites have on our economics and politics, and reempowering everyone else. ... says the Guido Calibresi Professor of Law at Yale Law School

<comment><USER35> By analogy... I'm a well-off technocrat and I think the big tech monopolies should be broken up and taxed more (and I think I should be taxed more also). That doesn't make me a hypocrite, it makes my position _stronger_ because it eliminates resentment toward successful tech elites as a possible motive.

I think it speaks well of this guy that he's not some bitter barista ranting about elites - he's talking about knocking his own class down a peg.

<comment><USER36> It may speak well of him, but it is the bitter barista, ready to enforce that knocking down a peg, who ends of in control. Just because you are willing to accept a tax increase of some percentage does not align your motives and position with the hypothetical barista. I think that is the actual substance, of not the intent of the parent comment. After all, that bitter barista and his friends have no problem spray painting 'liberals get the bullet too' on things as they attempt to prove there point.

<comment><USER35> I'm not just willing to accept some small tax increase, I'm willing to accept (and actively advocating/voting for) radical socialist transformation of our economy to a point that would be far beyond anything that would be in my own interest. I vehemently disagree that I'm not "really" on the same side as the barista because our interests don't align. There are some of us out there who will fight for what's right even if it's against our own selfish interests. Obviously we don't share the same struggles as, say, the struggling barista on a day-to-day basis so sometimes the appropriate urgency isn't there but in the end we are 100% on the same side.

> it is the bitter barista, ready to enforce that knocking down a peg, who > ends of in control

This is not really the goal in my experience moving in leftist circles. There's a lot of talk about bringing the wealthy down to the same level as everyone else to eliminate various forms of inequality, but not much talk about inverting the system so that the formerly rich are now under the heel of the formerly poor. The ones "in control" would be _everyone_ , including the former elites.</comment></comment></comment></comment>


Don't use autofill in your browser - <AUTHOR> http://yoast.com/autocomplete-security/ <comment><USER2> That's a misuse for the term "autocomplete" in my opinion. What he complains about is "autofill", not "autocomplete" as I understand it. Autocomplete takes the values you used previously and gives you suggestions for the stuff you're typing in yourself. Autofill tries to guess what values are required and fills them in without additional interactions.

They're very different mechanisms...

<comment><USER3> Fully agree, using "autocomplete" is misleading. The suggestions that go into auto-complete fields come from the server, autofill from the client.

<comment><USER4> You conflate autocompletion provided by the browser, based on values previously submitted in identically named fields, and autocompletion against values provided by the server.

</comment></comment></comment><comment><USER5> Doesn't seem to be an issue in Firefox, as far as I can tell. Certainly didn't fill any other fields for me.

<comment><USER6> Even if it showed you the fields, it wouldn't be conclusive proof of a privacy leak. Firefox shows links visited without exposing that property outside of render context: [https://blog.mozilla.org/security/2010/03/31/plugging-the- cs...](https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history- leak/)

<comment><USER7> The fields in this demo are being echoed back from the server, so if you see values in them then it is indeed proof they are being leaked.

<comment><USER6> The fields appear immediately, the demo actually does this:

        $("#mine").submit( function() {
        $("#hide").css("height","auto");

</comment></comment></comment></comment><comment><USER8> I remeber noting with concern several years ago that Safari was blindly saving my credit card number along with all my other auto-fill data. Thing is, I recall observing that behavior stopping around Safari 4 or so – the browser appeared to be using something along the lines of the data detectors that put calendar links on times mentioned in emails, and saving everything but the credit card field.

</comment><comment><USER9> This is weird, I'm on chrome but it doesn't happen for me...

<comment><USER10> I'm using Chrome version 30.0.1599.101 m on Vista. The form did what the post said it would - all those extra fields got filled in.

<comment><USER11> Same on W7, Chrome build 30.0.1599.101 m.

</comment></comment></comment><comment><USER12> Safari tells you what is actually going to autocomplete, so you could easily catch stuff that should not be sent...

<comment><USER13> This is true, and actually a pretty smart feature, but you have to take the time to double-check (which I suspect most users won't).

<comment><USER14> Usually I agree that people will blindly click through, but I don't see people clicking through this[1]. Especially if Safari said it would auto-fill your credit card number and you weren't buying anything?

[1] [https://www.evernote.com/shard/s356/sh/dcf7867e-eb16-4e0e-83...](https://www.evernote.com/shard/s356/sh/dcf7867e-eb16-4e0e-8387-6b72e5dbdd3b/ae46289e9b82a3897fb2a389b9ae708e)

<comment><USER15> My understanding is that even credit card information is only available if the person is specifically in a credit card field, and not just the name.

</comment></comment></comment></comment><comment><USER16> Firefox and the Mozilla Suite have had a very similar problem since at least 2005: it autofilled usernames and passwords, which creates a problem with XSS or user-generated content on the same domain. The bug was marked WONTFIX: [https://bugzilla.mozilla.org/show_bug.cgi?id=280469](https://bugzilla.mozilla.org/show_bug.cgi?id=280469)

<comment><USER17> Strange, but for me Firefox does not auto-fill passwords, unless you provide a username (and of course, you opted into auto-filling). What did it do, as I don't understand? Did it automatically auto-fill password fields that happened to get loaded on the page?

<comment><USER16> It indeed autofilled password fields on the page. Haven't re-tested it, but I think most browsers still show the same behaviour.

</comment></comment></comment><comment><USER18> Seems to work correctly (only name is submitted as one would expect) on Firefox 24.0 and Chromium 30.0. Edit: This is on Gentoo Linux.

<comment><USER19> You have to have an autofill set up with more information than just your name. You can tell if you have this set up because when the autofill choices show they will have your address etc in gray next to the choices you are auto- completing.

</comment></comment><comment><USER20> I just don't store credit card details in my browser. Auto-complete for emails is extremely handy and I use that all the time, but does purchasing things online really need to be any easier?

I don't mind reaching for my wallet there; it forces you to make a conscious decision to spend the money, which is at least slightly better than a 1-click impulse.

<comment><USER19> Credit card details are not the main concern here (because they are separated on Chrome), but you could send your address and phone number to a server without expecting to send more than your name or email address.

</comment></comment><comment><USER21> I dont see the problem all that was filled in was my name. The other fields were left blank. Even when I reentered it after the other fields popped up.

</comment><comment><USER22> Should be easy to make a proof of concept page to scare people dumb enough to have credit card auto-complete.

Just make hidden form fields for every field name you can think of, then make some onload javascript to welcome them to the page with any fields that aren't empty.

<comment><USER23> Oh, c'mon! Storing credit card data in Autofill is actually recommended by Google and considered secure: [https://support.google.com/chrome/answer/142893?hl=en](https://support.google.com/chrome/answer/142893?hl=en)

You shouldn't call people dumb for following Google's instructions. I agree with you that storing CC details in a web browser is a bad idea, but we should take issue with Chrome here (and other browsers) not with regular "dumb" users.

<comment><USER13> Apple are also touting credit card autofill with their new version of OS X, with strong claims of security. [http://www.apple.com/osx/whats-new/#gallery- icloud-keychain-...](http://www.apple.com/osx/whats-new/#gallery-icloud- keychain-creditcard)

</comment></comment></comment><comment><USER24> I always disable all "auto" functions in any browser. Autocompete for forms and URLs, remember passwords, everything I can find a switch for I turn off. Makes the browser faster and I feel like I'm more in control of it.

<comment><USER25> If only you could turn off auto-rendering, that bugs the hell out of me

</comment></comment><comment><USER26> Web devs can recommend input fields not use autocomplete: [http://www.w3schools.com/tags/att_input_autocomplete.asp](http://www.w3schools.com/tags/att_input_autocomplete.asp)

It's considered good practice to use it on login fields, but otherwise depends on whether you think security or user preference should take priority.

<comment><USER27> Users that find this "good practice" annoying can override it with a bookmarklet or extension: [http://kb.mozillazine.org/User_name_and_password_not_remembe...](http://kb.mozillazine.org/User_name_and_password_not_remembered#Sites_prohibit_password_saving)

<comment><USER4> I've noticed with Firefox (17 ESR) that, having once used Firebug to delete the 'autocomplete="no"' attribute on a password field and then submitted the form, it's not necessary to do so again; in whatever heuristic Firefox uses to determine how to behave in that case, the existence of auto-completion data for the field apparently overrides the advice given by the attribute. For those leery of adding still more extensions to a Firefox profile already well larded with them, this may be useful information.

</comment></comment></comment><comment><USER28> I'm sorry, I've never used autocomplete for a few privacy related reasons, and this was one of them... this seems obvious, to the point where I thought the title was written in a sarcastic 'duh' tone...

I figured not letting your (google especially) browser store personal details was pretty much common privacy/security sense at this point.

</comment><comment><USER29> Only occurred in Safari for me, not in Chrome or FireFox.

Also I was a little confused by autocomplete, I thought he meant for the address bar.

<comment><USER19> Worked in Chrome for me.

</comment></comment><comment><USER30> Tested this with Autocomplete off in both Safari and Chrome, but completed the forms with Lastpass. Same problem.

</comment><comment><USER31> Can someone explain the following page please? (As in what's being demonstrated here.)

[https://yoast.com/research/autocompletetype.php](https://yoast.com/research/autocompletetype.php)

</comment><comment><USER32> well I don't get the justification for the headline

<comment><AUTHOR> I added the word "apparently", coz I don't know if what the article claims is true or not...

</comment></comment><comment><USER33> This seems like an easy fix for the layout engines. Only include a field on autofill if it's currently visible on screen.

One might even classify this as a bug.

<comment><USER34> "Visible on screen" unfortunately is a hard thing to determine. You can easily imagine a textbox with white text on a white background, or a very small textbox, or a textbox that briefly pops up whenever you type a keystroke or click the mouse, or...

Browsers really need to support some mechanism where the user can determine precisely what information will be filled prior to it being handed over to the website. This needn't be difficult; Chrome's existing autofill popup already displays a subset of the information, the popup just needs to give a fuller picture.

<comment><USER35>
        </comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----
        | This webpage is asking for information that your |
        | browser can automatically fill in for you. Check |
        | the box next to each item you'd like to include. |
        |                                                  |
        | [x] Email address - firstname.lastname@example.com              |
        | [ ] Name - Bob Jones                             |
        | [ ] Address - 123 Sample Street                  |
        |                                                  |
        | [Autofill] [No thanks]                           |
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----

</comment><comment><USER36> Just name and email here, but I guess I'm paranoid enough.

</comment><comment><USER37> When your girlfriend borrows your computer and the browser sends her to porn sites.

<comment><USER38> You don't use "private browsing"? BTW, Chrome supports multiple profiles now.

<comment><USER31> I guess that's for signed in users?

<comment><USER39> No, it's for everything, though it might sound that way. Add a user on the settings page, it'll open up the switching UI, no sign-in required. (unless they changed that recently, of course. but that would suck.)

<comment><USER31> Nice hidden feature! Cheers.

</comment></comment></comment></comment></comment><comment><USER40> Seems to be an issue with Chrome only, which is unsurprising.

</comment><comment><USER41> 1password works great, and is secure.

<comment><USER13> I just tried 1password Safari integration with the test form[0] and it had the same problem as Safari's own autofill (it filled out the hidden fields).

[0][https://yoast.com/research/autocompletetype.php](https://yoast.com/research/autocompletetype.php)</comment></comment>


Ask HN: What do you think of my kickstarter video? - <AUTHOR>

I'm building an athletic apparel brand for men. I started working on the idea 8 months ago and am now launching the first product on kick-starter. I'm confident about the superiority of the product after getting validation from many potential customers, but I would love to get some feedback on the kickstarter video I made. Provided that I'm able to reach out to a large audience, do you think I can exceed my kickstarter goal with this video, or do you think i should make a new one at the cost of launching on kickstarter later? Thanks!<p>http://preview.yathletics.com <comment><USER2> You spend too long in the beginning talking about your shirt... I have to spend the first 45 seconds before you start posing problems that I may have that buying your shirt will solve. Your video is good, and you narrating and talking is good- but having a shirt that is soft isn't a big concern for me... you hit on some great points about wearing it multiple times.. want to know why I buy smart wool socks because they tell me that my feet won't stink if I wear them a couple of times in fact as far as I am concerned it is the only reason that wool is smart- because it fixes a problem of stinky feet. Good luck!

<comment><AUTHOR> Thank you. The silver, which breaks down the odor-causing bacteria and allows for multiple use, has consistently been voted as the most attractive feature. If I make a new video it will definitely focus more on that particular feature.

</comment></comment><comment><AUTHOR> clickable - [http://preview.yathletics.com](http://preview.yathletics.com)</comment>


Coming to CED Tech Venture '12? Fogbeam Labs, PragPress present The Escape Hatch - <AUTHOR> http://fogbeam.com/september_2012.html

<comment><AUTHOR> Since CED's "selection panel" didn't pick us for their "demo room," we decided to put on our own event. We'll be four blocks from the Raleigh Convention Center, at the offices of LocalSense. All CED TVC12 attendees (and anyone else) are welcome to come visit the Escape Hatch hospitality suite.

Escape the noise and activity of the CED Tech Venture Conference and join us at our hospitality suite. You'll get a chance to meet a select group of North Carolina-based startups and their founders for product demonstrations, networking and one-on-one conversation. Oh, and there will be beer, water & food available as well.

Visit <http://fogbeam.com/september_2012.html> to RSVP.</comment>


The centuries-old struggle to play in tune - <AUTHOR> http://www.slate.com/id/2250793/pagenum/all/#p2

<comment><AUTHOR> Quick mathematical summary of the problem:

An octave is a 2:1 ratio between frequencies, so 880 hz is one octave above 440 hz. A perfect fifth is a 3:2 ratio between frequencies, so 660 hz is a perfect fifth above 440.

In the modern western system of music, twelve perfect fifths is harmonically equal to seven octaves. In other words,

(2/1) __7 == (3/2) __12

Unfortunately, we know this is mathematically untrue.

Furthermore, three major thirds is harmonically equal to one octave:

(2/1) == (5/4) __3

This also is mathematically untrue.

Hilarity ensues.

<comment><USER2> You are using multiplication where you should be using exponentiation. If one fifth is (3/2) then 2 fifths is (3/2) times (3/2) which is (9/4). Your math looked semi-plausible when comparing fifths and octaves, but comparing 3 thirds and an octave it was way off.

Therefore the first comparison should be 7 octaves which is (2/1)^7 = 128, versus 12 perfect fifths which is (3/2)^12 = 531441/4096 = 129+3057/4096 = 129.746337890625.

Similarly for thirds, you're comparing one octave (2/1) = 1 with 3 thirds (5/4)^3 = 125/128 = 1.953125.

As you can see, the ratios are close, but not quite right. Hence the problem.

<comment><USER3> I think we just lost some carats in the mix. The original comment meant to type exponentials but they didn't come out right on the page.

Someday HTML will support TeX and we'll never have this problem again. ;)

</comment></comment></comment><comment><USER4> A better explanation of the problem:

<http://www.yuvalnov.org/temperament/>

Also, if you listened to samples in the Slate article and couldn't hear any difference, try this:

[http://www.youtube.com/watch?v=BhZpvGSPx6w&feature=relat...](http://www.youtube.com/watch?v=BhZpvGSPx6w&feature=related)

<comment><USER5> terrible example, because he's using pure sine tones. What makes intervals sound in or out of tune are the harmonics, which clash if it's not just tuning. No one can hear the difference between just and tempered thirds on a tone with no harmonics -- our aural circuitry is just not that precise.

<comment><USER4> > _What makes intervals sound in or out of tune are the harmonics, which clash > if it's not just tuning._

How come people use tuning forks and pipes for tuning?

<comment><USER6> There are two things at work here. There's harmonics, where you're working with a relationship between two or more frequencies; and then there's the absolute frequency, which is needed to get different instruments to harmonize. Tuning forks give you an absolute frequency.

<comment><USER4> > _Tuning forks give you an absolute frequency._

Well, yes, that's the point of my question. If harmonics were essential to the concept of "in tune", we wouldn't tune by using an instrument that has essentially no harmonics.

<comment><USER6> Harmonics are how you figure other notes are in tune with your absolute note - they're related to how the frequencies interfere. But that only tells you how to tune one note relative to another. It doesn't help you get a bunch of instruments in tune with one another, even if they're in different locations, etc.

Perhaps if you explained your confusion more, it could be answered better.

</comment></comment></comment></comment></comment></comment><comment><USER7> Previous submission, submitted with the canonical URL:

<http://news.ycombinator.com/item?id=1283523>

</comment><comment><USER2> Dupe: <http://news.ycombinator.com/item?id=1283523></comment>


Dead bodies abound on Mount Everest - <AUTHOR> http://imgur.com/a/rkRAk

<comment><USER2> At least we can rest assured that, in the event of some horrible cataclysm, there will always be plenty of human fossils hanging around somewhere, to preserve humanity's legacy.

</comment><comment><USER3> The entire world is a cemetery. Only when the ice cryopreserves our remains do we remember that.</comment>


Arcade Game Typography - <AUTHOR> https://readonlymemory.vg/shop/book/arcade-game-typography/ <comment><USER2> It's a shame these are all presented with giant blocky pixels. It makes some of the fonts look _really_ ugly (ex. Lady Bug). Better IMO to present them as they would appear on the medium for which the designers intended them, a CRT. [https://www.hottechzone.com/is-an-old-crt-television- perfect...](https://www.hottechzone.com/is-an-old-crt-television-perfect-for- retro-gaming/) has some good examples of the difference.

Another post from the same site, with a high-quality image of a Space Invaders CRT for direct comparison with the first example in the article: [https://www.hottechzone.com/taito-space-invaders-arcade- mach...](https://www.hottechzone.com/taito-space-invaders-arcade-machine/)

<comment><USER3> I dunno, I think it's good to look at these typefaces from a different perspective. An analogy would be examining a butterfly that has been pinned so that its anatomy can be examined up close. It's not as pretty or elegant as seeing it fluttering around outside, but it does let you experience it in a way that gives you information you wouldn't normally get.

<comment><USER2> I don't disagree, but to continue the analogy, pictures of live butterflies in flight are nonetheless invaluable to a researcher, and difficult to obtain. Although emulation helps, the "original look" of many of these fonts may be forever lost to time as the original hardware dies out.

</comment></comment></comment><comment><USER4> In case you're looking for a cheaper copy (or that sells out) I think that's just a hardback version of [https://smile.amazon.co.uk/gp/aw/d/0500021740](https://smile.amazon.co.uk/gp/aw/d/0500021740)

<comment><USER5> Damn: I wish I'd seen that before. No comments on this when I ordered. Would also have dodged their annoying checkout process.

<comment><USER6> It's mentioned in the page itself, third paragraph. I think the extra 20 is definitely worth it for the hard cover.

What annoyed you during checkout? Took 30s on mobile for me.

<comment><USER5> On reflection I'm actually pretty happy with the decision to go with hardcover.

Nowadays I've got quite used to Paypal checkout for sites I've not bought from before, which has the advantage that you generally don't need to enter any details or digout your card.

</comment></comment></comment></comment><comment><USER7> On ZX Spectrum, games often had fonts based on MICR[1] or OCR-A[2]. Example: [3]. I still don't understand why. I see these fonts in the wild very, very rarely. Was they popular in UK in 80s maybe? Was they used even outside bank cheques?

[1] [https://en.wikipedia.org/wiki/Magnetic_ink_character_recogni...](https://en.wikipedia.org/wiki/Magnetic_ink_character_recognition)

[2] [https://en.wikipedia.org/wiki/OCR-A](https://en.wikipedia.org/wiki/OCR-A)

[3] [https://archive.org/serve/zx_Alien_8_1985_Ultimate_Play_The_...](https://archive.org/serve/zx_Alien_8_1985_Ultimate_Play_The_Game_a/Alien_8_1985_Ultimate_Play_The_Game_a_screenshot.gif)

<comment><USER8> That's an easy question to answer - because they looked cool and futuristic. If you watch old episodes of Doctor Who or 70s films you will often see props and displays with similar fonts, and video games followed that aesthetic.

I guess those fonts had just started to appear on cheques and machine readable tickets so people associated those typefaces with computers.

<comment><USER9> Exactly, the cheque font was synonymous with sci-fi back then.

</comment></comment></comment><comment><USER10> I'm a sucker for these old bitmap fonts. Here's a collection of links I've bookmarked over the years:

* [https://damieng.com/blog/2011/02/20/typography-in-8-bits-sys...](https://damieng.com/blog/2011/02/20/typography-in-8-bits-system-fonts) and [https://damieng.com/blog/2011/03/27/typography-in-16-bits-sy...](https://damieng.com/blog/2011/03/27/typography-in-16-bits-system-fonts)

* [http://www.type-invaders.com/sinclair/8bitfonts/](http://www.type-invaders.com/sinclair/8bitfonts/)

* [https://opengameart.org/content/the-collection-of-8-bit-font...](https://opengameart.org/content/the-collection-of-8-bit-fonts-for-grafx2)

* [https://forums.nesdev.com/viewtopic.php?t=8440](https://forums.nesdev.com/viewtopic.php?t=8440) (scroll down a bit)

</comment><comment><USER11> I'm an even bigger fan of the slightly larger and more detailed bitmap fonts used in the early 90s, popularized on Amiga, arcade machines, and in particular the demoscene. These fonts were the inspiration for the Voxel Quest logo [1].

[1] [https://ksr- ugc.imgix.net/assets/011/631/892/83281ea18b64eab...](https://ksr- ugc.imgix.net/assets/011/631/892/83281ea18b64eab16462df01b2f10908_original.png?ixlib=rb-2.1.0&crop=faces&w=1552&h=873&fit=crop&v=1463685891&auto=format&frame=1&q=92&s=2b5a3fdab8c787c280dc6a8b25277744)

</comment><comment><USER12> Don't sunset bitmap fonts just yet (or many old school gamedev dark arts). They can be more portable and faster to render than vectors ;)

<comment><USER13> The software I work on at work uses bitmap fonts. We actually have a system that renders windows fonts without subpixel rendering on a few backgrounds and then saves the output to header files for us to include in the project. It's mainly for space saving reasons and the fact that getting a proper text rendering system was more work than it was worth.

</comment></comment><comment><USER14> So what's your favorite, HN?

Personally I'm a big fan of

\- the Apple ][ font,

\- what I call the "Nintendo Font" that was in many 8-bit NES games and arcade games. It's the font in Pac-man. I believe some Atari games from the 70's used it,

\- The VT220 font - I use the GlassTTY font in PuTTY, I really like it.

<comment><USER15> \- the Apple ][ font, I sometimes use it in Terminal as it is compact and retro.

[https://www.kreativekorp.com/software/fonts/apple2.shtml](https://www.kreativekorp.com/software/fonts/apple2.shtml)

<comment><USER16> re the apple 2 font, yes i instantly recognized the space invaders page in the book to be exactly, or nearly so, the upper case 40-column character set used on the apple 2.

ha, i used the condensed (ie. 80-column) version of this font in my terminal too, and for coding as well. see the xcode theme i made... [https://smallduck.wordpress.com/2015/06/03/throwback- xcode-t...](https://smallduck.wordpress.com/2015/06/03/throwback-xcode-theme/)

</comment></comment></comment><comment><USER17> Used to love making bitmap fonts in DPaint on the Amiga, something quite meditative about it almost.

</comment><comment><USER18> These are beautiful and very on-trend rn. Anyone have links to good webfont versions?

<comment><USER19> Not webfonts as such, but this site will generate you some images: [https://nfggames.com/games/fontmaker/](https://nfggames.com/games/fontmaker/)

(I feel the book must have been inspired by this site somehow, particularly when you read the various 'notes' that pop up after selecting a font from the dropdown.)

<comment><USER20> Great site! Unfortunately they're limiting themselves to arcade machines. For instance, the font from Lemmings looks great too: [http://www.lemmingsuniverse.net/shots/images/amigashot03.png](http://www.lemmingsuniverse.net/shots/images/amigashot03.png)

<comment><USER21> _Unfortunately they 're limiting themselves to arcade machines._

There are _thousands_ of different bitmap fonts from the 8- and 16-bit era of gaming. Any book about them has to be limited in some way.

<comment><USER20> I wasn't talking about the book, but about the site CmdrKrool mentioned.

</comment></comment></comment></comment></comment><comment><USER22> It would be interesting to pass all those fonts trough a neural network so a GAN try to generate some new ones

<comment><USER23> In a sense, any GAN which generates fonts, like [https://twitter.com/kikko_fr/status/1095603397179396098](https://twitter.com/kikko_fr/status/1095603397179396098) or [http://www.machinelearningfont.com/](http://www.machinelearningfont.com/) or [https://email@example.com/creating-new-scripts- with-s...](https://firstname.lastname@example.com/creating-new-scripts-with- stylegan-c16473a50fd0) , is already generating bitmap fonts, because the generator is upscaling through multiple resolutions. If you want the 'bitmap' version, you'd just grab the 32px layer output etc.

But the pixel art I've seen from GANs hasn't been too good. I think it's ultimately because it's very impoverished a representation and pixel art relies heavily on us already knowing what we might be looking at, and a GAN doesn't know that. Imagine trying to learn to generate Pokemon when there's only a few hundred examples of them and you've never seen any of the millions of plant or animal species they are based off of?

<comment><USER22> I'm doing some experiments with GAN. I think I'm halfway done. I don't want to talk much about it now, cause I'm afraid of failure, but... if things goes well, I'm might post something interesting here this weekend.

</comment></comment></comment><comment><USER24> Does it have the vector fonts?

<comment><USER25> Looks like it's about pixel fonts specifically.

</comment></comment><comment><USER26> So no fonts included?

<comment><USER27> You can make your own. Here is guide to rip fonts from your favorite childhood arcade machine using MAME:

[https://web.archive.org/web/20170107110149/https://nfgworld....](https://web.archive.org/web/20170107110149/https://nfgworld.com/mb/thread/623)

</comment></comment><comment><USER28> this looks so good! thanks.</comment>


Mimic – abusing Unicode to create tragedy - <AUTHOR> https://github.com/reinderien/mimic <comment><USER2> Slightly tangential:

In Russia there is a government procurement portal. Where gov organizations have to post their requests to enforce competetion and best prices.

The usual tactics [1] of corrupt officials was replacing cyrillic (russian) letters with respective latin homoglyphs so only affiliated companies can find and win this contract.

[1] [http://www.bbc.com/russian/rolling_news/2013/04/130409_rn_st...](http://www.bbc.com/russian/rolling_news/2013/04/130409_rn_state_auctions_improve)

<comment><USER3> Now that you have revealed the secret, Hacker News will be banned in russia forever.

</comment></comment><comment><USER4> Taylor Swift? Never heard of her: [https://www.google.com/search?q=Τаylοr+Ѕwіft](https://www.google.com/search?q=Τаylοr+Ѕwіft)

:D

<comment><USER5> Kind of surprised at how poorly Google handles this (I would have expected at least a correction suggestion)! Heck, it might open the door for an obscure blackhat/phishing technique...

<comment><USER6> Forget google. Can you do this in domain names?

<comment><USER7> No, [https://en.wikipedia.org/wiki/Domain_name#Technical_requirem...](https://en.wikipedia.org/wiki/Domain_name#Technical_requirements_and_process) (last paragraph)

<comment><USER8> No, you're mistaken. It is actually a very big problem. Earlier on the same page you linked to, it explain that "ICANN approved the Internationalized domain name system, which maps Unicode strings used in application user interfaces"[1].

As a concrete example, the following are fake links to Wikipedia (and entirely equivalent):

[http://xn--wkd-8cdx9d7hbd.org](http://xn--wkd-8cdx9d7hbd.org) (FAKE, same as below)

[http://www.wіkіреdіа.org](http://www.wіkіреdіа.org) (FAKE, same as above)

It is true that _network protocols_ encode these internationalized domain names in a subset of ASCII, but the _user_ sees Unicode in his browser address bar or email. There is no restriction on how applications (like browsers) display domain names[2]; they can use Unicode if they want. This lead to all sorts of devious attacks[3].

[1] [https://en.wikipedia.org/wiki/Domain_name#Internationalized_...](https://en.wikipedia.org/wiki/Domain_name#Internationalized_domain_names)

[2] [https://en.wikipedia.org/wiki/Internationalized_domain_name#...](https://en.wikipedia.org/wiki/Internationalized_domain_name#Internationalizing_Domain_Names_in_Applications)

[3] [https://en.wikipedia.org/wiki/IDN_homograph_attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)

</comment></comment></comment></comment></comment><comment><USER9> So, one might wonder why these homo-graphs have different code points. After all the French A and the English A share the same code point.

It's really difficult to do the right thing here. If Greek question marks share code point with semi-colon, it obstructs search and replace for question marks.

Subtle differences in how Japanese and Chinese are written has led to differently written characters sharing the same code point. It's nice that you can easily look up most Japanese characters in a Chinese dictionary and see how they are used in China, but it has become frustratingly hard to get subtleties in their written form right. The Chinese version may have the line strike through another line, while the Japanese only has it touching.

I honestly don't know how to go about posting how to same code points have different written forms!

But it seems like it would be nice if code editors warned about text outside ascii. You usually only want that in strings and comments.

<comment><USER10> > _It 's really difficult to do the right thing here. If Greek question marks > share code point with semi-colon, it obstructs search and replace for > question marks._

Context is the key here. Greek text doesn't use the semicolon for other purposes and searching/replacing such single characters in source code is a terrible idea anyway (think comments, string literals...). So what is the prohibitive failure scenario here?

Indistinguishable (for humans) characters with different code points were a stupid idea, it's fine to abuse it in order to point out that fact.

<comment><USER9> I don't know enough about Greek to deeply comment on it. some people do consider using the same code point for apostrophe and citations problematic (it's definitely annoying when doing word segmentation) we also have breaking and non-breaking spaces, as well as tabs. We luckily didn't follow typewriter conventions and collapsed several alphabetic characters!

A semicolon is not considered sentence final, whereas a question mark usually is. This makes it easier for software to auto capitalize. So at least that's possible a use case.

There's also the possibility that Greek requires the top dot to be square or circle, meaning it might in fact have subtle differences in print.

<comment><USER10> > _A semicolon is not considered sentence final, whereas a question mark > usually is. This makes it easier for software to auto capitalize. So at > least that 's possible a use case._

Such software will need and have a language setting anyway (e.g. for hyphenation). It doesn't have to and cannot rely on code points alone, so the characters (or rather, different uses of the semicolon) needn't have different codepoints.

<comment><USER11> What if someone is quoting something in a different language for a translation or similar?

<comment><USER12> To be fair, that would break hyphenation as well if both languages use a Latin alphabet (give or take a few carons and such).

</comment></comment></comment></comment></comment></comment><comment><USER13> Mac users might appreciate the great UnicodeChecker:

[http://earthlingsoft.net/UnicodeChecker/](http://earthlingsoft.net/UnicodeChecker/)

It offers a convenient utility to diff arbitrary strings, which is also quite handy for e.g. detecting normalization discrepancies, and installs a service so you can highlight a character in any app and use "Display character information" to see what it actually is.

I have Python command-line version in my PATH which displays the character info for arbitrary input strings: [https://github.com/acdha/unix_tools/blob/master/bin/unicode-...](https://github.com/acdha/unix_tools/blob/master/bin/unicode- characters.py)

<comment><USER13> Using the Taylor Swift example from [https://news.ycombinator.com/item?id=10438363](https://news.ycombinator.com/item?id=10438363) in the comparison window looks like this:

[https://www.dropbox.com/s/9j9h5rjt4gu22hb/Screenshot%202015-...](https://www.dropbox.com/s/9j9h5rjt4gu22hb/Screenshot%202015-10-23%2014.49.30.png)

Each hex value shown can be clicked to open the Unicode character info for that codepoint

</comment></comment><comment><USER14> This sort of stuff can be the basis for many XSS attacks, see [http://websec.github.io/unicode-security-guide/character- tra...](http://websec.github.io/unicode-security-guide/character- transformations/)

For instance, \u2329, \uFE64, \uFF1C and \u3008 can be best-fitted automatically to \u003C (the regular '<' mark in HTML)

<comment><USER15> It is also good tool to check is Unicode supported well: just convert all user visible messages and then check interface of the program for <?> or [].

</comment></comment><comment><USER16> I had something similar happen in the wild to me.

I work for a "major search engine" that does a lot of advertising & marketing stuff. To get the most out of it, we need customers to implement some javascript on their ecommerce sites.

As is often the case, javascript code that needs to get implemented on an ecommerce site often gets copy-pasted or emailed around a lot internally within a customer before it reaches the right person who can add it to the site's pages.

In this example somewhere along the way, a normal javascript snippet got all of the semi-colons changed from ; to ;.

In case you've not already spotted it, ; is not a ; but is actually "Greek Question Mark" ([http://www.fileformat.info/info/unicode/char/037e/index.htm](http://www.fileformat.info/info/unicode/char/037e/index.htm)).

It was very confusing why Chrome was moaning about a semi-colon an illegal token. I had a genuine "Am I going mad? Seriously?" moment before I realised what was happening.

<comment><USER17> I would probably have to quit my job before I could figure out that problem. May I ask how did you spot it?

<comment><USER18> Personally, my vim status line has an indicator which shows the hex code for the rune currently under the cursor.

After fighting against word processor quotes, it's become second nature to double check it periodically.

<comment><USER19> That seems useful. Can you share it?

<comment><USER18> Here you go:

        :set statusline=%F%m%r%h%w\ [TYPE=%Y]\ [ASCII=\%03.3b]\ [HEX=\%02.2B]\ [POS=%04l,%04v][%p%%]\ [LEN=%L]
        :set laststatus=2

Produces a status line when inserting and recording a macro like (the character under the cursor is 'm':

        ~/.vimrc [TYPE=VIM] [ASCII=109] [HEX=6D] [POS=0123,0020][67%] [LEN=182]
        -- INSERT --recording

And, of course... `:help statusline`

<comment><USER20> This doesn't seem Unicode-aware at all. I put my cursor on the character 每 and it says:

      [ASCII=2>4] [HEX=0>4]

It's not ASCII, and its hex code is 6BCF.

It also says "ASCII=252" when I put the cursor over "ü". Claiming that values over 127 are ASCII is just a malapropism.

</comment></comment></comment></comment></comment></comment><comment><USER21> There is a special place in hell for anyone doing this. I'm going to watch this repo and blacklist pull requests from anyone who forks it :-)

<comment><USER22> They share the place with coding blogs that use   instead of spaces for code snippets.

<comment><USER23> Or "real" quotes in code examples..

<comment><USER24> I don't think people do this intentionally. Either the code snippet has passed through MS Word (why?) or their blog tool is being "helpful".

<comment><USER25> I once had to do a team project with another student who did all his coding in Wordpad, god knows why. His indentation was more or less random. I wanted to murder him.

</comment></comment></comment></comment></comment><comment><USER5> I can foresee a new phenomenon arising in stackoverflow-style sites and coding discussion forums:

" _My simple piece of code looks perfect and should work without problems. Yet it won 't compile! Help!_"

Answer:

" _Try running `. /mimic --reverse` on your source._"

<comment><USER26> I actually almost submitted something in that vein once. I'd type

      > ls | wc -l

and get

      > bash:  wc: command not found

As it turns out, I need Alt+1 to type a pipe character in my keyboard. If I'm not quick enough releasing the Alt key, I'll type Alt+Space instead of just Space, which inserts a Non-breaking space[1] in Mac. This character is not a space, and therefore it gave me a weird "command not found" error.

This lasted for months until I found out what the problem was - given that it was a combination of my keyboard settings and OS, finding the root of the error took quite some time. The hint? The "command not found" error had an extra space in front of the unknown command.

[1] [https://en.wikipedia.org/wiki/Non- breaking_space](https://en.wikipedia.org/wiki/Non-breaking_space)

<comment><USER27> This bit me as well, as I mentioned in a comment above. The solution I found best was to make OS X not produce an NBSP on alt+space.

</comment></comment></comment><comment><USER28> I'm reminded how very useful I've found Text::Unidecode in the past.

[http://search.cpan.org/~sburke/Text- Unidecode-1.27/lib/Text/...](http://search.cpan.org/~sburke/Text- Unidecode-1.27/lib/Text/Unidecode.pm)

<comment><USER29> Author of Python port of Unidecode here. I wrote a comment previously, pointing out that Unidecode does the reverse of Mimic. But then I actually checked the tables of characters that Mimic uses and deleted my comment.

Mimic chooses replacement characters solely based on their visual similarity with ASCII. Unidecode, while still doing character-by-character replacements without deeper analysis, tries to optimize the replacement tables for transliteration of natural languages.

For example, mimic will replace Latin capital H with Greek capital eta (U+0397), because they look similar. However, Unidecode will replace U+0397 with Latin capital E, because Latin E is typically used in place of Greek eta when transliterating Greek text to Latin.

<comment><USER30> I have used the php port long ago when creating a simple website search engine... Great project!

</comment></comment></comment><comment><USER31> On a Mac you (used to?) get a non-ascii space when you hit the space bar while holding Alt or something like that. Easy to fat-finger it in any case and looks the same in most text editors. It's a great source of fun for novice Mac-using programmers to find out why the compiler complains.

<comment><USER32> This is still happening as of today:

ps aux | grep foo

zsh: command not found: grep

It happens to me at least every other day.

</comment></comment><comment><USER33> Ironically I have weird OCD where I always assume I made a typo, so I keep deleting and retyping code a few dozen character at a type, often in lines where I see nothing wrong. Over time this has just become something my hands do whenever my brain needs time to think about something else. So in a way I developed natural immunity to said unicode tricks ;)

<comment><USER34> I think you're not alone. A common error I've noticed is when you make a typo somewhere (that compiles) and copy and paste it in a different place where you have the correctly named symbol. It's often hard to see the typo because the eye fly over the word. So you erase and type it manually.

</comment></comment><comment><USER35> There's a set of rules used on domain names to stop homoglyph abuse there.[1][2] Applying those rules to language identifiers would prevent this problem. It's also useful to apply those rules to login names for forum/social systems. The rules prevent mixed language identifiers, mixed left to right and right to left text, and similar annoyances.

[1] [https://tools.ietf.org/html/rfc5893](https://tools.ietf.org/html/rfc5893) [2] [http://unicode.org/reports/tr46/](http://unicode.org/reports/tr46/)

</comment><comment><USER36> I guess someone should develop an IDE/editor plugin that marks non-ASCII characters outside of string literals.

<comment><USER10> > _marks non-ASCII characters outside of string literals._

Many programming languages support non-ASCII variable name characters now.

<comment><USER24> > Many programming languages support non-ASCII variable name characters now.

Just because you can do something doesn't mean you should.

It is usually worth keeping variable names and such in English in enable international collaboration. Also non-ASCII source files can get mangled in transit.

<comment><USER37> Well, it does happen, though – look at this weather data from a large German newspaper, it is in a custom format ('|' separated values) and in German: [http://wetter.bild.de/data/meinwetter.txt](http://wetter.bild.de/data/meinwetter.txt)

It happens all the time, everywhere, that people write code and stuff in their native language.

<comment><USER38> That's data. The suggestion is about variable names.

<comment><USER37> Well, the variable names of Bild.de (for example HTML class names) are also in German.

It happens all the time, everywhere.

</comment></comment></comment></comment></comment></comment><comment><USER39> I think the line about "Mimic substitutes common ASCII characters for obscure homographs" has it backward. Shouldn't it say Mimic substitutes obscure homographs for common ASCII characters?

<comment><USER40> Never occurred to me before, but here "substitutes" reads to me as being commutative. I read both as having the same meaning. (i.e. you end up with unicode homographs replacing your ascii) Just me?

<comment><USER41> In that case, you won't mind if I substitute poison for your favorite tasty beverage.

<comment><USER42> Technically, my favorite tasty beverage _is_ poison.

</comment></comment></comment></comment><comment><USER43> Also GREAT if you're trying to identify untaken phishing domain names to register for your next scam!

<comment><USER21> wouldn't you end up with the 'xn--' ascii expansion in the url window?

<comment><USER44> Most modern browser will show you the unicode version.

<comment><USER45> Nowadays most modern browsers will revert to the punycode ("xn--") if there is any chance of confusion, cf. [https://en.wikipedia.org/wiki/IDN_homograph_attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)

</comment></comment></comment></comment><comment><USER46> Mimic author here... sorry, humanity...

</comment><comment><USER47> Wow, now that's just pure evil.

<comment><USER48> Yes, seriously. This is why we can't have nice things.

</comment></comment><comment><USER49> One could name variables and functions to later identify whether code was copied (e.g. to find out whether somebody copied some GPL code).

<comment><USER50> Note to self: Run mimic --reverse on GPL code I copy.

</comment></comment><comment><USER51> Spotify used to have a security problem with this kind of characters:

[https://labs.spotify.com/2013/06/18/creative- usernames/](https://labs.spotify.com/2013/06/18/creative-usernames/)

</comment><comment><USER52> > Replace a semicolon (;) with a greek question mark (;) in your friend's C# > code and watch them pull their hair out over the syntax error

I'm not sure how frustrating this would be. Wouldn't most people just delete the character immediately and type a new one?

<comment><USER53> If faced with a linter error, I don't typically delete the marked stuff, write it anew and hope fingers crossed that the error would be gone. I would try to make sense of the message, how it applies, and what the error is. At some point though, I definitely would pull my hair over a greek question mark.

<comment><USER52> Only one character is going to be marked in this case, not a whole line or section of code. Deleting it and retyping it costs one second. I guess I've seen more than my fair share of encoding issues. I used to tutor at a university, so students were constantly coming in with code they'd copy/pasted out of their assignment (usually a Word doc) or from a web site.

<comment><USER53> I think that's a great argument. If someone mails the code, I hope to have the cleverness to suspect the encoding. However, I thought about a code repository or similar where this may be an issue, but most often is not. And I have seen some code where a wrong language character did not provoke a reasonable error, but some arbitrary parser error that went off in another line altogether (not necessarily C#).

</comment></comment></comment></comment><comment><USER54> This somewhat reminds me if this little entry on how "tolerant" JavaScript is...

[https://mathiasbynens.be/notes/javascript- identifiers](https://mathiasbynens.be/notes/javascript-identifiers)

</comment><comment><USER55> This can actually be used productively, to see how your app reacts to weird input :)

</comment><comment><USER56> The repo's README mentions a vim plugin to highlight Unicode homoglyphs. As an Emacs user, I did a quick M-x package-list-packages, thinking I'll find at least half a dozen equivalent Emacs packages.

To my dismay, there were _none_. So I spent the rest of my afternoon correcting this glaring deficiency. Fellow Emacs users, protect yourself from Unicode trolls and grab it here: [https://github.com/camsaul/emacs-unicode- troll-stopper](https://github.com/camsaul/emacs-unicode-troll-stopper)

</comment><comment><USER57> This seems like a useful tool for fuzztesting your dev ops person, or if you are the dev ops person, for fuzz testing development. Fuzz for all!

</comment><comment><USER50> Piping the result through TTS creates weird results (on OS X):

      echo "hello world" | mimic --me-harder 100 | say

<comment><USER58> Can anybody provide an audio snippet for those of us who use Linux?

<comment><USER59> I don't have an audio snippet, but I can transcribe what the voice says on different runs. It usually pronounces random letters individually, but sometimes pronounces syllables with letters missing:

"L-W-R-D", "L-L-W-R-L", "hell-erl", "H-L-er-D"", "eor-D", "H-L-L-erl", "L-L-W- L-R-D", "H-L-W-R-L", "hell-W-R"

</comment></comment></comment><comment> n-gauge Just chuck the code into an XML validator. Any character > 127 will be flagged as invalid.

</comment><comment><USER60> is anyone aware of the reverse of this, a homoglyph normalization library? id love to be able to take strings that visually look the same and compare them against one master list, such as for spam detection

</comment><comment><USER61> In cases like those I use unicodelookup.com to list suspicious characters :)

<comment><USER62> That site does not work for me. I paste into the input field and it automatically turns into %F0%9F%90%88.

Compare with [https://codepoints.net/](https://codepoints.net/) instead.

Edit: great, HN is broken too.

<comment><USER61> Thanks, didn't know this one.

</comment></comment></comment><comment><USER63> Add the following to your ~/.vimrc to always highlight non-ascii characters:

        au BufWinEnter * let w:matchnonascii=matchadd('ErrorMsg', "[\x7f-\xff]", -1)

</comment><comment><USER64> These dang democrats done banned Ben Carson from google man!

[https://www.google.com/search?q=Ben+Сarѕоn](https://www.google.com/search?q=Ben+Сarѕоn)

</comment><comment><USER65> Made a perl port: [https://metacpan.org/pod/mimic](https://metacpan.org/pod/mimic) (currently 50% faster)

</comment><comment><USER27> In some languages which allow non-ASCII but aren't Unicode-aware (PHP, for instance), you can add significant, invisible zero-width spaces to identifiers.

</comment><comment> florian-f

        > var ﷺ = 1;
        < undefined

</comment><comment><USER66> Hmm... I wonder if this can be used in browser source maps.

</comment><comment><USER67> Some people just want to see the world burn...

</comment><comment><USER68> Some men just want to watch the world burn.

</comment><comment><USER69> And now I know what I'm doing for April 1st next year.

</comment><comment><USER70> i smell a Notepad++ extension

</comment><comment><USER71> YOU ARE A TERRIBLE PERSON AND I LIKE YOU</comment>


Show HN: Puree – Password-based Uniform-Random-Equivalent Encryption - <AUTHOR> http://puree.cc/ <comment><USER2> There is [https://github.com/kriswebdev/cryptsetup- deluks](https://github.com/kriswebdev/cryptsetup-deluks): "The DeLUKS header is designed to be indistinguishible from random data."

And also volumes by the quite popular TrueCrypt and its successor VeraCrypt have random headers... [https://www.raedts.biz/forensics/detecting-truecrypt- veracry...](https://www.raedts.biz/forensics/detecting-truecrypt-veracrypt- volumes/)

Looks like a nice enough project, but be careful with claims like "first".

<comment><AUTHOR> > DeLUKS

Interesting, hadn't seen this project yet, or would have been more careful, thanks.

A few thoughts:

\- The lack of a link to a white paper makes DeLUKS difficult to analyze, but it looks like they're hashing the password using PBKDF2-SHA1, which is quite outdated. (PUREE uses argon2id.)

\- The installation/usage seems slightly complex. I'd suggest people compare to the PUREE quick start instructions.

> TrueCrypt/VeraCrypt

As per your link: "When you create an encrypted volume using TrueCrypt or VeraCrypt it is stored as a file (container) on your hard drive.".

And as per VeraCrypt's wikipedia page: "VeraCrypt supports plausible deniability[16] by allowing a single "hidden volume" to be created within another volume"

I didn't read too much deeper, but the phrases "stored in a file" and "hidden volume within another volume" are red flags.

<comment><USER3> > PBKDF2-SHA1

What's the problem?

<comment><USER4> No memory hardness and no data dependence. Along with that SHA1 is really simple to implement on ASICs, FPGA, GPUs and such. This means that you can do lots of tests in parallel trivially (not much ram needed for each test, and no branching). You can use lots of PBKDF2 rounds to help against this but it will always mean that the cost of attacking it will scale much lower than something like scrypt or the argon2 family. In this application I don't believe there's any specific attacks against SHA1 or PBKDF2 but they don't provide the additional security that more modern things provide.

<comment><USER3> Fair enough. I use a ton of rounds, but yeah that's fair.

</comment></comment></comment></comment></comment><comment><USER5> I like that the quick start guide uses /dev/sd _z_ in the examples, so that copy-pasting will generally not work and you don't risk wiping a disk that actually exists.

<comment><USER6> I've seen some mad man on Twitter talking this fun fact that 27th disk on Linux becomes /dev/sdaa and Debian Installer gets pikachu'd at grub-installer step just by having it

So there are exceptions and you said "will _generally_ not work", damn you nailed it

<comment><USER5> Get _pikachu 'd_ ?

<comment><USER7> The "surprised Pikachu" [1] meme is essentially the progression of some initial scenario, followed by the most reasonable and likely outcome, followed by a surprised Pikachu face. It's commonly used to for example sarcastically highlight that something that was overlooked should be common sense.

[1] [https://knowyourmeme.com/memes/surprised- pikachu](https://knowyourmeme.com/memes/surprised-pikachu)

<comment><USER5> Ha! I know the meme but didn't make the connection. Thanks!

</comment></comment></comment></comment></comment><comment><AUTHOR> PUREE stands for "Password-based Uniform-Random-Equivalent Encryption".

PUREE lets you perform password-based full-disk encryption securely, and in a way that ensures the disk is 100% indistinguishable from random. And as far as I know, this is the first tool to do so.

It also comes with a very simple-to-use command-line tool for encrypting disks. (Currently only supported by Linux.)

After putting much love into this project, I've finally released version 1.0.0. All PUREE designs and software are hereby released as public domain.

All feedback greatly appreciated.

<comment><USER8> (originally posted to [https://news.ycombinator.com/item?id=23436038](https://news.ycombinator.com/item?id=23436038) but was lonely there so we moved it hither)

</comment></comment><comment><USER9> PGP Disk also had "deniable encryption". So this is certainly not "first"

[https://en.wikipedia.org/wiki/Deniable_encryption](https://en.wikipedia.org/wiki/Deniable_encryption)

Also see the Wikipedia chart for "Hidden Containers"

[https://en.wikipedia.org/wiki/Comparison_of_disk_encryption_...](https://en.wikipedia.org/wiki/Comparison_of_disk_encryption_software#Features)

</comment><comment><USER10> I really like this, especially the part that allows subvolumes and multiple password slots. One thing I didn't really understand or maybe simply missed in the paper is how data integrity is handled. Okay, so the header can be duplicated. What about bit-flips in individual blocks? How large are the blocks, does this affect other blocks, and how can intact blocks be recovered?

How does this work in block devices like this? What errors will occur in Linux when a block is bad? Is that a file system issue on top of it, so e.g. if I format it with Ext4 I can use fsck to "fix" errors?

<comment><AUTHOR> > especially the part that allows subvolumes and multiple password slots

Admittedly backup headers are not yet implemented. (I had to release an MVP at some point.)

> how [is] data integrity is handled?

(Beware though that this is still MVP, and _the code doesn 't actually write a backup header yet_. If enough people are enthusiastic about PUREE, I promise to do so.)

Every part of the header is encrypted+authenticated. If any part of the header has a bit-flip, the message-authentication code will fail to decrypt the header. PUREE can't tell whether this happened or you're just providing the wrong password. If corruption does occur, you'd need to hint to PUREE to read a backup header---by default, one will be at the final 1MiB of the device. (But again I stress, not implemented yet.)

> How large are the blocks, does this affect other blocks, and how can intact > blocks be recovered?

PUREE just handles the header. After that, it hands control to the next stage, which according to the spec, can really be anything. The implementation, as it is now, only has four possible encryption modes, and each just hands things off to Linux dm-crypt subsystem. You'd have to read about that in dm-crypt.

<comment><USER11> This touches on one of the great problems of encrypted disks.

Anything on the volume is almost by definition important.

But a single bit flip and it can be complete garbage.

It would be lovely if someone, far more clever then me, layered fountain codes

[https://en.wikipedia.org/wiki/Fountain_code](https://en.wikipedia.org/wiki/Fountain_code)

at a tasteful spot.

<comment><USER12> Can any class of "data with ECC" be made indistinguishable from random data, excepting obscurity?

<comment><USER13> It can: you can just apply encryption after the FEC/ECC. This is done for example in GSM and I believe in many other radio systems. Of course there is one huge caveat: it inherently means that you are doing MAC-then-Encrypt which is generally disliked as error-prone.

<comment><USER12> Right, if you get a bitflip error in the encrypted data, decrypting it isn't going to yield something that the error-correcting-codes work on, right? It'll potentially ruin all your data, not just the single affected bit. I guess if GSM is doing it it must be useful, I need to read up on that.

<comment><USER13> Stream cipher preserves bit-flips between ciphertext and plaintext, which is useful property for this application.

And many "military/diplomatic" ciphersystems used in second half of 20th century have various interesting properties wrt. error correction or non- propagation. My suspicion is that these properties are built by doing MAC- then-FEC-then-Encrypt and in some cases even by relying on limited error propagation of CBC mode. If you think about it, for these applications reliability is more interesting than strict authentication as the ciphertext of diplomatic "cable" or similar thing is sent through somewhat noisy channels and often was manually handled by fallible human radio operators while active MitM was not exactly feasible attack.

<comment><USER12> Thank you for all this explanation, I appreciate it. :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Interesting, but only useful in a specific situation (decryption coercion). And probably not that effective in such situations.

Obligatory XKCD: [https://xkcd.com/538/](https://xkcd.com/538/) Obviously it ignores habeas corpus but of course, so have most governments, even the more 'evolved' ones.

For most situations, denial of encryption is not necessary. I can see the point for data drives. But in a laptop/PC scenario, there must be a way to actually boot the thing. If there's a way to boot it, it can be detected by trying to boot it ;) There must be something machine-readable that asks for the password. You can store that part on a separate USB but even the possession of that is an indication that you use encryption.

And to mention the obvious: Who carries around drives with random data on them? Storage devices that are unformatted are normally filled with zeroes. Sure, it could have been wiped with random data, but it is still a very suspicious situation.

It's a nice project for this niche usecase but for encrypting my boot drives I'm perfectly happy with LUKS as it is. In most cases denying the existence of encryption is not needed.

<comment><USER15> My paper on a scheme that makes the drive, including header, indistinguishable from one that's been zeroed out should be ready by April.

<comment><USER16> That sounds interesting, how do you do that?

<comment><USER17> Per-volume zero-based one-time pad (PVZBOTP). It's a common technique used by almost all Fortune 500 organizations these days. The tl;dr is that you generate an encrypted volume that, when XOR'd with a volume consisting entirely of zeroes, produces the original plaintext volume.

<comment><USER18> probably the best joke in HN today :)

</comment></comment></comment></comment></comment><comment><USER19> From the article:

> Clearly, it is trivial to detect that a disk is encrypted with LUKS. In > fact, this isn't just a problem with LUKS; but also with most password-based > disk encryption solutions. This isn't surprising: it turns out to be a > difficult problem to solve.

Is it though? The reason people add metadata headers is because they provide features, such as allowing different parameters without the user having to know them, allowing autodetection that encryption is in use when you plug in a portable drive, etc. Puree trades-off these features for instead having deniable encryption. However for most users, deniable encryption is pretty useless, and those other features are very useful. Hence why most disk encryption solutions go with non-deniability.

</comment><comment><USER20> > Since it has long been common practice to wipe disks by overwriting with > random data

Is it really that common of a practice to leave your entire disk full of random data? I would expect that it's more common for disks to be full of zeros, or non-encrypted leftovers, than random data.

<comment><USER21> It's pretty uncommon for technically inclined folks to just abandon a disk with unencrypted data.

And from what I remember reading long ago, several writes of random data is more secure than several (or one) writes of zeros.

<comment><USER22> Depends on the disk (magnetic hard drive, density, type of storage (eg smr), flash/SSD etc).

AFAIK for a recent (say, 2010 and later) drive - there's little to indicate random/"smart" patterns are better than just a single pass off all zeroes. Even if you consider an adversary with the capability to analyze drive with magnetic force microscopy.

[https://www.howtogeek.com/115573/htg-explains-why-you- only-h...](https://www.howtogeek.com/115573/htg-explains-why-you-only-have-to- wipe-a-disk-once-to-erase-it/)

[https://www.sans.org/blog/overwriting-hard-drive- data/](https://www.sans.org/blog/overwriting-hard-drive-data/)

"Data Reconstruction from a Hard Disk Drive using Magnetic Force Microscopy", 2013 Author(s): Kanekal, Vasu [https://escholarship.org/uc/item/26g4p84b](https://escholarship.org/uc/item/26g4p84b)

A quick skims seems to indicate the NSA recommends degaussuing and destruction: [https://www.nsa.gov/resources/everyone/media- destruction/](https://www.nsa.gov/resources/everyone/media-destruction/)

Nist 800-80: [https://www.nist.gov/publications/guidelines-media- sanitizat...](https://www.nist.gov/publications/guidelines-media- sanitization-0)

Refers to: [https://cmrr.ucsd.edu/resources/secure- erase.html](https://cmrr.ucsd.edu/resources/secure-erase.html)

Who's readme: [https://cmrr.ucsd.edu/_files/hdd-erase- readme.txt](https://cmrr.ucsd.edu/_files/hdd-erase-readme.txt)

And q'n'a indicate that single pass sata secure erase is generally considered sufficient - it typically does a single pass, but should also write over all bad blocks etc.

See also: [https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase](https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase)

</comment></comment></comment><comment><USER23> "Denial of encryption" is no different from "Denial of having password", and leads you straight into XKCD 538.

If the adversary does not belive you, their best bet is to keep torturing you, until they get their way.

What you want is "Proof of inability to decrypt" so that the adversary has nothing to gain by waterboarding you.

See also: [https://papers.freebsd.org/2004/phk- gbde/](https://papers.freebsd.org/2004/phk-gbde/)

<comment><USER24> I think there are some situations where there might be a difference: ones where the adversary does not know for sure whether the data exists.

For example, suppose you work in the IT department of a law firm, something fishy is going on and you want to be a whistle blower, and you need a way to exfiltrate some evidence. You are getting rid of some obsolete laptops, and standard procedure is to wipe the drives before selling them.

Management has its suspicions about you because you've been asking too many questions. So they get another IT person to check the drives you were supposed to wipe.

If the drives have the data on them with a LUKS header, you've been caught (or at least they think you were too lazy to wipe the drives). If it's indistinguishable from random data, then you've given them no reason to suspect you.

<comment><USER23> This scenario suffers from what I call "IT-Dude-Syndrome".

IT-Dude-Syndrome is when IT-people come up with scenarios which hinge on "IT- Dude" being smarter than everybody else in the whole world.

First, if you're suspected of anything in a law firm, you're _out_ until the issue is resolved, you don't get to "destroy old laptops" or anything of that sort.

In a high-security operation you don't even get to touch a laptop, and you will be handed a loaner-phone, while your own phone is turned off, signed, sealed and stored in a safe until the matter is resolved.

Second, if "standard procedure" in that law firm is to "wipe the drives before selling them", that law firm is not following best, or even minimum, security practices for the business they are in, and that is what the whistle-blower should report to the relevant authority.

Third and most significant, IT-dude is smarter than the obviously junior IT- dude called in to "check the drives" IT-dude "were supposed to wipe" ?

You know what, he's not.

In such scenario you can be damn sure, that whoever is called in to check is several levels smarter than IT-dude.

And you know what super-IT-Dude will do when she see the disks full of high entropy data ?

She will point to the final step in the official procedure for wiping disks, which is to write _all zeros_ to the entire media _to prove that there is nothing hidden_.

She will write in the report that IT-dude did not follow a trivial procedure to the letter, and point out that the most likely, in fact the only credible, explanation for skipping a trivial step in the procedure, was that IT dude were trying to exfiltrate data.

</comment></comment></comment><comment><USER25> From the white paper: "If additional shadow headers are used, their suggested locations are (where possible) at the sectors starting at offsets 128MiB, 128GiB, and 128TiB"

Is such repetition of header (in a supposedly random-wiped disk) not suggestive of existence of a PUREE partition? This can be figured by scanning the entire disk.

<comment><AUTHOR> Each header is individually encrypted with a different salt/nonce, so there won't be any detectable repetition.

</comment></comment><comment><USER26> As much as this is a cool project, I feel like a significant use case for disk encryption is for boot disks on PCs. It's gonna be pretty obvious that a machine is encrypted if it has a boot loader and early stage OS that prompts for a password. Plausible deniability of spare drives though, this is very cool

</comment><comment><USER27> In the white paper I can't find a comparison with or even mention of TrueCrypt disk/container format, which also offers plausible deniability. Does PUREE improves over it on something, or just cleanly redesigns and reimplements to be surely free of potential backdoors?

</comment><comment><USER28> I am wondering if this could be applied to network streams as well.

How could we make protocol handshake invisible? AEAD?

</comment><comment><USER29> Apologies if I missed something...

You can do this with

      cryptsetup open ... --type plain

<comment><AUTHOR> This will simply hash your password a single time. LUKS and PUREE use password-key derivation.

</comment></comment><comment><USER30> Puree , in french , means smashed potatoes. Just saying</comment>


Ubuntu to replace Firefox with chromium - <AUTHOR>

http://goo.gl/00vXFy
Is it even possible to run chromium in a way that doesn't send info to google?
This combined with the amazon-Ubuntu fiasco just makes me want o use Ubuntu less and less. Sure I can turn off the amazon thing and I could replace chromium with my browser of choice but the point is that if I have to spend a crapload of time reconfiguring the default installation of Ubuntu to disable features that violate my privacy, then it's starting to become more and more like other OS's that Linux users typically avoid for just these reasons (and others)
Hellooooo Debian! <comment><USER2> I do believe that chromium doesn't send too much data to google compared to chrome but i also find that chrome/chromium is significantly faster at loading many sites that i use on a daily basis and could be reason to switch, also with firefox's 6-week release schedule it seems that many people are becoming frustrated with the constant updates, all decent reasons to consider a change of default web browser.

</comment><comment><USER3> hi mr.? Fiasco has happened; some time before there is news report on HN, by a former personnel(previously holding some administrator seat in Ubuntu), that whenever u search any thing on your desktop in Ubuntu that query goes to some anonymous server of Ubuntu even if u search on your hard drive.</comment>


A juggler remembers Claude Shannon - <AUTHOR> http://www2.bc.edu/~lewbel/Shannon.html

<comment><USER2> claude shannon = biggest stud ever.

i highly recommend "Fortune's Formula".

Great read. Smart dudes (Shannon, Ed Thorpe), blackjack, casinos, financial markets, and more.

[http://www.amazon.com/Fortunes-Formula-Scientific-Betting- Ca...](http://www.amazon.com/Fortunes-Formula-Scientific-Betting- Casinos/dp/0809046377)</comment>


Show HN: WhatsCarrier – Look up friends mobile network easily - <AUTHOR> http://whatscarrier.com <comment><USER2> Why did you name it that?

<comment><AUTHOR> The name came from Whoscall; an app to look up caller info, and I've no idea what else should I name it.

<comment><USER2> Ah. I thought it was named after WhatsApp and was trying to ride on the tails of success. I wonder if more than just me would think that? I think it would make make sense without the "S". Just "WhatCarrier".

Either way, I like the idea but I am not going to download it. I have really limited space on my phone and while this is a useful app, it's not that important to me. It would be a really cool feature if it was built into the phone's OS or launcher.

How do you figure out the contacts carrier?</comment></comment></comment>