When you browse Instagram and find Tony Abbott's passport number - <AUTHOR> https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram <comment><USER2> Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient.

A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery. I didn't use any specialized software; it was just Mathematica with its built-in ImageDeconvolve function with guessed parameters for the Gaussian kernel.

I personally recommend blacking out (add a black rectangle) instead of blurring, and if it is a PDF, convert to an image afterwards because too many PDF editors use non-destructive operations to add a new object instead of changing what's underneath.

<comment><USER3> Your advice is good, and I agree that you didn't use specialized software to reverse the blur, but this

> _I didn 't use any specialized software; it was just Mathematica with its > built-in ImageDeconvolve function with guessed parameters for the Gaussian > kernel._

is one of the most HN comments I've come across recently :)

<comment><USER4> Reminds me of the Simpson's 3D episode. Professor Frink's

>"Well, it should be obvious to even the most dimwitted individual, who holds an advanced degree in hyperbolic topology..."

<comment><USER5> Professor Frink, Professor Frink. He'll make you laugh, he'll make you think. He likes to run and then the thing with the.. person...

<comment><USER6> That monkey is going to pay...

</comment></comment></comment></comment></comment><comment><USER7> Apart from the really interesting content, this is an extremely good read, strikes me as the right kind of balance of information and keeping you entertained. I really enjoyed this writing style!

<comment><USER8> Interesting, I liked the story but got the opposite impression you did. At first the humor was amusing but I felt like the relentless, extremely heavy sarcasm dripping off every sentence quickly turned it into a slog and even started to make me wonder which parts were genuine vs. joking. Not great.

<comment><USER9> I agree... when you listen to a great comedian, it's not 1 joke/sentence. This article was too much. I still read it all since the overall topic was entertaining but the attempt at humour was overkill.

<comment><USER10> Have you actually listen to nowadays comedians ? It _is_ one joke/sentence nowadays (at least in my country).

More exactly, they separate each sentence. Each has a tiny bit of funny in it (in the words, in the way they say it, because they stay in character, whatever) and they let audience lol. Rinse and repeat.

Look I just googled "up and coming standupers" and picked the first video (new laptop, not connected to Gaccount) [https://www.youtube.com/watch?v=s6uW1odtjPc](https://www.youtube.com/watch?v=s6uW1odtjPc)

Check the 36 first seconds.

Humour changed without you (us) realizing ¯\\_(ツ)_/¯

</comment></comment></comment></comment><comment><USER11> Some Grade A zingers in there:

> The man in question is Tony Abbott, one of Australia's many former Prime > Ministers.

> For security reasons, we try to change our Prime Minister every six months, > and to never use the same Prime Minister on multiple websites.

> Harold Holt was another former Prime Minster and we… lost him? He > disappeared while going for a swim one morning. This is not a joke. We named > Harold Holt Memorial Swim Centre after him. I repeat, this is not a joke.

<comment><USER12> "...I called up and was all like "yeah bloody g'day, day for it ay, hot enough for ya?". Once the formalities were out of the way..."

<comment><USER13> I couldn't stop laughing.

His skills at hacking are only matched by his wit at writing.

</comment></comment></comment><comment><USER14> I feel like this buries the lede massively: Qantas' system was run by Amadeus, who also run the booking system for some 200 other airlines [0]. If you could do this with Qantas and get all those notes, you could probably do it to any other airline and get them too. That would be bad enough, but it also appears that this issue (or one very much like it) has been reported widely at least back in early 2019.

So, either Amadeus didn't fix the issue until it was disclosed here (very very bad) or Qantas didn't update their booking system for a security patch ( _also_ very bad).

[0] [https://techcrunch.com/2019/01/15/amadeus-airline-booking- vu...](https://techcrunch.com/2019/01/15/amadeus-airline-booking- vulnerability-passenger-records/)

<comment><USER15> The underlying issues have been known for quite a while. There was a fantastic talk in CCC at 2016 about the airline booking systems and the various bits of information you can glean from them.[0]

0: [https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...](https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego)

<comment><USER16> The underlying issue is that PNR+Last Name has always been the "secuirty" to access a booking, and no airline or travel agency wants to enforce stronger measures unilaterally, for fear of increasing friction for their customers

</comment></comment></comment><comment><USER17> I found his advice to Tony on how to get better with computers remarkably insightful:

> I said there probably was a book out there about "the basics of IT", but it > wouldn't help much. I didn't learn from a book. 13 year old TikTok > influencers don't learn from a book. They just vibe.

> My mum always said when I was growing up that:

> There were "too many buttons" She was afraid to press the buttons, because > she didn't know what they did I can understand that, since grown ups don't > have the sheer dumb hubris of a child, and that's what makes them afraid of > the buttons.

> Like, when a toddler uses a spoon for the first time, they don't know what a > spoon is, where they are, or who the current Prime Minister is. But they see > the spoon, and they see the cereal, and their dumb baby brain is just like > "yeA" and they have a red hot go. And like, they get it wrong the first few > times, but it doesn't matter, because they don't know to be afraid of > getting it wrong. So eventually, they get it right.

> Okay so I didn't tell the spoon thing to Tony Abbott, but I did tell him > what I always told my mum, which was: "Mum you just gotta press all the > buttons, to find out what they do".

<comment><USER18> A similar anecdote from my family.

My uncle (a sheep farmer) and I discovered that:

1\. I was afraid to touch anything in a car engine, but happy to muddle through unfamiliar computer issues

2\. He was afraid to click unknown buttons on a computer screen, but comfortable pulling apart and rebuilding an unfamiliar car engine.

In both cases, we were confident because we knew whatever mistake we made we'd be able to reverse it. And in both cases, we were afraid of making a mistake that we couldn't reverse.

<comment><USER19> That's basically how I taught my father to use a computer. It came down to two things:

1\. He was terrified of breaking it, so I told him that there was nothing he could possibly do to it that I couldn't fix. I made sure to sound overly confident -- almost like I was challenging him to break it. That gave him the confidence to do whatever.

2\. Every time there was a problem with it, I would Google the answer in front of him, and he'd watch me figure it out in real time. Eventually, he got the confidence to start Googling things himself. The tech support calls dropped off pretty steeply after that.

<comment><USER20> Give a man a fish, and he'll eat for a day.

Teach a man how to google, and he'll never go a day in his life without being obsessed with conspiracy theories.

<comment><USER19> You're not far off, to be honest. Just replace 'conspiracy theories' with 'extreme political YouTube channels'.

It's not all bad, though. He invites his friends over and shows them how you can find all sorts of cool stuff online. One of them the other day was apparently trying to stump YouTube with increasingly obscure woodworking joints.

I think most people would be surprised how many people are still out there who have no idea what the internet is or what it does. Imagine discovering that there's a machine that can show you how to do anything, or play any song you've ever listened to, and you had no idea something like that even existed.

</comment></comment></comment></comment></comment><comment><USER21> Great post, thoroughly enjoyed reading it.

BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2].

But when I opened the PDF, I was hit with this random string of characters:

cGJhdGVuZ2h5bmd2YmFmLCBsYmggZmJ5aXJxIHpsIHlodnR2IGNobW15ci4gQCB6ci BiYSBnanZnZ3JlIGp2Z3UgbGJoZSBzbmliaGV2Z3IgcXJmZnJlZyBnYiB0cmcgbGJo ZSBlcmpuZXEuIFZnJ2YgeXZ4ciwgYWJnIG4gaXJlbCB0YmJxIGVyam5lcSBmYiBodQ o=

I tried to decode this using every available decoder, but it only throws up random result. Was wondering if any of you smart people here had any idea about this code.

[0] [https://mango.pdf.zone/](https://mango.pdf.zone/)

[1] [https://mango.pdf.zone/mango.pdf](https://mango.pdf.zone/mango.pdf)

[2] view-source:[https://mango.pdf.zone/](https://mango.pdf.zone/)

EDIT: SOLVED IT!

As the commenters who replied to me mentioned, this puzzle is double-encoded. I think the trick is to figure out which decoder to use first.

<comment><USER22> Hint: try ROT13.

<comment><USER23> Quick posix shell rot13 tip: pipe it into:

tr '[A-Za-z]' '[N-ZA-Mn-za-m]'

<comment><USER24> Also sometimes useful is vim: `g?` ... it's useful to have "scrambled" lines in notes for protection against casual disclosure.

Vim used to have a (terrible) encryption capability, but lately I've been fairly happy with `pass` (passwordstore.org) for basic local encryption.

</comment></comment></comment></comment><comment><USER25> The power of Inspect Element. This is exactly how I found out I was underpaid[1]. A company I worked for used a software called erecruit to manage my contracts. When you click on a clients name, it makes an ajax request to fetch the data. Being a web developer, I inspected the data returned.

I'm pretty sure all the developer did was:

        echo json_encode($queryResult);

I saw how much I was getting paid vs how much they were charging clients. I quickly changed my prices after that.

[1]: [https://idiallo.com/blog/how-much-do-you-charge-for-your- wor...](https://idiallo.com/blog/how-much-do-you-charge-for-your-work)

<comment><USER26> I think this is a lesson lots of early AJAX/client-side coders should be forced to learn. When you do a `SELECT * FROM` and return the entire result, that data is visible on the client end in full detail (if you're familiar with how to use the browser's dev tools that is). Maybe you only make some of that data visible to the user in the UI, but the data you didn't use is still part of that AJAX return. Only send to the browser the data you actually need!

</comment></comment><comment><USER27> I accidentally discovered a way to get hold of passport details of random people by applying for Visa on arrival to Vietnam. There are these online portals which do some document pre processing which is legit. And on landing in Vietnam we are expected to show that we have already applied for Visa. It so happens that these portals do batch processing. Which means my application is processed along with a half a dozen or so other random applicants.

And so I applied for one. And when I received the confirmation document I received the entire batch file. It included passport number, expiry date and other PII of ten random people which would be super valuable in the hands of criminals and such.

And conversely ten random people know my PII

<comment><USER28> The same when you apply to give up vietnamese citizenship, all your info are public on the goverment website (pdf files with name, birthday, current addresss...)

<comment><USER29> with the way how the government over there works, even if you have those information... there's really nothing much to do with it.

<comment><USER30> If you are applying to give up Vietnamese citizenship, I would guess that you are no longer living in Viet Nam, so this information might serve as a starter kit for someone to steal your identity?

</comment></comment></comment></comment><comment><USER31> This is one the of the funniest things I've read in recent memory. He made an Instagram post 30 second check of Chrome's dev tools into a narrative I couldn't stop reading. Thanks for brightening my day author!

</comment><comment><USER32> I am very impressed by this piece. Something about how "Alex" manages to blend the kind of humor not typically associated with compassion or competence, with a story that is most spectacular because of the very compassionate and competent actions of its protagonist...I literally couldn't stop reading.

So well done.

</comment><comment><USER33> > "You could drop me in the bush and I'd feel perfectly confident navigating > my way out, looking at the sun and direction of rivers and figuring out > where to go, but this! Hah!"

I mean not to call him out but this did happen and he didn't navigate his way out (although that says nothing about his confidence).

[https://www.smh.com.au/national/tony-abbott-lost-in-the- outb...](https://www.smh.com.au/national/tony-abbott-lost-in-the- outback-20100303-phd9.html)

EDIT: To be fair, it's been a decade. Maybe he's worked on his orienteering skills since having that experience?

<comment><USER34> Sure, this is the guy who knighted a prince and ate a raw onion. What did you expect?

Abbott was Australia's Trump. Thankfully he lasted in office an even shorter time than the people he replaced.

<comment><USER35> I don't get it, is there something noteworthy about eating a raw onion?

<comment><USER36> Yes and no. It was the pinnacle in a series of bizzare behaviour from Tony while he was the Prime Minister. Certainly its the one people most remember of him. Keep in mind he ate it with the skin on as well. I think its also something people look out for, with the previous PM Kevin Rudd being somewhat infamous for eating his own ear wax on live TV.

When I was working on an archive project for the ABC, "tony eating onion" or some variation was the most common thing people searched for in the system when they first started using it.

<comment><USER37> > I think its also something people look out for, with the previous PM Kevin > Rudd being somewhat infamous for eating his own ear wax on live TV.

… as a stunt? On a dare? _Why_?

<comment><USER36> It was during a long question time [https://www.youtube.com/watch?v=_ipvdBnU8F8](https://www.youtube.com/watch?v=_ipvdBnU8F8)

</comment></comment></comment></comment></comment></comment><comment><USER38> The contact form on Abbott's website 403ing is impressively on-brand.

<comment><USER39> I wouldn't be surprised if the staff deliberately sabotaged it. I've worked for a party before and the emails are horrendous

<comment><USER40> My MP had several death threats last year - including in the post to her home address inside an otherwise normal looking birthday card.

</comment></comment></comment><comment><USER41> I would encourage anyone interested in this article to read it thoroughly to the end. This is one of the most satisfying articles I've read recently and I really enjoy the author's unique sense of humor.

<comment><USER42> Try some of james mickens articles: [https://mickens.seas.harvard.edu/wisdom- james-mickens](https://mickens.seas.harvard.edu/wisdom-james-mickens)

They are written in a similar style, I really love them.

<comment><USER43> Thank you for this. I ate the entire mango.pdf and was still hungry.

<comment><USER44> His presentations are also a fine quality

</comment></comment></comment></comment><comment><USER45> The following line confuses me, because it contradicts a lot in the post.

 _Update: I have been arrested._

Is that just an obvious mistake? Or is there a news flash that we would like to hear more on?

<comment><USER46> Looks like that was yet another joke.

</comment></comment><comment><USER47> I still find it strange you can manage a booking with just a reference and name. About ~5 years ago someone I follow on twitter posted their boarding pass and I replied to them with a screen shot asking if I should cancel the booking. They removed their post and I removed mine. But all it took was the reference on the boarding pass and their last name...

<comment><USER48> What I've gathered left and right wrt the airline industry is that it was one of the earliest industries that went digital, and / but they have a lot of legacy going on.

I mean in this particular case, they could have Abbott create an account on their website first, but then, someone else booked the ticket for him so that makes things more complicated (because they don't have an e-mail address), and then there's tickets being booked all over the world, and then loads of people don't have computers or e-mail.

It escalates quickly.

<comment><USER49> The amount of pain still caused by things like somebody back in the sixties deciding that two characters is plenty to encode every single airline ever is still felt to this day. Witness the majesty of the "controlled duplicate": [https://en.wikipedia.org/wiki/Airline_codes](https://en.wikipedia.org/wiki/Airline_codes)

</comment></comment></comment><comment><USER50> The hacker known as "Alex" also gave a really fun talk at PyCon AU in 2018: [https://www.youtube.com/watch?v=ZlNkIFipKZ4](https://www.youtube.com/watch?v=ZlNkIFipKZ4)

<comment><USER51> Associated blog post [https://mango.pdf.zone/operation-luigi-how-i-hacked-my- frien...](https://mango.pdf.zone/operation-luigi-how-i-hacked-my-friend- without-her-noticing)

and salty hacker news comments (his words) [https://news.ycombinator.com/item?id=14919845](https://news.ycombinator.com/item?id=14919845)

</comment></comment><comment><USER52> It's nice to live in a country where not only do various parts of the government actively try to help someone with a really bizarre issue, but no one got arrested (or shot) for bullshit trumped-up hacking charges. I can't think of many other countries responding well to 'hi I'm some random person and I used the PM's boarding pass and found out all this secret stuff'

</comment><comment><USER53> A few years back when I was looking to buy a house, I was interested in how long the property had been on the market. (I was looking in country towns and their outskirts, where six months is a typical time for a property to be on the market; I even saw one or two blocks of land that seemed to have been for sale for at least five or six years.) Few real estate agents tell you this on their websites (though if you ask, they may), and aggregators like domain.com.au and realestate.com.au don't either. Except sometimes they do, in the markup. My vague recollection (I don't have the scraping scripts I wrote handy right now, they're just on my old laptop and backups) is that I found a JSON blob in the realestate.com.au mobile website containing two dates, and that the domain.com.au desktop website fetched a JSON response from an API which happened to contain one date. I ended up deciding that REA's dates were when the listing was first seen and last updated, and the Domain one was one of those. Neither of these sites were actually _displaying_ this date, but the data was there for me to take and feed into my research.

Careless or unwitting information disclosure from APIs—sometimes sensitive, sometimes not—is a real problem.

<comment><USER54> That's interesting. The time on market is always listed on Danish real estate websites. And the aggregator sites also have previous listings.

</comment></comment><comment><USER55> In some countries, identity documents are in relatively frequent use. The number of authorised strangers who would have access to one's identity document might be significantly higher in these jurisdictions than, say, the number who would be able to view Tony Abbott's passport number. I'm thinking of - for instance - the 'personnummer' in Sweden (I've heard friends recite theirs in public when asked for them).

Q: Should (merely) the _number_ from your passport really be considered a secret?

<comment><USER20> In theory no, but in practice yes. It's the same for a lot of metadata about our lives that routinely doubles up as authentication factor, e.g. "to verify your identity, can you please confirm the first line of your address and your postcode?"... Most of my neighbours know that!

<comment><USER56> As an example of metadata revealing a lot about you:

Ireland got a postcode system in 2015 (the last time they considered implementing postcodes to improve autosorting, they were so late to the party that "an post" (Irish postal service) had OCR machines good enough to just read the whole address) which assigns each residence in the country a 7-digit alphanumerical code. Called an "Eircode" [1] It is purported to be a solution to packages getting lost or delayed, and an unambiguous way of giving someone a building's address.

An Eircode can be resolved into a full postal address, and GPS co-ordinates for the address.

e.g, here's some Eircodes;

Facebook's headquarters: D02 Y098

President's house: D08 E1W3

Data protection commission: D02 RD28

To get the info for any of these, check out: [https://finder.eircode.ie/](https://finder.eircode.ie/)

Personal note: I'm not too jazzed on the specifics of the implementation, but it sure is handy when you're shitfaced and can trivially explain exactly where you live to a food-delivery driver over the phone.

[1]: [https://en.wikipedia.org/wiki/Postal_addresses_in_the_Republ...](https://en.wikipedia.org/wiki/Postal_addresses_in_the_Republic_of_Ireland#Eircode)

</comment></comment></comment><comment><USER57> Great read.

I really like the bit about learn "the IT", there's no book or anything to be good at computers you just gotta fuck around and find out a bunch.

> Like, when a toddler uses a spoon for the first time, they don't know what a > spoon is, where they are, or who the current Prime Minister is. But they see > the spoon, and they see the cereal, and their dumb baby brain is just like > "yeA" and they have a red hot go. And like, they get it wrong the first few > times, but it doesn't matter, because they don't know to be afraid of > getting it wrong. So eventually, they get it right.

<comment><USER48> The problem is that there are a LOT of books, but what is relevant just changes every couple years.

I mean the IT books section of the charity shops is a good example of this, there's so many there for older versions of Office, operating systems, etc.

That said, I had a school book (Structured Computer Organization by Tanenbaum) that explains a lot of the basics of computers. Sure, it's about the Pentium architecture and early JVM and doesn't cover multi-core architecture or using GPU's to crunch numbers, but it goes through a lot of the basics.

</comment></comment><comment><USER58> I find it incredible that Abbott being openly vulnerable about his lack of competency with computers, has been more effective in making me like him than anything he has ever done in his political career.

Teams of media advisors and a very favorable alliance with the Murdock press have paled in comparison to this one blog post that didn't even have that as an aim.

</comment><comment><USER59> Great talk [0] given during the 2016 congress touching on the Amadeus flight booking system and the danger of posting your boarding pass on social media

[0]: [https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...](https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego)

<comment><USER60> This was an amazing watch. Thank you very much for the link.

</comment></comment><comment><USER61> We blame these social networks for collecting vast amounts of our private data (yes we should), yet these folk have no problem of posting already sensitive information under a hashtag - creating an Aladdin's cave of identities waiting to be stolen for fraud as this blog-post has demonstrated.

'If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place' \- Eric Schmidt

I guess they will learn the hard way given that they aren't really 'tech savvy' or internet wise these days.

<comment><USER62> The problem is people have no idea what is sensitive. Until just now I would have thought a boarding pass was safe to share.

Its more the airlines fault for making this info so easy to access with what looks like unsensitive info.

<comment><USER63> I have told people at airports to not friggin post their boarding passes or documents containing their booking refeeence on Instagram. Back when I was 20 I didn't lot of stupid things. One was to change tine obnoxious details about their reservations. When they were in air (and presumably had their phones off) I sent them a text message. "Never put booking information on asocial media".

I could probably have gotten in a lot of trouble.

</comment></comment></comment><comment><USER64> >> Instagram, in case you don't know it, is an app you can open up on your phone any time to look at ads).

Nailed it.

</comment><comment><USER65> Imagine doing something similar to a government application of an EU country and in 15 minutes finding a way to expose all citizen requests for an EORI number ever (some tens of thousands), with all personal details there for you to take. This was last year and in the meantime they updated their application from an ancient 2003 Oracle one to one that's more modern.

Thinking in perspective now, I regret not going out with it because that ancient application probably cost millions of euro from taxes.

</comment><comment><USER66> This post was very amusing! It always bordered on silly meme-style writing, but never doing too much of it at once which I find annoying. The story itself was also very interesting!

</comment><comment><USER67> Surprisingly good experience, and even a call from the man himself. I'm actually impressed, I expected way more incompetence and fumbling from a government.

</comment><comment><USER68> Great read. If somebody is interest in another great talk about boarding pass data security, there is this one from 33c3: [https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...](https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego)

</comment><comment><USER69> I don't know if it's just me or it's the fact that I'm reading this on mobile on a small screen but I couldn't stand the writing style. Curious to know if anyone else felt that way.

<comment><USER70> I found myself rolling my eyes a few times, but the core content was good so I didn't find it all that off-putting.

"Update: I have been arrested." did leave me slightly confused for a while though, probably due to the verbosity making me want to scan read.

<comment><USER71> If you were scanning that would be an easy joke to miss. The giveaway is the previous paragraph ending mid-word like the authorities just busted in and hauled the author off to a CIA black site.

</comment></comment></comment><comment><USER71> This was a great read but I'm a bit disappointed there are no easter eggs in the page source. Or maybe I'm just not finding them.

<comment><USER72> There is one, but it's on the homepage - take a look under the "about" heading at the bottom and go from there.... (assuming that's the puzzle that ASD figured out)

</comment></comment><comment><USER73> I loved the writing style. That "hard mode" effect had me wheezing though.

</comment><comment><USER74> > If you laid all the people I contacted end to end along the equator, they > would die, and you would be arrested.

Possibly the best line in an article full of really fantastic lines.

</comment><comment><USER75> Out of curiosity a few months back I spent a few hours looking at this exact hashtag (#boardingpass) and other travel related hashtags.

I ended up thinking that Instagram was actively removing pictures of boarding passes because I could only find a surprisingly low amount of pictures containing valid Lastname/BookingRef. As for the few pictures available, the references were often either too old, or partially covered.

I'm still wondering if Instagram does remove such photos.

<comment><USER76> I even get a 501 Not Implemented for [https://www.instagram.com/explore/tags/boardingpass/](https://www.instagram.com/explore/tags/boardingpass/) on desktop. May be related?

</comment></comment><comment><USER77> Most entertaining post-morterm I've ever read, Australian through and through.

</comment><comment><USER78> aha amazing read, quality content.

</comment><comment><USER79> >I personally recommend blacking out (add a black rectangle) instead of blurring

This can be reversed as well, if you do black things out this way: please make sure you're using 100% opacity black. I've managed to retrieve data from plenty "blacked-out" documents simply by playing with contrast and exposure filters in Photoshop because the opacity wasn't set correctly.

<comment><USER80> Black it out, print it to paper, scan it back in, embed the image in a Word document, and print to PDF. Wait, that's just how "most" people do it anyway..

</comment></comment><comment><USER81> Well now I feel compelled to read everything this person has ever written.

</comment><comment><USER82> Real question here is: should the passport number have any expectations of privacy? It seems like such an easy thing to expose as you literally put it down on every document like hotel check ins etc. AFAIK it's not even a random number and instead it's generated from basic info like birth year/place/gender.

That being said it was a really good blog!

<comment><USER83> It depends where you are from. Our (Australian) passports have a "series" letter at the start and then a set of numbers. Not sure whether they are random or incremental or derived.

YMMV based on nation that issues yours.

</comment></comment><comment><USER84> I like that there was such a good response to the disclosure from all the different parties, compared to this: [https://research.digitalinterruption.com/2020/09/10/giggle-l...](https://research.digitalinterruption.com/2020/09/10/giggle- laughable-security/)

</comment><comment><USER85> The tl;dr:

> Your boarding pass for a flight can sometimes be used to get your passport > number. Don't post your boarding pass or baggage receipt online, keep it as > secret as your passport.

> How it works: The Booking Reference on the boarding pass can be used to log > in to the airline's "Manage Booking" page, which sometimes contains the > passport number, depending on the airline. I saw that Tony Abbott had posted > a photo of his boarding pass on Instagram, and used it to get his passport > details, phone number, and internal messages between Qantas flight staff > about his flight booking.

</comment><comment><USER86> Amazingly written post, really enjoyable to read!

It's amazing that we have all those security protocols (HTTPS, e2e encryption, secure log-in, etc.) but in the end most of the "hacks" are just people being stupid or manipulated through social engineering.

</comment><comment><USER87> This got picked up by the news in Australia [0], they also interviewed the author [1].

[0] [https://www.abc.net.au/news/2020-09-19/tony-abbott- boarding-...](https://www.abc.net.au/news/2020-09-19/tony-abbott-boarding- pass-online-cyber-safety-mistake/12678776)

[1] [https://www.abc.net.au/radio/melbourne/programs/drive/alex-h...](https://www.abc.net.au/radio/melbourne/programs/drive/alex- hope-hacking-tony-abbott-boarding-pass/12675504)

</comment><comment><USER88> Lately I am thinking about building a framework for web APIs where the database stores the owner, group and other's rights for each entity. The framework will then fetch data based on the user and fills the models based on the rights set for each field.

Exactly for the reason shown in the article.

I believe right now it is still too difficult to do this in any framework. That's why developers take shortcuts and just expose all entity data or just make a mistake and forget about it.

Does anyone know if such a framework already exists? So per field rights, not per entity rights.

<comment><USER89> or... GraphQL.

<comment><USER88> How does GraphQL fix the problem of showing different fields depending on rights?

</comment></comment></comment><comment><USER90> This is a long read, but trust me, _keep reading_ it's great.

</comment><comment><USER91> Reminds me of the time I learned Jim Morrison's social security number from a framed form hanging on the wall next to my table at a Hard Rock Café, written in ballpoint pen, "redacted" with a magic marker that did nothing, obviously, to obfuscate the impression made by the pen in the paper.

While I have no idea how the SSN of a long-dead rock star could ever be useful, I'm certain I still have a copy saved around here somewhere...

</comment><comment><USER92> For anyone who wants to do this easier... ZAP Proxy has a HUD display that will allow you to see the data flying on a page after you load it.

No need to do funky Inspect Element magic. Works wonders for reverse engineering how your fancy UI talks to the fancy API to do the fancy things.

If you can't figure out ZAP with HUD, you can alternatively use the Network tab on Chrome and switch to AJAX (if it's something that happens without the page loading)

<comment><USER93> > funky Inspect Element magic

Are you sure you're on the right website?

</comment></comment><comment><USER94> Is it just me, or did anyone else try to clean up their monitor from dust, realizing eventually the "dust" is the websites background image?

<comment><USER95> TFW your monitor is dirty enough for you to _not_ notice the dusty BG image.

<comment><USER96> Could be worse. I'm pretty sure some of the dirt on one of my monitors is actually dead pixels.

</comment></comment></comment><comment><USER97> This is easily top 1% of all writing on the internet

</comment><comment><USER98> This was a thoroughly entertaining read, thank you!

</comment><comment><USER99> Question: do you think you will be arrested for doing the same thing if it was in your country? (A from myself: yes absolutely)

</comment><comment><USER100> What a well written article. Really enjoyed that. If the hacking doesn't work out get a job writing about hacking...wait.

</comment><comment><USER101> Australian here, he's doing the best he can

</comment><comment><USER102> Did anyone notice the line, "Update: I have been arrested"? Chekhov's gun is just hanging there.

</comment><comment><USER103> This has to be the funniest and most gratifying thing I've ever read on Hacker News. Great job!

</comment><comment><USER104> That's a long read, has anyone got a blurb so I know what I'm getting myself into?

<comment><USER105> Search for "tl; dr". It's a section at the end of the page with the summary.

<comment><USER104> Thanks

</comment></comment></comment><comment><USER106> Are passport numbers secrets?

<comment><USER107> Yes. The bottom of the post covers some of the things you can do with the number.

<comment><USER108> Yet good luck traveling without actually surrendering them to all kinds of places you'd rather not. Like hotel clerks basically everywhere.

</comment></comment></comment><comment><USER109> Is the passport number supposed to be secret? You show them when you buy alcohol in some countries as well to the police if they ask for it - all of these people can copy the number if they so wish.

</comment><comment><USER110> Really enjoyed reading this. Thanks for redirecting my time brotheeeRRRR

</comment><comment> half-kh-hacker I love Alex's stuff.

</comment><comment><USER111> To be honest, I find it ridiculous (just like with social security numbers) how much you can apparently do just by virtue of knowing a passport number.

It shouldn't work like that.

</comment><comment><USER112> We are trying to fix this in the language ... It's just hard to convince people around that the change is worth it, I guess that I found the perfect use case.

</comment><comment><USER113> That is one of the best blog post I read for a long time.

</comment><comment><USER114> "Unblending the smoothie" is such a great line.

</comment><comment><USER115> Interestingly (and strangely) some frequent flyer _numbers_ are treated by Australian airlines as confidential information.

</comment><comment><USER116> Really entertaining read. I'm amazed how much information they were able to get from the airline website.

</comment><comment><USER117> What a fun article to read! Congratulations!

</comment><comment><USER118> This was a great read! Highly recommended.

</comment><comment><USER119> Clicking Inspect Element in this post results in some fun as well (NSA Tracking cookies). A true Droste effect.

</comment><comment><USER120> One of the better blog posts I've read

</comment><comment><USER121> > I've been practicing every morning at sunrise, but still can't scan barcodes > with my eyes.

rofl. Great writer.

</comment><comment> dis-sys What is the big deal of knowing Tony Abbott's diplomatic passport number?

</comment><comment><USER122> That was extremely entertaining and so much fun to read, thanks!

</comment><comment><USER123> is there a book about basics of IT?

[https://news.ycombinator.com/item?id=24492554](https://news.ycombinator.com/item?id=24492554)

</comment><comment><USER124> That's the best funny post about "CVE" I've ever read.

<comment><USER38> How about this one: [http://tom7.org/chess/cve.pdf](http://tom7.org/chess/cve.pdf)

Sarcastic PDFs never stop being amusing to me.

</comment></comment><comment><USER125> What a brilliant blog post. Thank you for posting it!

</comment><comment><USER126> I can't believe how funny this writer is

</comment><comment><USER127> It would've been faster and easier to report it to Instagram but this way it made a better story and educated the user better than instagram just removing the picture.

</comment><comment><USER128> Most hilarious techie post I've read ever

</comment><comment><USER129> When your simple blog page is crashing Spice and virt-viewer, there is a serious bloat problem. I can't even view this blog because it immediately crashes.

</comment><comment><USER121> TIL McAfee® Gamer Security is a thing...

</comment><comment><USER130> Bloody love the way this guy writes...

</comment><comment><USER131> Enjoyed the read very much, thanks.

</comment><comment><USER132> Looked interesting, but as an old fogey I just couldn't get past the "omg u guise yikes jklsflsfdjfds" style.

</comment><comment><USER133> Narrative is cute, but too much.

</comment><comment><USER134> This was a great read--thanks!

</comment><comment><USER135> Highly entertaining reading.

</comment><comment><USER136> This is certifiably grouse.

</comment><comment><USER137> This entertained me a lot.

</comment><comment><USER138> Alex, you are so funny!

</comment><comment><USER139> This is a great read!

</comment><comment><USER140> this is such a great story. Love the way he writes!

</comment><comment><USER141> it is easy to figure out passport number in a picture of ticket posted on Instagram

</comment><comment><USER142> A friendly advice to the author of this article. Even though I enjoyed reading the whole thing, if you are gonna have a tl;dr in your article; put it at the start, not at the end. Almost felt lika a mockery.

</comment><comment><USER143> This write up... irreverent and dumb. Did you study any Dave Barry? <3 I would love to buy a book. I mean probably not me, but if you need any moneys</comment>


Amputee Successfully Feels Prosthetic Grip Strength Via Arm Electrodes - <AUTHOR> http://spectrum.ieee.org/tech-talk/biomedical/bionics/sensitive-prosthetic-hand-gets-a-grip

<comment><USER2> I'm super curious to learn more about the software behind this. I think this is one area where open sourcing this kind of software could help to really improve it, and putting cynicism aside really improve the lives of others. If the os community built things like Linux I think we can do amazing things here. I for one would be very happy to participate in something like this and contribute if I can.</comment>


Why We Rank #1 for 'John Chow' and Why You Shouldn't Mess With Google - <AUTHOR> http://www.pronetadvertising.com/articles/why-we-rank-1-for-john-chow-and-why-you-shouldnt-mess-with-google.html If you came to this article looking for ways to "Make Money Online", you came to the right place. If you were searching for John Chow, and ended up here you must be wondering how we are the first result and if it makes sense.
<comment><USER2> If Google ranks anyone manually, it only proves that their algorithm is inadequate.</comment>


How well do cars do in crash tests they're not optimized for? - <AUTHOR> https://danluu.com/car-safety/ <comment><USER2> The article reminds me of a story from a friend that was an engineer at a major water heater company. Modern electric water heaters are already fairly efficient, but every model gets tested by the government to be given an efficiency rating.

The test consists of replacing the anode with a rod that has a series of temperature probes to measure the water at different levels in the water heater. Since water would form layers of different temperatures you needed measure at multiple locations to know the overall energy in the water. Then a series of water draws are performed with pauses between them and the total energy used is compared to the energy delivered.

Our engineer realized that if he could put the temperature layers at just the right locations then the calculations with the limited number of probes could be skewed. And this can be done by tweaking the height of the 2 heating elements. Just moving them a few inches.

The first time he tried this, an internal test came back at 101% efficiency. At little more tweaking and the test returns a consistent 99.x% that was respectable.

<comment><USER3> Serious question, how is this different from what VW did? There was a lot of talk about complicit engineers vs. shady management in that discussion. Did this ever make it to production?

<comment><USER4> VW actively detected if the car was on a treadmill testing setup and electronically changed the engine parameters to make it run cleaner.

The water heater was designed with the test in mind but functions the same regardless.

VW was clearly cheating whereas the water heater is taking advantage of known deficiencies in the test (is that cheating?).

<comment><USER5> I'm not sure that's an accurate description of VW's cheat.

VW knew the parameters of the test (stationary car, no steering input, prescribed throttle inputs, etc). And they configured the car to pass the test.

Water-heater engineer knew the parameters of the test (number and location of probes). And he configure the water-heater to pass the test.

Same-same. In both cases, an engineering team willfully committed fraud to improve their sales figures.

The only differences are a bit pedantic. VW's "configuration" was more elaborate. But, both groups gamed the test.

<comment><USER6> The differences are not pedantic at all. The differences are _extremely_ significant.

The VW engineers designed the car to do different thing while being tested vs used by consumers. While being tested, the emissions system was on. While being used by consumers, the emission system was _entirely disabled_.

The water heater engineers designed the water heater to do the same thing while being tested vs used by consumers.

If the water heater engineers designed the water heater to _never turn on_ and keep the water at room temperature while being tested, ("works good boss, water heater efficiency is infinity percent") then yes, it would be reasonable to claim they did essentially the same thing.

<comment><USER7> > If the water heater engineers designed the water heater to never turn on and > keep the water at room temperature while being tested

I think the difference between what they did and this is only a difference in degree and not kind though, right?

<comment><USER8> It _is_ a difference in kind: VW dynamically detected and _adapted behavior_ to the test. It would never operate in that way under normal conditions. The water heater example was completely static: it always behaved the same way, under test or not.

<comment><USER7> People obviously disagree since I was downvoted but I don't really see the black-and-white difference between the two.

In both cases there was an intentional design change to deliberately changed mislead a measurement, and the final product does not match the intended thing. Both adversarially directly cause the consumer's purchase to not be the intended item; no one gets a car that has emissions measured and no one gets a heater that has the efficiency measured.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The whole car safety topic is very confusing. Car accidents is top1-top2 death reason in US for people in 20-40 age group [1]. Probably less in Europe but still one of the leading ones. I was thinking about how I can make myself safer.

Which car brand/model is better? Which seat is better for passenger? How much riskier it is to drive during the night? In the rain? How dangerous is it to overtake on road with 1 lane in each direction? What is most dangerous: crossroad with no traffic lights? Turns? City? Highways or smaller roads?

I was not able to find any meaningful research. There are ratings by different government agencies (US, UK, Australia etc), but basically all cars have highest rating which I find hard to believe.

<comment><USER10> Drive the largest vehicle you can. When in a collision the momentum is converted to crushing force, you want to be in the less-crushable vehicle.

Hey this may be an unpopular choice, but it is the one with the biggest safety impact! And that was the question.

<comment><USER11> Rather immoral. Not just offloading, but also exacerbating the burden onto others.

Vehicles and Crashes: Why is this Moral Issue Overlooked? by Douglas Husak

[https://www.jstor.org/stable/23562447?seq=1](https://www.jstor.org/stable/23562447?seq=1)

<comment><USER12> It's the arms race itself (and the fact that we allow it to continue) that's immoral. Acting rationally within the arms race is not immoral. Our laws should address the core causes of this arms race.

People are starting to wake up to the notion of "systemic issues," but still too slow to apply what they've learned about that topic to other matters. It's a mistake to focus on the behavior of individuals in a system that's sanctioning and encouraging bad behavior.

</comment></comment></comment></comment><comment><USER13> One of the more morbid yet profound aphorisms that I know is:

Safety regulations are written in blood.

FAA regulations are often based on finding a new way to break an airplane that they hadn't diagnosed before. Safety ratchets up as new failure modes are discovered. If cars keep showing up pancaked it a particular way, then guidelines change.

Until those failure modes are regulatory capture, at least.

In the 90's the collective wisdom said you could shock people into doing the right thing, and on several occasions they preserved a badly t-boned vehicle to illustrate why drunk driving was such a bad thing.

These days the pillars are huge and well-connected. I'm not sure you can crush a car that badly without a commercial vehicle. They test for that stuff.

<comment> w-ll The "pancaking" is designed, modern cars are made to "crush" and absorb the energy of an impact.

<comment><USER13> You might want to talk to someone about your pancake making skills.

A pancake is flat. There is no room in a pancake for a viable human. The car is all but obliterated.

<comment><USER14> The front pancakes. The cabin does not.

<comment><USER13> If I were talking about crumple zones I would have said crumple zones. I'm talking about the car as a unit. Is-a, not has-a.

</comment></comment></comment></comment></comment><comment><USER15> Does anyone know of a way to objectively compare safety ratings between different eras of cars?

The standards for safety ratings change periodically, and great strides have been made in safety. I'm curious how much risk I'd remove by upgrading from a 2010 to a 2015 or 2018.

Driver death data [1] mentioned below may be the best source, just curious if there are any others.

Also, [2] is a really interesting crash test between a 1998 Corolla and a 2015 Auris (rebranded Corolla).

[1] [https://www.iihs.org/ratings/driver-death-rates-by-make- and-...](https://www.iihs.org/ratings/driver-death-rates-by-make-and-model)

[2] [https://youtu.be/IVEjsvip8kc](https://youtu.be/IVEjsvip8kc)

<comment><USER16> Also worth considering is that anything after 2018 likely has intelligent crash prevention features. In addition to modern cars being much safer in a crash, the benefits of avoiding collisions altogether have to be worth it.

I've been driving a car with the pre collision warnings, lane departure warnings, etc since 2017 and it has saved me at least once.

There's a concern about moral hazard with the new technologies, but my rule is to drive as if the car has no safety features, and if they activate, then that is a bonus.

It's hard to compare the collision prevention systems over time since they're so new, but just going off the narrative reporting from IIHS, and comparing the test standard in 2017 vs 2020, leads me to believe they've made great strides in the last few years.

<comment><USER17> > Also worth considering is that anything after 2018 likely has intelligent > crash prevention features. In addition to modern cars being much safer in a > crash, the benefits of avoiding collisions altogether have to be worth it.

I expect they're a net gain for the public, but that for an individual who's conscientious and never drives under the influence, tired, or distracted, that they're only marginally useful at best.

<comment><USER18> >I expect they're a net gain for the public, but that for an individual who's conscientious and never drives under the influence, tired, or distracted, that they're only marginally useful at best.

Possibly even negatively useful if you consider that the car they come in has significantly reduced visibility compared to it's '00s counterpart.

</comment></comment></comment></comment><comment><USER19> In my university physics course, we did a project where we made our own physics models of car crashes and compared with crash tests and statistical data about real-life crashes. Our conclusion at the time was that crash test results matched our models of collisions with identical vehicles of opposite velocity (i.e. a head-on collision - the most complex case we could solve analytically), which, if you work it out, should come out the same as the normal force when hitting something stationary like a concrete pillar. In this case crumple zones are the most important factor, as they allow you to decelerate over a longer distance. The real life data crash reports though matched the result we got from simulations (which is what we resorted to when the models got to complex to solve analytically), in which case by far the most important factor was the weight of the cars involved in a given crash. Whoever is in the heaviest car will tend to win the game of conservation of momentum. Kind of a sobering conclusion tbh.

</comment><comment><USER20> This is the most confusing article I've seen from danluu. What data was used?

The glaring incongruity for me arose from the details on Tesla.

"For example, on the driver-side small overlap test, Tesla had one model with a relevant score and it scored Acceptable (below Good, but above Poor and Marginal) "

Note the words "above poor." But in the bullet points danluu uses a different scale that doesn't match this prose, and slots Tesla into "poor."

I'm sensing an agenda. But I'd rather keep an open mind, and look at the raw data myself.

The other odd thing is that the article mentions both 2012 and 2018 data, but doesn't provide a specific link to the data that was used. What raw data was used?

A clue lies in the other prose about Tesla in the article, which refers to a 2017 article about Tesla's pushing back. (The points about this being predictable as a PR move seem valid. However what's more interesting is the timeline.) 2017 is prior to 2018. Which points to the data being relied on here being the 2012 data, not the 2018 data.

The problem with using very old data is that the cars have evolved significantly since 2012. I mean, 2012 was the very first production year for Model 2. We're talking almost a hand crafted (though semi robotic) assembly line back at that point. And yet the article talks about this as though the data represents Tesla in general. We are eight years along into the future now — almost a decade — with that many years of improvements and two (correction, _three_ ) new models, if you don't even count the vast updates to the Model S. This should be disclosed in a way that is glaringly clear, not glossed over or minimized.

In short, I would take everything here with a grain of salt. The research question, though, seems like a very good one. I would look forward to hearing an update where the data is provided, the sources are examined, the funding for the lab tests is disclosed, and current car models are covered.

<comment><USER21> Most of this is based on the IIHS data; 2012 is the last time a new type of test was added (small overlap), so it's what's being used to make this comparison.

Almost all the cars mentioned in the article have likely improved since then, but the issue isn't so much how safe specific models are, but rather what approaches the manufacturers are using to improve safety. What the test results indicate is that rather than actually designing for safety, manufacturers are designing to meet a very specific set of benchmarks; there isn't much reason to believe that has changed since then.

The most obvious example of this (which the article briefly mentions) is the difference between driver-side and passenger-side performance: [https://www.iihs.org/news/detail/small-overlap-gap- vehicles-...](https://www.iihs.org/news/detail/small-overlap-gap-vehicles- with-good-driver-protection-may-leave-passengers-at-risk)

<comment><USER20> >the issue isn't so much how safe specific models are, but rather what approaches the manufacturers are using to improve safety.

How would anybody possibly be able to characterize Tesla's approach to improve safety today based on looking only at a test of one car eight years ago? You said it yourself: "improve" — the word implies a measurable delta in the data. But if the data is a static single value, there is no delta to work with.

And there's no rule stating that this is the issue that a blog post must cover.

It's a blog. The author is free to choose and cover any issue they please.

It's just not a worthy issue to make claims about, if your data is so limited that you are (he is) trying to derive manufacturer behavior by looking only at a single car model year as a snapshot in time. It's simply ridiculous to try to conclude anything from such data. And then to cover that up by presenting the results on twitter as a table that highlights the false conclusion... just dishonest imho.

<comment><USER22> Selective reading?

He acknowledges Tesla to be difficult to fit, right under the "Tier Table": "[...] Tesla not really properly fitting into any category (with their category being the closest fit)".

And in the "Bonus: Reputation" section, he supplies an argument/reasoning what he doesn't like about Tesla:

[...]I find the Tesla thing interesting since their responses are basically the opposite of what you'd expect from a company that was serious about safety. [...], they often have a very quick response that's basically "everything is fine". I would expect an organization that's serious about safety or improvement to respond with "we're investigating", [...]

For example, on the driver-side small overlap test, Tesla had one model with a relevant score and it scored Acceptable (below Good, but above Poor and Marginal) even after modifications were made to improve the score. Tesla disputed the results, saying they make "the safest cars in history" and implying that IIHS should be ignored in favor of NHSTA test scores[...]

(end quote).

In that context I think it's important not to skip on Tesla and mention the above. And by giving his thoughts this allows readers to make up their own opinion (and you're free to come to your own conclusion).

Full disclosure: Safety was one of the main reasons to get a Volvo. However, I am not someone to hate on Tesla.

</comment></comment></comment></comment><comment><USER23> Volvo was always marketed as a safety product years ago. Seatbelts, seatbelt warning lights, airbags, and daytime lights — a requirement in Sweden — all spring to mind.

I had assumed that Volvo lost that edge this century so it's good to see them at the top of the list.

<comment><USER24> I just took a quick look at Consumer Reports for Vovlo's reliability and they're not great. A couple were even bad. If my memory is right, this has been the case for a while. It looks like maybe Volvos are safe, but not super reliable I guess?

<comment><USER25> On the other hand, all car makes have become much more reliable than they were in the past.

Mostly, what you're looking out for is cost of parts and difficulty of labor. For example, a lot of Audi/Volkswagen products suffer from simple repairs being made more complicated by the need to pull things apart for the mechanic to reach them.

<comment> frosted-flakes In some cases, absolutely. Having to completely disassemble the door to repair a failing lock module is seriously annoying, as is making it impossible to remove the engine mount while the engine is in the car (seriously complicates timing belt changes on VW mk4 cars, because the belt loops around the engine mount).

But on the GTI (2009 in my case), they did something rather ingenious: instead of welding the outer door skin on, they bolted it on with about 25 short bolts. Taking those off takes about one minute with an impact driver, and you have full access to the door lock module and window regulator, as well as making rust or dent repairs almost trivial. Why can't everything be like that?

<comment><USER26> Speaking of timing.. .you got that Timing chain Tensioner replaced right? Mine blew on my 2009 Eos and lunched the motor.

<comment> frosted-flakes Five years ago! The GTI was my late brother's (now my parents'), and he was on top of that kind of stuff. Of course, we got a recall notice last year for it, way too late. And since we did it ourselves, I don't see that VW would reimburse us for the work.

</comment></comment></comment></comment></comment></comment><comment><USER27> When I designed car seats we optimized them for the federal tests. The biggest load on a seat back was represented by a large 95% man leaning back to get at his wallet. We were ready for production when the car had it's first sled test. Basically mimic what happens to the occupants when hitting a solid barrier at 30 MPH. The front seat occupants flew forward, bounced back, and completely broke the seat backs, crushing the legs of the rear occupants.

<comment><USER28> What's a 95% man?

<comment> kube-system 95th percentile in size

<comment><USER29> And more importantly: mass.

</comment></comment></comment></comment><comment><USER30> >For a long time, adult NHSTA and IIHS tests used a 1970s 50%-ile male dummy, which is 5'9" and 171lbs. ... >For reference, in 2019, the average weight of a U.S. adult male was 198 lbs and the average weight of a U.S. adult female was 171 lbs.

So the average mass of the American male has increased 15% in 50 years! No data on whether he is taller, but I'd bet the BMI has gone up.

<comment><USER31> Referencing the same line, I remember seeing another article on HN somewhat recently about the downside to taking averages of a human to fit specs since the "average"(mathematical mean of measurements) human never existed in reality. Something about fitting pilots to a cockpit?

<comment><USER32> These "average" cars have pretty terrible seat backs if you happen to be taller than the average. Outright destructive to the spine.

</comment></comment></comment><comment><USER33> This was an excellent article, car safety is something I think most people don't take very seriously when buying a new car.

However, the author mentions the 1959 Bel-Air vs 2009 Chevy Malibu crash test as a dramatic example of the progress of car safety. It is indeed a spectacular video, but there's a good case to be made that the 1959 Bel-Air was likely specifically chosen to exaggerate the progression of car safety, as it had a _particularly_ terrible X-frame design that crumples like tissue paper in a crash. Other, more traditionally designed cars from that era would almost certainly fair significantly better in that test.

Take note of the comment below a Jalopnik article on this crash test:

>"Fast_Nel in the last story about this crash-off posted a video showing the deficiency of the X-Frame design of this car and it was an excellent video. If the IIHS would have chosen a car with a ladder frame, like say a 65 Impala or another car of the same year with a standard ladder frame, the results would probably been much better for the older car. I am sure IIHS purposefully used this particular style vehicle with the knowledge that it would fail spectacularly in order to toot its own horn. So yes there was something seriously wrong with the video.

One might ask, "Why GM would use a frame like this?" My guess is that GM attempted to be innovative with the X-Frame concept and they failed, because all the ramifications had not been considered."

Source: [https://jalopnik.com/yes-the-iihs-crashed-59-chevy-had-an- en...](https://jalopnik.com/yes-the-iihs-crashed-59-chevy-had-an- engine-5364071)

That's not to say that newer cars aren't safer in general, they very likely are. But that test in particular is not a good example.

</comment><comment><USER34> Is passenger side small overlap really a common form of collision? I would imagine since everyone drives on the right side of the road, most higher speed small overlap collisions would be on the driver side. Perhaps car manufacturers were right not to optimize for passenger side small overlap collisions?

Frankly though, this is an area where I don't think it is all that harmful for the metric to become the target, since the metric itself can be modified to reflect common crash conditions, and signal to car manufacturers what kinds of collisions should be optimized for to improve real world safety.

One big feature missing from the current suite of crash testing though is small vehicles colliding with larger vehicles. Walls only simulate colliding with the same vehicle, but small vehicles are especially vulnerable in collisions with larger vehicles.

<comment><USER13> Passenger side small overlap seems like something that would happen when someone tries to pull into your lane. As you say, the average delta-V for that collision is going to be much lower than the driver's side collisions (passing on the right, or crossing the center line)

<comment><USER18> overlap crashes tend to happen when the driver attempts to avoid an obstacle but there is not sufficient space to fully do so.

</comment></comment></comment><comment><USER35> One thing I appreciate in supervised machine learning is that it's widely acknowledged that one should not test on training/tuning data. For both computer benchmarks and car crash tests, this is not the case. Both fields routinely work to optimize for a test, which leads to dramatic overfitting. This would be like passing out a standardized test years before students take it.

This seems solvable. For benchmarks, there should be held out tests that don't get distributed to (say) compiler authors until after the results are published. For crash tests, parameters like overlap and speed should be randomized each year so that manufacturers are forced to optimize for a range of possible crash scenarios.

<comment><USER36> >For benchmarks, there should be held out tests that don't get distributed to (say) compiler authors until after the results are published.

The way you really "solve" the problem is to have a third-party test organization run the benchmark and only provide the final result--and you only get one shot for a given generation of hardware/software. (This is sort of how standardized tests work.)

The problem is that you're now benchmarking with a totally opaque test that you have to trust is reasonably representative of the type of workload it claims to represent as well as trust that the benchmark isn't favoring specific vendors or design decisions that are irrelevant to real world workloads.

I assume there have been benchmarks at various times that were similar to this. Certainly, I'm pretty sure source code for benchmark suites hasn't always been available.

</comment></comment><comment><USER37> Somewhat related anecdote, related to me by an acquaintance who works at a major US crash testing facility:

I don't know about now, but, once upon a time, not too long ago, US safety standards included crash tests where the dummies were not wearing seat belts. This naturally leads to cars sold in the US having air bags that are tuned slightly differently, so that they are less likely to cause injuries to people not wearing seat belts. Unfortunately, doing this _decreases_ their ability to protect the vast majority (nowadays) of people who do use their seat belts.

<comment><USER38> As far as I know, this is still the case. A significant minority of people in the US do not wear seat belts; thus the timing on airbags has to accommodate this, or the airbags themselves would cause injury.

<comment><USER39> I feel naked without my seat belt.

Occasionally, I'll get into my wife's car to simply move it into the street so I have room in my driveway to wash mine, and even though I'm driving less than 50 feet, I still feel awkward not putting on the seat belt.

</comment></comment></comment><comment><USER40> The "Using real life crash data" section is just wrong. The IIHS confidence interval describes an empirical death rate, not an "expected fatality rate." Therefore, an interval including 0 deaths per million registered vehicle years arises due to very few deaths over a very large dataset, not from some "informative prior" bounding the interval at 0. As an empirical description, the IIHS figures should have high statistical power, after adjusting for confounding variables. Time and location could be interesting factors to consider.

For Dan's suggestions, the IIHS already breaks down death rates per 10 billion miles by vehicle class and individual vehicles, and the latter supports the original ordering by registered vehicle years. Also, incorporating data from models under the same make doesn't make sense. Since the IIHS already accounts for different vehicle platforms, any believed correlation in death rates between a manufacturer's models must derive from the original dataset, creating a meaningless statistic.

Updated IIHS doc here: [https://www.iihs.org/api/datastoredocument/status- report/pdf...](https://www.iihs.org/api/datastoredocument/status- report/pdf/55/2)

</comment><comment><USER41> On page 3 of [1] from the article which shows most number of deaths, it seems like there's almost a perfect correlation between 'size' and 'deaths'.

I remember thinking about getting a mini Cooper, literally while driving in my family's quite large SUV, and my father indicating how they are unsafe due to size. I couldn't help thinking of the odd kind of 'race to size-safety' factor severely limiting people's ability to drive smaller, more efficient cars.

I want to drive a small car for a variety of reasons. But the moment I have children ... 'safety' might be my #1 concern (along with the convenience of a large utility vehicle). It could very well be that this 'safety arms race' is harmful.

[1] [https://www.iihs.org/api/datastoredocument/status- report/pdf...](https://www.iihs.org/api/datastoredocument/status- report/pdf/52/3)

</comment><comment><USER42> "I think it would be surprising if other car makers had a large suite of crash tests they ran that aren't being run by testing agencies, but it's theoretically possible that they do and just didn't include a passenger side small overlap test)."

The fact that Mercedes and BMW are in the category "poor without modifications; good with modifications" (i.e. with some modifications, the cars get from "bad" to "good") rather shows to me that these two car manufacturers _do_ have such test facilities where they do such tests to be prepared for the situation when such test become included.

</comment><comment><USER43> Reminds me of the modern web that is more optimized for SEO than for the users.

</comment><comment><USER44> Whenever metrics are instrumented that measure productivity, safety, quality, or efficiency, the metrics and metrics alone are what matter, not the over arching goal.

Whether it's car crashes, fuel efficiency, lines of code, completed tickets, OKRs, or anything else, players in the system adjust to optimize output for the evaluated metric.

A tale as old as time.

<comment><USER45> Unfortunately, there isn't really a solution to this problem. Metrics are the only way to measure some things reliably and consistently across users, testers and subjects.

The goal is to have performance on the metric be as close as possible to the desired characteristic. This isn't always possible (and gets really hard when people are involved), but there isn't really any other solution.

<comment><USER32> Hidden metrics help, but it is pretty frustrating as an individual to be evaluated based on hidden criteria.

<comment><USER45> Yea, and no metric stays hidden forever if there is enough money in it getting unhidden.

Statistical metrics have some of the benefits of hidden metrics while staying "hidden" forever, but they also can be much more time consuming to do right and are even more frustrating to be evaluated by.

</comment></comment></comment></comment><comment><USER46> For those who find this website's edge to edge text maddening to read on large displays, I highly recommend Sakura ([https://github.com/oxalorg/sakura](https://github.com/oxalorg/sakura)) for a one-click fix for badly formatted websites.

<comment><USER47> Reader mode is another option on most browsers.

However, it can also be said that a full-screen browser on a landscape widescreen monitor is "doing it wrong."

</comment></comment><comment><USER48> This was a very interesting article. I'm curious if auto makers knew about the new tests being added, and if so, how far in advance? It certainly seems that if they did know about the new tests, it was far too long into the vehicle development to make changes.

</comment><comment><USER49> "When a measure becomes a target, it ceases to be a good measure."

</comment><comment><USER50> Also, don't forget. Crash tests (in the US atleast) don't measure safety for non-occupants, ie pedestrians, other car users.

</comment><comment><USER51> There must be stats for injuries or deaths by car. Is it public?

<comment> kube-system [https://www.iihs.org/ratings/driver-death-rates-by-make- and-...](https://www.iihs.org/ratings/driver-death-rates-by-make-and-model)

<comment><USER50> Those are just driver deaths.

<comment> kube-system The request was vague, but insurance industry figures are going to be the best breakdown by vehicle you can get in the US. NHTSA stats are usually broken down by category of vehicle.

</comment></comment></comment></comment><comment><USER52> How about F1 cars?

<comment><USER53> Has there ever been a full or partial head-on collision with an f1 car?

<comment><USER54> Yes, in Abu Dhabi in 2010, Michael Schumacher spun 180 and Vitantonio Liuzzi then hit him head on.

It was at relatively low speed (for F1) but Schumacher's head was very nearly hit as the other car rode over his.

</comment></comment></comment><comment><USER55> Optimizing for a test is an issue if the test is not well correlated with the desired outcome. By and large that doesn't seem to be a big issue for crash tests.

<comment><USER56> In this case, it's an argument that crash testing should be more expansive and thorough.

For example, if engineers are going to position the driver and passenger airbags for optimal crash test performance, we probably shouldn't just be testing with a male dummy in the driver's seat and a female dummy in the passenger's seat, as in the modern age women often drive.

If engineers are strictly designing to the test, there should be a suite of repeats, putting dummies that are male, female, fat, thin, tall and short in every seat.</comment></comment>


"To start using Twitter, go get the app" - Twitter disables signups from website - <AUTHOR> https://twitter.com/signup

<comment><USER2> Works normal here, I guess this is a case of a/b testing (gone wrong, lol)

<comment><AUTHOR> Also from a desktop computer?

It only works from mobile browsers here.

<comment><USER2> Yup, Google Chrome on Windows here. Might be geo-restricted though, I'm from Europe.</comment></comment></comment>


What usage restrictions can we place in a free software license? - <AUTHOR> https://mjg59.dreamwidth.org/54709.html <comment><USER2> I keep reading these types of discussions in part because I'm hoping $smart_people are going to solve this for me. There are restrictions I'd probably like to see, but I just can't see how they could work.

 _All_ I want is the magic unicorn solution, preferably built in a manner I can put in front of my employer's lawyers ;)

</comment><comment><USER3> For me the only acceptable (and even desirable) restriction is to protect against privatisation/closing up free software. So basically what GPL already does or any strong copyleft license. This way free software is even more strongly free as in freedom, other wise with other restrictions it actually weakens the freedom part.

<comment><USER4> How does making private closed-source derivatives of software close up the original software?</comment></comment>


How the Internet works: Submarine fibre, brains in jars, and coaxial cables - <AUTHOR> http://arstechnica.com/information-technology/2016/05/how-the-internet-works-submarine-cables-data-centres-last-mile/ <comment><USER2> Did somebody else notice those absurd CRT monitors?

</comment><comment><USER3> "Sub-marine", surely?</comment>


Swift Server Work Group Annual Update - <AUTHOR> https://swift.org/blog/sswg-update/ <comment><USER2> Swift isn't comfortable to use on non-Mac platforms. Because of this I can't see it taking over from Go or Rust in the server space. (I mention Rust because the language type system feels similar to Swift's and Rust is gunning for the same server space.)

If the Swift folks want adoption, they're going to have to think about the broader developer ecosystem. There's also an inherent mistrust in Apple that I think a lot of engineers have. It feels a lot like Google Dart in this respect.

<comment><USER3> I'm not sure why the discussion is always framed as Swift vs. Rust vs. Go. It's not like any of them are the dominant backend languages.

Swift can be a great choice for backends for lots of reasons (shared code between client and server, client devs become full-stack devs, etc.), and it has its drawbacks as well.

This idea that for Swift to thrive as a server language it has to win some contest against Go and Rust makes absolutely no sense to me.

<comment><USER4> If anything, the comparison I'd make is javascript. Just like Node, it's a nice notion that you can take your client language and use it on a server. Aside from that, does anyone think that javascript is a _good_ language choice for backend development?

Swift has a lot more redeeming aspects than javascript does, but like this post acknowledges, they don't have its package ecosystem.

<comment><USER5> > they don't have its package ecosystem.

I think in some ways this is a chicken-and-egg problem. If people start working with Swift in the server space, that ecosystem will quickly evolve.

Also, Swift has great interop with the C FFI, so you have access to every C library, and every Rust library with a C API to boot.

edit:

> Aside from that, does anyone think that javascript is a good language choice > for backend development?

I write a lot of swift code for personal projects, largely because it's so nice to program in, and I actually think it could be a great choice for back- end development.

I think Swift offers many of the same advantages of Rust in terms of a robust, powerful type system, and the feeling that if your code compiles, you're probably not going to have too many runtime errors (as long as you followed the rules).

Swift makes tradeoffs in favor of developer ergonomics where Rust chooses in favor of performance. In the vast majority back-end cases, Swift's performance will be good enough, and it's ease of use lets you have many of the advantages of a language like Rust but with the improved productivity of working with a higher level language.

<comment><USER6> >Also, Swift has great interop with the C FFI, so you have access to every C library, and every Rust library with a C API to boot. I can think of maybe 3 Rust libraries that I'd want to interface with through their C api.

</comment></comment></comment></comment></comment><comment><USER7> I love Swift and I think it could be one of the best languages on the server. However here are a few things that I think would make it better:

\- Async/Await

\- Swift and Swift package manager support on Windows

\- Swift Package Manager resources and run scripts

\- Backtraces

\- Faster/incremental builds

<comment><USER8> > Async/Await

There's some long-term plans for concurrency: [https://gist.github.com/lattner/31ed37682ef1576b16bca1432ea9...](https://gist.github.com/lattner/31ed37682ef1576b16bca1432ea9f782)

IIRC the compiler already has internal support for coroutines. Unfortunately, I think it will probably a long time before we get user-facing features like async/await.

> Swift and Swift package manager support on Windows

Swift works on Windows with all tests passing, though I imagine it's still a lot of work to compile and run (but I haven't checked).

> Swift Package Manager resources and run scripts

I agree this would be nice. Swift PM doesn't really give you much flexibility right now.

> Backtraces

Discussed in the article (section Swift Backtrace):

> This package provides support for automatically printing crash backtraces of > Swift programs on Linux. Backtraces are generated by a builtin C library > libbacktrace and demangled using a private Swift runtime call. We hope to > improve the implementation by adopting SE-0262 when it is approved. We are > also working with the Swift core team to discuss the benefits of merging > this functionality into the Swift standard library.

> Faster/incremental builds

Swift has pretty good incremental builds, especially compared to the early versions. Compile times are _way_ better than they used to be and are continuing to improve.

</comment></comment><comment><USER9> I work for a startup that uses swift as a server language. The original idea was that both ios and the server would use the same object model which made life easier. Sadly that didn't scale as they started the android app.

We're migrating away from it slowly as we make more microservices but it's been an interesting experience.

It was my first time using swift as I am a server engineer and not an ios engineer.

Its definitely lacking in tooling and libs but it's a really nice language with a good type system (it's not great though but it's easy). It definitely has potential to be a really good server language. I'd be more comfortable using go or python but it's more fun using swift

<comment><USER10> IDLs and schema/contract definitions in common places should help with this. Stuff like protobufs are good at generating code to use/translate to object models as well.

The primary motivation for choosing the language should not be sharing object models, atleast IMO.

</comment></comment><comment><USER11> I am writing this from the Server Side swift conference. Despite what is said in the comments, I do not see a community waiting for Apple to push the server-side ecosystem further. What I see is a group of passionate people building plans to move the ecosystem forward. Yes, it is still easier to develop on MacOS than on Linux (but it is doable). Yes, having the async/await feature in the language sooner than later would help. However, the community seems healthy and the projects are interesting and well designed.

<comment><USER12> I'm using vapor on a production app and really enjoying the experience. I do see there is a lot of work to do in the community though. Where would one start out to help with the efforts?

<comment><USER11> I would start by both getting involved in the server part of the Swift forum ([https://forums.swift.org/c/server](https://forums.swift.org/c/server)), and by checking simple tickets you could help with on those projects Github.

</comment></comment></comment><comment><USER13> Hey Tanner - there's a typo right away:

We believe that a healthy open source ecosystem relies heavily on the quality its packages -> We believe that a healthy open source ecosystem relies heavily on the quality _of_ its packages

</comment><comment><USER14> No thanks.

</comment><comment><USER15> Still no plans for concurrency? Such a waste.

</comment><comment><USER16> Not gonna lie, this logging api is a howler.

"""

Good:

logger.info("hello world")

Bad:

let message = "hello world"

logger.info(message)

If you have a String that you received from elsewhere, please use

logger.info("\\(stringIAlreadyHave)")

"""

Ugh.

And the payload field (think extra= in python logging) is pretty gross, you can't even pass a [String: String] dict. Got help you if you want to dump your structured logging/data into splunk.</comment>


Ask HN: How can one take advantage of the rumored transition of Macs to ARM? - <AUTHOR> I have never developed software for Mac or any Apple product. However, I feel that if the rumors about Apple moving from Intel to ARM are true then there will be a huge opportunity for software developers to make new stuff and in turn make money.<p>Does the community think the same? How can a software developer take advantage of such a huge transition? <comment><USER2> We can get ideas from past transitions.

When the iPhone came out with "Web apps only" many OS X developers got into jailbreaking because iOS was based on OS X and they could use their existing knowledge. A little later when the official iPhone SDK came out, those developers were the hottest in the world and got paid huge amounts to develop simple apps.

When Quark XPress decided not to support OS X back around 2001, Adobe InDesign took many of their customers. There are Mac apps that will never be updated (or will take five years like Adobe) for 64-bit or ARM and people will be looking for replacements.

</comment><comment><USER3> I'm not sure it'll have a big effect on software. The vast majority of application software will work the same, only with fat binaries containing both x86 and ARM code. The few bits that are optimized for particular CPUs, like video codecs, already exist for both CPUs.

The most likely opportunity is applications that are currently too sluggish except on big Mac Pros, but would be more popular if people could run them on cheap ARM macs. One might be real time video manipulation for live video conferencing.

You can get your feet wet by developing for iPad, or ARM Linux.

</comment><comment><USER4> There's going to be a gap made by people who don't port over their software, certainly worth looking at that gap and see if there's something you can provide.

Most software should be just a recompile if it's well packaged. Of course that's a huge if and not everybody wants to support Mac anyway, and I lost a ton of my steam library (not that anybody really plays games on Mac anyway) in just the 32-64 bit transition recently. I also lost textwrangler, which was the greatest Mac text editor ever created and I refuse to pay a subscription for its 64 bit successor.

<comment><USER5> Not sure why you were downvoted, this is a great point.

</comment></comment><comment><USER6> Get good at ARM.

It isn't just Apple that will be selling ARM computers. Soon we will see good workstations based on server-type ARM chips that will support absolutely insane bandwidth and number of threads. For now we have

[https://www.nvidia.com/en-us/autonomous-machines/embedded- sy...](https://www.nvidia.com/en-us/autonomous-machines/embedded- systems/jetson-agx-xavier/)

The software ecosystem is ragged so there is work to be done. ARM has a bright future whether or not Apple switches macs over.

<comment><USER2> What's there to get good at? C is C, Swift is Swift, and CUDA is CUDA. There's little asm out there and it has already been ported to ARM because of phones.

<comment><USER6> ARM is much less developed than x86 from the viewpoint of a Linux developer. In the case of x86, for instance, you can usually download Python wheels that are already built, you can find wheels that are built for various SIMD levels, with highly optimized numerics, etc. Building software on ARM that isn't phonish is more of an adventure.

If your goal is "personal workstation that smokes current workstations" based on an ARM processor with a monstrous core count and memory bandwidth you are going to have to confront the problem of making a 64-core machine feel snappy, which means you need to take advantage of parallelism to a high extend, understand the very different memory consistency model, etc.</comment></comment></comment>


storage for user-generated media? - <AUTHOR>

I'm curious: How are startups here managing their storage needs, especially when it comes to storing multiple MG and even GB of photos, videos, and other media per user?
Amazon S3 seems to be the "in" solution right now, but when you do the math, it gets pretty expensive as you start nearing multiple TB of storage.  Managing your own NAS at a colocated facility seems like it would be cheaper, but then you have all the additional admin overhead of colocating.
Has anyone found a good VPS or dedicated server provider that offers lots of storage and bandwidth at reasonable rates?  Or is colocation pretty much the way to go?  Other options? <comment><USER2> _Amazon S3 seems to be the "in" solution right now, but when you do the math, it gets pretty expensive as you start nearing multiple TB of storage._

I've done the math, and (at least compared to renting dedicated servers) Amazon S3 is reasonably priced well into the TB range. The cheapest prices I've seen advertised for bulk storage servers online are at softlayer, where it's possible to get down to about $80/TB-month (they have TB drives for $50/month, but you need a server to contain them) compared to S3's $140/TB- month ($0.15 / 2^30 bit-months); but that's for unreplicated storage, and you'll find it very hard to get good performance and reliability (considering that drives will inevitably fail) for less than a 2x increase in price.

I haven't done the math on colocation (and that involves more of a judgement call, valuing capital costs vs. monthly expenses) but I suspect that any system you can design which is anywhere near as reliable as S3 will end up being fairly close to it in price.

</comment><comment><USER3> S3 is ~$150/TB for scalable, high-availability, low-latency, redundant storage, with on-demand pricing -- no power costs, or overhead admin. Your post makes it sound like S3 is the latest fashion, but my reasons (and others) are why it's gaining popularity, especially around the startup scene.

<comment><AUTHOR> Good points. I probably should have worded my original post differently so as not to imply that S3 was simply being used because of its popularity. It's clear that its popularity comes in large part to its utility.

Still, I'm curious what other solutions are being used out there. (For instance, with 1 TB hard drives {at 7200 rpm} retailing for $200-$300 these days, perhaps someone has come up with a storage method that's an even better deal than S3?)

</comment></comment><comment><AUTHOR> er, "multiple MG" = "multiple MB"</comment>


Tell HN: My local startup hub just launched an online magazine - <AUTHOR>

I'm part of a local startup hub based in Iceland. We just released an online magazine titled "Nordic Innovation". It's focused on startups, innovation and design in the Nordic countries.
Our plan for the future is to release it using treesaver.js, but this version is a simple PDF based version.
We would love some feedback on the magazine, it's contents, implementation or the website itself.
- http://www.nordicinnovation.is/
Direct links to the first issue:
- pdf: http://www.nordicinnovation.is/issues/pdf/nordic-innovation_2011-02.pdf
- web/image based: http://www.nordicinnovation.is/issues/web/1 <comment><USER2> Really love the content, some fantastic and well-written articles in there. It looks great but yes Treesaver would be a bit easier/nicer to read. Would love to see more like this from other startup hubs around Europe, well done.

<comment><AUTHOR> Thanks a lot!

I suspect that we will cross over to mostly startup related content as time goes by, but we had such great interviews that weren't _strictly_ startup related, so it's got a bit a vague direction atm.

<comment><USER2> Well keep up the great work. I'd like to do something similar here in Ireland, definitely, just not sure what kind of frequency makes sense, bi-monthly or so perhaps.

<comment><AUTHOR> we've set a goal of releasing 4 issues a year. But of course, the magazine's not our primary focus, atm.

</comment></comment></comment></comment><comment><USER3> Clickable links:

Site: <http://www.nordicinnovation.is/>

PDF: [http://www.nordicinnovation.is/issues/pdf/nordic- innovation_...](http://www.nordicinnovation.is/issues/pdf/nordic- innovation_2011-02.pdf)

Web/image: <http://www.nordicinnovation.is/issues/web/1>

<comment><USER3> Just finished a quick look/read.

Wow!!

Wonderful design, useful content.

Especially, 'The Internationalization Process of Internet Based Companies' is a _very_ interesting, valuable paper.

Thanks and congrats.</comment></comment>


A command line interface for 1Password - <AUTHOR> https://github.com/georgebrock/1pass

<comment><USER2> For those interested in 1password on other platforms, I also created a Chrome extension a while ago, primarily so I could use my 1password DB on Linux: [https://github.com/robbiev/multipass- chrome](https://github.com/robbiev/multipass-chrome)

I don't make use of the project posted here though, I wrote my own 1password lib in Go. The extension uses Chrome's native messaging to talk to the native Go binary, so unlike some other projects this does not run a local HTTP server or something like that.

</comment><comment><USER3> Heh--I just spent the last few days going the opposite way, building a web interface for Pass for fun. Demo is up here: [http://example.pw.less.sexy/](http://example.pw.less.sexy/) (the service and master password are both "pass") and source is here: [https://github.com/johnswanson/pass- server](https://github.com/johnswanson/pass-server)

Nice job--I used to use 1Password and remember looking for a tool like this!

</comment><comment><USER4> I've seen something similar like this for Keepass. They warned that it is not as secure as using Keepass directly (here is no warning) and I guess it is the same for 1Password. This gives more possibility for attack vectors is my guess.

</comment><comment><USER5> Why would anyone trust 1password or any other closed source password manager at all?

<comment><USER6> It's a little excessive to say that closed source means it can't possibly be secure or trustworthy. It implies open source is a silver bullet for security, which just isn't true.

I use 1Password and love it. I can tell after using other products that they have put a tremendous attention to detail into it. It is really easy to use and thoughtful in its design compared to the alternatives.

<comment><USER5> I said nothing about open source being a silver bullet. I only implied that it is better than closed source. The consensus has been that open source is more secure, especially with the bad behavior of corporations and government agency strong arm techniques in mind.

It just makes no sense to centralize your most important secrets into a single attack point for which you have no idea about its inner workings.

<comment><USER7> What consensus? All I'm seeing are assumptions that being able to read code easily means it is more secure. Someone can easily write an open-source project that looks like it is a secure project but can easily be misused to do bad things without people catching it in the act.

Look at Heartbleed and how lack of funding led to a horrible bug being missed. There has been other open-source projects hit by similar issues. Just as there are closed-source projects being hit with their own issues.

The nature of the code license does not, and I stress this strongly, lead to anything being more secure than other solutions.

A properly funded and talented team of developers working on an open source project is just as secure as a properly funded and talented team of developers working on a closed source project.

</comment></comment></comment></comment><comment><USER8> There's another 1password interface that works on Linux called 1pass [http://icculus.org/1pass/](http://icculus.org/1pass/) that will pop up a GUI menu for your items.

</comment><comment><USER9> Looks less useful than [http://www.passwordstore.org/](http://www.passwordstore.org/). Also, try renaming README.txt to README.md.

</comment><comment><USER10> I wish I could use 1password as my private key store (~/.ssh, per se). I hope the author reads this.

</comment><comment><USER11> This looks interesting. I am curious where the main use cases would lie for this CLI vs. the official GUI?

<comment><USER12> > Now, whenever I start ``mutt``, I am prompted for my 1Password Master > Password and not my Gmail password.

So I guess it is useful for staying in context when needing a password at the command line.

</comment></comment><comment><USER13> Really neat. Thank you!!!</comment>


A way to manage modules for Deno - <AUTHOR> https://github.com/crewdevio/Trex <comment><AUTHOR> it's have been weeks when I started to learn Deno, when my team started to work in the Trex project.

there are many people still want to a package manager for deno and I think deno doesn't need one, but sometimes we need an auto-completation and when you use deno at first time, before caching the module there's no auto-completation of words of a module.

Trex has a new release to help with that: Use Trex

Trex is a way more easy to use the Import Maps

This tool also support install modules from:

Deno.land Nest.land denodpkg an you can install custom modules from any url You can see all the new features in the Trex documentation</comment>


China's nightmarish citizen scores are a warning for Americans - <AUTHOR> https://www.aclu.org/blog/free-future/chinas-nightmarish-citizen-scores-are-warning-americans <comment><USER2> Nightmarish is the perfect adjective for this.

It's reminiscent of the way the Stasi[0] operated. Files on everyone, turn your subversive friends and neighbors in to gain political influence, revenge or just spite. Only in China, it will be automated. AI will determine who is naughty and who is nice. I've always felt Gilliam's Brazil was a true cautionary tale. It looms before us.

[0] [https://en.wikipedia.org/wiki/Stasi](https://en.wikipedia.org/wiki/Stasi)

</comment><comment><USER3> I agree that this scoring is a nightmare, and it should be a warning, but I also think this kind of score would cause economic problems. If I understand, credit ratings would depend partly/mostly on correct political expression. Now China's credit rating system is pretty worthless. Nobody can issue a sound loan. There may be other consequences in the same vein.

</comment><comment><USER4> If George Orwell wrote 1984 in the Information Age, this would be in it.

</comment><comment><USER5> There are startups working in this area in SF. I interviewed at one.</comment>