In protest of the web{*} bulldozer, a response to websocket port scanning - <AUTHOR> https://medium.com/@bjt2n3904/in-protest-of-the-web-bulldozer-e0fce4567d26 <comment><USER2> The web already has a user-facing permissions system; it wouldn't be hard to add many of these under that umbrella (USB, Bluetooth, and Sensors stand out as obvious candidates that should've been behind that barrier from the beginning). Battery Status definitely seems pointless overall.

But I don't agree with the overall thesis, that the web fundamentally should not get features like these. Though, obviously, some of these "standards" have been rushed through and poorly executed.

I think for this we can blame Chromium's dominance. As the author said, many of these features were probably motivated by Chrome OS. And the devil's bargain of letting Chromium take such complete control over the web is that Google can strongarm whichever new "standards" they like into the Web.

The standards committee doesn't want WebBatteryStatus? Fine, we'll implement it anyway and now Chrome desktop/mobile, Chromebooks, and Edge will all have it. Sites that want to use it will probably just use it and throw up a "Use Chrome" notification for Firefox and Safari.

<comment><USER3> I don't think these features are bad, they are useful in some ways. Why we need USB on the browser? Think about updating the firmware of a device, you just go to the webpage, connect the device to the USB and update it, without having to download and install a tool to flash it, for an operation that you need to do just one time. This is only one example of many that we can make, another could be IDEs in the browser to program boards like Arduino, without installing software on the PC.

Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery, even for a stupid scenario like watching a video, when I'm low on battery I usually reduce the resolution of a YouTube video because reproducing a 4k60p video uses a lot of resources, and drains the battery quickly. It would be useful if the webapp could just do that automatically, maybe on YouTube an option like reduce resolution when low on battery. Or for games, or whatever uses a lot of resources.

Think about it: the only reason because Electron apps exist (and we waste 200Mb of disk for each one of them) is only because browsers don't have APIs to access the filesystem! To me is a waste, the browser should give each application (let's stop calling them sites, they are no longer that) the APIs and permissions to access hardware, just like on mobile devices you have a dialog that says "this app would like to access the internal storage, consent or deny?".

Where is the problem? The user should give the privilege (only one time) and you finally can do basically 99% of work in the browser (and maybe the browser introduces also API to run the application in a window), you no longer need Electron just to do these kind of things, is still more secure than Electron because the code is sandboxed by the browser, and you don't have to worry about packaging your software for different operating systems.

<comment><USER4> > I don't think these features are bad, they are useful in some ways.

That's the whole point: they look like APIs that might be useful for something but then they invariably become used for fingerprinting or an attack surface and we find out that nobody was actually using it at all, even though we came up with a couple of legitimate-sounding use cases for it.

> the code is sandboxed by the browser

What's the point of a sandbox if you keep poking holes in it by adding new APIs?

<comment><USER5> aka the road to hell is paved with good intentions

</comment></comment></comment></comment><comment><USER6> > Unlike the rest of the technologies, [Websockets] seems to have somewhat of > a purpose — even if it's been made redundant by things like HTTP/2 streams. > ... Give it a few months, and there will be some NodeJS fad where everyone > wants to re-implement HTTP with WebSockets, and load every asset for their > website through JavaScript to save a tenth of a microsecond in some edge > case involving tech buzzword bingo. ... Once this happens, disabling > WebSockets breaks the internet.

To be fair to Websockets, they've been around for almost a decade, pre-dating http/2 by a few years, and the duplex communication they offer is a fundamental building block for all kinds of stuff, from games to trading websites to chat systems.

Although the Battery API is a different story, the author's point about Websockets seems to be based on somehow having overlooked them for quite a while.

<comment><USER7> Yes, and WebSockets are a clean and fast replacement for horrible hacks that preceded them. Nobody liked having to constantly poll the server one way or another, or god forbid, use Flash.

<comment><USER8> One alternative to repeated polling or Flash is hanging GETs. But yes, that's a pretty weird hack.

<comment><USER9> That's unidirectional. Websockets allow fully stateful bidirectional data transfer (just like a regular socket). They're wonderful when that's what you need.

<comment><USER8> Yeah, you pair hanging GETs with XHR to get bidirectional transfer. Yeah I agree websockets are a lot easier than the hacky hanging GETs + XHR setup.

</comment></comment></comment></comment></comment><comment><USER10> One website can use resources from other website using img, script, link tags. That was since WWW invented. User agent will retrieve related resources from other websites.

Those port scanners abuse that feature. ](https://website-resolving-to-127-0-0-1.com:1234">) is a legitimate code and browser is expect to establish TLS connection to 127.0.0.1:1234.

Trying to patch that fundamental behaviour is hard.

Websockets are not enemy here. They are just convenient tool. It could be implemented without websockets.

Imagine that google.com added  into their main page. Now you've got billions of requests and your website is DDoSed. Who's bad here? Browser which allows requests from google.com to yourpoorwebsite.com? Or Google who decided to kill your website?

<comment><USER11> "One website can use resources from other website using img, script, link tags."

Interestingly, you can't do this for web fonts, because they require CORS, which was only added to make type foundries happier by making hotlinking fonts not possible.

</comment></comment><comment><USER4> All the new web standards are a bit tiresome, to be honest, and some of them have the flimsiest justification. I remember someone pushing the Ambient Light Sensor API on Twitter at some point and the example they gave was "you can offer dark mode to your users if the brightness you detect is low". Like, really? There are actual browser APIs for this, and they offer a better signal of user intent than brightness levels could ever do. Can you please just think these through?

<comment><USER12> Extrapolating the reasons behind a particular standard being created from a random Tweet is a bit disingenuous. Here are the examples that the standard proposal cites:

[https://w3c.github.io/ambient-light/#usecases- requirements](https://w3c.github.io/ambient-light/#usecases-requirements)

The camera one especially seems convincing to me.

<comment><USER13> None of the examples they've listed sound convincing.

>A Web application provides input for a smart home system to control lighting.

Why would you need ambient light level to control lighting? Do you need a phone to calibrate the room's brightness or something?

>A Web aplication checks whether light level at work space is sufficient.

Can't think of a reason why an app would need to do this

>A Web application calculates settings for a camera with manual controls (apperture, shutter speed, ISO).

Seems contrived to me. It might make sense for an analog camera, but every digital camera has a lightmeter, which is what you'd want anyways rather than the light sensor on your phone with unknown accuracy and viewing angle.

>A Web application monitors light level changes produced by hovering hand user gesture and interprets them to control a game character.

Wouldn't that be better served by using the front facing camera? You can even implement different hand gestures that way.

</comment></comment></comment><comment><USER14> I am starting to wonder whether we should split the web into "document mode" with only small subset of javascript APIs and "application mode". This could actually spark some innovation because the threshold to build a document-web- browser from scratch would be so much lower and it could have much better security.

<comment><USER15> I browse the web with js off by default, and turn it on per domain in 2 clicks. That's basically what you are proposing accessible today, with Firefox, on desktop and on Android

<comment><USER16> Aside: I turn off JS and never allow it on outside a VM (which gets wiped back to a clean state on shutdown).

It's definitely not the same thing because a lot of documents simply do not render (here's one I was looking at not 2 minutes ago, at least it has text, but no pics [https://vanschneider.com/the-kawaiization-of-product- design](https://vanschneider.com/the-kawaiization-of-product-design) A Number of sites will render absolutely nothing at all, text or otherwise eg [https://www.washingtonpost.com](https://www.washingtonpost.com)).

Nope, he's got a good suggestion IMO.

</comment></comment></comment><comment><USER17> So much misinformation and FUD in this article. It's immediately suspect that the author had to lookup what websockets even WERE. No mention of the permissions system? This is a super low-quality article to make it to the front page.

<comment><USER18> Right, and he didn't try out all sockets to find out what is the blacklist. Did he notice that Firefox is open source and reading the source might give good hints? (On my phone now and not starting to do it myself. But I have run Firefox under gdb before to check how Google Streetview uses WebGL. It's not difficult under Linux at least, even if you like myself know absolutely nothing about the somewhat intimidating code base of Firefox.)

</comment></comment><comment><USER7> > Web{Assembly}: Enables binary executables to run in your browser

"Binary executables" makes it sound like it's machine code, but WebAssembly is more like a bytecode for JavaScript.

<comment><USER19> I'm of two minds about it. On the one hand, JS should've been compiled in the first place; that we spent some two decades making computers parse increasingly complex scripts repeatedly is a sad waste, and it spawned what's probably the biggest hack ever to become a standard practice: minifying code. On the other hand, WebASM webapps will be an order of magnitude less inspectable.

<comment><USER20> On the other hand, V8 is the most widely run, heavily invested and thus optimized JIT compiler in history. So I think most of the interpreted vs compiled mistakes have been Google'd out at this point.

<comment> default-kramer In my opinion, the "sad waste" has nothing to do with CPU clock cycles and everything to do with the uncountable hours humans have spent trying to make javascript tolerable. If we had bytecode from the start, it would have enabled a huge reduction in human labor.

<comment><USER21> Flash implemented using bytecode.

</comment></comment></comment></comment></comment><comment><USER22> > Firstly, WebSockets seem to be prohibited from accessing 192.168.0.0/16 and > 10.0.0.0/8\. In Firefox, it raises SecurityError.

And 172.16.0.0/12 I hope. I did a little Googling and didn't quickly find a list of sources they are blocking in Firefox (or is it part of the standard?), but I hope that one is included. It's not as common, but it's still a private network and used sometimes.

<comment><USER23> Gee, good job no one uses IPv6.

<comment><USER24> Consider a /64 subnet will take a while, if not forever, to scan.

<comment><USER25> Unless you know part of the mac address. Or it's bound to :0:0:0:1. And maybe you already know the IP and the firewall is blocking connections from outside the building.

</comment></comment></comment></comment><comment><USER26> I remember being a little surprised websockets could violate the same origin policy. It was only a matter of time before that was going to be abused.

It's a shame because it meant you could run your own server for eg js/html games.

<comment><USER7> > I remember being a little surprised websockets could violate the same origin > policy. It was only a matter of time before that was going to be abused.

WebSockets don't have the Same Origin Policy like XMLHttpRequest does, yes, but they are required to tell the server they connect to what origin they came from, so the server can enforce whatever restrictions it likes.

WebSockets were also designed with preventing abuse in mind: note the protocol obfuscation and weird headers, which I think are there so you can't confuse non-WebSocket-aware servers and non-HTTP protocols.

However, as with XMLHttpRequest and other ways to do an HTTP request, it's not possible for the browser to know if a destination server speaks HTTP without trying to connect to it, and I guess that's why port scanning is possible.

</comment></comment><comment><USER20> I'm a bit surprised that anyone with a remotely techie background has been unaware of websockets until now.

<comment><AUTHOR> I generally do embedded and radio things. :) I'm not gonna lie, I can't follow web stuff with the speed at which it changes.

</comment></comment><comment><USER27> Good list of Web* technologies but he is wrong about them being all on-by- default security risks and wrong about them being useless gimmicks:

* WebSockets: On by default but obviously useful and not that different to normal HTTP requests. Can you port scan with XMLHttpRequest? I wouldn't be surprised.

* WebBluetooth: Has a permission dialog. This is actually really useful for things like the physical web - you can control nearby one-off devices without needing to install an app or for either device to have internet access. Great for interactive art installations for example.

* WebRTC: Enabled by default but very useful for web based games because it allows UDP-like communication. Also obviously useful for video conferencing.

* WebAssembly: This doesn't let you do anything that Javascript didn't so he's just being paranoid that it "enables binary executables to run in your browser".

* WebGL: This one he has a point on - GPU drivers are _full_ of bugs and weren't designed to run untrusted software. I'm surprised there aren't more exploits of this.

* WebUSB: Again, useful for using USB devices without having to install an app. This also has a permission dialog.

Most of these are because the web is now an app platform, not just a document store.

</comment><comment><USER28> I fully agree.

When I open a newspaper website, I want to receive a tiny bit of HTML and CSS and maybe references to some images. Like 50KB+images.

Instead, I am bombarded with megabytes of JavaScript and these new APIs so that advertisers can better spy on me. All of that comes at the expense of my bandwidth, my CPU usage and battery power, and my privacy.

Soon, we'll need a service that remotely opens those websites for you, then dumps the DOM and only forwards that to you. So basically server-side rendering for other people's delinquent websites.

</comment><comment> nana- Actually Microsofts work on [https://docs.microsoft.com/en- us/openspecs/windows_protocols...](https://docs.microsoft.com/en- us/openspecs/windows_protocols/ms-rdperp/ead02bce-64ef-41d6-aa06-8565956b9fe7)

</comment><comment><USER29> The problem is that these APIs have been developed with little concern paid to security. Compounding this, Mozilla hasn't even tweaked the implementation details to retain what security they could. This is seemingly due to a mistaken idea that sandbox escape is the only security property that matters, allowing these APIs to leak identifying information like sieves.

For example, AFAICT the common wisdom for mitigating Location with user.js is to set it to Ask for every site instead of a blanket Deny, because the latter actually turns out to be more fingerprintable. Whereas Deny should be indistinguishable from Ask with a negative response.

</comment><comment><USER30> > Each brings the browser closer and closer to my desktop, and seems solely > driven by ChromeBook developers.

Yes. So let's reject them all.

Let sane desktop browsers tell the web that these APIs don't exist in a meaningful way, and that building applications that rely on them is a waste of time.

Mozilla, Microsoft and Apple? Pretty please?</comment>


What Stress Does to the Brain - <AUTHOR> https://neurosciencenews.com/brain-stress-14580/ <comment><USER2> Some time ago I had a long period of intense stress. It is amazing how much it changes your mind and body.

Muscles contract causing all kinds of insuline problems, your hormones become a mess, and all this is raising stress levels more because you don't know what is going on in your body.

And then an anxiety disorder is right around the corner.

And when everything is ok again your brain produces stress hormones when you hear a sound that would trigger you earlier or just a smell or a color.

I think this is the most difficult part to get back to normal:

The brain brings you in stress mode for no obvious reason. Then you have to reason about it so the stress goes away and you will slowly reset your brain.

But I doubt the paths in the brain will ever go away. It will be like a overgrown path in the end but it is still there.

<comment><USER3> I am in such a period and have been for months. Stupid company demands we ship something no matter what, even though there is insufficient time to do all the work, and they keep adding more on top of it. I work 7 days a week, no vacations, hardly even a weekend day off much less a vacation. I even lost my temper at work and yelled a lot, something I never do. This is no way to do proper work either. At least what little time I have away from this nightmare I do art which helps somewhat.

<comment><USER4> Not to add another load on your mind, but the long-term issue here is that - assuming this is a crunch that ends - you will still be heavily affected for a long time during normal, non-stress periods.

It takes a long pause from stress for you mind and body to stop over-producing stress hormones.

I hope you situation changes for the better soon, and when it does, remember to be mindfull of yourself and accept that everything won't go back to normal right away, just because the external stress-factor stops.

<comment><USER5> > It takes a long pause from stress for you mind and body to stop over- > producing stress hormones.

I can vouch for this, I feel like I have been permanently damaged from a multi-year stressful job.

Speaking of stress hormones, does anyone in this thread know if there's some quantitative way to measure stress hormone levels, even if it's only somewhat accurate?

The best real relief I've managed to find is microdosing psilocybin combined with meditation, this seems to allow me to see right through my negative beliefs & perceptions, but also largely eliminate the ongoing ~unavoidable mental/emotional (eventually manifesting in physical) reactions to them. It feels like it allows me to mostly not give a fuck about things like normal people. Perhaps something the grandparent should look into.

<comment><USER6> Yes, stress levels are tied to cortisol levels in the bloodstream. This is especially bad for your physical health as it will cause you to store fat and crave sugary foods. The single best thing you can do is exercise 5 times a week for at least 45 minutes. It will retrain your brain to embrace stress because of the endorphin reward you get after. I promise you, the gym is never as hard as people make it out to be in their mind. 90% is just showing up. Don't take shrooms, you're just messing up your brain chemistry even more with a temporary bandaid. Furthermore, you're treating yourself with a drugs side- effect. If anything the drug you are looking for is Ativan or Xanax. I'm someone who used to be majorly overweight, overworked and stressed to no end, but exercise changed my life.

<comment><USER7> > If anything the drug you are looking for is Ativan or Xanax.

No it really isn't, even if it might seem that way in the short term.

Source: Personal. Xanax for occasional stress turned into Xanax for sleep sometimes turned into Xanax every night or insomnia. Kicking the habit now and it really sucks.

Stick to exercise and meditation. Actually agree with grandparent about the benefits of psilocybin, but you probably shouldn't listen to a stranger on the internet about that anyway.

Throwaway for obvious reasons.

<comment><USER8> [https://pbs.twimg.com/profile_images/378800000485764460/e2e5...](https://pbs.twimg.com/profile_images/378800000485764460/e2e5c2e81b2b89f447b2ba98d384c439.jpeg)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I've been thinking lately about the line between feeling "stimulated" and feeling "stressed" by intellectual work. I certainly crave challenging problems but I feel sometimes like that inherently brushes up against stress -- thinking hard about a problem and hitting frustrating roadblocks along the way is more stressful than laying on the beach, but also to me feels much more meaningful.

I worry if the type of person who seeks out stimulating work and having that become a source of stress is risking damaging their health in the longer term -- I always vaguely assumed thinking hard about problems was a net positive for my brain & would keep me mentally active, but perhaps it's worth thinking about finding ways to keep doing this kind of work and at the same time minimizing the impact of the stress it causes.

Maybe aiming to work only when feeling well-rested, or working without deadlines could be things to consider along these lines -- I don't really have a central thesis or solution to stress-free & stimulating work, but these kinds of ideas have been on my mind.

<comment><USER10> I thought quite a bit on the topic of craving and frustration. I wrote an article about it that I could email to you if you would like.

And I learned a thing or two about stress when I studied psychology.

Here are my thoughts (without sources and a bit worse editing as I am on my phone).

> I certainly crave challenging problems.

When crave something I always wonder how it is different vs a cocaine addict craving cocaine. I crave mental stimulation as well, so here are my observations:

1\. Psychological addiction is possible.

2\. Craving too much mental stimulation could weaken your social ties depending on how you seek it out.

3\. You become intellectually sharper at whatever it is you're stimulated by but in almost all cases not sharper in other areas, even when skills are transferable (unless the areas are really close).

4\. As almost always, following a chronic crave does not make you happier. Like scratching an itch doesn't make you happier.

Being frustrated is not an issue in my opinion. Frustration results from not achieving your goal while you believe you should still be able to progress but somehow you don't. There is no stress there as you can simply do something else. Take the option of doing something else away and then you do have stress (e.g. this wasn't a frustrating hobby problem in your free time but a problem on your job that is making your company lose $10k per hour).

> I worry if the type of person who seeks out stimulating work and having that > become a source of stress is risking damaging their health in the longer > term

Only if it is chronic. Read about the HPA axis. It proposes a biological explanation for depression through stress. Also, burnout is symptomatically very similar to depression (I am on mobile cannot find the source now, but any decent search engine can help).

> I always vaguely assumed thinking hard about problems was a net positive for > my brain & would keep me mentally active

In this particular case the exercise analogy works. If you do anything physical (or mental) that is beyond your capacity or stamina but you somehow are forced to go through with it, then you will experience stress.

In closing only chronic stress is a bad thing since we can recuperate from temporary stress. Aka we simply need the ability to rest and the ability to recover.

On a short-term basis, stress is a good motivator to some.

Related to all of this (in an unusual way) is the self-determination theory of motivation. What you may see here is that in my examples people have little to no autonomy and that results in stress.

<comment><USER11> > When crave something I always wonder how it is different vs a cocaine addict > craving cocaine.

Lately, I've been trying to give myself plenty of boredom time. I still fail at it a lot, but I try to do most things with purpose now: I don't listen to music just because, for example, instead I decide I want to listen to music and then sit down to do just that. I feel I enjoy it a lot more this way! I also don't idly listen while travelling or walking anymore. I go for walks almost every day now and I enjoy the quiet as much as the exercise. I also try not to idly read stuff online (especially on my phone). I definitely still fail at this, but slowly I'm improving. Its better to spend half an hour bored than mindlessly reading stuff. There's been plenty of articles here about how boredom is good for your brain, after all.

Having said that, I do find it very difficult to do work that isn't mentally stimulating.

> On a short-term basis, stress is a good motivator to some.

When I was in my early twenties, I worked very very well under stress. Having a lot of pressure pushed me harder and I got a lot done in a short space of time. As I get older, though, I find that the stress bleeds over to the rest of my life and I'm less able to just shrug it off or channel it to get work done, so now too much stress slows me down instead, and seems to negatively effect my life and health in other ways instead. A small bit of stress is fine, of course, but chronic stress is, I believe, very unhealthy.

Anecdotally, I had a ton of health issues a few years ago that I believe (and the doctors said its possible when I asked about it) that they were all a side effect of my few years as a startup founder. Again, anecdotally, I've known other startup founders (including my current boss) who have had probably- stress-induced health problems. Its an aspect of startups people rarely talk about or warn you about.

<comment><USER10> I feel like I'm almost reading my own writing here. I have very similar experiences.

> Its an aspect of startups people rarely talk about or warn you about.

I agree, and it should be talked about more. The same is true for other high performance jobs (e.g. investment banking or consulting), where high performance means working a lot of hours.

I also think Ycombinator could improve on this as I remember Sam Altman saying during a Startup School lecture (paraphrased): if you get a burnout, fix it. I felt like he implied to just make it work somehow, it doesn't matter how.

In fairness, most of these people aren't mental health professionals and somehow had to deal with these things themselves as well and they are simply sharing their views on how they dealt with it. What I wonder is if they reflect on the idea that some people that this as advice and moreover take it to heart. Taking a personal strategy of someone else to heart seems quite dangerous to me.

<comment><USER11> Its not just mental health that stress affects, but physical health too. I had stomach problems for a long time that seem to have been caused by stress and went away when I eliminated much of the stress. It was never concretely confirmed that it was stress related, but my doctors didn't object to the idea either.

I absolutely agree that taking other peoples personal strategies without making sure they will work for you is unhealthy.

</comment></comment></comment></comment></comment><comment><USER12> It would be helpful to tag articles about animal model studies and early stage drug trials on HN, similar to [pdf] and [video] content; would tone down the clickbait/sensationalism levels without the need to modify the submission title.

<comment><USER13> Like this novelty Twitter account [https://mobile.twitter.com/justsaysinmice](https://mobile.twitter.com/justsaysinmice) which points out hilarity of sensational headlines that are based on distant experiments on mice.

<comment><USER12> Indeed, seeing it mentioned in another article was one of the inspirations for my comment.

On another note, does anyone know how they actually perform (f)MRI on mice?

</comment></comment></comment><comment><USER14> My body also changes due to stress. I get rashes on my hand if I get stressed for more than 2 days at a stretch.

<comment><USER15> If you don't mind sharing - what kind of rashes?

<comment><USER16> From [https://www.medicalnewstoday.com/articles/317631.php](https://www.medicalnewstoday.com/articles/317631.php)

"It is also possible for emotional stress to trigger an outbreak of hives. There can be a number of hormonal or chemical changes that occur in response to stress.

These changes can trigger blood vessels to expand and leak, causing red and swollen patches of skin."

<comment><USER17> > It is also possible for emotional stress to trigger an outbreak of hives.

No doubt, stress has physiological effects, but so does laughter and excitement. Having stress is a normal part of being a human. In reasonable doses it's fine.

<comment><USER18> I've always found it ironic that one of the best antidotes for day to day stress is to be in a situation where you get "stressed" in a completely different way... (the main factor in the 'positive' stress situations for me being in fairly complete control, confidence in your own abilities and requirement to focus on the matter in hand for a few hours).

<comment><USER19> Good observation.

</comment></comment></comment></comment></comment></comment><comment><USER20> Professor Sapolsky has talked about this in a somewhat different context as well, about what it does during childhood development. Really tragic actually.

<comment><USER21> Any links?

<comment><USER22> Playlist: Sapolsky and stress

[https://www.invidio.us/playlist?list=PLY5d5qxwc2vvad_lbulFmo...](https://www.invidio.us/playlist?list=PLY5d5qxwc2vvad_lbulFmoR4XfZMz_3SG)

</comment></comment></comment><comment><USER23> Is the summary accurate? It says "A new study sheds light on how the brain changes as a result of chronic stress", but the rest of the article only mentions acute stress.

<comment> alok-g +1

It's not uncommon to see such basic flaws or misinterpretations in various articles.

</comment></comment><comment><USER24> Stress is such a stupid thing. Here in London, you're almost celebrated for having a stressful job. Neither does it improve productivity in the long term, nor does it support a healthy life. I wished more managers would understand that.

</comment><comment><USER25> There are some important dimensions of stress that often get lumped together in a way that can be misleading.

First, there is good and bad stress -- eustress and distress.

Second, there is acute and chronic stress.

This study addresses acute distress -- like a car accident. As they say, it is hard to produce this in a lab study (for ethical reasons, one supposes).

</comment><comment><USER26> I believe that stress does cause a tremendous amount of damage to the brain. I'm glad to see others share the same ideas. It may not be proven whether damage is permanent or not. But it's not something that can be left alone.

</comment><comment><USER27> Am busy doing the Win Hof method. From what I understand, norepinephrine and particularly epinephrine release are desired goals of the cold exposure part his method as they suppress release of pro inflammatory cytokines.

<comment><USER28> *Wim, for those who might want to google.

<comment><USER27> Auto correct playing it's vital part ;) Thank-you

</comment></comment></comment><comment><USER29> The article mentions that they hope that this will be useful when understanding 'pathological hyperactivity of the noradrenaline system, which is associated with anxiety and panic disorders'. For those interested, I wrote a paper on how the fall of Norepinephrine during REM dreaming can help diagnose the precise way to reduce this stress: [https://psyarxiv.com/k6trz](https://psyarxiv.com/k6trz) Worked for me.

</comment><comment><USER30> It would be interesting to know if there is any connection to PTSD. I think that rapidly created connections between different brain regions could be plausible explanation.

</comment><comment><USER31> So they stimulated norepinephrine release in rats in an fMRI machine and they found it increased "activity" in sensory processing and the amygdala. Presumably it would increase "activity" in "higher" regions of the brain, except those only exist to a limited extent in rats.

For most humans, the question about stress is, "what is the effect of chronic stress?" which this paper did not answer. I'm sure it was still a good study, largely because it's demonstrating concrete mechanisms for things we think are happening anyway, but I can't confirm that because it's behind a paywall, like most publicly-funded research.

<comment><USER32> Preprint PDF: [https://www.researchgate.net/profile/Johannes_Bohacek/public...](https://www.researchgate.net/profile/Johannes_Bohacek/publication/330604048_Rapid_Reconfiguration_of_the_Functional_Connectome_after_Chemogenetic_Locus_Coeruleus_Activation/links/5c4eab73a6fdccd6b5cecb0c/Rapid- Reconfiguration-of-the-Functional-Connectome-after-Chemogenetic-Locus- Coeruleus-Activation.pdf)

</comment></comment><comment><USER33> To someone who is not a neuroscientist, what does this do? Yes the regions are rewired, but aren't they rewired all the time anyway?

<comment><USER34> From the intro of this article:

 _Activity in the amygdala and networks that process sensory stimuli increased._

The amygdala is a part of the brain that will dictate reactions to crisis before you can consciously process it. It's called "amygdala hijack" and is responsible for people doing things like leaping into a river to save a drowning child before they fully register the child consciously, so they find themselves in a river going "Why the hell am I here?" and then realize there's a child drowning in front of them.

This is potentially dangerous. Vietnam vets and others with PTSD sometimes strongly overreact to stimuli that aren't actually a signal of a problem. For example, waking a Vietnam vet can get you assaulted before they realize you aren't a danger to them, sort of like that scene where Wolverine skewers Rogue because she wakes him from a nightmare, though usually not that dramatic. (I have heard of people winding up in the ER though.)

[https://en.m.wikipedia.org/wiki/Amygdala_hijack](https://en.m.wikipedia.org/wiki/Amygdala_hijack)

From an article written for lay people

 _Chronic Stress Increases the Risk of Mental Illness

Stress Changes the Brain's Structure.

Stress Kills Brain Cells.

Stress Shrinks the Brain._

Etc.

[https://www.verywellmind.com/surprising-ways-that-stress- aff...](https://www.verywellmind.com/surprising-ways-that-stress-affects-your- brain-2795040)

</comment></comment><comment><USER35> Paul Tough's book, "How Children Succeed" [1] has a great section on how mother rats (called dams) can significantly counteract the stress of their offspring (called pups):

"Scientists in rat labs are always picking up baby rats to examine them or weigh them, and one day about ten years ago, researchers in Meaney's lab noticed a curious thing: When they put the pups back in the cages after handling them, some dams would scurry over and spend a few minutes licking and grooming their pups. Others would just ignore them. When the researchers examined the rat pups, they discovered that this seemingly insignificant practice had a distinct physiological effect. When a lab assistant handled a rat pup, researchers found, it produced anxiety, a flood of stress hormones, in the pup. The dam's licking and grooming counteracted that anxiety and calmed down that surge of hormones.

Meaney and his researchers were intrigued, and they wanted to learn more about how licking and grooming worked and what kind of effect it had on the pups. So they kept watching the rats, spending long days and nights with their faces pressed up against the Plexiglas, and after many weeks of careful observation, they made an additional discovery: different mother rats had different patterns of licking and grooming, even in the absence of their pups' being handled. So Meaney's team undertook a new experiment, with a new set of dams, to try to quantify these patterns. This time, they didn't handle any of the pups. They just closely observed each cage, an hour at a time, eight sessions a day, for the first ten days of the pups' lives. Researchers counted every instance of maternal licking and grooming. And after ten days, they divided the dams into two categories: the ones that licked and groomed a lot, which they labeled high LG, and the ones that licked and groomed a little, which they labeled low LG.

...

The researchers ran test after test, and on each one, the high-LG offspring excelled: They were better at mazes. They were more social. They were more curious. They were less aggressive. They had more self-control. They were healthier. They lived longer. Meaney and his researchers were astounded. What seemed like a tiny variation in early mothering style, so small that decades of researchers hadn't noticed it, created huge behavioral differences in mature rats, months after the licking and grooming had taken place. And the effect wasn't just behavioral; it was biological too. When Meaney's researchers examined the brains of the adult rats, they found significant differences in the stress-response systems of the high—LG and low-LG rats, including big variations in the size and shape and complexity of the parts of the brain that regulated stress."

[1] [http://www.amazon.com/How-Children-Succeed-Curiosity- Charact...](http://www.amazon.com/How-Children-Succeed-Curiosity- Character/dp/1452658145)

<comment><USER36> This is so interesting, thank you for sharing. I was recently thinking about affection in my own early childhood - I grew up with loving parents (and grandparents) who were happy to hug me etc. The only 'weird' thing that stands out in terms of affection offered by my family is that my mom was apparently afraid to hold me for the first few days after my birth - I was her first child and she was worried she'd drop or hurt me in some way, so my grandmother took care of me for that short period of time instead.

The problem was that _I_ always refused affection as a kid. I never came for hugs or kisses or anything, and when my parents tried to hug me it always felt really awkward for me. The only thing I'd come to my parents for would be back scratches, which I loved. I didn't get a feeling of affection from the scratches, they just felt physically pleasant and relaxing.

I wonder how, if at all, kids who refuse affection are impacted later in life. I _think_ I grew up to be a fairly well adjusted person. If I try to find something 'wrong' with me the only thing I can point to is some difficulty in relating to negative emotions in others. I guess I'd be very curious to see any studies about the flip-side - eg how many baby rats are resistant to the 'licking and grooming' offered by their mothers, and how are they impacted later in life?

<comment><USER37> We know human touch is important and that a lack of it will cause severe psychological problems. The evidence is from Russian orphans with kids who were never held or touched. There is also evidence with monkeys and the wire doll mothers. This falls under the wider psychological theory Attachment and need for the infant to have its needs met which is very dependent on the parent. Attachment is probably a life long thing too.

As kids develop they shift from being parent oriented to peer oriented.

There are some cultural aspects as well, you see this largely expressed in greetings and maybe extended family interactions.

As for a rat pup or infant refusing affection it is a warning sign for autism spectrum disorder for sure.

<comment><USER36> Even though I've jokingly been told I may be on the spectrum due to my difficulty relating to some emotions, I was under the impression that autistic children usually have speech delays and don't really want human attention, which definitely wasn't the case for me - I just didn't want human _affection_ as a kid, but was perfectly happy to talk and bug my parents to play games with me.

Either way I fear I'm going down a path of the kind of self-analysis that is best left to a professional, so I'll leave it at that and enjoy feeling well- adjusted even if it's all an illusion :D

</comment></comment></comment></comment><comment><USER38> This is really interesting in terms of such an acute chemical change causing such a systemic alteration in connectivity. I can imagine if you are under stressful conditions constantly you can't truly function as these changes are constantly occurring. You could see how this would lead to ptsd, depression, other neurological conditions.

</comment><comment><USER39> Original Source:

[https://ethz.ch/en/news-and-events/eth- news/news/2019/07/wha...](https://ethz.ch/en/news-and-events/eth- news/news/2019/07/what-stress-does-to-the-brain.html)

</comment><comment> La-ang Am I the only one relating this to PUBG, and that moment when you're low on health, with a torn police vest, 30 bullets left in AKM, no compensator, no meds and a whole squad taking the stairs up to come rip you apart?

</comment><comment><USER6> > "However, it is not possible to directly examine this theory in people, > because noradrenaline release cannot be selectively manipulated."

This is exactly what ADHD medication like Vyvanse or Adderall does.

</comment><comment><USER40> How I feel when reading an article about how bad stress is for you:

[https://www.youtube.com/watch?v=Cr9DI3YLOTA](https://www.youtube.com/watch?v=Cr9DI3YLOTA)</comment>


Show HN: AI powered local indie coffee shops recommendation engine - <AUTHOR> https://indie.coffee?ref=hn <comment><AUTHOR> Hey HN, we are launching our API and AI engine for indie coffee shops recommendations around the world. We have everything working on adbeus.com, they are using our API already. Looking forward to hear your feedback!</comment>


Data Engineer in Google Case Is Identified - author of NetStumbler - <AUTHOR> http://www.nytimes.com/2012/05/01/technology/engineer-in-googles-street-view-is-identified.html

<comment><USER2> > _On his LinkedIn page, Mr. Milner lists his occupation as "hacker," and > under the category called "Specialties," his entry reads, "I know more than > I want to about Wi-Fi."_

I am more than moderately offended/troubled/irked by this excerpt, as it appears to deliberately depict the engineer as a "hacker" in the sense of Hollywood culture, rather than "hacker" as we know it in makers' terms.

In the wrong hands, the English language is much more potent and destructive than any programming language. An English Specialist can often cause more harm than _a Wi-Fi Specialist_.

<comment><USER3> I've long thought that trying to adopt "hacker" as a professional term was a bad idea. I told friends that I was going to a government hackathon once, and they thought I was going to be arrested.

Why do we have to be hackers? What was wrong with being developers?

<comment><USER4> Because society took both hacker and developer and changed their meaning.

Hackers became criminals and developers were Javabean coding wage slaves... given a choice criminal sounds cooler then wage slave.

<comment><USER3> _Because society took both hacker and developer and changed their meaning._

But the article (and my anecdotal experiences) are proof that this hasn't actually happened. We decided to call ourselves 'hackers', but society as a whole doesn't.

 _given a choice criminal sounds cooler then wage slave._

I think that's my main problem with "hacker". It's an attempt to be cool.

</comment></comment></comment></comment><comment><USER5> _Depicting his actions as the work of a rogue "requires putting a lot of dots together," Mr. Milner said enigmatically Sunday before insisting again he had no comment._

It doesn't sound particularly enigmatic to me. It seems like Milner is clearly saying that Google deliberately misrepresented his behavior as a rogue action to facilitate their legal self-protection when in fact it's obvious from their choice of the author of NetStumbler to work on Street View that his designated role was likely to involve making use of his expertise with Wi-Fi networks.

<comment> jack-r-abbit Of course they hired a WiFi expert for their WiFi-related project. But that doesn't mean their claim of rogue behavior is simply self-protection. What if they hired him for his expertise with Wi-Fi and told him they only wanted to collect the minimal amount of data but he went rogue and collected ALL the data anyway? But I'm with those people that think the freely broadcast unencrypted packets are in the public domain and Google didn't do anything illegal.

</comment></comment><comment><USER4> It feels to me like they were just logging everything for future analysis so they don't have to come back and do a second pass when they upgrade their software.

But then again I'm sorry, I have never seen what the big deal was about this. If you broadcast your crap around you can't blame people for receiving it.

Sure people's passwords may be in the data stream, but they broadcast it over an open connection. If your going to blame anyone blame the electronics shop sales guy, the hardware vendor and the TV "experts" that tell people that using an unencrypted wifi access point is completely reasonable.

<comment><USER6> > But then again I'm sorry, I have never seen what the big deal was about > this.

You don't see what the deal is with a major corporation doing wardriving and packet capturing?

> If you broadcast your crap around you can't blame people for receiving it.

By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?

<comment><USER7> > By your logic then if someone gets robbed on the streets, then it's their > fault for "walking around freely"?

Well, to more strictly match the analogy--if someone is walking around with a purse that is constantly leaking coins, and they get "robbed" (by someone finding some of said coins and wandering off with them), then I would say that that _is_ their own fault, yes.

<comment><USER6> So by your logic simply owning a Wi-Fi access-point at home and not adding strong cryptography is reason enough for a corporation to drive their car to your house and capture your data?

So to keep Google away from logging my network data I need a strong virtual fence now, otherwise they'll come spying on my traffic?

That is 100% wrong. Google shouldn't be snooping on my data at all, not even if my AP was within their corporate headquarters reach. That is simply not acceptable behavior from a major corporation.

<comment><USER8> No, just like photography being allowed in public does not mean that a video camera is going to be pointed at your house 24 hours a day and you'll be mandated to like it.

On the other hand, the existence of the paparazzi is not enough to justify banning the freedom to take pictures in public places.

All of these laws have to be carefully balanced to make sure we retain our rights.

<comment><USER6> Sure, but what is the parallel here?

The paparazzi make a living from those photos, so there is a reason for them to be out there doing that(not saying I agree, just saying there's a reason for it).

What is Google doing driving around collecting personal data for? Google is a search engine with several great products around it. WTF are they driving around collecting data for? See? It doesn't make any sense, this is plain creepy.

<comment><USER7> ...because Google Maps has backup-geolocation through a database of wi-fi access point ID/GPS-pair mappings, which can only be discovered by exactly this wardriving process? It's kind of the central point of the story, here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> _The data collection, which took place over three years, was legal because the information was not encrypted, the F.C.C. ultimately determined._

Interesting how this works. If I went wardriving and collected personal emails from unencrypted networks, I'd have my house rummaged by FBI agents, be hit with a 25,000-count felony wiretapping indictment and have some go-getter federal prosecutor try to convince a judge to sentence me to 7,000 years in prison. _Then_ an appeals court might say reverse on the grounds that it was unencrypted. Maybe.

Google does it? A slap on the wrist and a small fine for "obstructing an investigation."

<comment><USER10> That's because the software Google used didn't actively browse the networks to look for documents, but passively intercepted and logged packets. If they wrote a program that actually searched the networks for shared folders and copied information that way, then conceivably they could be guilty of unauthorized computer access.

<comment><USER6> > That's because the software Google used didn't actively browse the networks > to look for documents

Do we know that for a fact? Sorry if well known, genuine question.

<comment><USER11> When did you stop beating your wife? How do we know for a fact?

<comment><USER6> > When did you stop beating your wife? How do we know for a fact?

I never was accused of that. Silly response. Google has been accused of several privacy violations.

</comment></comment></comment></comment></comment><comment><USER12> "The F.C.C. report also had Engineer Doe spelling out his intentions quite clearly in his initial proposal. Managers of the Street View project said they never read it."

I think the authors intended this to be read as 'wink wink yeah sure', but this sounds entirely plausible on both sides. The more detailed the spec is, the less likely anyone will read it. They probably just forwarded it around and assumed someone competent to render an opinion would raise a red flag if anything were not well thought out.

<comment><USER13> The issue is that it is not just the initial proposal. As the NYTimes article points out in the previous paragraph, and the complete FCC report [1] clearly states, there were additional events after the proposal was submitted where other members of the Street View team came in contact with the actual code while doing code review or debugging, but later claimed during interviews with the FCC that they were unaware that it was collecting data.

On page 15, the report even mentions "Engineer Doe" sending an email to a manager stating, "You might recall asking me about URLs seen over Wi-Fi...", and talking about the number of unique URLs retrieved (only 32,000 from 300 million packets). The manager asked if the URLs were sniffed from WiFi packets, and Doe responded in the affirmative.

[1]: [http://s3.documentcloud.org/documents/351298/fcc-report- on-g...](http://s3.documentcloud.org/documents/351298/fcc-report-on-googles- street-view.pdf)

</comment></comment><comment><USER14> The engineer who created this system is completely irrelevant since the production implementation of Street View collected all data.

The fault lies _solely_ with Google whether by intent, lack of legal or legal ethics advice, lack of technical oversight, or management incompetence etc. This also seems to be the regulator's view.

However, Google itself and, of course, the media are quite happy to muddy the waters with a bit of "gone rogue" nonsense, though for differing reasons.

</comment><comment><USER15> > On his LinkedIn page, Mr. Milner lists his occupation as "hacker," and under > the category called "Specialties," his entry reads, "I know more than I want > to about Wi-Fi."

While I don't know for sure which use of the word "hacker" Milner intends, the author of this article ought to have added a line like, "Software engineers use the word 'hacker' in a positive, non-malicious sense...", since this is effectively taking his words out of context.

<comment><USER16> Same can be said for knowing too much. I know way too much about PHP, doesn't mean that there is anything malicious about it

</comment></comment><comment><USER17> What is the point in publicly naming an the engineer in this case? How does this benefit the public good?

<comment><USER6> > What is the point in publicly naming an the engineer in this case? How does > this benefit the public good?

The public has the right to know. Otherwise, who decides what should be public or not, the ministry of big brother?

<comment><USER18> The public doesn't have the right to know, since no law was broken. The engineer was identified by a "former state investigator [who] spoke on the condition that he not be identified because he was not authorized to speak."

<comment><USER6> > no law was broken.

We don't know that yet, do we?

<comment><USER18> Yes we do, it's in the second paragraph of the article.

"The F.C.C. recently closed its 17-month inquiry into the project, Street View, with a finding that Google broke no laws but had obstructed its investigation."

Even if we didn't, that's also a reason for not disclosing this person's identity: innocent until proven guilty.

<comment><USER6> Fair point, I stand corrected.</comment></comment></comment></comment></comment></comment>


Tackling Concurrency Bugs with TLA+ - <AUTHOR> https://www.youtube.com/watch?v=_9B__0S21y8 <comment><USER2> This is pretty amazing resource to get started with TLA+</comment>


Missile Command: Pause a YouTube Video and type 1980 - <AUTHOR>

<comment><USER2> awesome</comment>


Ask HN : What Are the Alternatives to Upwork? - <AUTHOR> Recently Upwork announced that it will charge for bid in projects and restricted individual without company email, I would like to know what are the alternatives to Upwork now? <comment><USER2> Google doc with (currently) 101 options:

[https://docs.google.com/spreadsheets/d/1JfNAbUX_lN9K3MCNHO15...](https://docs.google.com/spreadsheets/d/1JfNAbUX_lN9K3MCNHO15GJtJ5qpk7H9Cl3xTBwv2FR8/htmlview)

<comment><USER3> Your list is very helpful. Thank you!

</comment></comment><comment><USER4> One of the biggest pains of Upwork (until this new thing) was that you have to bid on a project based solely on the description of the job. There was no way to ask for aditional details or clarification before placing a bid.

</comment><comment><USER5> Just to clarify, if you bid on a project, you need to pay? How much exactly? That sounds like a horrible policy.

<comment><USER6> Explained here [https://www.entrepreneur.com/article/331700](https://www.entrepreneur.com/article/331700)

Basically you need to buy tokens and use them for bidding, probably to cut down on people who bid for everything. These sites are all terrible anyway and I prefer collecting bountys for commits.

</comment></comment><comment><USER7> Upwork is the worst actor in this area. eLance was 10x better in design, fees and customer service</comment>


WWII pigeon message stumps GCHQ decoders - <AUTHOR> http://www.bbc.co.uk/news/uk-20456782

<comment><USER2> You have to look at the facts the message was sent by Sjt W Stot.

You do a search and you find this.

<http://www.archieraf.co.uk/archie/1037zau.html>

And you will find that there was a sgt H H Stott and his crew position is w/op Air Gunner so hence the sjt W Stot.

You will then find that On 27th April 1942, the crew of Halifax W1037 ZA-U from 10 Squadron failed to return hence the need to send a message.

You will also find that on the birds ID NURP.40.TW.194 and NURP.37.OK.76 - NURP" was the National Union of Racing Pigeons so it was british so this back up the fact it was send by the RAF. The number 40 relates to 1940 but you can't read to much into that if you see this website.

[http://www.thebirdman.org/Index/Others/Others-Doc- Birds&...](http://www.thebirdman.org/Index/Others/Others-Doc- Birds&OtherAnimals/+Doc-Birds&OtherAnimals-Birds/RoleOfPigeonsInWartime.html)

You will see pigeons with number 38 was used in 1941 and 1942 and a pigeon with number 39 was used in 1945 and a pigeon with number 41 was used in 1942.

So this backs up the argument that the date would be between 1940 and 1945. So the date of the crash in 1942 wouldn't be far off.

All you have to do is find the codes used by Halifax W1037 ZA-U from 10 Squadron. The RAF would have records once you get that you can decode the message.

I thought the GCHQ had smart people working at it.

sgt H H Stott personal number is 1058698 take the first four numbers 1058 and use that as the ciper.

So the first letter A is plus 1 the second letter is O plus O the four letter is A and it is plus 5 which is G and the four letter K is plus 8 which is W so.

The first row is as follows.

BOG WT NHF LD KVG JB GJD IK

Which so far I have translated as.

BOMBER ON GROUND WITH TROOPS NEED HELF FAST LITTLE DEFENCE k___ v____ G_____ J___ B____ G____ J____ D____ I___ K___

Need help solving the rest.

<comment><USER3> On the other hand, 'W Stot' could well be different from 'H H Stott': it's a short surname, and not particularly rare:

<http://www.192.com/atoz/people/surnames/stott/50/>

Also, the article mentions that spelling 'sergeant' with a j, as in the abbreviation 'Sjt' was more common practice in the army, whereas the RAF would probably have used a g.

<comment><USER4> @SuperChihuahua posted a link to [http://www.ciphermysteries.com/2012/11/02/dead-pigeon- sparks...](http://www.ciphermysteries.com/2012/11/02/dead-pigeon-sparks- ww2-cipher-mystery). According to the author of that document it may have been Sergeant William Leslie Stott (508080 in the RAF, died in 1945 aged 35, buried in Chester's Overleigh Cemetery) [1]. The spelling of "Sergeant" matches.

[1] [http://www.cwgc.org/find-war- dead/casualty/2928300/STOTT,%20...](http://www.cwgc.org/find-war- dead/casualty/2928300/STOTT,%20WILLIAM%20LESLIE)

</comment></comment></comment><comment><USER4> According to this [1] article the message reads:

AOAKN HVPKD FNFJW YIDDC

RQXSR DJHFP GOVFN MIAPX

PABUZ WYYNP CMPNW HJRZH

NLXKG MEMKK ONOIB AKEEQ

WAOTA RBQRH DJOFM TPZEH

LKXGH RGGHT JRZCQ FNKTQ

KLDTS FQIRW AOAKN 27 1525/6

[1] [http://www.telegraph.co.uk/news/uknews/defence/9697929/Wante...](http://www.telegraph.co.uk/news/uknews/defence/9697929/Wanted- for-one-last-mission-call-for-Bletchley-Park-codebreakers-to-crack-the-D-Day- pigeon-cipher.html)

<comment><USER5> Hi there :-)

I read the message slightly differently (I believe some of the supposed 'w's are 'u's and one of your 'F' s is I believe a 'G'. As follows:

AOAKN HVPKD FNFJW YIDDC RQXSR DJHFP GOVFN MIAPX PABUZ WYYNP CMPNW HJRZH NLXKG MEMKK ONOIB AKEEQ UAOTA RBQRH DJOFM TPZEH LKXGH RGGHT JRZCQ FNKTQ KLDTS GQIRW AOAKN

Also do you know who 'Mason' is? Maybe the person who sent in the photo? Is this a recruiting sergeant for GCHQ? :-))

Not being a code breaker myself what relevance does AOAKN have? Beginning and end of message.

This pigeon was found in a chimney - what can we learn from that? What was the procedure when a message was sent but not received? This can be solved :-)

<comment><USER6> One time pads are mathematically provably secure. So, if it's a one time pad then we may not be able to solve this. There are some possibilities. If there's enough information with the pigeon and the message to find the original other half of the pad the message may be decrypted.

</comment></comment></comment><comment><USER7> Wow. I have in my possession some really similar looking crypted pages form an Italian partisan of the WWII (prepared and parachuted by the English forces).

It seems to me that the situations might be analog. How can I contact them? I see that they are asking for help but I don't see contact info.

<comment><USER8> I know some folks at GCHQ. Email me via my profile here and I will put you in contact.

</comment></comment><comment><USER9> If this were from 2012, the message would be in plaintext in some DB, and probably easily crackable.

WW2 crypto FTW

<comment><USER10> And if this were from 2012 said DB would be on an encrypted hard drive that can only be unlocked by typing "password".

<comment><USER11> Which would reveal a filesystem with the plausible looking content, while having typed a _different_ password would have revealed the true contents of the message.

<comment><USER12> And the weight of the hard drive would clearly be the cause of the pigeon getting pulled down into the chimney and unable to get out.

</comment></comment></comment></comment><comment><USER8> It's very curious that the first and last groups are identical: AOAKN. That would not be expected from a one time pad.

<comment><USER13> 1 in 11 million probability of the first and last blocks being the same by pure random chance. I'd guess they must be some sort of pre-agreed message sentinel, but even 1 in 11 million chances happen sometimes!

<comment><USER12> Right -- as improbable as that sounds, it pales in comparison to the likelihood of renovating your chimney and finding a pigeon with a coded message from WWII!

</comment></comment></comment><comment><USER14> As suggested in the comments on the Telegraph article, it would would seem likely that this message was encrypted with a one-time pad, making it essentially unbreakable. Unless the key is found in some MoD vault (and released to the public).

<comment><USER4> Probably correct. Another option is that the message was produced using a cipher machine, which were in use by the allied forces at that time. If a machine and records of the pre-arranged keys still exist then decryption might be possible.

<comment><USER15> If we can find records of how that machine worked, then we should be able to build a program to break the encryption.

</comment></comment></comment><comment><USER16> This message was sent by a homeland "Y Station", most likely from the RAF, to a decoding facility downstream, in the SIGINT community. At Bletchley or elsewhere. Y Stations were monitoring German military communications from the UK. It is why what we can now read on paper is the verbatim retranscription of a procedure that was heard on a radio receiver by a radio intelligence operator, --ie the presence of the standard "checksum" and EOM signature comprising the reiteration of the header group followed by the total number of 5-groups sent -- 27 in the instance. The origin time "1522" is the ZULU at which the actual transmission started while the end of transmission time is written after the checksum "1525/6". Taking pauses into account, this means the morse code operator was transmitting the groups at 10wpm, a credible speed for this type of operation. I hope this helps. Greetings from rainy Montreal David Thorne-Alexander <http://en.wikipedia.org/wiki/Beaumanor_Hall>

</comment><comment><USER3> By the signature, in the video clip, there's a box labelled 'Number of copies sent', filled in with a number 2. So, assuming the other copy went on another pigeon, it could well have already been received and deciphered back in WWII.

Here's the still from the video showing that and the signature: <http://i.imgur.com/KTp15.png>

</comment><comment><USER17> If you're interested in this you might be interested in a another unsolved message. <http://en.wikipedia.org/wiki/Taman_Shud_Case>

Also written up recently at [http://www.smh.com.au/lifestyle/riddle-on-the- sands-20121119...](http://www.smh.com.au/lifestyle/riddle-on-the- sands-20121119-29kwz.html)

Unfortunately the evidence is that decryption might depend on either a unavailable first edition of the Enlgish translation of <http://en.wikipedia.org/wiki/Rubaiyat_of_Omar_Khayyam> and/or information from a person who died in 2007.

</comment><comment><USER18> While much has been published about the German Enigma system I've not seen much about the British equivalents during WW2.

If this message was produced using a one time pad - which is practical for short messages - then it may be very difficult to decypher.

</comment><comment><USER19> More reading here: [http://www.ciphermysteries.com/2012/11/02/dead-pigeon- sparks...](http://www.ciphermysteries.com/2012/11/02/dead-pigeon-sparks- ww2-cipher-mystery)

<comment><USER4> This has some good ideas and research, but the author seems fixed on the idea that the message was produced by an SOE agent using a poem cypher. This seems unlikely to me because the cyphertext is written on an official-looking form. Blank message pads and quantities of homing pigeons are presumably not something that an under-cover agent would want to carry around with them.

</comment></comment><comment><USER20> And I'm just reading Cryptonomicon by Neal Stephenson. Amazing book.

<comment><USER21> Me too, really made the article stand out for me.

</comment></comment><comment><USER22> Running low on #pigeons. Please send more #WWII

</comment><comment><USER4> 1525/6 could be a time and day. The Normandy landings took place on 6th June 1944.

<comment><USER23> Could be a page/offset in a one-time pad.

</comment></comment><comment><USER24> The article missed some of the message, which read:

IDKFA IDDQD IDCLIP IDCLEV

<comment><USER25> IDSPISPOPD

</comment></comment><comment><USER26> If you count you will find that there are 26 diferent codes. This tells me that each 5 letter code represents a letter of the alphbet. This is not a message but it is the code itself.

</comment><comment><USER27> I still say this could be from the underground you have to stop and think . The underground use many forms of code to talk to one another</comment>


Generating PDF files with JavaScript - <AUTHOR> http://stackoverflow.com/a/742626/560299

<comment><AUTHOR> I posted it because when the question was asked in 2009 it was very hard to do it in js, now the comments says:

> You can easily create files in JavaScript these days. (I'm from the future)</comment>


Ask HN: What's your personal workflow environment like? - <AUTHOR> How do you optimize your productivity? What techniques and apps are you using to manage tasks?
I'm especially interested in you super-productive folks who have been sticking with effective routines for a long time (you know who you are, I'm lucky if I can catch you on HN), startup founders and university students. Less interested in those who jump frequently from app to app.
I'll start: I use a variation of GTD techniques for task management (iOS reminders managed by Fantastical), Pomodoro timers for focus (BreakTime on Mac), Productive App for building and tracking my personal habits, HIIT exercises twice weekly for basic physical health, Krill oil omega-3 supplements and probiotics for brain health, Asana for work/group collaboration, pen-and-paper for notes (which are reviewed at the end of the week and digitized with ScanBot) and daily meditation to stay calm and sane.
Would love to hear about your productive environment. <comment><USER2> 1\. Limit inputs and the number of inboxes you have to pay attention to. By "limit inputs", I mean limit and control what goes into your brain to limit information fatigue -- websites, podcasts, etc. All this stuff must be processed by your brain. If it's not truly important to you, cut it out.

Learn to enjoy the silence.

2\. Pay no attention to the latest productivity "life hacks" and apps. Use simple, age-tested, least-friction approaches.

3\. Exercise very single day. Walk, run, lift, whatever. This is a keystone habit for discipline and productivity and is vital.

4\. Get stuff done.

</comment><comment><USER3> This is how I optimise my productivity:

\- Make a list every morning of your priorities \- Take a break every 1.5hrs minimum \- Exercise at least every second day for 30mins \- At the end of the week review where you were unproductive (due to the benefit of hindsight, missed opportunities, focussing on the wrong thing) \- Pen and paper can't be beaten for some activities

I also fast one day a week as it sharpens my mind.

<comment><USER4> >I also fast one day a week as it sharpens my mind.

I tried this and my body literally can NOT handle this. When I fast one day the next day my body goes nuts and I eat everything in sight.

I fast til diner (5 pm) and then eat all my protein + calories. This builds a kind of 'buffer' for random food I didn't expect (lunch with someone I met that day, birthday cake, etc)

<comment><USER5> He only exercises 30 minutes every other day. I would try exercising 30 minutes every day before this fasting. As someone that exercises 1+ hour a day I gotta say I couldn't think without proper nutrition, even delayed a few hours.</comment></comment></comment>


Consider a startup accountability email list - <AUTHOR> http://www.mooreds.com/wordpress/archives/3324 <comment><USER2> When I started [http://Fairpixels.pro](http://Fairpixels.pro), I did exactly this. Only instead of an email list, I was writing posts on Reddit. I think having friends & family on the list is nice, but personally I prefer a rougher audience that will try to burn down whatever I'm building. Even if it's fragile. It helps you grow a thick skin and many of the comments are actually very useful. They force you to think about every tiny aspect of your business. Most of the time, things you may have missed (because they seemed obvious to you). Building in the open seems to be happening more often lately but we need more of that.

<comment><AUTHOR> Wow. Bold.

Which Reddit did you post to?

</comment></comment><comment><USER3> I was first introduced to this by Kyle Porter of SalesLoft when we rebooted the company in 2013. He has sent one of these emails without fail every Sunday evening for the past 8 years (with a few rare substitutions by others). It's sent to everyone at the company, investors, advisors, and interested third parties.

It's a fantastic tool for accountability and can be a huge driver for performance. Including some sort of metrics is really the key. You can see those grow and change over time, which can be a great motivator. And you can change them whenever they stop making sense, so they're more flexible than something like OKRs that might be locked to a quarter.

I recommend it even to solo bootstrapped founders. Just having this history of progress is great to look back on. And even sending it to yourself gives you something to work towards every week.

</comment><comment><USER4> I and another have been doing exactly this for our respective startups for the pst two months. It's been very helpful to keep in touch with people and get support.

</comment><comment><USER5> I do this via Meetup group. We've got five or so participants, meet every two weeks to make sure we all stay on our respective game.

</comment><comment><USER6> YC's startup school covers most of this. Except your audience is other founders rather than family and friends so maybe the advice is better?</comment>


How To Get Rails 3 and RSpec 2 Running Specs Fast (From Scratch) - <AUTHOR> http://www.rubyinside.com/how-to-rails-3-and-rspec-2-4336.html

<comment><USER2> a rails template for this would be icing on the cake</comment>


How and Why Chrome Is Overtaking Firefox Among Power Users - <AUTHOR> http://lifehacker.com/5645038/how-and-why-chrome-is-overtaking-firefox-among-power-users

<comment><USER4> I've been using Chrome as my browser for almost a couple of years now. I switched from firefox for basically one reason.

The browser is fast. Blazing _fast_. Starts-faster-than-notepad-while-my- system-is-still-settling-down fast.

I don't like how tabs get obscured if you have too many open. And there are some crashing bugs (I'm running the developer channel) but I still prefer it to any other browser.

There are some other nice features it has:

1) Silent updates that don't ask you questions. One day I'll click on the bookmark organizer and find that its been revamped completely since the last time I saw it. One day the tools menu has new items in it. I keep getting improvements pushed down as and when they are released and I've never had to notice it or take any action on it.

2) Automatically registers search engines whenever you search with it.

3) Syncs across multiple machines. Re-arranging the bookmarks on my Mac show up on my Windows system the next time I open Chrome on it.

That said, I still keep Firefox around as a container for Firebug. The chrome developer tools are nice but not on the same level as Firebug.

<comment><USER5> The search engine registration feature is fantastic. I do a ton of searching all day on various sites and when I ever have to use firefox, I find myself start typing en.wiki-- hitting tab and remembering that firefox still has quite a bit of friction in the search interface.

</comment></comment><comment><USER6> I recently switched back to Firefox from a two week test drive of Chrome, reasons:

* I don't like how the display of a lot of tabs are handled (dozens of really small unreadable tabs)

* No NoScript (found one extension that didn't work very well)

* It doesn't feel that much faster with dozens of open tabs

* I prefer FF's interface

* Uncertainty about what data is shared with Google

Integration with Google's other services is not a selling point for me.

I now have an "Open in Chrome" item in my context menu for opening Planet Wars replays.

<comment><USER7> Completely agree, specifically with these items:

* I don't like how the display of a lot of tabs are handled (dozens of really small unreadable tabs)

 __I wish Chrome had something like Tree Style Tabs (vertical tab panel on the left).

* It doesn't feel that much faster with dozens of open tabs

 __For me, it feels much, much slower when you have 30 tabs open - which are all visible because of Tree Style Tabs.

If I need to look at one website quickly and FF isn't open, I'll use Chrome. Otherwise, it's all Firefox.

<comment><USER8> If you run the dev channel version of Chrome, you can enable vertical tabs by browsing to about:labs and switching it on.

</comment></comment></comment><comment><USER9> One thing I find absolutely annoying in FireFox is that its always bugging me about updating either the browser or its extensions. Chrome does this all in the background and just works.

<comment><USER10> Mozilla is moving toward this by working on silent background updates (just for Windows users at the moment: [http://www.computerworld.com/s/article/9180272/Mozilla_plans...](http://www.computerworld.com/s/article/9180272/Mozilla_plans_to_silently_update_Firefox)) and by eliminating startup dialogs of all kinds: [https://wiki.mozilla.org/Firefox/Projects/Eradicate_Startup_...](https://wiki.mozilla.org/Firefox/Projects/Eradicate_Startup_Dialogs)

They know about the problem and are working to fix it.

<comment><USER11> > They know about the problem

I consider silent, automatic updates to be a HUGE problem.

<comment><USER12> I imagine they'll provide a configuration option for users to choose which they prefer, either in the Prefs menu or about:config.

I agree though, I prefer seeing update notifications popup at startup or anytime for that matter, than have it run silently in the background.

</comment></comment></comment></comment><comment><USER13> I started off being uncomfortable that I was using Chrome more and more. But it is a lot of little things that make it better. I'm on the dev channel, and some things might break, but having quick patches and updates is awesome.

Three things are holding me back to fully switching over:

\- Awesome bar - its awesome

\- Web Inspector <<<<< Firebug

\- '/' to start searching (unless its there and i just dont know about it)

edit: formatting

<comment><USER11> I use Chrome at work and FF everywhere else. Chrome is bloody fast.

But, FF keywords and awesome bar are so much better than what Chrome does. Totally miss '/', and ctrl-u to view source. An extension to bring those back would make me 37% happier!

Next version of FF claims big speed improvements. And since they've delivered on speed and memory improvements in the past I'm hopeful. I'll probably be switching back to FF only when that's out.

<comment><USER14> FWIW, Ctrl+u works as View Source in Chrome! Sadly, / doesn't do anything.

</comment></comment></comment><comment><USER15> For me, Chrome wins purely on speed. Like the article says, "it [Chrome] feels faster, and that's all that matters." Once in a while I need to use Firefox to test something, and it just feels painfully slow in comparison.

<comment><USER16> Ironically, for me Chrome loses on speed. I intentionally use somewhat underpowered tools for development. The danger is accidentally building something that runs fine on my system but that drags for users, i.e. the Crysis effect. Until the whole world uses Chrome, I can't target that level of performance.

<comment><USER15> That's a good point. I was simply speaking from a usage standpoint, not for development. Also, I suspect you're talking about javascript speed -- I was mainly addressing non-javascript rendering. Chrome feels basically instant, while Firefox's rendering takes an extra 300-500ms.. just enough to feel really sluggish.

</comment></comment></comment><comment><USER17> I switched to Chrome relatively recently and I love it however there are two things I really don't like:

* Inconsistent pinned tabs behaviour. A month ago, when I closed a pinned tab, it's favicon would remain, and I could click the favicon to reopen it. I loved this. Also, it would retain pinned tabs when I reopened the browser. Now, however, the "close but retain favicon" behaviour has disappeared, and it only sometimes remembers my pinned tabs between browser restarts, but I don't know why it's inconsistent.

* I detest the search bar's automatic handling of certain terms. For example, if I want information about a Google API, I may start typing "google maps api" but as soon as I finish typing "google" it turns my entry into an automatic search of Google, followed by the terms. But searching for Google for "google maps api" is not the same thing as searching Google for "maps api". It does this for all sorts of stuff.

<comment><USER18> Have you tried a question mark at the start of your query? (i.e. ?google maps api)

<comment><USER17> Thanks for the tip, works great!

</comment></comment></comment><comment><USER19> I don't really get why Chrome is so exciting. OK, it uses the GPU to render pages. That's fine, but that's never the bottleneck for me; my CPU is done rendering pages long before it gets the next byte from the painfully-slow web app that I'm connected to.

What we really need is GPU acceleration for Arc...

<comment><USER20> > OK, it uses the GPU to render pages

? It actually doesn't -- not release versions at any rate. Are you confusing Chrome with IE9 or Firefox 4?

<comment><USER21> Latest development releases of chromium support this (see [http://blog.chromium.org/2010/09/unleashing-gpu- acceleration...](http://blog.chromium.org/2010/09/unleashing-gpu-acceleration- on-web.html))

</comment></comment></comment><comment><USER22> For me it's mostly just the combined search & url field. Once you get used to that, anything else feels awkward.

<comment><USER23> In Firefox,

(1) View >> Toolbars >> Customize

(2) Drag your search box out of the bar

(3) Okay

(4) Go to any search engine. For example, go to google.

(5) Right-click in the search box, and choose "Add Keyword for this search"

(6) Give it a friendly name. For a google search keyword, I might suggest "g".

Now, when you want to search in Firefox's single URL bar, you can type "g cute cat pictures". Add the "cpan" search keyword for the search.cpan.org box, and in the same bar, you can type "cpan Moose". Want to define a word? Set up a keyword for the box at dictionary.com (Would "d" work for you?).

Also, Firefox has NoScript and supports the latest version of JavaScript (Chrome is years behind).

<comment><USER24> The search keywords is the main reason I can't get used to Chrome. After years of typing g <search> or wiki <search>, I'm having a lot of trouble readjusting.

<comment><USER25> You can use keywords in Chrome: go to Options > Basics > Default search > Manage, pick a search engine, click Edit, and enter your keyword. It's a few more steps than in Firefox, but at least it doesn't clutter your bookmarks.

<comment><USER26> I think Chrome one-ups them, actually. It keeps track of search engines you visit, so you can go there _now_ and fill out ones you've already used without browsing anywhere.

</comment></comment></comment></comment></comment><comment><USER27> Chrome is definitely awesome, but I've been using FF a lot more recently because Vimperator is better than Vimium.

</comment><comment><USER28> Chrome still can't seem to get mouse gestures right. I don't care if a page is "protected". I don't care what platform limitations are in place. I just want the same experience, regardless of where I am or what OS I'm on. Right now siphon+xmarks+firefox comes a lot closer to that than chrome.

Past that I think it's a great browser. But until the day comes that I never have to click the back or close buttons, it won't be my browser of choice.

</comment><comment><USER29> I think it's a fools errand to try to make one browser for every single type of web browsing user on the planet. I use the browser a lot differently - <USER2> development, checking HTTP headers, etc - than my girlfriend does - <USER3> facebook and looking up clothes on the Anthropologie website.

Firefox + Firebug, Web Developers Toolbar + all my other extensions make it a wonderful browser for doing we development, but makes it _terrible_ (and slower) for doing casual browsing...which is why I'm not writing this comment in Firefox :)

The iPad does this exceptionally well. It did a great job of showing that while the laptop platform is a superset of all iPad functionality, it was the actual _platform_ (bigger hardware, short(er) battery life, needing mouse/trackpad, etc) that got in the way from the best user experience of consuming content.

</comment><comment><USER30> There are a lot of things I really love about chrome, and it is very tempting to make the switch. I would bet in a few years it is as large as or larger then IE.

Im not switching from firefox, but from Opera. I haven't been able to use Firefox as my default browser without being annoyed to hell for some time.

However I still feel chrome is not as polished as Opera but I still enjoy using chrome and there are so many things that are better then Opera. However there are still 2 game breakers that are keeping me from switching to chrome.

Built in RSS reader - I don't want another program to handle RSS for me. This is a key thing keeping me on opera and I really hope they don't try to force you to go to Google Reader.

Mouse Gestures - Every plugin for this sucks. They are awful, slow, inaccurate and annoying. Big time game breaker for me.

</comment><comment><USER31> They missed the main reason I switched to chrome. I constantly had issues where firefox had a (memory leak?) that slowed my whole computer down, usually causing me to kill the task couple days.

I love the extensibility of FF, and aza's usability contributions, but I can't live repeatedly restarting a browser in a world of webapps.

(Disclaimer: I haven't tried FF 4 yet, but experienced the same issues last spring when I tried to switch back to FF for treeview tabs)

(Disclaimer 2: I suppose there's ways to workaround it - searching led me to this: [http://blog.skdev.net/2009/02/12/how-to-fix-firefox- memory-l...](http://blog.skdev.net/2009/02/12/how-to-fix-firefox-memory-leak- problem/) )

</comment><comment><USER32> Sounds like history repeats itself. New Microsoft - Google - takes on Netscape browser (Netscape 5 -> Mozilla -> FireFox).

"Integration with Google Services .... When Chrome OS comes out with a stable release, you'll be able to sync your full computing experience by just logging in with your Google account. It's not there yet, but it's all part of where Chrome is going. " sounds strangely familiar to the strategy of close integration of IE into Windows successfully played many years ago.

Competition and greed is good. And current state of browsers only confirms it. In result we'll have even better and faster browsers :)

</comment><comment><USER33> Chrome, so far, is the only browser I can keep open with a bazillion tabs for days, weeks, MONTHS without seeing my system take a slow, deadly, performance hit. I'm sorry I didn't start using it sooner.

<comment><USER34> Very true. Indeed, I switched from Firefox to Chrome after Firefox hanged yet again with N tabs open, and I just couldn't figure which one it was and simply close that one. On chrome this never happened, and I never had to restart the browser.

</comment></comment><comment><USER12> I've actually switched the other way, from Chrome and Chromium to Firefox. I used to think FF was compartively slow and clunky too, but then something strange happened: I discovered Vimperator a few months ago.

I don't how Vimperator does it, or whether it's just the a placebo effect of sorts, but installing it on FF 3.6 on Linux made FF feel as or more responsive and stable than Chrome and Chromium. It's now my primary browser & I'm lovin' it.

</comment><comment><USER35> _Power users love things that sync. Synchronization means you can work from any computer and expect the same basic environment._

I've gotten hosed by Sync before. I switched OSes not realizing I was also switching to an older version of Chrome. In the process of syncing I lost a few months of bookmarks (it looked like all the bookmarks I had saved with the newer Chrome were gone).

So I'm using Xmarks now.

</comment><comment><USER36> One bug that I've seen that is _not_ developer friendly is that you need to run with --enable-ipv6 on Linux to be able to access 127.0.0.1 or localhost when you don't have a network/internet connection. It's especially annoying that it gives a name lookup error when trying to access 127.0.0.1... IT'S AN IP ADDRESS!

</comment><comment><USER37> I love Chrome because it uses the screen real-estate so efficiently. It's essential on a netbook.

The only thing I miss is "/" starting search. There's an extension for it, but it interferes with other things often enough I had to turn it off.

</comment><comment><USER38> FTA: > consolidating the search box and address bar seems so obvious

I know that Mozilla's engineers would love to do that, but the search box is their revenue model. Google pays a lot of money for that box to be there.

</comment><comment><USER39> AdBlock Plus is holding me to Firefox... I have disabled check updates in firefox and do it myself once in a while. This has kept me sane otherwise it is too annoying and load time is high.

<comment><USER40> Chrome has an AdBlock extension too. It works great for me.

[https://chrome.google.com/extensions/detail/gighmmpiobklfepj...](https://chrome.google.com/extensions/detail/gighmmpiobklfepjocnamgkkbiglidom)

<comment><USER41> The Chrome/Safari adblock has an extremely crap UI compared to Firefox adblock if you ever wanna add your own blocking rules.

</comment></comment></comment><comment><USER42> As a Flash game developer, I find that Flash games run substantially faster in Chrome because of the way that Flash is integrated. By a factor of 2x in some cases.

</comment><comment><USER43> Firefox has firebug and greasemonkey but I'm probably using a different definition of power user.

<comment><USER14> The author of Greasemonkey works on the Chrome team now (he's also an HN user, I believe). So pretty much all Greasemonkey scripts work in Chrome by default (they're extensions).

Also, have you tried the Chrome Developer Tools? They rival Firebug. You might like them even more.

<comment><USER36> A while back there were a few things that a number of GreaseMonkey scripts used that was not available in Chrome. (GreaseMonkey 'API' things)

</comment></comment></comment><comment><USER44> Can you right click and copy an image? That was not working last time I tried it on OSX.

<comment><USER45> Yes. <http://i.imgur.com/VfAoa.png>

<comment><USER44> No. Have you actually tried it? I just did. It copies a broken image. Sweet.

<comment><USER45> It works for me on 3 different computers.

</comment></comment></comment></comment><comment><USER46> I'll probably always have Firefox installed on my machine, but Chrome is my default browser. Chrome is the better piece of software, and one of the best desktop applications overall, it obviously was well thought out and well designed from the start: The sandboxing, the update system, the extension system, the omnibox, using webkit, V8.</comment>