How can we disrupt the agricultural industry with tech? - <AUTHOR>

Does anybody have any ideas or recommendation on ways tech can improve the agricultural industry (i.e. food production, marketing, distribution, etc)? Are there any startups out there doing something pertaining to agriculture? I feel like there's a lot of potential in tapping into Agriculture 2.0. <comment><USER2> I have in-laws who work for rural phone co-ops in northern Iowa. Back in the late 1990's they were laying fiber-optic everywhere because of the bandwidth farmers were willing to pay for...particularly the hog farms which were largely automated.

And that's nothing compared to the level of genetic technology and associated startups involved with agriculture.

I'm sorry but the idea that we are at Agriculture 2.0 only suggests a lack of familiarity with the contemporary agriculture industries and a lack of historical perspective.

[<http://en.wikipedia.org/wiki/Green_revolution>]

</comment><comment><USER3> I think anything that brings value up the market will benefit consumers. Let me quote from Mark Mills of Forbes, where he explains that, although a tiny fraction of a percent of the U.S. population works in agriculture today versus 100 years ago, much of that population is now involved in food preparation.

 _Roughly a century ago when America had fewer than 100 million citizens, nearly 12 million worked on farms, a number that then comprised over 40 percent of the entire labor force. Now barely three million people call themselves farmers, accounting for a shade over two percent of today's workforce. Meanwhile, technology enabled a 600 percent growth in agricultural output.

Both in absolute and relative terms technology blew the lid off agricultural productivity, and crushed direct farm employment. But, over that same century, somehow the American economy managed to generate enough wealth to create jobs for more than 100 million more workers.

Most of the new employment over the past century came from new services and new products that didn't exist in 1900 – airlines and computing to name only two examples. It is worth noting that a lot of the new employment actually came from the same industry, food, as farming. It's just that we count the jobs differently. While barely two percent of the modern American workforce is in farming, over 15 percent work in the food industry._

What is the next step beyond food service?

</comment><comment><USER4> A site that connects growers with eaters, especially in dense areas. It's very easy to grow much more than you need in a garden, but it's not so easy to sell the surplusage.

I can buy vegetables and fruit at the store but it's not just-picked fresh. Why couldn't I buy right off the plant from a neighbor a few minutes' walk away?

<comment><USER5> Unfortunately, I believe that many places have laws (e.g. food safety regulations) that ban such informal growing and selling.

</comment></comment><comment><USER6> \--VC-type or incubator funding (there are only a few) for agricultural startups \--Social sites promoting education in agriculture--countries like Chile hold agriculture up as a profession on par with medicine and law \--Full chain product based startups (see POM Wonderful) that manage genetic improvements through breeding, growing, sales and distribution of a novel food product.

</comment><comment><USER7> Reverse the entire "Deal" process. Let the Farmer put the deals on its produce and auction its produce to the best bidder.

</comment><comment><USER8> Have a look at this approach for Open Source Hardware for the agricultural sector.

[http://opensourceecology.org/wiki/Global_Village_Constructio...](http://opensourceecology.org/wiki/Global_Village_Construction_Set)

</comment><comment><USER9> <http://www.farmeron.com/>

</comment><comment><USER10> in all seriousness, stop subsidizing it and let the market deal with it</comment>


Browse the archived web the old way: 13 emulated browsers in your browser - <AUTHOR> http://oldweb.today/ <comment><USER2> This is really, really cool. I'm really impressed with the technical implementation.

</comment><comment><USER3> Whoever made this is a bad ass. Bravo!

</comment><comment><AUTHOR> oldweb.today connects to various web archives and allows users to browse old websites in old browsers, each running in a Docker container. Emulators such as Basilisk, Sheepshaver and Wine are used to run old MacOS and Windows browsers, alongside Linux versions of Mosaic and Netscape. The Memento protocol is used to talk to multiple web archives and combine results. The project is fully open-source and available at [https://github.com/ikreymer/netcapsule](https://github.com/ikreymer/netcapsule) Suggestions and contributions for other browsers, or other web archives sources are definitely welcome! Any other feedback also appreciated.

Here is a more thorough blog post from my collaborators at rhizome.org [http://rhizome.org/editorial/2015/nov/30/oldweb- today/](http://rhizome.org/editorial/2015/nov/30/oldweb-today/)

<comment><USER4> Very neat, but what besides being a neat hack is the exact point of this, I have never come across an old website that I needed an old browser for, usually the old websites work better than the new ones! So is this really a problem, do you have some examples where an old browser is really required?

<comment><AUTHOR> There are many reasons. From technology standpoint, as the web changes, old technologies may no longer work in new browsers. One case in point: Java applets. A few of the old browsers on oldweb support Java applets, which most likely won't work in a modern browser.

Here's one example: [http://oldweb.today/nslinux/2015/http://archive.rhizome.org/...](http://oldweb.today/nslinux/2015/http://archive.rhizome.org/artbase/1722/eicon.html)

</comment></comment></comment><comment><USER5> Hacker News homepage on day 1: [http://oldweb.today/nsmac3/19991202212008/news.ycombinator.c...](http://oldweb.today/nsmac3/19991202212008/news.ycombinator.com)

</comment><comment><USER6> Blog post: [https://news.ycombinator.com/item?id=10653578](https://news.ycombinator.com/item?id=10653578).

</comment><comment><USER7> Doesn't work on two separate browsers (Firefox and Arora).</comment>


Apple Picks Instagram As The "iPhone App Of The Year" - <AUTHOR> http://techcrunch.com/2011/12/08/apple-picks-instagram-as-the-iphone-app-of-the-year/

<comment><USER2> It truly is an amazing journey for Instagram and they deserve the accolades.</comment>


Get All Angry Birds Levels in Chrome HTML5 Version with a quick hack - <AUTHOR> http://wesbos.com/all-levels-html5-angry-birds/

<comment><AUTHOR> If you dont want to hit the page, just copy and paste this code :)

javascript: var i = 0; while (i<=69) { localStorage.setItem('level_star_'+i,'3'); i++; } window.location.reload();

</comment><comment><USER2> Its legit :)</comment>


Making games for a living means being in constant fear of losing your job - <AUTHOR> https://www.polygon.com/2019/3/5/18233699/game-developer-layoffs-unions-katie-chironis <comment><USER2> For an industry whose customers are about values, Gaming Industry has none of them. Internet has the power to change it.</comment>


Document 17 Declassified – 9/11 attackers may have had links to Saudi Arabia [pdf] - <AUTHOR> https://28pagesdotorg.files.wordpress.com/2016/04/document-17.pdf <comment><USER3> We should not be surprised. The Kingdom of Saud is rooted in wahhabism - <USER2> ultraconservative branch of Islam that also happens to be the primary influence of a little group called Daesh/ISIL.

<comment><USER4> There is a fantastic Adam Curtis documentary about Saudi Arabia and Wahhabism called Bitter Lake.

[https://en.wikipedia.org/wiki/Bitter_Lake_(film)](https://en.wikipedia.org/wiki/Bitter_Lake_\(film\))

Due to various issues, you'll just have to find a way to watch it... (BBC iplayer blocked in us, copyright issues when posted on youtube, etc, etc, etc)

<comment><USER5> I thought Bitter Lake was an amazing documentary.

Can anyone recommend related or similar work of the same quality?

<comment><USER6> "The Century of Self" is probably his seminal work. Remember that Adam Curtis is .. well.. Adam Curtis. His story is going to have a spin (as anyone's will - but it's important to be cognizant of that; when one reads Zinn's Peoples History of the US, I tell them to read "The Origin of Politics" just to get another take from an equally well-educated, articulate writer). I try _really hard_ to get both sides of the story from internally consistent sources.

It's easy for me to immediately dismiss most modern neo-con sources, since their (amazingly effective) strategy is mostly based on emotional scaremongering with internally inconsistent arguments. I'm not their target demographic and they know it.

They're not idiots (in fact, re: education - Fox News has a surprisingly large percentage of hosts with degrees from well-revered instituions; which makes it all the more ironic when one points out that nice blonde lady denigrating the "liberal East coast elites" trying to emotionally connect with the midwestern housewife, herself is Harvard educated) but there definitely is another side to the story and it's important to at least hear their argument before you dismiss it.

<comment><USER5> I recently watched "The Century of Self" \-- it was excellent and I can thoroughly second iheartmemcache's recommendation.

As for getting the balance of hearing all arguments, I have a habit of doing the same. I regularly read The Economist for its free-market bias (and excellent writing, btw), for example.

</comment></comment></comment></comment></comment><comment><USER7> This document is different from the 28 pages that remain classified. For more info on that, read here:

[https://28pages.org/faq/](https://28pages.org/faq/)

<comment><USER8> Precisely.

Those pages have been kept so securely & hidden away from everyone that even Congressmen & Senators with clearances weren't even allowed to take notes on a scratchpad, when perusing them.

They had to mentally memorize any of the contents therein !

Here's the recent 60 Minutes piece on the White House's potential declassification of the "28 pages" [1] of the 9/11 Commission Report [2].

[http://www.cbsnews.com/videos/28-pages](http://www.cbsnews.com/videos/28-pages)

[ Warning : Auto play video ]

      It also comes at a time when the White House and intelligence officials
      are reviewing whether to declassify one of the country's most sensitive
      documents -- known as the "28 pages." They have to do with 9/11 and the
      possible existence of a Saudi support network for the hijackers while
      they were in the U.S.

      For 13 years, the 28 pages have been locked away in a secret vault. Only
      a small group of people have ever seen them. Tonight, you will hear from
      some of the people who have read them and believe, along with the families
      of 9/11 victims that they should be declassified.

[1] 28 Pages

[http://www.cbsnews.com/news/60-minutes-911-classified- report...](http://www.cbsnews.com/news/60-minutes-911-classified-report-steve- kroft/)

[ Warning : Auto play video ]

[2] 9/11 Commission Report

[https://en.wikipedia.org/wiki/9/11_Commission_Report](https://en.wikipedia.org/wiki/9/11_Commission_Report)

<comment><USER9> > (...) weren't even allowed to take notes on a scratchpad, when perusing > them.

That's really not that surprising. Notes would need to be derivatively classified, and would require special transportation out of the SCIF that they were taken in. Additionally, I doubt any congresspeople's offices are SCIFs that would be allowed to store such sensitive information.

<comment><USER10> Careful not to drink the KOOLAID. Congress people, especially Wyden, have requested SCIF's for events like that before and were rejected on technicalities. Bruce Schneier said they requested one when they met him to discuss Snowden leaks DOD were still trying to contain. DOD wouldnt allow the SCIF.

CIA pulled same kind of BS with torture report allegedly for OPSEC then showed true motivation with hacking to cover up their wrongdoing.

<comment><USER9> Not drinking any koolaid, I have just worked with classified info in the past and have run head-on with the restrictions regarding their handling. I have no idea whether the intelligence community has some ulterior motive, I'm just saying that not allowing them to take notes isn't some unbelievable restriction for TS information.

<comment><USER10> I was joking with you on that part. Yes, there's policy requirements that affect these things. That the Executive agencies keep refusing to make adequate exceptions or provisions for Legislative and Judicial is either a sign of incompetence or malice.

</comment></comment></comment></comment></comment></comment><comment><USER11> This is hard to parse without any commentary. What should I, as an average person, take from this? Should I start to think Saudi Arabia as a terrorist country or is there room for interpretation?

I'm very sure, by intuition, that this is important but probably would have been more valuable with some opinions from people who are knowledgeable on the subject.

<comment><USER12> In addition to coldtea's point: Saudi is in some respects the bizarro version of the US. While we export American Idol and McDonalds, they build schools teaching extremist Islam all over the world. Many formerly more moderate countries have gotten much more theocratic in the last 20 years, and Saudi evangelism funded by oil money has played a huge role.

For example, when I visited Bangladesh in the early 1990's, seeing veiled women in the capital city of Dhaka was unusual. It's very common today.

<comment><USER13> > For example, when I visited Bangladesh in the early 1990's, seeing veiled > women in the capital city of Dhaka was unusual. It's very common today.

Why do you think SA has something to do with this?

BTW, this is true in some western countries as well (I'm thinking of France where veiled women are everywhere, it wasn't the case in the 80s). I wonder what explains this trend.

<comment><USER12> See: [http://m.dw.com/en/petro-islam-on-the-rise-in- bangladesh/a-6...](http://m.dw.com/en/petro-islam-on-the-rise-in- bangladesh/a-6552859)

</comment></comment></comment></comment><comment><USER14> The title is a little misleading. Obviously the hijackers were mostly from Saudi. The document shows how those people were directly connected with government.

However in Saudi a ton of people work for the government so it isn't surprising they had connections to Saudi government.

</comment><comment><USER15> I thought everyone already knew this?

<comment><USER16> Yeah, I was thinking the same thing. Has a very "Scientists report water to be wet" feel to the whole thing.

It's almost like they think that 9/11 is just a part of life now, and the only thing that matters is the paper trail. Realistically, it signals a new societal problem of religious toxicity and an insidious new type of invader that we as Americans (assumption) have not faced before. If we can't trust our neighbors not to blow us up, who CAN we trust?

</comment></comment><comment><USER17> I was curious about a source, especially since it seems like it was declassified almost a year ago. The same papers are available from .gov as:

[https://www.archives.gov/declassification/iscap/pdf/2012-048...](https://www.archives.gov/declassification/iscap/pdf/2012-048-doc17.pdf)

The index page,

[https://www.archives.gov/declassification/iscap/pdf/2012-048...](https://www.archives.gov/declassification/iscap/pdf/2012-048.html)

calls it "Saudi Notes". There's one other set of "Saudi Notes" and some "Saudi News Clips" on that page.

Does anyone know what the declassification process was for these / why they were declassified?

</comment><comment><USER18> Is it unusual for nations to use terrorists, mercenaries, privateers for missions that they don't want to be directly associated with? IIRC, the Russians and the Americans were doing this in the Middle East in the 20th century, and may still be doing it in Syria now.

Seems to me that the real news is that Saudi and America are able to be allies and enemies at the same time, not that they may have employed people who have the big T label.

</comment><comment><USER19> I'd be curious to see whether any of the redacted sections are available via Illustrator[1].

1\. [http://hackaday.com/2008/08/01/exposing-poorly-redacted- pdfs...](http://hackaday.com/2008/08/01/exposing-poorly-redacted-pdfs/)

<comment><USER20> Funny story:

My economics professor back in college would give us these take-home quizzes each month with hundreds and hundreds of "short-answer" questions on them to use to study for tests and such.

I noticed there was a inconsistent amount spacing between questions and opened one of the pdf's in illustrator. The fool actually drew white boxes over all of the answers. Needless to say, I walked away from that class with high marks.

That was a lovely class.

</comment></comment><comment><USER21> "May have had"?

I thought it was widely known that Osama Bin Laden was heavily financed from there? Also: wahabi?

<comment><USER22> Heavily financed as in "inherited a shit-ton of money from his rich dad", or something else?

</comment></comment><comment><USER23> In 2012 Citigroup forecast that Saudi Arabia would run out of oil in 2030. If true, there must have been considerable anxiety in the years preceding 9/11 as the Saudi government contemplated ways to offset its impending decline in reserves. Fortunately for the Saudis, 9/11 was the catalyst for the fall of Iraq, a country with the largest unproven oil reserves in the region, and ideally located near Saudi refineries and export infrastructure. In the book Hotel California: The Clandestine War in Iraq, the author repeatedly claims the Bush Administration was divorced from reality... its scary to think the United States was manipulated into deposing Sadaam for the benefit of Saudi Arabia.

<comment><USER24> I have stated this was the goal for years. They knew that Saudi was peak, and what better way to prevent the next largest reserves from being pumped dry; war. Keep that going until you can go in and steal all the oil after you run out.

</comment></comment><comment><USER25> Reading the quotes from this page give enough of an indication that there is more than just a connection between the hijackers and Saudi diplomats as was shown in this release, but specifically financing and involvement from well known figures at a seemingly significant level:

[https://28pages.org/quotable/](https://28pages.org/quotable/)

> When asked by 60 Minutes if the 28 pages include specific names: "Yes. The > average intelligent watcher of 60 Minutes would recognize them instantly."

<comment><USER24> Can someone explain exactly why these 28 pages are being held top secret? What implications are there if the wider world knew their content?

And are they classified with a certain timeframe - like "for the next 70 years" or some such?

</comment></comment><comment><USER26> Informant Codename: Muppet. Poor guy.

</comment><comment><USER27> The timing couldn't be better.

<comment><USER28> Can you clarify? Why was it important that this came out now?

<comment><USER29> Maybe because of the Presidential trip to Saudi Arabia?

[http://www.theguardian.com/world/2016/apr/20/barack-obama- sa...](http://www.theguardian.com/world/2016/apr/20/barack-obama-saudi-arabia- visit-king-salman-relationship)

</comment></comment></comment><comment><USER30> I'm afraid that this will put SA in a very bad position, bad enough to gain some hate from around the world.

The day this alliance between the US and SA starts to diminish or ends, it's not going to be worrying. Muslims already get so much hate everywhere, if the home of Islam gets bad PR, the middle east will turn up worse than it already is. I hope I'm just being pessimistic here.

<comment><USER31> SA should get bad PR. SA has been exporting Islamic terrorism for decades with their petro-dollars. SA funds mosques, madrassas with their extreme ideologies which in turn breeds terrorists. I have seen my home country has been being Islamized which is directly funded by SA.

<comment><USER30> Unless they manage to stir enough hate to create more and more conflicts. The problem isn't really SA's government, it is the potential for violence to spread.

Once SA gets bad rep, muslims around the world might also get bad PR. So it might be wiser to play along with them than to pave the way for more middle east instability.

I also hate islamism, but I prefer that than WW3.

</comment></comment></comment><comment><USER32> I'm curious about the repercussions for the British Monarchy and th Bushes due to their unnaturally cozy relationships.

</comment><comment><USER33> What a coincidence with the recent visit...

</comment><comment><USER34> Looks like they might be getting some democracy soon!

<comment><USER35> Doubt it, they've been a dictatorship supported by the US since day one.

<comment><USER36> He is using "democracy" as an ironic euphemism for "bombs".

<comment><USER35> I understand that. I don't think the US is about to attack Saudi Arabia, it's longest standing ally.

</comment></comment></comment></comment><comment><USER37> Is anyone seriously shocked by this?

<comment><USER17> Well, we knew almost immediately after the attacks that 15 of the 19 attackers were citizens of Saudi Arabia.

From skimming the document quickly, I don't see anything that implies definite ties to the Saudi _government_ , which would be interesting. They knew people who worked for the Saudi government, but I don't think this document says anything more than that.

</comment></comment><comment><USER38> not a HN content

<comment><USER39> HN is a social bookmarking site.

Anything that gets voted to the first page IS de facto HN content, as voted by HN users, unless it specifically violates some rule.

<comment><USER40> That rule would be the first rule in the guidelines:

Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon. [...] If they'd cover it on TV news, it's probably off-topic.

From [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER41> > unless they're evidence of some interesting new phenomenon.

I think this article fits the description.

</comment></comment></comment></comment><comment><USER42> O ba ma: [https://www.rt.com/usa/340313-obama-saudi-pages- classified/#...](https://www.rt.com/usa/340313-obama-saudi-pages- classified/#.VxebaXHmckE.facebook)

<comment><USER43> This is not just Obama, Hillary, and obviously the Bush families who have had long ties with the Saudi dinasty. This isn't a left vs right issue, most politicians in US are in bed with the Saudis.

</comment></comment><comment><USER44> I wonder if its part of Panama Leaks counter measures. Make US and SA look bad and make them hostile towards each other to cover up the leaks.</comment>


Columbia Downed by Megalightning (2005) - <AUTHOR> http://www.holoscience.com/wp/columbia-downed-by-megalightning/ <comment><AUTHOR> There are two reasons I posted this:

1\. One of the companies we started working with is named after megalightning (ELVES-Emission of Light and Very Low Frequency perturbations due to Electromagnetic Pulse Sources). I had never heard of megalightning before and wondered why.

2\. There seems to be very little information about ELVES and wanted to know if anyone had some insight on it.</comment>


Good keyboard for programmers? - <AUTHOR> http://www.typematrix.com/2030/features.php

<comment><USER2> The most important ergonomic feature of my keyboards is capslock being remapped to ctrl. If I have to stretch to reach a conventional ctrl key, I am in severe pain within a single working day. A good keyboard for ordinary users perhaps, but not developers.

Also, why put keys where I would naturally rest my palms?

</comment><comment><USER3> I personally will not even consider a keyboard which is not split (i.e. "ergonomic"), simply because after typing on one for the past decade I cannot go back to regular square grid keyboards without feeling as though something is horribly, horribly wrong.

</comment><comment><USER4> Looks cramped to me, but I may have sausage fingers.

It also isn't an IBM Model M.

<comment><USER5> I have the same problem with some regular keyboards as well although I don't have thick fingers. Why are manufacturers making smaller buttons beats me.

</comment></comment><comment> jc-denton Apple wireless keyboard.</comment>


Which programming languages have the happiest (and angriest) commenters? - <AUTHOR> https://hackernoon.com/which-programming-languages-have-the-happiest-and-angriest-commenters-ebe91b3852ed?imm_mid=0ec3e0&cmp=em-prog-na-na-newsltr_20170114#.hez1czpdr <comment><USER2> It's interesting that the most commonly used enterprise languages seem to be missing ... does this mean that Java and .NET are just solidly plugging away? No one is raving about them (positively or negatively). Javascript and C/C++ don't make the list either. I think you need to take a look at a lot more than the top-ten and bottom-ten to know what's going on with this data-set (or if the method for deciding positive versus negative is working).</comment>


Generating Music Using GANs and Deep Learning - <AUTHOR> https://arxiv.org/abs/1704.08292 <comment><USER2> I'm baffled by this paper. They appear to be trying to generate music from broad musical gestures caught on video. They seem surprised that you can't train a network to synthesize good music from a statistical map of sounds and gestures.

This makes as much sense as using a video of the postures of a developer at work as a training set, combined with code output, and then wondering why this doesn't generate useful apps when fed by a live posture csm.

Am I missing something?

<comment><USER3> You are missing the the magic word "deep" in the title. I was looking at Nvidias GPU conference session lineup recently, it was hilarious how many talks had the words "deep learning" in the title.

<comment><USER4> Why would that be hilarious?

NVIDIA GPUs are the primary platform where Deep Learning training and inference is being done. Not only that, NVIDIA is making that the core of what they do

<comment><USER5> It's getting a lot of press for sure, but most of their profit (by a large margin) still comes from gaming

</comment></comment></comment></comment><comment><USER6> Reminds me of:

here was a whole chain of separate departments dealing with proletarian literature, music, drama, and entertainment generally. Here were produced rubbishy newspapers containing almost nothing except sport, crime and astrology, sensational five-cent novelettes, films oozing with sex, and sentimental songs which were composed entirely by mechanical means on a special kind of kaleidoscope known as a versificator.

\-- George Orwell, 1984

</comment><comment><USER7> Any open source code released? I am very interested to have a try!

<comment><USER8> I doubt it. This is academia. When discussing releasing the code to prove that the researchers did what they said, I was told that I was unreasonable and should just trust people. If that worked, my house would run on cold fusion and my hybrid would fly.

Edit: science requires reproducing. Opening the code is literally enabling reproduction. When researchers refuse to do that, they refuse to be scientists. I find this especially irksome when there are public funds used NG the researchers.

<comment><USER9> The thing is that anything ever published in a paper represents a _claim_ : the researchers claim that they have achieved something. You may choose to trust the claim to be true, or not- or you may try to reproduce the results if you need to do so for some reason (for instance, because you want to use them in your own work). Until you have convinced yourself that something is true, you can't be expected to believe it just because someone else -anyone else- says it is.

This is true even for theoretical papers with mathematical proofs and the like. I don't think this is a very controversial opinion. I've often seen reports in the (mostly popular) press starting with "such and such team _claims_ to have solved such-and-such longstanding problem in a new paper released..." etc.

In the popular press we tend to see claims made in papers reported as an absolute fact: "These Danish boffins trained a deep managerial neural pixie network to recognise the sex of starfish" etc. The point that the paper reports the team's own results as the team understands them and that other teams may have a different interpretation of the same results, is often lost in the translation.

The best outlets often include a few opinions from researchers not involved in the work- I tend to trust those better.

<comment><USER10> One thing I've noticed more with science journalists (which I greatly approve of) is that they seem as a whole to have taken to heart the "get a quote from a researcher who wasn't involved in the study" mantra, so that it's rare to see an article without a "says x who was not involved in the research" line.

</comment></comment></comment></comment><comment><USER11> Yet another example of generative adversarial networks learning mindbogglingly complicated functions, in this case, a function that takes an image of a person playing an instrument and produces sounds made by that instrument, and another function that does the opposite (i.e., generates an image of a person playing an instrument from a sound sample).

Very cool.

</comment><comment><USER10> Do they not have links to the audio generated anywhere?</comment>


GET, POST, and safely surfacing more of the web - <AUTHOR> http://googlewebmastercentral.blogspot.com/2011/11/get-post-and-safely-surfacing-more-of.html <comment><USER2> ok, i'm highlighting two awesome pieces of information in that specific blogpost. both of them aren't new but this is the first time they were ever officially confirmed by google.

      Google begins indexing yummy-sundae.html and, as a part of
      this process, decides to attempt to render the page to
      better understand its content and/or generate the Instant
      Preview.

this is the first time ever that google confirms that they are internally rendering the page - not only for preview purposes - but also for indexing purposes.

      >Remember to include important content (i.e., the content you'd like
      >indexed) as text, visible directly on the page and without
      >requiring user-action to display. Most search engines are text-
      >based and generally work best with text-based content. We're always
      >improving our ability to crawl and index content published in a
      >variety of ways, but it remains a good practice to use text for
      >important information.

first time ever they advise - directly - against "user action dependent hidden content"

<comment><USER3> One more nice piece of infomration (I'm sure it was out there before, but the consequences are now more interesting): If .js files referenced in your page are disallowed by robots.txt, googlebot won't load them.

</comment></comment><comment><USER4> This strongly supports this: <http://news.ycombinator.com/item?id=3182579>

I wonder if another implication of Google actually rendering pages is that SEO is going to have to focus much more heavily on visible page content rather than hidden or quietly shuffled out-of-sight content.

<comment><USER2> well, there is the implication that we will see HN posts a la "Google deleted my content!"

google says they will only post POST request that are automatically triggered onpageload and will have no other side effects other than (fetching & ) rendering content.

ok, lets say google does 1000 000 000 POST requests and gets it 99.999% right. this means that there will be 1 000 000 occurrences where google actually will trigger some unintended side-effects.

"At scale everything breaks" (c) Urs Hölzle [http://www.zdnet.co.uk/news/cloud/2011/06/22/google-at- scale...](http://www.zdnet.co.uk/news/cloud/2011/06/22/google-at-scale- everything-breaks-40093061/)

<comment><USER5> If you've got a website and look at the logs, you'll notice dozens of badly behaved bots, spam farms etc that follow any and every get or post link, fill in forms with spam and submit them, and ignore robots.txt. If your site is deleting comments based on an unauthenticated POST, you've already got a broken site.

</comment></comment></comment><comment><USER6> This seems relevant (from HN a couple weeks ago):

[http://www.thumbtack.com/engineering/googlebot-makes-post- re...](http://www.thumbtack.com/engineering/googlebot-makes-post-requests-via- ajax/)</comment>


Former Apple employees try a different management approach at Pearl Automation - <AUTHOR> http://www.nytimes.com/2017/01/02/technology/pearl-automation-apple-alumni.html <comment><USER2> The article is all Apple, Apple, Apple. That's not Pearl's problem. Pearl is in the auto accessory business, selling through all those cheesy stores in the auto-parts part of town. Their product is not novel. It's so not novel that there's an Amazon Vehicle Backup Cameras Store.[1] Pearl is in it, at $499, alongside comparable products starting at $32.99. That's Pearl's problem.

Not only that, the competing products come with a display. Pearl's product assumes you have a phone on your dashboard, running their app. User comment: "any time you backup, you need to manually launch the app and wait through a 3-5 second lag as the video feed loads."

Those guys are automotive noobs. Their recommended temperature range is -4°F (-20°C) to 113°F (45°C). You can easily exceed those on a car body. Automotive temperature range for components is usually considered to be -40°C to 125°C. Their device is also battery powered, so it will need a recharge or a new battery regularly. Everybody else wires into vehicle power, so it's install and forget.

They say they're going to do self-parking next. As a retrofit. Right. Those guys need to get out of Scotts Valley, move to Detroit or some place with auto parts plants, and get their hands dirty.

[1] [https://www.amazon.com/Vehicle-Backup- Cameras/b?ie=UTF8&node...](https://www.amazon.com/Vehicle-Backup- Cameras/b?ie=UTF8&node=1253823011)

<comment><USER3> The article makes a lot more sense if you look at it as an acquihire solicitation.

<comment><USER2> You may be right. I don't see those guys ten years downstream with hundreds of RetroDrive installation shops and a factory turning out many models of steering box adapters. On the other hand, they're not MobilEye, which has innovative vision processing technology. They're just a camera sales operation.

</comment></comment></comment><comment><USER4> Kind of feels like an ad for Pearl they agreed to publish in exchange for anecdotes about working at Apple.

The Apple PR statement at the end made me laugh for some reason:

"Pearl Auto is a great example of the creativity and innovation driving the iPhone ecosystem," said Josh Rosenstock, an Apple spokesman. "We wish them great success with their new product."

<comment><USER5> Yes, this is obviously paid content marketing material.

EDIT: The Pearl team mass downvoted me. :(

<comment><USER6> No, but it may have come to them via a press release.

Paul Graham on PR from 2005: [http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)

"PR is not dishonest. Not quite. In fact, the reason the best PR firms are so effective is precisely that they aren't dishonest. They give reporters genuinely valuable information. A good PR firm won't bug reporters just because the client tells them to; they've worked hard to build their credibility with reporters, and they don't want to destroy it by feeding them mere propaganda.

If anyone is dishonest, it's the reporters. The main reason PR firms exist is that reporters are lazy. Or, to put it more nicely, overworked. Really they ought to be out there digging up stories for themselves. But it's so tempting to sit in their offices and let PR firms bring the stories to them. After all, they know good PR firms won't lie to them."

<comment><USER5> It's not dishonesty; it's just biased, and I wasn't necessarily pointing the finger at Pearl either.

<comment><USER6> I didn't mean to comment on the honesty or otherwise, those were just the paragraphs that contained the key info: PR firms feed valid facts to journalists.

If a news outlet so much as carries an article about a given topic, they are exercising discretion and leaving themselves open to accusations of bias... Really it's NPoV that is the unachievable ideal.

<comment><USER5> I see, you did seem to imply that I implied that NYT/Pearl (pg favors the former when it comes to possible "bad actors") were being dishonest.

I think it's an important lesson to learn how to discern whether articles are "paid marketing" or "content marketing" (or biased in other ways). Not many people know how to do this kind of critical thinking -- look at the "fake news" debacle (if anything, there is a certain blind trust people place in authority figures like the NYT).

The transparency (or lack thereof) of this particular article is an important observation to note.

</comment></comment></comment></comment></comment></comment><comment><USER7> This is the most interesting part of the article for me:

> Apple, which has about 110,000 employees, breaks big projects down into > smaller tasks. Those are assigned to small teams, and each subtask is given > to a specific employee, who must get it done — what Apple calls the > "directly responsible individual."

> Pearl has copied this system. "In leading small teams, that's very > effective," Mr. Gardner said.

Apparently this directly responsible individual (DRI) approach is famous, but it's the first I've heard of it. Is anyone able to comment on how effective this is?

Say you have a multi-disciplinary team of UX designers, a PM, front-end and back-end devs - I'd be accustomed to seeing a team lead in charge of the project who is the DRI for the whole thing, but do subtasks for the project also get parcelled out in formal, DRI-fashion? E.g. user stories for a web app like, "As a user I can log in securely", would this get a DRI assigned to it? What happens when the DRI doesn't have time for that task, are they able to pass it along to someone else, and would the decision to punt it over to someone need to be run past someone, typically, or is the DRI empowered to make decisions on delegation/task transferring?

<comment><USER8> Isn't this how every organization in the world operates?

How can anything resembling non-hobby work get done without a "directly responsible individual"?

<comment><USER9> Implicitly, yes, some person is always doing the work. But in my experience a "DRI" culture is one where at the end of a meeting it's 100% clear _what_ needs to be done and _who_ is doing it. That doesn't happen in a lot of companies, because a lot of companies call meetings to brainstorm.

</comment></comment></comment><comment><USER10> $500 for the PearlVision product and you have to supply your own phone for the display. That is some hefty markup. You can get some decent ones that include a display in the range of $50-$150 on Amazon.

<comment><USER11> Seems to me the main advantage is that you don't have to wire anything up (or pay someone else to do that).

And personally I already mount my phone for navigation & music, so I wouldn't WANT to have the extra display.

<comment><USER10> I paid about $75 for a rear view camera setup on Amazon and another $75 for someone to install it in an hour hooked into the existing entertainment display. No worry about wires, charging, etc. Still better than a $500 product which needs a phone that I need to mount and dismount, charge, etc.

</comment></comment></comment><comment><USER12> > Apple, for its part, appears to hold no hard feelings toward Pearl, despite > the steady poaching of employees.

This has made me wonder, why does offering people a better option for employment than what they currently have get described with the word for illegally killing/stealing animals? Was there some concerted effort years ago to associate the two, to make leaving one company for another seem like a bad thing?

<comment><USER13> I can't speak to the history of the term, unfortunately, but the term poaching in a hunting context means more than just killing an animal illegally; it has a connotation of trespassing to gain something otherwise inaccessible. Employee poaching has the same connotation because the former employee uses their familiarity with the old company to hire employees that other companies can't access as easily.

<comment><USER14> I see your definition and that of the first definition I saw from the internet, and coming from a family of hunters/fishers, it surprised me a bit. I associate poaching almost entirely with killing of animals illegally. I think that is because in my home state, there were fewer problems with people trespassing to hunt than with those hunting with no regard for licenses/hunting laws. The Wikipedia article on poaching in the USA[0] is more what I associate with poaching.

[0] [https://en.wikipedia.org/wiki/Poaching#Poaching_in_the_USA](https://en.wikipedia.org/wiki/Poaching#Poaching_in_the_USA)

</comment></comment></comment><comment><USER15> Interesting they're based in Scotts Valley. I have to wonder if California tech in Santa Cruz and Monterey have dwindled in recent years because of the emphasis on San Francisco and Palo Alto.

<comment><USER16> Don't think ever was much at that side of SV to begin with. People who work in tech and live in SC just travel to SV. From what I remember its a ~1 hour drive from SC to SFO airport or SJ. Quite doable if you love living in SC.

</comment></comment><comment><USER17> Sounds like a vanishing market, though.

People don't buy new cars because theirs are "outdated". They buy the new shiny because they deserve the new shiny godammit. Not unlike computer hardware geeks who only buy new devices when they need it.

<comment><USER18> Are you kidding me? Have you ever worked in/or visited a vehicle dealership? It's over -run with 1st-movers, and most of the time the owners and salesmen always have the newest and latest.

<comment><USER19> Not like it used to be.

See: [https://www.rita.dot.gov/bts/sites/rita.dot.gov.bts/files/pu...](https://www.rita.dot.gov/bts/sites/rita.dot.gov.bts/files/publications/national_transportation_statistics/html/table_01_26.html_mfd)

I work with a group of well paid engineering types. About 50% have cars < 5 years old. I have the third oldest -- a 2003 model year. My boss drives a 1991 Accord, although this will be its last winter.

</comment></comment></comment><comment><USER20> How do people gain satisfaction from working for a dead on arrival product?

</comment><comment><USER21> > More than 50 of the company's 80 or so employees worked for Apple at some > point.

I understand how/why this happens, but as an engineer who's not an Apple "alumnus" (ugh), I would never work at a place like that. A company needs diversity in more ways than one.

<comment><USER22> I don't understand. Would you work at Apple itself?

<comment><USER21> Maybe. Apple's too large to have 70% of their employees come from the same company. I've worked at "startups" like this before, and there is a caste system with the former $BIG_CORP-ers and everybody else. No thanks.

</comment></comment></comment><comment><USER23> Sure, plug a mobile app directly into your OBD-II, what could go wrong?

<comment><USER24> Does OBD-II have any direct control capability? I had thought it was a diagnostic (read-only) interface.

<comment><USER25> OBD-II diagnostics are mandated by law, but manufactures often connect almost all microcontrollers to that connector. This allows updating all of your firmware from one port. That can be a security problem when connected to the internet.

<comment><USER26> I was not aware of this; I assumed it was read-only except for reset flags, thank you for pointing this out.

<comment><USER27> There are numerous holes in various firmware that allow cross-talk between the various CAN busses anyway. I don't think anyone who set out to research automotive security has ever had to move on to another vehicle due to lack of exploitable flaws.

</comment></comment></comment></comment></comment><comment><USER28> I am less concerned with who they are and more concerned with what they're doing. What does their company do?

<comment><USER29> The sell an aftermarket rear view camera for your car.

[https://pearlauto.com/](https://pearlauto.com/)

</comment></comment><comment><USER30> I don't know if there is a huge need for this in the market though. I would rather spend to upgrade the media and other controls in the car than the rear view camera if I have to. For someone used to driving without a rear camera there is no need for one. They need more products.</comment>


Reverse engineering a camera protocol for fun and profit - <AUTHOR> https://www.thirtythreeforty.net/posts/2020/05/hacking-reolink-cameras-for-fun-and-profit/ <comment><USER2> I must say, out of all the things to happen on a Thursday night I wouldn't have expected to read an article where someone referenced my own code that I wrote _when I was 15._ (5 years ago now... time flies) Here's the file I presumed he looked at; [https://github.com/nvella/sdvr/blob/master/pk.c](https://github.com/nvella/sdvr/blob/master/pk.c)

I was trying to reverse-engineer my parent's network CCTV DVR so I could hopefully integrate it with Home Assistant - as far as I'm aware the sluggish smartphone apps are still the only way to access those boxes. I wasn't ever able to get as far as George did with his IP cameras; I hit a snag on trying to correctly reassemble the H264 streams, so all I ever got out of it was mostly corrupt still frames.

If you're reading this George, well done! :D

<comment><USER3> Hi! Author here. You saved me a good day of figuring out what all the header fields meant. I definitely appreciated finding your code!

<comment><USER3> Also... When you were _15_? Geez, I think I knew what GWBASIC was at that age. Kudos again.

<comment><USER2> Cheers :) Yeah, I was one of those kids that spent most of their free time programming or otherwise tinkering with computers. I started with simple systems scripting languages before moving to Ruby and getting a proper grip on basic OOP stuff, C then shortly followed.

I don't really have any use for C today, but it definitely taught me _a lot_. It was intimidating at first, but when the concept of pointers finally clicked I felt like I had a sense of control in the language, and things were relatively deterministic and predictable.

I did most of my projects in C for a few years, but eventually got sucked into the JS ecosystem like pretty much everyone else at the time. These days I mostly work in .NET - C# is constantly evolving, and with .NET Core it's seemed to strike a good balance between powerful tooling, cross-platform support, performance, and just fun language features. I'm pretty content for now :)

</comment></comment></comment></comment><comment><USER4> That was a super fun read! I was super impressed with the content! It seems like the "mastering embedded Linux" is extremely rich too [1]!

[1] [https://www.thirtythreeforty.net/posts/2019/08/mastering- emb...](https://www.thirtythreeforty.net/posts/2019/08/mastering-embedded- linux-part-1-concepts/)

</comment><comment><USER5> These articles always make me feel two conflicting emotions at the same time: _" I feel so inadequate because I couldn't do this reverse engineering myself"_ and _" it feels good knowing that I'd do a better job than Charlie even though I don't even work in that industry"_. Poor Charlie.

<comment><USER6> charlie is a double agent who intentionally made the security weak so it could be hacked and opened. i salute you charlie, fight the power!

<comment><USER7> Charlie apparently also works at a large US car manufacturer as they do some bit mashing as well as a form of "encryption" in their software tooling (though only for the key as they then decrypt everything with the unmashed key with salted 3DES so no xor there at least).

<comment><USER8> I would love to understand the software process breakdowns that allow that "Charlie" code to make it into production! Almost everywhere I've worked, this would have been instantly caught during code review and Charlie would have had to answer to at least his peers for his crimes! Or, it would have been caught during the integration phase, as there had to be some other team consuming the byte stream and implementing the reverse to "decrypt" it. How on earth does this make it through all the gates and out into the field??

1\. Were the requirements just vague? e.g. PRD just says "Encrypt the payload somehow, lol" and junior engineer Charlie, not being a crypto expert, just made something up? If so, that should have been caught and corrected by a code review. More eyes than Charlie would have at least looked at it and should have raised an alarm.

2\. Did the requirements actually say "The payload shall be XOR'ed with the string 'Charlie is the designer of P2P!!' and then the bytes shuffled around as such: [...]" and everyone agreed this would be great? Where is engineering/security leadership push-back during the design phase, in that case?

3\. Did the requirements call for proper encryption, and Charlie just ran out of time and cobbled this together? Again--code review, maybe insufficient project planning?

I mean, bugs slip in to code all the time, but this seems like something deliberately done this way and deliberately ignored through the entire design, development, test, and deploy process!

<comment><USER9> > I would love to understand the software process breakdowns that allow that > "Charlie" code to make it into production!

In embedded systems FW-space is at a premium.

If you can avoid embedding a full crypto-stack in your firmware and replace it with 5 lines of C, which provides at least some safety, more often than not (depending on the use-case), that might be the right decision.

I mean, even if the encryption used here was proper RSA, the method discussed in this article might lead to disclosing the key and cracking the protocol anyway.

<comment><USER5> Except this thing runs a full-blown Linux! It's hardly the kind of severely space-constrained system you're talking about.

<comment><USER9> I've worked with firmware's where individual megabytes matter, and they've been Linux-based too.

Just because it runs "full blown Linux" doesn't mean you get more than 16MB to play with.

<comment><USER5> And if we're talking _megabytes_ , there's no excuse not to do proper crypto. MbedTLS, for example, gives you a basic TLS stack in 64kB ROM + 64kB RAM, and a pretty splurgy one in 200kB.

Of course this can be way too much for small embedded systems, but if you can afford to run Linux and use phrases like "individual megabytes matter", you can definitely do proper crypto.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> >"The only thing that jumped out to me was the appearance of a sync word at the beginning of each packet, 0xf0debc0a. (In little endian, this is 0x0abcdef0.) On a lark, I Googled this, and actually found a project on GitHub from 2015..."

That is some excellent Google-Fu!

I had never thought about _Googling the reversed-endian versions of hexadecimal constants_ \-- until you wrote about doing this; I think it's a brilliant idea, so I'm adding it to my search engine technique toolbox.

In summation, it's a great idea!

It's both simple and elegant!

<comment><USER11> What surprises me is that there aren't more users of this constant...

<comment><USER12> I usually see constants that are easier to read like 0xdeadbeef, 0x0c0ffee0 or 0xcafecafe

</comment></comment></comment><comment><USER13> This is a story after my own heart.

I have written a lot of ONVIF stuff, and have done pretty similar stuff with WireShark and Cocoa Packet Analyzer.

Video is still surprisingly proprietary, even after all this time.

I got the ONVIF stuff sorted, but the challenges I deal with, these days, is providing the video in a realtime streaming format that can be interpreted by as many clients as possible (especially Apple). RT[S]P doesn't really cut it.

<comment><USER14> What prevents you from simply using Kurento with the Playerendpoint and broadcasting the stream via WebRTC?

There is even a nice sample application that you can try out without having to write any code.

[https://github.com/Kurento/kurento-tutorial- java/tree/master...](https://github.com/Kurento/kurento-tutorial- java/tree/master/kurento-player)

<comment><USER13> Well...this is for Apple systems.

As you probably know, Apple is not just badly supported in the surveillance industry, it is actively hated.

As I was working on the ONVIF stuff, I encountered this quite often. As soon as people found out I was working on Apple stuff, the relationship would go belly-up.

I ended up not bothering to renew my ONVIF membership, because it didn't really buy me anything.

I created a "breadboard" streaming server for ffmpeg[0], but I've put my ONVIF stuff aside for a while, as I work on Bluetooth projects.

[0] [https://github.com/RiftValleySoftware/RVS_MediaServer](https://github.com/RiftValleySoftware/RVS_MediaServer)

</comment></comment></comment><comment><USER15> I have a SWANN camera (some do rtsp, others not) only has port 900 open, wonder if this would work on all these "proprietary" cameras.

The camera industry is shady AF with everything listed as call-for-price. I hate trying to source anything for it.

</comment><comment><USER16> To the author: This site has major scrolling issues on Mac Safari in certain dimensions. For example, my window width is at 1347px and when I scroll quickly the layout goes crazy and everything flashes in different locations until the scrolling or overscroll stops. Occurs on any page on this site and in many other dimensions. Doesn't happen in Chrome though.

<comment><USER3> Author here. How bizarre. Thanks for the report. I'll see if I can reproduce the behavior (I don't normally use Macs so I have to test ad-hoc).

<comment><USER17> On Android (Chrome/SM-T719 tablet in portrait) the sidebar occupies over half the screen.

</comment></comment></comment><comment><USER18> Oh wow, what a great read. When you thought it was over, there was another entire level deeper in the rabbit hole. Fascinating post. HN at its best.

</comment><comment><USER19> Huh, this gives me the same kind of frisson that a middle school football- crazy boy must experience when his dad takes him to a football game when Tom Brady is in town.

<comment><USER20> Or you do not know who is tom Brady and American football or even the rule, but still enjoy it very much the whole analysts. Would read the embedded one. Great work. Great read.

</comment></comment><comment><USER21> It's nice work. I always thought it would be a pain to implement a Wireshark decoder but I was wrong!

One other approach that could have been taken: to add the desired protocols into the camera directly. I assume you're just adding a control channel and the video stream encapsulation would be minimal.

</comment><comment><USER22> > As a quick aside, it's natural to wonder why this camera doesn't support > RTSP and/or ONVIF. After all, plenty of other Reolink cameras do. Because > I'd like to give them the benefit of the doubt, I'll propose the possibility > that Reolink ran out of storage on this camera and had to axe some features. > After all, a 16MB flash chip would cost a whole 20 cents extra. This is just > a cost-saving measure and definitely not vendor lock-in, hmmm?

Don't underestimate the licensing cost of the software. Afaik most camera vendors use [http://www.live555.com/mediaServer/](http://www.live555.com/mediaServer/) for the RTSP server software. There's a licensing cost for commercial use.

<comment><USER23> FWIW, Wyze manages to offer RTSP firmware (not pre-installed, but freely available on their website) for their $25 cameras.

<comment><USER24> I tried using their RTSP for my own motion detection logic (python, opencv, pointing at my birdfeeder) but the stream is too glitchy. So far the Amcrest IP2M-841 is working best for me.

</comment></comment></comment><comment><USER25> Poor Charlie. Does anyone know of a wireshark dissector tutorial similar to the one in the article, but for proper C?

</comment><comment><USER26> How do you have motivation to do this kind of stuff in your free time?

<comment><USER27> For me it was that I stopped reading the news, and generally 'consuming' the media. Not only did it clear out several hours in the day, but it also generally allowed me to focus on being productive instead of being outraged or saddened by whatever was being peddled that day.

</comment></comment><comment><USER19> One thing that I'd like to mention is that the author of this post attended Mississippi State University. I mention this because there is a widespread stereotype of the Deep South as a place teeming with racists, rubes, the willfully uneducated, etc... and I want to draw attention to the fact that there are also technology geniuses that come from there too.

<comment><USER28> Many great people have come from Mississippi, or passed through on their journey in life. Sadly, I think most of these great people end up leaving, thus re-enforcing some of the problems the area faces.

I was thrilled to see a rigorous reverse engineering article. It's exactly the sort of thing I always hope to find when I browse HN. But I have to admit, it was a special delight to get to the end and find that the author was a fellow MSU alum. :)

<comment><USER19> I think addressing the perception gap is part of this. No doubt that a lot of people equate "Southern accent" with "stupid." I've seen many lists of "Top 20 black engineers" or "Rising female executives in tech" but haven't seen something similar for Southerners, although I'd guess that in a typical FAANG interview the Southerner is starting out with more unconscious bias against them.

</comment></comment></comment><comment><USER24> I'm a retired software dev. Before the pandemic I hadn't coded in 4 years, but somehow got the itch. One of the things I've been playing with is pointing a security camera at my birdfeeder, but I'm not so interested in clips of boring brown sparrows. Instead I want clips of bright red cardinals and bright yellow goldfinches. So I wrote some python opencv code that reacts to color changes: [https://github.com/ctrager/opencv_py/blob/master/red_yellow_...](https://github.com/ctrager/opencv_py/blob/master/red_yellow_blue.py)

This is working for me with an Amcrest camera, but I also got a Reolink E1 thinking it supported RTSP and felt cheated when I learned it didn't. I'll be playing with Neolink the rest of the day. Thanks.

</comment><comment><USER29> "Charlie is the designer of P2P!!" should be on a shirt.

<comment><USER3> Ha - sort of a shitty version of the DeCSS T-shirts, huh? I love it. Pity nobody would know why it's funny... Or maybe that's part of the appeal. I can't decide.

<comment><USER29> You'd be surprised how many people would get it. This thread has some legs.

</comment></comment></comment><comment><USER23> Hey, I'm in the market for some ONVIF/RTSP IPcams and saw Reolink highly recommended time and time again. Upon seeing how their 8MP cams don't have ONVIF but <=5MP do, I found this write-up just a week or two ago. Really cool work! I hate to say it with the author in the room, but I pretty quickly decided on 5MP to have everything work natively without also running bleeding edge middleware ;)

</comment><comment><USER30> I wonder did the Great Scrambler Charlie read this post. Proper encryption takes time, just XOR it, XOR it all he always says :)

Great job and realy well written post.

</comment><comment><USER31> Things I have reverse engineered in recent memory, that perhaps deserve a write-up.

Nextwave Piranha CNC protocol -- easy, about three days of work Virtucache for VMWare ESXi -- easy-ish, about five days of work to completey take apart SONY camera firmware -- quite hard, about two weeks of work Loc8tor tracking tags - easy once I understood how active RFID works

</comment><comment><USER32> Fantastic read. I feel very stupid now though xD

<comment><USER33> These reverse engineering posts always do that. I'm pretty good at developing software but I see people pull off insane reverse engineering efforts like extracting encryption keys from a chip with 1000 security measures and I wonder if I know anything.

<comment><USER34> Same here! Then I remember that problem to solution only takes a sentence or two in the article, but might be few days of dead ends irl.

<comment><USER35> Absolutely.

I found myself wondering while reading the article what the guys notes look like. Does he screenshot everything and bullet point as he goes along? Or does he hit a logical stopping point and write up what worked from A-B, B-C etc.?

It's massively inspiring though.

<comment><USER3> The screenshots were definitely taken near the end of the project, while I still had it all in my head but before I started writing.

In general, the process looked like:

\- Brainstorm and reverse engineer first. Have in the back of my mind that I'm writing this up, and releasing a tool, at the end. This guides my search: no your reader won't want to desolder something to use their camera, so yes you need to speak the stock Baichuan protocol.

\- As I hit interesting things (like the Charlie Scrambler) start filling out a Google Keep note with keywords that will remind me of them when I'm writing.

\- Take screenshots and produce other media, giving me a rough layout of waypoints that the article has to hit.

\- Write the article, editorializing optional but recommended.

For me, my "writing mindset" is very different from my "engineering mindset." Some days, I can pound out a new piece of code and sometimes it will even be a decent design. Other days, I can write clear documentation. Very seldom can I do both on the same day.

</comment></comment></comment></comment></comment><comment><USER36> Where can I purchase one of those SOIC sockets?

<comment><USER37> I found someone selling them on AliExpress, though at a high price point: [https://www.aliexpress.com/item/4000990317952.html](https://www.aliexpress.com/item/4000990317952.html)

If you don't mind a different style (clam shell), you can get them for significantly less: [https://www.aliexpress.com/item/33025755888.html](https://www.aliexpress.com/item/33025755888.html)

I suspect both AliExpress listings are an order of magnitude more expensive than they can be purchased on Taobao, but then you have to A) find it on Taobao, and B) use a shipping agent in China to export it.

Found a US-based seller who has them for $3/each (min quantity 10): [http://siliconkit.com/ocart/index.php?route=product/product&...](http://siliconkit.com/ocart/index.php?route=product/product&product_id=81)

Ah, the model number is listed on the flashrom wiki: [https://www.flashrom.org/Technology#SO8.2FSOIC8:_Small- Outli...](https://www.flashrom.org/Technology#SO8.2FSOIC8:_Small- Outline_Integrated_Circuit.2C_8_pins)

Edit: Here's the Taobao link: [https://item.taobao.com/item.htm?id=576521466919](https://item.taobao.com/item.htm?id=576521466919)

<comment><USER38> Thank you, I've been drooling over them on Dediprog for a while: [https://www.dediprog.com/category/smt- sockets](https://www.dediprog.com/category/smt-sockets) but their MOQ is slightly offputting; I'd like just a few of each style to have on-hand.

</comment></comment></comment><comment><USER39> How can I get started doing something like this? Maybe there is an ASK HN about this. Can someone point me to that?

I bombed digital systems classes (I didn't actually fail, but I really suck at it) and I want to get better. I give out this info just to relay my feeble grasp at what is happening here.

</comment><comment><USER40> Super cool! I've never done any embedded device work but have an interest.

Seeing the layout of the flash in a straight forward image like this is pretty inspirational honestly. Definitely will be checking out more of his work.

</comment><comment><USER41> For those of us interested in beginning to do RE, what does everyone suggest?

</comment><comment> 4x5-Guy Definitely a blog I'll have to keep track of.

</comment><comment><USER20> Great job!!! open some eyes on video world. Would start to hack my video camera.

</comment><comment><USER34> I don't really understand the busybox step. Can someone expand on what is happening there?

</comment><comment><USER34> I don't really understand the busybox step? Can someone expand on what is happening there?

</comment><comment><USER42> Using binwalk you can unpack existing firmware and later you can build some exec for same architecture (can be MIPS or ARM) and repack in new firmware.

</comment><comment><USER43> Nice work dude!!

</comment><comment><USER44> Brilliant.</comment>


Re-keying every lock in your house all by yourself - <AUTHOR> https://a.wholelottanothing.org/2020/01/12/re-keying-every-lock-in-your-house-all-by-yourself/ <comment><USER2> > The best part was my original key wasn't even a Smart Key, but the existing > Kwikset key that came with the house.

So the old property owner (plus who knows who else) can still get into the place — and through every door with nothing more than what used to be the front door key?

What a missed opportunity.

<comment><USER3> Yeah, that's a big mistake. The author should have at least had a new key cut, preferably one with a difficult-to-pick bitting.

From a security perspective (which is presumably the point when discussing locks), one would use different keys for all doors; or at least for all external doors. I understand the convenience of using a single key, but the author really should have cut a new key instead of using an existing one.

<comment><USER4> >one would use different keys for all doors

This sounds like common sense, but when you think about it, how is this more secure? You're going to store all the keys together anyway, so if you lose them, you lose them all. And it's not like a thief can make a fake key after picking your lock, they have to pick all your locks individually anyway... So how does it help if your front/side/back/garage doors all have different keys?

<comment><USER5> It doesn't. Someone tried to apply digital key management to the physical world, and mapped it poorly. There is zero value in having each door to the same space have different keys. There is some marginal value in having different spaces having different keys (house, storage unit, detached garage), except that generally you will lose the entire key ring when you lose one, so the separation doesn't net much.

<comment><USER6> I like different spaces having different keys. If someone is house sitting, then I can give them the one key they need and not worry about snooping.

Obviously a bad actor could get around it no problem, I'm just keeping out the honest

<comment><USER5> Different keys for what, though? Separate spaces? Sure. Front and back doors? Pointless complication.

</comment></comment></comment></comment></comment></comment><comment><USER7> If you're buying a new house using locks that have contractor keys, you absolutely should rekey your locks, if for no reason other than to remove the contractor key aligned pins. After a quick analysis, my entire subdivision (100+ houses) could be opened with just 6 specifically crafted keys, and each of your neighbors has enough information in their locks to determine how to make those keys.

<comment><USER8> I don't know where you live, but at least here (Italy) locks that have "contractors keys" can only be opened with contractors key until the "proprietor" key is used once (with an "installing maneuvre"), and then contractors key won't work anymore.

What you describe is more like the master key systems (used as an example in some hotels) where there is generally a three level (but there can be more) set of keys, the manager's one (that opens all doors/locks), the maid one (that opens - say - all doors/locks in a floor) and the actual customer one where each key only opens a single lock.

</comment></comment><comment><USER9> Replacing all of your locks doesn't really fit into the category that I'd call re-keying. It might be the way to go for anyone not at all into DIY, but you can buy a Kwikset compatible pin kit on Ebay for under $6 (in the US at least), and it can do several locks.

It looks like the author's total cost was $170, which is probably enough that it would have been worth getting a quote from a locksmith so see if they could have done it cheaper. Especially if you're willing to take the locks off yourself and take them to a hardware store or locksmith.

<comment><USER10> >which is probably enough that it would have been worth getting a quote from a locksmith

He mentions basically doing that:

> I researched getting a locksmith to come out, it would run hundreds of > dollars in their time plus you can only re-key locks to a key made by the > same manufacturer

> I could save money by bringing the locks to a locksmith's store, replacing > off brands with a single brand and re-installing myself, and there are > esoteric expensive kits on Amazon for locksmith-style rekeying, but each > brand requires it's own $80 box of materials plus many hours of practice to > master

<comment><USER5> It does not take hours to master rekeying a lock. It would take hours to do a whole house but probably an hour at most for the first.

</comment></comment></comment><comment><USER11> hmmm... I was trying to understand how the smartkey system worked and ran across this article:

"Millions of Kwikset Smartkey Locks Vulnerable to Hacking, Say Researchers"

[https://www.wired.com/2013/08/kwikset-smarkey-lock- vulns/](https://www.wired.com/2013/08/kwikset-smarkey-lock-vulns/)

EDIT: and then I noticed there is smartkey gen 1, gen 2 and gen 3 so I'm not sure if this is applicable.</comment>


Jack Yufe dies at 82; he was raised Jewish, his identical twin as a Nazi - <AUTHOR> http://www.latimes.com/local/obituaries/la-me-jack-yufe-20151111-story.html <comment><USER2> > "I always thought I picked up my nervous habits from my father – like > fidgeting with other people's rubber bands and pads and paper clips—until I > saw [Oskar]," Yufe said in The Times. "He's the same way."

They were separated at 6 months, is it possible they picked up this trait by observing their father at such an early age?

<comment><USER3> There are several explanations that could serve as hypothesis:

\- it's inherited genetically

\- it's something both their parents transmitted culturally/behaviorally because they themselves converged by living together

\- when you search for similarities between two given individuals you always find some and discard the dissimilarities (it's also a mentalist trick

Each hypothesis seems hard to test/falsify especially with such small samples

<comment><USER4> > it's something both their parents transmitted culturally/behaviorally > because they themselves converged by living together

I very much agree and I think there is even more here: The people in charge of their education (mother, father) weren't "drawn independently", they are two people that chose and love eachother (at least for some time).

People who marry each other tend to come from similar cultural background, or they can share some interests. All of this can then be transmitted to their respective kids.

After all Jack & Oskar's parents probably both liked white jackets before they even met.

</comment></comment></comment><comment><USER5> Except the headline is not true. One was brought up in Nazi society, knowing his Jewish ancestry but kept it quiet.

The other not brought up Jewish and didn't really become part of his life until he was 15.

That is _radically_ different from what the clickbait headline suggests.

<comment><USER6> characterizing being raised by a jewish father as 'raised jewish' is reasonable

<comment><USER5> > Jack knew he was Jewish

Doesn't sound like he spent much time spinning his dreidel

</comment></comment></comment><comment><USER7> Headline: Jack Yufe dies at 82; he was raised Jewish, his identical twin as a Nazi"

First Paragraph: "It sounded like a tabloid headline: Identical twins separated after birth. One grew up Jewish, the other a Nazi."

Wait, what?

</comment><comment><USER8> The revelation of this would have made their family gatherings quite awkward.</comment>


Equifax Data Breach Settlement - <AUTHOR> https://www.equifaxbreachsettlement.com <comment><USER2> I almost froze my credit a week before closing on my first house because of this breach.</comment>


Whole milk compared with reduced-fat milk and childhood overweight - <AUTHOR> https://academic.oup.com/ajcn/advance-article/doi/10.1093/ajcn/nqz276/5680464 <comment><USER2> High fat anything really. Fat has a very high satiety/calorie ratio vs sugars, and metabolizes more slowly, keeping you full longer. This is just shaking off the last vestiges of the 80s anti dietary-fat craze.

<comment><USER3> It's not that simple. Yes, dairy fats lend themselves to satiety but that doesn't mean all fats do. There's lots of unhealthy fats and even some healthy ones that don't lend themselves to higher satiety: take a look at the Holtz Satiety studies: [http://www.mendosa.com/satiety.htm](http://www.mendosa.com/satiety.htm)

They clearly show Croissants, cakes, Doughnuts and even Peanuts have very low satiety. Sure, eggs, cheese and beef do okay, but they're still beaten by apples, oranges, oatmeal and potatoes.

And, let's not loose sight of the fact that health is important too, and there's lots of fats out there that don't do your health good.

<comment><USER4> > Croissants, cakes, Doughnuts

Those things are also loaded with sugar.

<comment><USER5> There are croissant-based-pastries that are high in sugar, but a standard canonical croissant is savory not sweat. It's basically just butter, flour, water, and yeast.

</comment></comment></comment></comment><comment><USER6> One of the lede's that was buried slightly is that "whole milk" is _only_ 3.25% milkfat. So, going from 2% to whole milk is a miniscule increase in the total amount of milkfat consumed.

This surprised many of my relatives when I brought it up with them, who thought it was an increase to over 25% milkfat.

<comment><USER7> Want to add a few things.

>"whole milk" is only 3.25% milkfat

It is only in Canada and US whole milk is 3.25%. In UK, and I believe EU as well it is 3.5%.

>whole milk is a miniscule increase in the total amount of milkfat consumed.

This causes my brain to explode for a bit. A 2% to 3.25% is 62.5% increase in total amount of milk fat. Which is not really minuscule increase. At the same time I totally understand what you meant.

<comment><USER6> It's an increase of 1.25% of milkfat across the entire product. It's one half a teaspoon more milkfat in an 8 oz glass of milk.

As a point of comparison with another milky product - the flavored latte - flavor shots are 1/2 an oz (2.5 tsp) each, and two are added to an 8oz latte.

</comment></comment></comment><comment><USER8> It's good to avoid anything that sells itself as "low-fat" unless it comes that way naturally.

Often you'll find that "low-fat" means high sugar.

</comment><comment><USER9> This could be due to the vitamin additives required for reduced fat milk but not for whole milk in the US. Particularly Vitamin A palmitate, which is a controversial substance due to some cancer correlations in mice.

</comment><comment><USER4> I keep trying to get my in-laws to drink whole milk but they've had it beat into their head for decades that dietary fat = bad so they continue to drink gallons of skim milk. May as well drink water!

<comment><USER10> If they drink gallons of whole milk they will gain weight.

What is the issue with skim milk? It tastes like milk but has less calories.

<comment><USER6> Personal opinion: Skim milk tastes like a distant relative to whole milk. That 3.25% milkfat makes a major change in the taste of the product. It's like adding butter to a recipe - it's the fat that really adds to the taste.

</comment></comment></comment><comment><USER11> So should we keep our kids on whole fat milk, or is 2% good enough? That is, what does the correlation/curve look like? Is the takeaway just that we should avoid fat free milk?

<comment><USER12> You can almost think of fat free milk as juice with protein. both lactose and fructose require the liver to metabolize to glucose. The fat free milk, has some protein to help slow down the absorbtion of the lactose, so it'll be a slower carb than pure juice. The fat slows down the carb even more since the glycemic index of a food tends to be anti correlated with the proportion of carbs to other things (including non soluble fiber). More fat slower carb. Generally the slower the carb the slower the insulin response as well. And it's insulin that triggers cells to ingest glucose. Which means the faster the carb the faster the blood glucose rollercoaster. And the more frequent the urge to eat, potentially leading to obesity (and increasing issues with insulin resistance).

Now having said all that I personally suspect whole milk is the way to go, but I don't know the actual proportion. I'd expect whole milk to be correct for calfs, and if you really wanted to be correct for children, you'd look at the fat content of breast milk.

</comment></comment><comment><USER13> These headlines need help. A laymen's term for "adiposity" could save me a google and it wouldn't hurt my nerd feelings.

<comment><USER14> Changing headlines is discouraged in [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html) ("Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.")

This is a link to a scientific journal, so the context is experts in the field that are familiar with the jargon. If you look at [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3063466/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3063466/) it's a fairly technical term that roughly means "obesity".

<comment><USER15> The title on HN right now is not the title of the article (" Whole milk compared with reduced-fat milk and childhood overweight: a systematic review and meta-analysis").

<comment><USER14> You are completely right, looks like they took the first line of the conclusion instead. Thank you!

</comment></comment></comment></comment><comment><USER16> This makes sense to me. My understanding is that consuming sugar has a much higher impact on obesity then consuming fat, and that low-fat milk usually has added sugar to make up for the flavour-loss from removing the fat. I am not exactly well studied in this area though.

<comment><USER17> I don't think that's the case in the UK at least.

However the sugar level is higher per fixed volume because the removal of the fat increases the concentration of what remains.

<comment><USER16> Perhaps that's what they were saying. My memory of this idea is not great, but it's the same here in Canada as the UK.</comment></comment></comment>


Millions of Medical Images and Data Are Available on the Internet - <AUTHOR> https://www.propublica.org/article/millions-of-americans-medical-images-and-data-are-available-on-the-internet <comment><USER2> As usual for news articles there is little concrete what happened. Is it a single product/storage solution affected? It didn't sound like that. So how did they find so many different systems? Did they program a crawler searching for medical data specifically? Unfortunately I did not find any answer.

<comment><USER3> You expect them to tell you where to find all these still-unsecured images and medical data?</comment></comment>


Does Column Width of 80 Make Sense in 2018? - <AUTHOR> https://hackernoon.com/does-column-width-of-80-make-sense-in-2018-50c161fbdcf6 <comment><USER2> I don't really care how long you make your lines, as long as you put curly braces where they belong - on a line by themselves.

</comment><comment><USER3> No.

</comment><comment><USER4> Yes.

1\. I'm not always on a large monitor. Much of my coding is on a low res 13" cheap dell laptop. In future I'd like to downsize to a 10" machine but this form factor isn't getting much love lately.

2\. Even when I'm on that screen but also when I'm on a much bigger screen at work not everything is full screen. Terminal multiplexers, tiling window managers and multi window text editors are pretty common among developers and anyone using these will often have several code files (>=2) side by side.

3\. My eyesight is starting to succumb to staring at screens all day, bigger fonts are in my future.

4\. Not all text editors and IDE's are good at line wrapping. It's embarrassing how many of them (looking at you Visual Studio) can't wrap as well as vim with:

> :set sbr=\

> :set breakindent</comment>


Against Normalization: The Lesson of the "Munich Post" - <AUTHOR> https://lareviewofbooks.org/article/normalization-lesson-munich-post/ <comment><USER2> >'Putin isn't Hitler!' 'Trump isn't Hitler!' Wow, congratulations! You have failed the most basic lesson of learning from history in order not to repeat it!

>I wrote about this fallacy extensively in Winter is Coming and elsewhere, but am happy to recap it here. Of course Putin isn't Hitler, and Donald Trump isn't even Putin—no matter how much he would like to be. The point is that no one is making comparisons to the monster Adolf Hitler became in the 1940s. But in the 20s, even for most of the 30s, Hitler wasn't Hitler either! There could be no more important lesson to understand than how a race-baiting demagogue came to power in an educated and liberal country like Germany and how he transformed that nation into a fascist death machine capable of World War and unimaginable acts.

\-- Garry Kasparov

<comment><USER3> Zeit has eye opening article Adolf Hitler : "Wait Calmly"

[http://www.zeit.de/wissen/geschichte/2017-02/adolf-hitler- ch...](http://www.zeit.de/wissen/geschichte/2017-02/adolf-hitler-chancellor- appointment-anniversary/komplettansicht)

They describe how journalists, even big liberal newspapers, big-business representatives, and conservatives had all the same illusion that Hitler would be something that could be managed and lived trough. Business leaders and conservatives aligned with him because there seemed to be some common interests they could work trough together.

""In the Frankfurter Zeitung, politics editor Benno Reifenberg expressed doubt Hitler had the "social competence" for the office of chancellor, but didn't think it was out of the question that the responsibility of his office might transform him in ways that could earn him respect. Like Theodor Wolff, Reifenberg described it as "a hopeless misjudgment of our country to believe a dictatorial regime could be forced upon it." "The diversity of the German people demands democracy," he wrote.""

Hitler needed only five months in power to change everything.

<comment><USER4> Let's speak plainly.

Are you suggesting that Trump intends to abolish democracy or commit genocide?

<comment><USER3> >intends to abolish democracy

He don't even know what that is. He has already demonstrated that he was surprised that he can't rule the government as a CEO-king. Bannon believes in big war that cleansing the system, so maybe he does. Attorney General Sessions has shown clear contempt against civil rights.

>or commit genocide?

Of course not. Fascism is not equal to genocide. He want's to kill families of those who he opposes. So he is probably with some mass murders, but I don't think it's on the top of his mind.

Compare two fascist states in Europe, Germany under Hitler and Italy under Mussolini. They took two different paths. In Germany fascism developed without restraints into self destructive expansion. In Italy fascism turned into normal authoritarian rule and dictatorship under Mussolini.

If the assumption is that comparisons to fascists and Hitler all suggest some kind of holocaust, they are meaningless.

<comment><USER4> > If the assumption is that comparisons to fascists and Hitler all suggest > some kind of holocaust, they are meaningless.

They are meaningless.

The Holocaust is the reason everyone still talks about Hitler 70 years later, the reason people still compare politicians they don't like to Hitler.

If you merely wish to discuss "normal authoritarian rule" there are hundreds of other leaders to whom you could make less emotionally charged comparisons.

But I'm curious, now that you've said Trump doesn't know what democracy is and offered a comparison with "normal authoritarian rule and dictatorship under Mussolini" ...

Do you think we'll still hold elections 4 years and 8 years from now and Trump will resign peacefully when his term ends?

<comment><USER3> >The Holocaust is the reason everyone still talks about Hitler 70 years later,

That's vulgar comparison for uneducated people. If the only difference between Hitler and some other dictator is genocide, we haven't learned anything from history.

All fascist movements, Hitler, Mussolini, Franco etc. used similar methods that made fascism different from other dictatorships and authoritarian moments.

Suggested reading: The Anatomy of Fascism, Robert O. Paxton. In that book Paxton rescues the fascism as a concept from a insult into meaningful concept.

<comment><USER4> It easy to make such comparisons to fascism without invoking thoughts of the Holocaust: compare to Mussolini or Franco instead of Hitler.

<comment><USER3> Trump kept a book of Hitler's speeches by his bed, not books of Mussolini speeches.

<comment><USER4> And here again you seek to imply something without actually saying it.

What do you mean to imply by that?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Continuous war since 2001 and all 8 years of the Obama administration is the real normalization we should be afraid of.

<comment><USER6> We should be afraid of both (I would even argue that the Trump phenomenon is a direct consequence of the normalization you mention).

</comment></comment><comment><USER7> As someone from East Europe, I am highly offended by this post. Comparing your shit-show to WW2 is @#$%&*...

Mussolini is much better comparation, but not as punchy.

Trump does not advocate genocide, but enforcement of existing laws (mostly setup by democrats). And author should look where Mein Kampf is bestseller...

</comment><comment><USER8> The last US election can't be described without talking about the loosing candidate. A majority of voters on both side voted, not based on policy, but on emotional hatred towards the other candidate.

To compare it with 1920 Germany, would we have to frame it around the emotional state of both sides. Did the Weimar Republic focused their politics on their hatred for Hitler and his voters? In contrast to the US election, not only did that not happen but when Hitler got elected as Chancellor he did so as part of a minority coalition (41%) where the Nazi party held a meekly three out of eleven seats in the Papen-Nationalist-Hitler coalition. Voter focus seems (as far as historians seems to imply) to be on the treaty and difference between the four political parties.

</comment><comment><USER4> I thought Hacker News was above Nazi-comparisons, but if we are sinking to that level, perhaps we should also compare similarities between left-wing groups engaging in politically motivated acts of violence and the Nazi brownshirts.

For example, consider the group UC Berkeley Chancellor Nicholas Dirks called:

> more than 100 armed individuals clad all in black who utilized paramilitary > tactics to engage in violent, destructive behavior designed to shut [Milo's > speech] down.

[http://news.berkeley.edu/2017/02/02/campus-condemns- violence...](http://news.berkeley.edu/2017/02/02/campus-condemns-violence- defends-free-speech/)

(But I'd rather we avoid Nazi comparisons altogether. They can be an effective way for an author to get attention but they can be used by both sides and they rarely lead to useful discussion.)

<comment><USER9> > I thought Hacker News was above Nazi-comparisons

> [makes Nazi-comparison]

Edit: Parent changed

> Downvoted without response? I guess I shouldn't be surprised, groups that > resort to tactics like those at Berkeley are hardly above trying to silence > discussion here with downvotes.

into

> (But I'd rather we avoid Nazi comparisons altogether. They can be an > effective way for an author to get attention but they can be used by both > sides and they rarely lead to useful discussion.)

The latter I can agree with.

<comment><USER4> I'm willing to engage in discussion at any level the community prefers.

I'd rather not have it at this level but c'est la vie.

Response to update:

> The latter I can agree with.

Are we still flagging political posts here?

Perhaps we could agree to flag Nazi-comparisons, at least.

In that spirit, it's fair to downvote my Nazi-comparison, but only if you also flag the main post.</comment></comment></comment>


Show HN: Create and track access to your Online CV Website Today - <AUTHOR> https://kwickbox.intuitive-web.co.za/ <comment><AUTHOR> KwickBox - The Digital CV Revolution</comment>


Detroit: Decaying, Depopulated, Bankrupt... and a Great Place to Build a Company - <AUTHOR> http://areyouahuman.com/detroit-decaying-depopulated-bankrupt-and-a-great-place-to-build-a-company/

<comment><USER2> >This cost of living calculator shows that you would need to make over $100k in San Francisco to enjoy the same lifestyle that $60k gets you in the Motor City.

So in return for my employer having an excuse to pay me $40k less, I get the benefit of working in Detroit, ranking in at #2 on the list of "most dangerous cities in the US" the last 2 years running[1] (beaten out only by Flint, a mere hour's drive away to the north), with the additional side benefits of "people question your sanity" and a complete lack of other people in my chosen field, outside of coworkers, to meet up with locally, thus creating a situation where if I was discontent with my job I'd need to move across the country in one direction or another (after, presumably, having moved to go to Detroit in the first place).

I can't help but feel like this is a sour grapes article overall. "We can't afford to set up shop in California, but who wants to live there anyways? I'm perfectly happy here where I'm 4 times more likely to be mugged and/or murdered!"

[1] [http://www.fbi.gov/about-us/cjis/ucr/crime-in- the-u.s/2012/p...](http://www.fbi.gov/about-us/cjis/ucr/crime-in- the-u.s/2012/preliminary-annual-uniform-crime-report-january- december-2012/tables/table-4-cuts/table_4_offenses_reported_to_law_enforcement_by_state_illinois_through_missouri_2012.xls) \- Violent Crime divided by Population</comment>


Breaking Symmetric Cryptosystems Using Quantum Period Finding - <AUTHOR> http://arxiv.org/abs/1602.05973v1 <comment><USER2> Is he all "hat and no cattle" or is there some truth to his cowboy, "El Bravado"</comment>


LangSec: Taming the Weird Machines - <AUTHOR> http://blog.jacobtorrey.com/langsec-taming-the-weird-machines <comment><USER2> Stuff like this is a good case of history repeating. The high-assurance systems certified to B3 and A1 had many of the same principles. The system had to be broken into modules, each was implemented in a functionalish way, safer subsets of languages were used, many components were FSM's, all execution states modeled/analyzed, compositions analyzed, and so on.

LANGSEC rediscovered some of these ideas. It would probably benefit from a thorough study of old and current methods in high assurance to supplement what its subfield is doing. Maybe even accelerate it in case something was already achieved. Good news is they're both building tools and getting mainstream attention. Great news, actually. :)

The problem I have is that the use narrower languages thing is mostly talk with little worked examples that people might adopt. The descriptions, like reducing attacker's playground, remind me of promises of MAC, capability systems, language VM's, and so on. Might be a good thing where same solid principles apply yet again but might also show new stuff will be inadequate.

Just not sure at this point. I think the approach taken by SAFE, certified kernels, SVA-OS, and JX is going to end up best route. These raise abstraction up a bit from the machine to primitives with inherent security and safety properties. Then, developer can use high-level language to express themselves with trusted tools converting that to usage of the primitives. Or do it directly like a macro ASM or C library. A language like Haskell, ML, or typed Racket can take over from there with many integrated, Turing-Incomplete DSL's for specific functions. That's how I'm seeing it go if LANGSEC methods go anywhere near real security.

<comment><USER3> There's a funny excluded middle here:

On one side, small high-risk systems should be verified, so LangSec approaches seem archaic and lightweight. We should be advocating higher-assurance testing & verification approaches like model checking, symbolic execution, and proof systems.

On the other side, we see big systems that matter in the aggregate. That means stuff that scales: containerization, DLP + DLP honeypots, anomaly detection, and maybe eventually, information flow security.

That leaves LangSec in a funny place.

<comment><USER4> In a sense, langsec is complementary to verification, as it pertains more to specification than to implementation. Partly it's about using the least powerful level of the Chomsky hierarchy you can get away with, but, if you need to go higher, to do so unequivocally: if you need a CFG, go for a CFG, don't try to wing it with a regex.

<comment><USER3> Sort of. For example, instead of langsec, why not stuff the parser into a module, and implement higher-order contracts at the module boundary? At that point, we get dynamic enforcement of much richer policies, and model checking of richer static ones.

<comment><USER4> You still need to think of what's inside the module and how it behaves. It's nice that a contract allows you to, say, kill an attempt at denial of service that messes with the parser, but it's better to make your parser resistant to denial of service in the first place.

In fact, at the design level, you need to consider making whatever language you'll have to recognize as simple to handle as possible, with a recognizer that has the least computational power possible.

In a real application example, it would be great to isolate the ASN.1 parsing in TLS in some sort of prison, guarded by ruthless guards charged with blowing the parser's brains out if it so much a looks the wrong way. But it would actually be better to use a language that can be parsed with a simpler automaton that is more amenable to verification and inspection, because even if you hold a gun to its head, the parser can still give you the wrong answer.

<comment><USER3> If someone is running verifiers on the contract language, or worried that their policies are wrong, they can restructure the underlying code or the policies. You're assuming the only verifiable things are parser languages from the 70s.

<comment><USER4> In many cases you just _have_ to parse stuff (using a recognizer). If you want to verify that your parser is, in fact, parsing the right way, then you have to look at it formally.</comment></comment></comment></comment></comment></comment></comment>