One college town's uneasy embrace of drinking - <AUTHOR> http://chronicle.com/article/A-River-of-Booze/150221 <comment><USER2> _She runs "bartending school" for incoming students during mandatory orientation sessions at Georgia. Handing over a vodka bottle full of water, she asks them to pour what they think is one drink into a 16-ounce cup. After a discussion of alcohol's physical effects and consequences, she empties the cups into two-ounce shot glasses. What seemed like one drink is often two or three._

In normal countries, teenagers start drinking in a supervised environment (read: Mom and Dad, who won't appreciate that Sonny threw up in his shoe _again_ because he came home way too sozzled to find the toilet bowl), and they start on beer and wine, which makes it much more difficult to overdose. In America the infantilized teenagers go off to college and then proceed to black out on spirits, because spirits are easier to smuggle into the dorm. What could possibly go wrong there?

Also: the American problem of trying to get on top of alcohol abuse by limiting availability, when you would rather limit damage and trust peoples' responsibility. Why not hand out serious prison time for first-time drunk drivers? It would increase road safety so much.

<comment><USER3> > Why not hand out serious prison time for first-time drunk drivers? It would > increase road safety so much.

Research suggests that you might be wrong.

[http://fivethirtyeight.com/datalab/twitter-politics- drunken-...](http://fivethirtyeight.com/datalab/twitter-politics-drunken- driving-and-tax-deductions/)

> Key quote: "Harsher sanctions to drinking and driving may generate no > marginal deterrent effect if drivers' perceived risks of receiving the > punishments are low. Therefore, rather than escalating sanction severity, > increasing the probability of detection and/or enforcement may be more > effective in reducing drinking and driving."

<comment><USER4> This is a purely anecdotal response but I live in Texas now and come from Canada where the punishments for drunk driving are very severe. In short I am absolutely floored by the casual nature of drunk driving here, across all segments of society compared to Canada.

In Canada my very alternative friends to whom casual law breaking like illegal drinking and drugs would be nothing, would almost universally never consider drinking and driving.

In the US those same type of friends seeming drink and drive 5-6 days a week, often after consuming amounts of alcohol I consider ridiculous. Additionally I regularly interact with professionals and even professors who drink and drive.

This is purely my opinion, but the difference I experience here is outa control when it comes to drinking and driving and I do think the harsh punishments have something to do with it.

<comment><USER5> Texas is not realy the USA, they don't like much law and taxes. Most states come down hard on drinking and driving.

<comment><USER6> _Texas is not realy the USA..._

An attractive sentiment in general, but it's not true. Texas is just like every other state, in that they spend way too much on the "enforcement" of drunk-driving laws. The reason is obvious: local police and sheriffs get the same ridiculous federal grants that LEOs in all other states get.

EDIT: Congratulations to Louisiana, I expect they laugh at Texas' patchwork of dry and "partially-moist" counties.

<comment><USER5> Louisiana back in the 80s/early 90s had very lax drinking laws: the drinking age was 18 and they had "drive thru" daiquiri stores. I think they gave that up for highway money, but the culture still hangs around.

In contrast, many states in the north are now zero tolerance states. The limit is quite low, and the penalties are quite harsh. Well, that pales in comparison to Japan, where you would probably lose your job if caught (and they have a very low limit also).

<comment><USER7> Indeed, Louisiana still has drive thru daiquiri places. They just put a piece of tape over the straw hole in the lid as they hand it to you.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Overdrinking is a problem that I only think is going to get worse until there's some serious changes made to how drinking is treated legally.

When I was in college, I was a part of my fraternity's "risk management" team, a group of brothers whose only job is to stay sober during parties, find people who had drunk too much or more commonly people who had completely blacked out and hush them off away from the alcohol or to a safe part of the house where they could be watched for signs of alcohol poisoning and kept safe from being taken advantage of.

If there's any one trend I've noticed while I worked risk management at those parties, it was that the more taboo it is to drink alcohol, the more that people binge drink it. It's always the students whose parents were the most uptight about drinking or those who couldn't purchase alcohol yet who were the biggest binge drinkers and most common to pass out. There was one period during which there was a university crackdown on drinking at fraternity parties, and the most noticeable thing during the crackdown was that people would drink a -lot- more.

The amazing part about it was when people turned 21, it was like they became seasoned drinkers over night. People who had problems pacing themselves during every party would instantly turn into a moderate drinker once their 21st had passed.

I think it would be very interesting to see some studies done on the taboo of drinking and whether it changes people's likelihood to overdrink, because it seemed with every crackdown measure the local police force took against drinking at parties, the problem only got worse.

</comment><comment><USER9> The solution to this is to start drinking beers with your kids at age 10. This way drinking will be the most uncool thing ever, and they'll grow up to be teetotalers.

Seriously though, we need a culture change. You can't tell them they can never drink, then turn them loose in another city by themselves and expect it to not be taken to extremes. That's pretty dumb.

<comment><USER10> This is actually allowed in some states. There's doesn't seem to be any particular pattern to which states allow it and which don't, eg stereotypically liberal California has the same ultra-strict requirements as stereotypically conservative Kentucky. Here's a neat summary of the different exceptions to the 21-year minimum age rule, broken out by state.

[http://drinkingage.procon.org/view.resource.php?resourceID=0...](http://drinkingage.procon.org/view.resource.php?resourceID=002591)

<comment><USER6> _3\. for religious purposes in 26 states_

Haha, I guess all the Catholic churches in the other 24 states will get raided next time they have a First Communion. This is just one example of how unreliable these sorts of comparisons are.

<comment><USER10> Not necessarily. When I was growing up in Catholic Ireland we used to eat the communion wafer but only the priest drank the wine - more because it would have been impractical to serve to hundreds of people than any other reason, but also partly from hygiene considerations. I asked our priest about it once (I was an alter boy) and his response was that it was just too much hassle and they were glad to abandon the practice. Back then churches used to be packed 4 times a day on Sundays so I can see how it would be a headache. I used to get hand cramps from holding the little metal plate under people's chins to prevent the communion wafer falling on the floor.

<comment><USER11> Between the Council of Trent and about 1970, the Roman Catholic laity took communion in one kind only, and the chalice was reserved to the priests.

<comment><USER10> Interesting! They kept that up for a long time afterwards in Ireland, at least to the late 1980s (which was when I stopped going to church). I've occasionally been to a Catholic church in the US (weddings, funerals although I'm an atheist now) and it was quite disorienting to be offered the wine at Communion.

<comment><USER6> I'm similarly apostate, and I'm quite sure you're not welcome in the communion line as an atheist.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> "Even going to the tape, though, is not always enough. The mother of the guy in the Santa suit maintained that the police should've taken her son, who eventually passed out, back to his room, not to jail. Recounting the story, Mr. Williamson looks momentarily exasperated. He tried to explain, he says, that her son was safer sleeping off his drunkenness under supervision."

It seems the LEOs cannot win when dealing with a mother who 'knows best'

<comment><USER13> Well, considering he's one of the three people arrested per weekend out of "thousands"... it's arbitrary and ineffective.

<comment><USER14> Three people arrested for doing things considered over the top (e.g. passed out on a park bench, breaking in to a dorm of the opposite sex) out of thousands _of drinkers_ \-- who they do not enforce drinking laws on.

</comment></comment></comment><comment><USER15> I went to UGA my freshman year. Compared to other campuses where the parties are at fraternities or private residences, Athens is a bar (and, as the article points out, a fake ID) town.

It was very much a wink-and-grin environment: the "bad photocopy job pasted onto a McDonald's gift card" description is very apt. Some bars were tougher than others, but for a guy, showing up with a favorable distribution of girls would cause the bouncer to look the other way.

It's obvious and egregious (UGA suspends open container laws on gamedays), but as the article's subjects and other HN posters point out, the problem is not bars and fake IDs, and more college students' drinking problems. (Which exist at fraternities, house parties, and other venues as well.) To that end, I laud the focus on safety, education, and one-strikes over just pushing the "scene" underground.

<comment><USER16> (Re open container suspension) A few years ago I paid a $280 fine for walking an open beer across the street in Athens. To this article's point I think the cops pick and choose as to where they may be most effective at a given point in the day, the beer didn't have a label on it (I brewed it) and the cop may have thought it looked odd.

Although the town has stayed the same since my years in Athens, I do think there is an uptick in underage drinking in general, or at the least a larger movement to drinking harder spirits. Personally, I think there is a larger mention of liquor by name in today's music than there has been in the past and that plays a part.

</comment></comment><comment><USER11> Until the beginning of the 1980s, 18-year-olds could drink at least beer in most states. In New York they could drink hard liquor, in Colorado 3.2 beer, for example. Then the Reagan Administration decided that stopping under-21 drinking would reduce traffic deaths as much as mandatory airbags. States that did not raise the drinking age would lose highway funds. By the mid-1980s, the drinking age was 21 pretty much everywhere.</comment>


NASA is looking for a Sr. Django dev - <AUTHOR> http://twitter.com/#!/gretcurtis/status/10835871246848001 <comment><AUTHOR> i wonder hows it like working with NASA but i'll envy the fellow, by default</comment>


Make Me a Hanzi – Free, Open-Source Chinese Character Data - <AUTHOR> https://skishore.github.io/makemeahanzi/ <comment><USER2> This looks pretty great. In learning Chinese last year I was surprised at how few good resources there were available online.</comment>


For years, Guatemalans traveled thousands of miles for jobs in Mt Pleasant, Iowa - <AUTHOR> https://www.bloomberg.com/news/features/2018-12-27/two-towns-forged-an-unlikely-bond-now-ice-is-severing-the-connection <comment><USER2> I love the Casablanca style "what, we have illegal immigrants here" put-on.

The situation is a joke. The meat industry broke the unions and shipped out jobs to nowhere decades ago, empowered by federal and state policy. You really need to have your eyes closed to not know that if you're a state representative!

<comment><USER3> Just moved from Iowa to the Bay a couple months ago. You're right, they know. From the federal level on down to the local, everyone knows that immigrant labor keeps rural communities going in Iowa.

It's the worst kept political secret in the state, and I'd guess other states too.

When an immigration raid occured in Postville, Iowa in May of 2008, it devastated the local economy. The chief executive of the plant was actually charged and convicted on other crimes (commuted by President Trump last year). The city council called it an economic and humanitarian crisis.

Residents of the two counties Postville resides in voted almost 2 to 1 for President Trump.

<comment><USER4> >everyone knows that immigrant labor keeps rural communities going in Iowa

What? I know people who made $30 an hour with full benefits in the 70s doing those jobs. It amazes me people can claim to support the poor/middle class and illegal immigration at the same time

Illegal immigration killed those communities by driving down wages and forcing people to go to college and move to a city to find a job that provides a living wage. The result is the death spiral of many rural communities as young kids are forced to leave

I won't blame illegals completely, big business and corporate farms are the ones that pushed for it in the name of better profit margins for investors

<comment><USER2> Yes and no. They made $30/hr in Des Moines or Chicago or other cities. There were profitable union slaughterhosues in New York into the 80s. Slaughterhouses were moved out to the country to break the unions, period. "Saving money" by being closer to farms is a contrived argument. A good place to start is the book "Fast Food Nation".

Illegals are a symptom. The problems are industrial facilities with heavy manpower requirements, high turnover, designed to operate in a way that guarantees chronic medical problems with workers, placed in places with no people.

The big waves of Mexicans chose to move to places like rural Iowa in the 90s not out of a desire to break their bodies hacking at meat at high speed, but because trade policy flooded cheap corn into the market and exploded the Mexican agricultural economy.

Rural communities have been conned hook line and sinker. Their death began when the alliance between western resource barons and southern democrats (ie segregationists) began with Nixon. Trade policy, financial sector consolidation, offshoring of industrial economy dug the grave.

I grew up in a beautiful northeast rural community. It's a shell of what it was when I was a child. All of the dairy operations are gone, and most of the full time farms will cease operations when the owners retire. The economy runs on social security, public assistance, government workers commuting up to 90 miles away, and a couple of small industrial operations. Nobody with any ability will stick around, and that has nothing to do with people trying to escape life in Central America.

<comment><USER5> It occurs to me that if there had been a border wall, companies couldn't have utilized underpaid immigrants to break the unions up.

<comment><USER6> A theoretical perfect wall sure. But it's the nature of long walls that they 1000s (if not more) times cheaper to defeat than build. Witness the various tunnels, drones, ladders, and even catapults used to cross the existing border fences.

<comment><USER5> Well, I watched a wall defeat a caravan of migrants on TV back in November and December...

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > "When you walk out here in the central park, if it's a warm day, they're > sitting around on benches out here. I mean, it's like Europe. They don't > stay in their apartments. They come out in the street, and they sit around > and talk, and it's all in Spanish. I don't hear any English." This bugs > him...why don't they embrace Mount Pleasant?

Sounds like they _are_ embracing it — in fact they are using the parks rather than hiding in their apartments. What's his _real_ issue?

<comment><USER8> > But why don't they embrace Mount Pleasant? "Don't get me wrong," says > Heaton, who'll retire from the legislature in 2019. "The only thing that > upsets me is if they're coming, they need to blend. I don't need 'barrios.' > I don't need these certain sectors where everything is still the way it was > where they came from. If you're going to meld, then meld."

While it's a good thing that he wants the population to assimulate, it's disturbing that he considers the lack of English to be a problem.

<comment><USER9> Many countries require you show proficiency in the country's native language to acquire citizenship.

The desire to assimilate as well as having the ability to communicate with your fellow citizens should be mandatory for those who a pursing naturalization.

<comment><USER10> Over the holiday, I went through some old family stuff. There is a certificate attesting to great-grandparents' marriage from a church in Indiana ca. 1881. The document is entirely in German. Both parties had been in the US for several years by then. Now, their children grew up speaking English (and Platt-Deutsch), and any of their grandkids who knew German learned it in school.

<comment><USER9> Interesting from a historical perspective, but an anecdote doesn't make for good input when setting public policy, especially with it being almost over 140 years ago.

<comment><USER10> The comment I responded to said:

>> Many countries require you show proficiency in the country's native language to acquire citizenship. The desire to assimilate as well as having the ability to communicate with your fellow citizens should be mandatory for those who a pursing naturalization.

My point was that the use of Spanish/German/Chinese/whatever in conversation with other native speakers of that language does not per se indicate unwillingness to acquire English or communicate in it, or reluctance to assimilate. I did not intend to say anything about public policy, and really I don't see that I did.

<comment><USER10> I also don't see how I posted twice, but let that be..

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> For more on this, check out the PBS Frontline on child slave labor in an Ohio egg farm: [https://www.pbs.org/wgbh/frontline/film/trafficked-in- americ...](https://www.pbs.org/wgbh/frontline/film/trafficked-in-america/)

</comment><comment><USER12> This makes the long trip by the Guatemalans understandable, the lack of interest in politics by the main immigrant father is surprising though understandable - he can't do anything about it. On the other hand, if in the past we just placed juveniles with anyone as described, there's an incentive to risk it all and just send the kids for those stuck in poverty without hope. It's complicated and I can sympathize with a lot of ideas about immigration in this particular circumstance - though the companies moving jobs close to the farms in very rural areas and changing the work and not wanting to pay enough for citizens to take the job bears the brunt of the responsibility and in our political system they almost never do.

</comment><comment><USER13> Where are the arrests of the _employers_?

Until that happens, this is all a charade.

<comment><USER14> As an outsider this boggles my mind. Why not just implement strict employment verification instead of walls ect. what i am missing here.

<comment><USER15> We have that, but if the name given by the worker matches the social security number given by the worker, "nothing more can be done" and everyone looks the other way. Example: [https://www.desmoinesregister.com/story/news/crime-and- court...](https://www.desmoinesregister.com/story/news/crime-and- courts/2018/09/05/mollie-tibbetts-murder-defendant-bahena-rivera-mexico-used- alias-john-budd-employment-records-farm/1207117002/)

<comment> barry-cotter [https://en.wikipedia.org/wiki/E-Verify](https://en.wikipedia.org/wiki/E-Verify)

> Research shows that E-Verify harms the labor market outcomes of undocumented > immigrants and improves the labor market outcomes of Mexican legal > immigrants and U.S.-born Hispanics, but has no impact on labor market > outcomes for non-Hispanic white Americans.[4] A 2016 study suggests that > E-Verify reduces the number of undocumented immigrants in states that have > mandated use of E-Verify for all employers, and further notes that the > program may deter illegal immigration to the US in general.</comment></comment></comment></comment>


Ask HN: Moving away from contracting toward income generating apps & services - <AUTHOR>

I'm a web developer with a CS degree. I've spent the last 2+ years getting into a position where I have enough experience and skills to make a living freelancing. Unfortunately, I've also come to realise that I really dislike freelancing and I'm simply not happy being a developer - it's not what I want to do professionally and not where my interests lie.
While I decide on what I do want to do (potentially going back to college for example), I want to greatly reduce my hours freelancing and invest that time into developing some small projects with the intention of generating some sort of income to sustain me. I like working on my own projects but I don't have any previous real successes or any immediate ideas on what to do.
I know there are a lot of people who are making their living selling their own products (be them apps, services or physical products) and I'd be interested to see if any of them came from a similar background and what advice they might have. <comment><USER2> I am in the middle of moving from freelance to my own apps. I found it much more difficult to make what I want. Since there was no deadline and no goals to meet (other than what was in my head) it was very easy to go off the path. Things took longer than expected and my monies burned up. I would say make sure you have steady income before you fully give up working for others. The short answer is make sure you have the money to get you through the transition, otherwise you will have to take on more work and that will slow you down.

<comment><USER3> I agree. I think it becomes easier to self-manage when letting others in your life know about goals and deadlines. Let friends, colleagues, family members, and so on know about your decision. Make a blog or other public / external facing deadlines - this makes you accountable for actions. Collaboration is key, find a friend whose also on this endeavor - it could be someone miles away but the key is to have checkins and feel like you are responsible and accountable for something.</comment></comment>


You know you work for a startup when - <AUTHOR>

You know you work for a startup when... <comment><AUTHOR> ...you overhear someone challenging someone else to a math-off.</comment>


Vote from Abroad: Absentee Ballots for US Citizens - <AUTHOR> https://www.votefromabroad.org/ <comment><AUTHOR> I used this site because I am an American citizen living outside the country, but even if that doesn't describe you I encourage you to click through the forms to see the attention to detail given to details of internationalization. When you enter your address there's a button that says "I need to use a different format", when you enter a date in an ambiguous format there's a modal that pops up to ask "Did you mean Month/Day or Day/Month?" It's honestly pretty moving, given that US government forms - even electronic ones - <USER2> awful by comparison, and even more professional forms are never this good in my experience.

</comment><comment><USER3> There are limitations:

[https://travel.state.gov/content/travel/en/international- tra...](https://travel.state.gov/content/travel/en/international-travel/while- abroad/voting.html)</comment>


Modern terminal-based text editor - <AUTHOR> https://micro-editor.github.io/index.html <comment><USER2> I would suggest that, to replace nano, the #1 feature missing is: always show the most used keybindings at the bottom, just like nano does. IMHO the top feature of nano is that you don't need to remember commands and keybindings at all, the most important things you need are always reminded to you.

<comment><USER3> I have to say that is actually the main reason why I would be using nano. I know the basic commands for vim, as well as some extended keys for nano (save), but nano really helps for being able to not spend time outside of development to find keys for critical functions. Micro does have a help option, which is haven't really read, only briefly checked out the exe a few hours ago.

I wouldn't call it critical, but it really speeds up the learning process, or for users thst only use the program once in a blue moon (because GUI)

</comment></comment><comment><USER4> This looks like it's aimed at being a better nano, not a better vim.

I like it a lot; I wouldn't be sorry to see it take off and get included in OS X, major linux distros, etc. Because right now if you don't want to use vi/vim, your only reliably available option is nano, and nano is a _terrible_ editor.

<comment><USER5> It's 10MB uncompressed so at that point I'd hope Emacs would have finally become a "reliably available option" first (13MB on my system).

EDIT: why the downvote? Not trolling, just genuinely sad that with today's hard drive sizes it's not a given that Emacs is available virtually everywhere, like vi or nano are.

<comment><USER6> While emacs is a terrific editor (or platform for editors), it is not easy to use. It has a unique set of keyboard shortcuts, which means that for most newcomers, their familiar hotkeys or key combos will do things that they don't expect.

A modern, straightforward CLI editor would help many people.

<comment><USER7> Emacs has a GUI with icons and menus and tooltips and all that.

Isn't that what a true beginner would use anyway instead of the terminal version?

<comment><USER8> We're talking terminal (not GUI) editors here. If I fire emacs on macOS there's no menu displayed by default. If I connect remotely on a Debian machine, the menu is there but mouse reporting is not working. The help, if started by itself, vanishes at the first keypress (on macOS), which makes it really easy to skip the C-x C-c part, and uses the emacs-only convention of C- instead of the well known ^ for control (although it's explained right there), thus doubly easy to miss. I can see how newcomers would be turned away from it.

<comment><USER9> vi(m) is usually included by default and is no easier to use for a beginner, so why not emacs?

<comment><USER8> `apt-get install emacs-nox` pulls in 83MB on jessie. The installed-by-default one is vim-tiny (clocking in at 27MB), not vim-nox (which pulls in an additional 21MB), for which there is no similar emacs package. Turns out nano is ~370kB, that makes for a small non-modal beginner editor, the modal one being covered by vim-tiny.

<comment><USER9> Fair, but I don't think 20MB vs 80MB should be a problem in 2017, people are downloading ~60GB games off Steam, downloading a ~5GB ISO every 6-24 months is not that much in comparison.

<comment><USER10> For some people on the move data transfers are expensive, even if 80MB isn't much that adds up very fast.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> From the github repo:

> As the name indicates, micro aims to be somewhat of a successor to the nano > editor by being easy to install and use in a pinch, but micro also aims to > be enjoyable to use full time, whether you work in the terminal because you > prefer it (like me), or because you need to (over ssh).

<comment><USER12> Just in case people are still making decisions about _needing_ to use an editor because you are doing something over ssh.

Learn about sshfs! Use your preferred editor (or any program) locally for files you have ssh access to. It's not the right solution for everything, but for me it is for most things.

<comment><USER13> You don't even need sshfs. Both VIM and Emacs support network transparent file editing.

        :e scp://firstname.lastname@example.com/path/to/file

        C-x C-f /scp:firstname.lastname@example.com:/path/to/file

But the real magic on Emacs is using dired remotely.

<comment><USER14> I had to chuckle.

On the one hand, this comment is brilliant, because it's a concise piece of esoteric information. High signal-to-noise! And even though I won't remember the details, I suspect that next time I have a use for this information, I'll remember enough to google it.

On the other hand, if vi or emacs is the editor you want to use, you're almost certainly not the person who chooses their editor based on trying to figure out the least painful editor that'll work over SSH and will now be relieved to use micro (rather than one of those annoying options that's already there).

Though maybe that was the joke. In which case, ya got me. Zing!

</comment></comment></comment></comment><comment><USER15> Has anyone ever thought that the MS-DOS editor was one of the best CLI editors for complete beginners? I've always been disappointed that *nixs never ended up with something similar to edit. I suspected that irssi replaced ircii in a big way due to sane defaults, ease of configuration and a dash of color and I wondered if nano could've been replaced by similar principles.

<comment><USER16> At first I was going to agree with you, but I think this largely may be an artifact of where and how you started (and me too).

Text-based console editors I think are fundamentally unintuitive and make you learn a lot of different bizarre keystrokes that don't really map onto easy mnemonics or have much actual meaning, so I do kinda wonder if one set is better/worse than another.

</comment></comment><comment><USER17> "Micro's number one feature is being easy to install (it's just a static binary with no dependencies) and easy to use."

Ok after reading that one sentence I just closed the page. Why would I want an editor whose number one feature is "easy to install"? Like any other editor is hard to install by the way.

<comment> cup-of-tea Very ignorant comment. Many people work across multiple machines (hundreds) which they do not own and cannot spend time "setting up" on each one. "Easy to install" means one can start editing with it in seconds. Do you really think compiling a local copy of emacs or vim on some strange machine counts as "easy to install"?

<comment><USER17> Compiling vim? Where do you not have Vim by default? Or could not install it with the default systems package manager?

I seriously did not ever login into a system that does not had vim installed, excluding windows obviously, but how many of us have windows servers to manage..

<comment> cup-of-tea I've certainly logged on to places without vim. They probably have vi, though.

<comment><USER18> unless you're on a vax machine or something similarly ancient anything that says vi is actually vim.

<comment><USER19> Well, it's usually a trinmed down copy of vim, right? I just do a quick alias vim=vi and carry on.

</comment></comment></comment></comment></comment></comment><comment><USER20> I wonder what the target audience is for an editor like this is.

Most folks who use Vim/Emacs seem loyal to their editor and are not in much need of alternatives. Those who don't have plenty of graphical ones—Sublime, VS, Atom.

<comment><USER21> I'm a pretty hardcore Emacs user, and I'll just come right out and say it: I hate Emacs. However, the only thing I hate more than Emacs is anything else.

I tried to move to Atom, because I've heard good things, I read you could extend it in JS and that sounded good to me. The difference between customizing Emacs and customizing Atom could not be more night and day in my experience. Emacs is like a living thing, as crazy as that sounds. I feel the urge to make a slight customization to a key (which happens often) I just ask Emacs what function the key is executing and either wrap it in a custom function, or advise the function. I usually write and eval these customizations in the scratch buffer.

Meanwhile, Atom makes me restart to get any changes detected. There wasn't any live documentation system that I could find (which is something I can't fathom not having now).

Emacs, in terms of customization, is simply light years ahead of absolutely everything else. It's absurd to me that we're still stuck with it because seemingly nobody who wants to make a text editor has learned the lessons it has.

<comment><USER22> I'm in a pretty similar situation with Vim. I don't hate it, but compared to modern editors like Atom and Sublime I feel like I'm missing out on some features. Things like visual find and replace through a whole project, tight integration with Git, looking a lot prettier (even with a true colour terminal) make me a bit envious. And sometimes Vim just feels slow and laggy to me (I tried Neovim briefly but didn't notice any difference).

Vim is very powerful so although it hasn't got features like visual blocks, you can do pretty much the same thing with macros and shortcuts - as long as you know and remember them, but that's the tricky part... Somethings it would be nice just to click a menu to find that feature you use one a month.

I tried switching to Atom but then got lost and felt it was no way near as powerful as Vim out the box (even with the Vim plugin), so here I am stuck with Vim :-)

<comment><USER23> > Vim is very powerful so although it hasn't got features like visual blocks

Vim has visual blocks? Ctrl-v. Did you mean multiple cursors?

</comment></comment></comment></comment><comment><USER24> We need a better cross-platform _terminal_! Not editor. The current state of cross-platform terminals is fairly poor. Other than Alacritty[0] there hasn't really been any new innovation here.

[0] [https://github.com/jwilm/alacritty](https://github.com/jwilm/alacritty)

<comment><USER25> Actually, I collect new terminals as a hobby and the list is pretty long:

[https://github.com/evmar/smash/wiki/Related- projects](https://github.com/evmar/smash/wiki/Related-projects)

<comment><USER24> What do you recommend for cross-platform, easy to use, nice-looking terminals?

<comment><USER26> Termius.com I've come to enjoy, it is an electron app but has been reliable on Android, Ubuntu, Win7 & chrome (although chrome app is going away) on Ubuntu it does leverage snap like this editor.

<comment><USER27> I have termius on my iPad and I don't find it very convenient to use. It lacks a bar with quick access to many special keys we use often.

</comment></comment></comment></comment></comment><comment><USER28> I understand how rewriting the wheel to thoroughly learn a new language can be exciting, but please avoid the "betterism". No, just because you've rewritten something in go doesn't mean it's better, it's just a case of building your little space where you can claim cred.

<comment><USER9> Fair point, but it _might_ be better, so without comparing nano to micro yourself, it's hard to judge them, but it's true that 'better' is very subjective.

</comment></comment><comment><USER29> Random request but I'd love to see a video of someone using it. That's what sold me on VIM and on Emacs: just seeing someone power use it and love it.

<comment><USER30> Not for this editor, but here's a really impressive introduction to Kakoune, another small but excellent app

[https://github.com/mawww/kakoune](https://github.com/mawww/kakoune) [https://vimeo.com/82711574](https://vimeo.com/82711574)

<comment><USER31> This. I'm a loyal Emacs user (used Vim a couple years before migrating to Emacs and always kept it around) but I must confess: I'm in love with kak.

It's not Emacs (although it is powerful) and will probably never be (even more so to a lisper) since it doesn't try to. But it is easy and minimal, which gives me some pause after long Emacs hours.

I was very impressed to find that it has some degree of integration with tmux and with ranger, both tools that I love, to do window splitting and file management respectively. So clever and such a strong setup for a newcomer!

I don't really feel it as a competitor and I still do work in Emacs, but it became my default terminal editor and my fallback $EDITOR. Knowing vim made things a lot easier and everything that I discover about it feels like an improvement. Highly recommended.

</comment></comment></comment><comment><USER32> The source code for this is a really nice read, I just read the whole cmd/micro/micro.go like some prose. But one thing jumped at me:

      if err != nil && !strings.HasPrefix(err.Error(), "function does not exist")

I wonder why most modern languages don't provide symbols a la Lisp or keywords a la Ruby, which would allow the above comparison to be a pointer comparison instead of a stribg one.

Edit: add the missing "don't" before "provide symbols".

<comment><USER33> How could it be a pointer comparison? It's checking that the string has a prefix, not that the strings are equal.

<comment><USER34> The prefix check in this case is used as a means of typing the error, which many Lisps do via symbols.

</comment></comment></comment><comment><USER10> It's a great editor,not everyone needs the superpowers of vim, the best part is that it's very easy to customize since Go is a very readable language (not on the level of Python but still).

</comment><comment><USER35> One thing micro does very well is scrolling like GUI editors. It doesn't move the cursor with the scroll, and it will 'snap' back to where the cursor was if you begin to type. Always hated how other terminal based editors move the active cursors down/up on scroll.

</comment><comment><USER36> Extremely good text editor. Highly recommend. Other people think it's vim and then they think I'm a better programmer than I actually am.

<comment><USER37> How strong is this bias? There are plenty of bad programmers who use vim (usually not well, though).

</comment></comment><comment><USER38> I always mention [https://github.com/tombh/novim- mode](https://github.com/tombh/novim-mode) when this topic of 'normal' terminal-based editors come up.

I very much agree with the sentiment of Micro here - I'm very much of the Sublime/Atom ilk, but I also love living in tmux and my editor taking up minimal resources. So in the same way that you can introduce `vim-mode` into browsers (a la Vimium), you can introduce conventional `non-vim-mode` into Vim. Vim already has so much support for plugins, perhaps unprecedently so, then we can take advantage of that without creating a whole new editor.

</comment><comment><USER39> One small missing feature I noticed is when I have my cursor over a parens (or bracket, or brace) it does not highlight the matching parens.

</comment><comment><USER40> So...the look of Vim/Emacs without their advanced editing features?

(sorry for being so negative; this page really could benefit from a demo video)

<comment><USER41> This is what i gathered as well? Maybe an alternative for nano-users? I'm not sure which space this editor tries to fill. Non the less fun project and always interesting to see new terminal based applications.

<comment><USER42> Are there nano users out there?

It's an ok editor to throw in the face of an unsuspecting random person, much better than both vi and emacs. But it's an absolutely horrible choice for constant usage.

<comment><USER43> I use what I get, if I have a nice config with Vim, I'll use it (badly, but it works well for me). Most of the time I'm happy with nano, assuming it's a one time edit thing like /etc/hosts, or I'm copy-pasting something into a file.

</comment></comment></comment></comment><comment><USER44> I have it installed, and it's fine for quick file edits.

It's also been mentioned a few times here on hn.

[https://news.ycombinator.com/item?id=12388654](https://news.ycombinator.com/item?id=12388654)

[https://news.ycombinator.com/item?id=14427473](https://news.ycombinator.com/item?id=14427473)

[https://news.ycombinator.com/item?id=13735395](https://news.ycombinator.com/item?id=13735395)

[https://news.ycombinator.com/item?id=13636239](https://news.ycombinator.com/item?id=13636239)

[https://news.ycombinator.com/item?id=13633578](https://news.ycombinator.com/item?id=13633578)

[https://news.ycombinator.com/item?id=13300940](https://news.ycombinator.com/item?id=13300940)

</comment><comment><USER45> Micro is very good. I've been using it for a few months as my default Git commit editor, and it works wonderfully.

</comment><comment><USER46> Nice! But hey, rebinding control-z to redo in the examples? How's that for terminal convention compliance?

</comment><comment><USER47> We keep hearing about network effects in social media networks, but as an Engg who works with multiple systems (personal, work, EC2, EMR, etc etc.) I do feel that when it comes to text editing tools as well, there is a network effect that comes into play.

The only reason for me to switch to a different editor is if a majority of the systems I use have it preinstalled. Which means barebones vi/vim is still my best bet. My personal .vimrc is modified for my daily workflow, but doesn't stray too far away from barebones vim so that I always feel "at home" no matter which system I am on.

I've tried moving away to different editors, but find myself comign back to vim fairly quickly just because it is available everywhere!

</comment><comment><USER48> Looks interesting. Linux way seems to be snap or source... but snaps give this error after install:

        micro
        snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks

I've never used snaps before anyone know why this is? I used the classic mode like it says in the readme

[edit]

... nevermind, apparently snap just commonly does this with everything, great first experience with snap, back to apt.

<comment><USER49> Seems you're on Debian. ATM, confinement doesn't work there, though they promise to fix it soon ([https://github.com/snapcore/snapd/wiki/Distributions#debian](https://github.com/snapcore/snapd/wiki/Distributions#debian)).

</comment></comment><comment><USER50> For teaching a noob how to edit in commandline nano is always a go to for me. I often use vim if I want to show someone some code and don't want to look like a idiot fumbling for a mouse. If I'm on a long stretch of programming I prefer sublime for awesome multicursor functionality and prettier text than a terminal. Haven't tried this micro but if the config is easier to learn than the rest then that's a obvious plus.

</comment><comment><USER51> This is nice. It's not going to replace Vim for me, but it's definitely a nice quick editor, being cross platform is great.

</comment><comment><USER52> This look great, but miss something I like about nano and the old freepascal editor. It not show the menu!

Remember the keybindings is anoyning when you use several tools, or when you are triying to fix something and now need to look at the help to remember what to do. That is the most infurating thing about vim (ie: How the hell I close this stupid thing!)

</comment><comment><USER53> What exactly does "modern" mean here?

<comment><USER54> So far as I can tell, it means "Written in Go"

</comment></comment><comment><USER55> It saved the day when browsing large files. I recommended it to my co-workers. It is written in Golang. Big plus.

Just a recommendation, csvlint, which is another Golang tool also is very useful.

</comment><comment><USER56> Can't terminals capture mouse clicks? Does it work over SSH?

I know it's the main feature that bothers me.

I also wonder if you can have all highlighting features an editor like ST3 has.

<comment><USER57> It depends on the terminal - e.g. xterm supports mouse, but AFAIK the maximum height/width is limited (see `stty size`).

</comment></comment><comment><USER58> I still haven't paid for sublime text...

</comment><comment><USER59> Similar idea, but done in C: Hisham 'htop' Mohammed's dit editor. Use it for all my quick-in-out edits.

</comment><comment><USER60> > Common Keybindings

> Micro's keybindings are what you would expect from a simple-to-use editor.

Formed one idea.

then,

from the FAQ:

> Does micro support Vi keybindings?

> No, if you want to use Vim then use Vim.

Well then.

</comment><comment><USER61> >modern

>terminal-based

Such a funny oxymoron.

</comment><comment><USER62> This certainly looks cool. I usually use vim on the command line but that's only for quick and dirty editing.

</comment><comment><USER63> Or just use tmux with whatever non-windowed terminal editor you already use.

</comment><comment><USER64> Wow the Snap install is > 80MB ..; for a console based text editor...

</comment><comment><USER18> can someone explain to me how this has mouse support? I thought mouse selection / click information simply wasn't passed from terminal emulators to the apps running within them. I get how it works in something like MacVim but how is it that this has it but AFAIK vim and emacs haven't been able to add mouse support in the terminal in 20+ years of development even though both support it in the gui versions?

<comment><USER65> Hello from 1995: [http://www.linuxjournal.com/article/1136](http://www.linuxjournal.com/article/1136)

</comment></comment><comment><USER66> Sort-of-offtopic but this irks me

>>easy to install (it's just a static binary with no dependencies)

For some definition of "install". No deb/rpm/snap

<comment><USER67> It's written in Go, which compiles down to a statically linked binary. It's very easy to install: you download it and run it.

If you're on macOS, the latest version can be installed via brew.

<comment><USER68> Which is actually really nice for a non-standard editor like this.

If you are on another computer and want to use it, just download a single file and run it, no need for root.

</comment></comment></comment><comment><USER69> Stop complaining it doesn't look like a replacement for Vim/Emacs:

> _As the name indicates, micro aims to be somewhat of a successor to the nano > editor by being easy to install and use in a pinch_ [https://micro- > editor.github.io/about.html](https://micro-editor.github.io/about.html)

It it pretty neat. Congrats to the author :+1:

<comment><USER70> People are mentioning (not complaining) that it's not a replacement for vim/emacs because the discussion is on a web site largely frequented by software professionals. Toy tools are not well-regarded here, nor should they be.

It's like complaining on a site oriented towards construction workers to stop comparing something to pro-grade tools and just bask in the wonder of someone making a slightly better Craftsman ratchet. Cute idea and maybe worthwhile, but not especially relevant to professionals.

<comment><USER71> > nor should they be

lmao get over yourself

</comment></comment></comment><comment><USER72> ee is the best minimalist text editor.

<comment><USER73> For those unfamiliar, `ee` is the _E_ asy _E_ ditor, shipped with FreeBSD.

<comment><USER74> Then there is ed, man! !man ed: [https://www.gnu.org/fun/jokes/ed- msg.html](https://www.gnu.org/fun/jokes/ed-msg.html)

<comment><USER75> I know this is a joke, but in the past I've tried using ed just for kicks. Is actually quite illuminating. That was right around the same time that I realized that sed and grep are packaged ed functions.

If you're interested at all in Unix history, if recommend playing around with it some. It can be surprising how much ed shows its influence on conventions and standards to this day.

<comment><USER76> Not only that, but there's also ex which was an improved version of ed. ex later got a visual mode called vi. In vim, you can run it in ex mode with the -e parameter. You can also enter ex mode using Q or gQ depending on your vim configuration.

<comment><USER75> Yeah! The whole history of vim is sort of what kicked off my interest in Unix history! For those not familiar with the story of how Ken Thompson came to write ed, there's a short fun read here:

[https://www.bell-labs.com/usr/dmr/www/qed.html](https://www.bell- labs.com/usr/dmr/www/qed.html)

I do ocassionally end up in ex mode if I need to run a few vim commands back to back. I'm curious if there are other reasons to use it though.

</comment></comment></comment></comment></comment></comment><comment><USER77> "Does micro support Vi keybindings?

No, if you want to use Vim then use Vim."

Kthnksbye

</comment><comment><USER78> A modern cli editor for linux is sorely neede and most welcome.

The old editors are both powerful and arcane.</comment>


Windows 10 upgrades getting aggressive - <AUTHOR> http://www.zdnet.com/article/windows-10-upgrade-nags-become-more-aggressive-offer-no-opt-out/#ftag=YHFb1d24ec <comment><USER2> Simply put, this is not OK.

Microsoft has no idea what your situation is. They cannot possibly predict what the effect of the upgrade will be, no matter how good a job they think they did with Windows 10.

What if you depend on some program to do your job and the "upgrade" messes it up irreversibly? What if you're a student with a project due in two weeks and suddenly you're unable to open something after the "upgrade"? What if you're in some kind of managed environment that doesn't expect the "upgrade", that is then utterly confused afterwards (perhaps even trying to downgrade your software again)? I'm sure these aren't the only scenarios that could see big problems.

If they're so desperate to make people upgrade, they should at least have had the decency to pull an Apple and ship an entire compatibility-VM with their new OS (like Mac OS X 10.0 did) to minimize the chance of a problem.

<comment><USER3> > If they're so desperate to make people upgrade, they should at least have > had the decency to pull an Apple and ship an entire compatibility-VM with > their new OS (like Mac OS X 10.0 did) to minimize the chance of a problem.

I'm not sure how that'd work when it comes to hardware/drivers. For example, I know somebody with a transcription foot-pedal (USB) that just isn't compatible with newer versions of Windows.

</comment></comment><comment><USER4> Microsoft needs to keep bragging how Windows 10 is "growing", and likely that growth has stalled lately, so they're becoming more aggressive about pushing it.

Also, despite any sort of Windows 10 "growth", PC sales have been down by about 10% for the past two quarters. Maybe it's time for OEMs to look elsewhere.

</comment><comment><USER5> It's obviously not optional in the long run.

At some point Microsoft will force an upgrade on every Windows machine they can. You'll just wake up one day and be using Windows 10 whether you like it or not.

<comment><USER6> They might be able to get away with that with consumers, but a lot of professionals use Windows too, MS would get sued every way to Sunday if they pulled a stunt like that.</comment></comment>


Your DNS Provider Should Not Be Your Registrar - <AUTHOR> https://www.petekeen.net/your-dns-provider-should-not-be-your-registrar <comment><USER2> The benefit he's describing is completely negated by having a long TTL, which is an important security measure.

If your TTL is long, you can't change your DNS records quickly. So whenever the outage is shorter than your TTL, you see no benefit.</comment>


The Y Combinator (2008) - <AUTHOR> http://mvanier.livejournal.com/2897.html <comment><USER2> That is a nice description of how to arrive at the Y-combinator.

There was a talk using similar examples which I think is very educational.

[https://www.infoq.com/presentations/Y-Combinator](https://www.infoq.com/presentations/Y-Combinator)

I wrote down the examples used in the video (given the poor quality of video) to help myself learn about the Y-Combinator

[https://gist.github.com/gdevanla/9171085](https://gist.github.com/gdevanla/9171085)

Recently, I presented this topic to my team and wrote down a Python equivalent of this example.

[https://gist.github.com/gdevanla/07a08d99e183f494d036c6d6fe6...](https://gist.github.com/gdevanla/07a08d99e183f494d036c6d6fe665c09)

<comment><AUTHOR> Do you always need some lazy evaluation to arrive at the Y-combinator? It seems that even for the strict example a lambda was used to hold the recursive call evaluating too early.

Well, anyways, these are very interesting ideas to study and opened up some of the reasoning behind Haskell's laziness for me.

<comment><USER2> It doesn't have to be. The stricter version is called 'applicative-order' Y-combinator. The article talks about both versions as well.

</comment></comment></comment><comment><USER3> The Y combinator may be pictured as

        ────┬────
        ┬─┬ ┼─┬─┬
        └─┤ │ ├─┘
          │ ├─┘
          └─┘

according to the graphical notation for lambda terms at [http://tromp.github.io/cl/diagrams.html](http://tromp.github.io/cl/diagrams.html)

<comment><USER4> Also, check out this video of the lambda terms involved in computing factorial three evolving through beta reductions—to jazz music! It feels oddly fitting somehow...: [https://www.youtube.com/watch?v=Bt11BsAZMq8](https://www.youtube.com/watch?v=Bt11BsAZMq8)

I'd be curious to hear anyone's thoughts on the graphical notation here—I'd never seen it (or anything similar), and it's intriguing to me, but I wonder if folks have gained some specific concrete benefit from it (e.g. you can look at one of these and figure out what's happening much more quickly or something).

</comment></comment><comment><USER5> Speaking of "Recursion Without Really Recursing" and deep magic, check out this Scala-related paper, "Towards Strong Normalization for Dependent Object Types (DOT)":

[http://drops.dagstuhl.de/opus/volltexte/2017/7276/pdf/LIPIcs...](http://drops.dagstuhl.de/opus/volltexte/2017/7276/pdf/LIPIcs- ECOOP-2017-27.pdf)

Here, some choice quotes from it:

"We further showed that certain variants of DOT's recursive self types can be integrated successfully while keeping the calculus strongly normalizing. This result is surprising, as traditional recursive types are known to make a language Turing-complete."

"What is the minimum required change to achieve Turing-completeness? Consistent with our expectations from traditional models of recursive types, we demonstrate that recursive type values are enough to encode diverging computation."

"But surprisingly, with only non-recursive type values via rule (TTYP), we can still add recursive self types to the calculus and maintain strong normalization."

"Can we still do anything useful with recursive self types if the creation of proper recursive type values is prohibited? Even in this setting, recursive self types enable a certain degree of F-bounded quantification, ..."

I wish someone would try to implement Robinson arithmetic (See here: [https://en.wikipedia.org/wiki/Robinson_arithmetic](https://en.wikipedia.org/wiki/Robinson_arithmetic) and here: [https://ncatlab.org/nlab/show/Robinson+arithmetic](https://ncatlab.org/nlab/show/Robinson+arithmetic) ) in this. I don't think it'd work - for what I speculate as somewhat obvious reasons - but it'd seem interesting to see where exactly doing so would fail.

</comment><comment><USER6> > Strong typing simply means that every value in the language has one and only > one type, whereas weak typing means that some values can have multiple > types.

Aha! Now, any system with subtyping is "weakly typed"! For example, System F-sub!

</comment><comment><USER7> > Even though we often refer to Y as "the" Y combinator, in actual fact there > are an infinite number of Y combinators.

Drop the "the." Just "Y combinator." It's cleaner.

<comment><USER8> Can you provide a reasonable justification for this?

<comment><USER9> [https://www.youtube.com/watch?v=dU6scly2AFU](https://www.youtube.com/watch?v=dU6scly2AFU)

<comment><USER7> aw, it's not funny if you have to explain it!</comment></comment></comment></comment>


Mil edit: a simple, keyboard friendly, markdown list editor - <AUTHOR> http://userbound.com/ui/mil-edit/

<comment><AUTHOR> Been developing this interface for a while. Would love any feedback and input into what could make it better.

mil</comment>


Ask PG: What is the bottleneck to the number of profitable startups that exist? - <AUTHOR>

<comment><USER2> Probably the number of people who'd make good startup founders.

I don't think the limiting factor is the number of good startup ideas. See number 8 here: <http://paulgraham.com/notnot.html>

<comment><AUTHOR> Thanks</comment></comment>


Show HN: boardgamers.me - social netwok for grognards - <AUTHOR> http://boardgamers.me I built this as a part of the Grails48 Hackathon this past weekend. Since I was a single person team, I only managed to complete login, board game search, and game check-in but it's a start.<p>Check out the about page for a few more details about what I used to build it. <comment><USER2> Looks simple and clean, however is this not a feature that boardgamegeek already does?

They've created quite a strong community, it could be a challenge to overcome, but I understand they're quite willing to work with people who create cool things.

good luck!</comment>


Beyond passwords: New tools to identify humans - <AUTHOR> http://bits.blogs.nytimes.com/2013/09/10/beyond-passwords-new-tools-to-identify-humans/

<comment><USER2> > last month, it was discovered that even passwords as long as 55 characters > could be broken.

I stopped reading there. This is utter bullshit.

If 55 is doable, then 16 should be peanuts (like, many orders of magnitude easier). Here crack this _md5 hash_ for me: 2419219bcd13f7a6dfebeca7cf94108e. We all know md5 is broken, right? By the way, this was generated by using:

         head -c 16 /dev/urandom | md5sum

Of course we can crack 200-character passwords if we can make an educated guess at what it might be, but we can't break truly good passwords as short as 10 characters, even if a one-round md5 hash was used. This "revelation" is nothing more than FUD and may be completely ignored. Passwords are not broken.

<comment><USER3> Some of the characters you used are not allowed by many password systems. This decreases the entropy quite a bit, but still not enough to make your point invalid.

</comment></comment><comment><USER4> Another way to identify users is by the speed and rhythm they type their username and password.

For example, let's think about a hypothetical company that sells a per-seat license to a database, that wants to determine if multiple people are using a license for a single seat without false positives. The easiest case to detect are multiple concurrent logins from different IPs. However, if the service/database is used less frequently and concurrent logins would not occur, then it will be harder to catch. Detecting this is made more challenging because one user might login from different IPs, computers, operating system, browsers, etc.

<comment><USER5> Apparently that exists as a service already.. ( [https://www.keytrac.net/](https://www.keytrac.net/) ) Crazy.

</comment></comment><comment><USER6> For physical authentication, vein scanning [1] seems pretty neat -- though it's no more a replacement for passwords than a fingerprint is.

[1] [https://www.youtube.com/watch?v=eDo0W1tEkpk](https://www.youtube.com/watch?v=eDo0W1tEkpk)

</comment><comment><USER7> I like the idea of a device/app you keep on your person or maintain on your phone versus something biometric. There may be times when I want to enable a loved one to log in for me or if I become incapacitated I'd like for someone else to have the ability to unlock my info. For those reasons Clef seems to be about the right amount of functionality and device dependence for me.

</comment><comment><USER8> Biometrics aren't secrets and cannot replace passwords but they can compliment them perhaps.

For instance, I can think of identical twins who don't want the other to see their private photos etc...

<comment><USER9> They also should complement them so that the combination remains revokable. Using a biometric marker standalone is dangerous if that marker is somehow compromised.

<comment><USER8> Indeed.

What scares me is the idea of a cop at a random checkpoint forcing your finger onto your iPhone against your will to gain access to its contents.

A password is so much better in such a scenario.

<comment><USER10> In some jurisdictions they can force you to give that up, too. Or hold you in jail until you do. UK comes to mind.

</comment></comment></comment></comment><comment><USER11> In my opinion there are 2 main issues with Biometrics: \- The first is that it may identify you with precision but it can not tell your will, so basically, you can force someone to use the sensor. \- The second issue is that it does not allow you to give authorization to a third party in exceptional situations.

<comment><USER12> and third: You can't change whatever attribute of yours is being measured when the data leaks out by accident. And fourth: You always share the same attribute with every service identifying you.

We've already seen password databases being compromised. If that happens, you change your password and move on. If biometric data leaks out, you a) can't change your attribute and b) you will have shared that attribute with other parties.

Biometric data is WAY worse than passwords.

<comment><USER13> To me, that seems to suggest that biometrics aren't really _passwords_ (which are private, and authenticate you), so much as they are _usernames_ (which are public, and identify you.)

Just like a username, you can know/have someone else's thumbprint, and "type it in" for the identification phase of login. And just like a username, you need a password in addition, in order to test that you're really who you say you are.

The main difference is that biometrics, unlike usernames, are unique to a person (two people in separate places can't _decide_ to use the same thumbprint without knowing about each-other), so there's no equivalent to trying to log into a machine by using the top 50 most common username+password combinations. In other words, biometrics can always be compromised by HUMINT, and sometimes, given a flawed implementation, by SIGINT--but they're completely immune to MASINT ([http://en.wikipedia.org/wiki/Measurement_and_signature_intel...](http://en.wikipedia.org/wiki/Measurement_and_signature_intelligence)).

Another way to think about it: fingerprints and the like are pretty much UUIDs you're assigned at birth. Just like a textual UUID, anyone who can read it can replicate it or retransmit it fairly easily. There's no security there. What there is, is _collision-prevention._ Nobody will be using a UUID you just generated unless they're _trying_ to collide with it, specifically. If they just generate their own UUIDs, they'll never pick yours by coincidence. Much easier to detect and flag malicious logins once you can be sure that there's no chance of accidental collisions (e.g., someone just typing in their username-on-some-other-machine that happens to be already owned by someone else on this one.)

</comment></comment></comment><comment><USER14> When I pass away my daughter will get an envelope with all my passwords. I would still like her to be able to open all my accounts.

</comment><comment><USER15> > At the same time, biometric sensors raise questions of security. When > Apple's sensor was announced on Tuesday, a flurry of skepticism and privacy > concerns erupted online even though Apple said users' fingerprints would be > stored only on the phone — not sent to online servers or made available to > app developers.

Yes, the thumbprint is going to be the bane of the iPhone 5s. It is a horrible idea. They think phones are completely personal. They aren't. I share mine with my daughters all of the time. Sometimes my wife needs to use it. It is going to be a problem.

I'm not sure if thumbprints are worse or Microsoft's racist facial recognition that wouldn't recognize very dark African Americans.

<comment><USER16> The 5S let's you add other people's thumbprints in addition to your own to unlock the phone.</comment></comment>


Peace.facebook.com - <AUTHOR> http://peace.facebook.com/ <comment><USER2> The assumption here is that peace between nations can somehow be resolved by just communication among private citizens and individual friendships; that conflicts are just misunderstandings or that we are too prejudiced or don't have enough sympathy. I can see how that is sometimes the case, but I don't see how that is always or even commonly the case. In many conflicts, there are very real underlying issues that need to be resolved and unless those fundamental imbalances are addressed, then there will not be peace.

For example, it looks like China is on a possible collision course with India and Southeast Asian nations over water rights. China's north is heavily populated, rapidly growing, and severely short of water. Tibet on the other hand is very rich in water resources that are upstream of major rivers in India, Laos, Vietnam, etc. As we speak there are gigantic projects diverting water from China's south to the north. It's likely not to be enough, and if China moves on to divert and dam rivers that cross international borders, there will likely be war.

This is just one example, but my guess would be that a resource-driven conflict that incites national pride on both sides will break those friendships rather than the other way around. If the fundamental reasons driving a conflict are not resolved, it's hard to see why friendships will be able to prevent war.

<comment><USER3> I agree. In fact the China has already initiated the process of building a dam over one of the major rivers to flow into India (Tsangpo-Brahmaputra), and India has asked China to put a hold to this.

It is also to be noted that among the few Chinese people I have met, most seem to have a liking towards Indians and vice-versa. Also, you would not believe the extent to which Indians and Pakistanis would go to demonstrate their love for each other. A few years ago (2005, I think), when there was a bilateral cricket tournament between Pakistan and India in India (and the next year in Pakistan), Indians would literally drag Pakistanis to their homes as guests. This was repeated by the Pakistanis the next year.

Looking at the news reports and the way the Indian and Pakistani governments accuse each other, you would never guess such stuff could happen.

<comment><USER4> They would "literally" drag Pakistanis back to their homes? Seems quite harsh.

<comment><USER3> Well the Pakistanis certainly weren't complaining. They were expecting to be greeted by armed policemen scrutinizing their every move (or atleast that's how one of them put it in an interview to a newspaper).

</comment></comment></comment></comment><comment><USER5> Being Greek, what I despise is being framed as one half of the world's 'mortal enemy pairs' that facebook is helping fix. For one thing, we haven't fought a direct war with Turkey for nearly 90 years. Having cultural animosity between two nations is one thing, being paraded as an example of 'warring tribes' on a worldwide forum is quite another. I fear this initiative crystalises stereotypes rather than helping break them down.

</comment><comment><USER6> The funny thing about this is that Facebook leads to the exact opposite of peace among groups of people. There's massive amounts of social anxiety associated with your virtual prominence amongst your friends, even if you see them in-person on a regular basis.

Since I've quit using Facebook, etc I have noticed a massive improvement in the quality of my interactions with friends. They actually bother asking how I'm doing / what I'm up to, and I'm genuinely curious about their recent experiences.

I'm actually convinced that this global obsession with social networks could lead to more wars than peace -- the current generation of Internet trolls seem like a mere precursor of what's to come. People really take this virtual shit seriously -- doesn't that seem just the slightest bit scary, when coupled with natural youthful aggression?

<comment><USER7> I get the opposite reaction. I talk to people I'd never talk to otherwise. It doesn't hurt that I unfriend people I don't like talking to that much.

The problem is that Facebook is a constant communication. When you interact with people after talking to them on Facebook, there's less to talk about, because it's already been said. If you consider Facebook to be a part of interaction, as I do, the net conversation swells; if not, it shrinks.

> I'm actually convinced that this global obsession with social networks could > lead to more wars than peace -- the current generation of Internet trolls > seem like a mere precursor of what's to come. People really take this > virtual shit seriously -- doesn't that seem just the slightest bit scary, > when coupled with natural youthful aggression?

Yes and no. The good thing about the Internet is that to take it seriously, _you_ have to make the choice yourself. It's not like a war, in which nationalism can sweep a lot of good people into doing bad things. Rather, it's a bunch of smaller, decentralized, isolated incidents, and I like that. The more isolationist ( _not_ isolated) the world is, the healthier it is. If a thousand nutjobs kill a thousand people over Internet bullshit, that's a lot healthier than that thousand nutjobs congregating over political/religious/economic bullshit and attempting to kill a lot more. There'll be _more_ incidents, in other words, but each one will be vastly less harmful.

</comment></comment><comment><USER8> 1.) Was engaging and interesting at startup school? Check.

2.) Cool company initiative that I can respect? Check.

I think Zuckerberg might finally be growing into his own. :)

<comment><USER9> As amohr posted, this is actually a Stanford initiative, not something that Facebook started. Regardless, I think it's a great idea, but we should be giving credit where it's due.

<http://peace.stanford.edu/>

<comment><USER10> <http://peace.imvu.com/> is hilarious.

</comment></comment></comment><comment><USER11> In other facebook news everyone in my freshman level class spends the whole lecture on facebook on their computer and is very surprising to me that the teacher doesnt ban computers from the classroom. ( When I started 2 years ago no one even pulled out computers during lectures unless they were at the back of the room. )

Maybe facebook is planning world peace through extended computer use.

<comment><USER12> We can't fight any more wars if we're all too busy circlejerking on each others' walls.

<comment><USER13> Maybe, but we can still fight plenty of _mob wars_ that way.

</comment></comment></comment><comment><USER14> Yeah nice, how about stats for USA-Afghanistan and USA-Iraq.

</comment><comment><USER15> war is created by the minority in power. not by the majority that uses facebook.

"Of course the people don't want war. But after all, it's the leaders of the country who determine the policy..." Herman Goering

</comment><comment><USER16> Isn't it also possible that facebook could be used for the promotion of hate? An obvious and outstanding recent example was the recent quiz about whether the U.S. president should be killed. If you read about the balkans, (and more recently iraq) what is shocking is how quickly cultures with cross- ethnic/religous connections - even those as strong as intermarriage can quickly become polarized into bitter enemies. Which makes me wonder what these graphs of israel/palestine friendships will look like when tensions again escalate between these two groups. What did the india/pakistan graph look like after the Mumbai bombings?

<comment><USER7> Looking at it from a broader perspective, Facebook is the promotion of _communication_ manifest. It strives very hard, in fact, to be a neutral medium, in which no one type of conversation is favored over another, so conversation ranges from flirting to intense debate.

The question is, does prolonged communication lead to more peace or more hate? My bet: In the short term, more hate, because there'll be a lot of people getting in fights over issues they didn't know existed. (I lost a _lot_ of Palin-supporting friends last year.) In the long run, however, more open communication leads to us understanding each other better, and only good can come of that.

<comment><USER16> Yeah I agree - without any evidence I would expect it to be neutral. But I think that there is a pretty well documented tendency for people to be much more aggressive and extreme on online forums than there are in real life. (Similar to road rage) Back in the day I remember reading littlegreenfootballs and being shocked at some of the hateful rhetoric which was in the comments (of course left leaning sites have this too)

<comment><USER7> That's what I mean by short-term rage. As much as you think people accept you for who you are and what you think, when you express yourself online you realize that most people are awful and immature in a handful of ways. But past that point you develop some self-consciousness and, more often than not, come out of the social parts of the Internet a lot smarter, wittier, and more savvy than you used to be. I can't wait to see that happen on a mass scale.

</comment></comment></comment></comment><comment> n-named After seeing MZ at startup school, it was apparent that he is a big thinker. I didn't think _this_ big though. Brilliant!

<comment><USER17> "The next hundred years will be different for advertising, and it starts today."

<comment><USER7> And he was right. Facebook's policy of uniquely targeted ads is unlike anything else on the market, and it _will_ be the future of advertising. It's killer.

Advertising doesn't _just_ change every hundred years, but if you don't think Facebook is one of the two Great Advertisers of the decade, along with Google, then you weren't paying attention.

<comment><USER17> I agree with you. The kid thinks big.

</comment></comment></comment></comment><comment><USER18> Also, <http://peace.stanford.edu/> launched about 30 seconds ago. It has a list of all the other participating Peace Innovation sites.

</comment><comment><USER19> I'd rather see a campaign for equality. That's not so bland and gets more to the heart of the matter.

<comment><USER7> Define equality. There're a lot of versions of the word that I don't support. Peace, now, there's an idea I can get behind, impossible as it might seem.

<comment><USER19> Equal in rights and opportunity, ok? I'm not proposing the kind of enforced universal mediocrity that I know you hacker news ubermensch are paranoid of. Of course everyone wants peace. The oppressed want a peace that is an end to injustice. The oppressor wants a peace where the oppressed will just shut up and take it.

<comment><USER7> I wasn't talking about that. I also didn't know there was a Hacker News ubermensch.

"Equal in rights and opportunity" still doesn't mean much. How can Facebook enforce equal opportunities? And everybody on Facebook _is_ equal. So you're still dealing with a nebulous term.

<comment><USER19> Well, they aren't campaigning for peace ON Facebook, so I don't see why you think this is about equality in facebook itself. I don't see why equal in rights and opportunity is nebulous either. If you look at one of the contrasts on peace.facebook.com, Israel and Palestine, it's pretty obvious that the two populations are not equal in rights or opportunities and that this is the reason for the current strife in that region.

<comment><USER7> But if Facebook were to speak out actively in favor of either side, it would alienate the other side, which goes actively AGAINST Facebook's mission.

</comment></comment></comment></comment></comment></comment><comment><USER20> I've never been convinced that opages like this really have much effect.

Also it's worth pointing out that the graphs are immaterial; the people with real animosity wont be making those connections - and Facebook don't seem to be doing anything to encourage them......

</comment><comment><USER21> Hm... anybody can think of a reason why the adding cross country connections seems correlated for various pairs of countries.

For example the local max on Sep 19, or the local min at Aug 21 seem to hold for most pairs of countries.

</comment><comment><USER22> radiolab (part of nyc's public radio) had a great news piece about this very topic. Back during the cold war like 1 in 3 people thought war was inevitable. It says a lot about our culture that 1 in 10 think that we can achieve PEACE. 66% peace lovers to 10% is pretty sad.

Great listen if you have an hour commute: <http://blogs.wnyc.org/radiolab/2009/10/19/new-normal/>

<comment><USER23> Wanting peace and thinking we will get peace are 2 different things aren't they? I want peace, but I'm not so naive to think that humans will change their nature and we'll get it, so do I show up as a peace lover or not?

<comment><USER22> According to the question ask "do you think war is inevitable?" you'd be included in 9 of 10 think war is inevitable. What we want was not part of the question (and I don't think it is on peace.facebook.com either. Their question is "is world peace possible?", based on your response above your answer to facebook would be "no").

</comment></comment></comment><comment><USER24> I guess I shouldn't have been surprised by the reaction to this, but I was. Honestly, I'm disappointed by it.

<comment><USER25> Why?

</comment></comment><comment><USER26> Do they actually have a "theory of peace" that they are using to design the site, or are they just posting statistics?

edit: Here's my take. "War is a failure of the imagination." Once you understand that quote, you've just 'gotten' about half of history.

<comment><USER27> Less a theory and more an observation.</comment></comment>


Show HN: How to Talk to Nontechnical People - <AUTHOR>

This came to be as a result of an Ask HN, thanks for the support.
This is a developer-centric approach to learning communication and nontechnical life skills.
Please comment, I would really appreciate the advice for how I can best provide value to the community who has given me so much. <comment><AUTHOR> Clickable link:

<http://powerthegeek.launchrock.com/>

</comment><comment><USER2> Interesting, who are you?</comment>


Ask HN: Learning to program, how do I learn after I've learned syntax? - <AUTHOR>

I'm learning python and I have a long list of projects that I want to try working on, but I have this anxiety about going forward because I have this feeling that anything I do I'll learn later was a waste of time or done the wrong way.
Every day I see projects and applications here on HN made by people here that offer neat APIs or services and my mind churns out applications to use those things, but I want to have a solid understanding of programming before mucking around.
So I ask you: what is step two of learning to program well? I've learned some syntax, now I need to learn the grammar of programming. <comment><USER2> "Programming" itself is not the hard part or really what you should worry about, and by that I mean syntax and grammer. What really matters is knowing how to solve problems through programming. To get that knowledge you have to write programs and solve the problems that present themselves. It sounds like you can take your time, so I'd say just write something, maybe a small website in python or a cli-tool, and then when you come across something that gives you problems ( HTTP Caching, or building node trees ), study up on it and then implement it.

Don't worry about learning the right tools, just build things and find the tools - programming language(s) - that gets the job done the best for you :)

Also a note, reading source code is a great way to find out how the experts get the job done, so you can always learn from them by perusing github or a GNU project :)

</comment><comment><USER3> Like I'm sure almost everyone will say, just start making stuff.

Build until you hit a wall, then figure out why you hit the wall; Did you take a wrong turn? Did you a ladder? Or maybe a Hammer?

Build, build, build. Keep learning. Learn another language. Do things out of your comfort zone. Once you think you know something, try to take another step forward.

Don't be afraid to fail, don't be afraid to ask for help.

Above all else, just keep going. And never listen to people who discourage you because you aren't doing it "right".

</comment><comment><USER4> Build things. Even if you're "doing it wrong" - you're still learning about how to build the things you want to. As long as you keep building things and keep looking for ways to improve the way you build things, you'll learn. The trick is just building lots of things (the first few will suck).

</comment><comment><USER5> I would say that instead of worrying what could happen, just go ahead and do it. Sure, it might not be right the first time, but most bugs can be fixed.

P.S: Don't forget that Google is your friend</comment>


Browserprint: Browser fingerprint tool now can guess client OS even when spoofed - <AUTHOR> https://browserprint.info/#fingerprint <comment><USER2> Guessing OS is pretty simple though, I recommend the book "Silence on the wire" [0] for a thorough explanation of passive network fingerprinting.

TL;DR is that the each TCP stack has unique characteristics that are hard to spoof (you'd have to bypass the OS TCP stack and build your own that mimics another) and definitely out of reach for tools that run in sandboxed environments (like browser extensions)

edit: Also, the author of that book, Michal Zalewski, made open source tool p0f [1] that implements some of those techniques to identify spoofed user agents.

      [0]: https://www.amazon.com/gp/product/1593270461
      [1]: http://lcamtuf.coredump.cx/p0f3/

<comment><USER3> Nice! [https://amzn.com/dp/B008FRNHVY/](https://amzn.com/dp/B008FRNHVY/) $18

<comment><USER4> $24 for me, perhaps i have a richer looking browser ...

<comment><USER3> Thanks for the heads-up, I fixed the link to point to the Kindle edition!

Amazon has indeed gotten called out for these types of shenanigans in the past but that was a long time ago! [https://en.wikipedia.org/wiki/Amazon.com_controversies#Diffe...](https://en.wikipedia.org/wiki/Amazon.com_controversies#Differential_pricing)

I missed this related discussion last month: _The High-Speed Trading Behind an Amazon Purchase_ | [https://news.ycombinator.com/item?id=13963743](https://news.ycombinator.com/item?id=13963743)

</comment></comment></comment></comment><comment><USER5> I had a project I did for university a few years back, and we'd identify the browser or application just by looking at the timing information between packets (without looking at ports, source/destination, etc.).

We could identify malware with around 85% accuracy, which was pretty good without any other marker.

<comment><USER6> That sounds really interesting, do you have any publicly available documentation or articles about it?

</comment></comment><comment><USER7> Wrote my thesis about passive and active fingerprinting, it's very easy to do, most operating systems network stacks have different default values like window size, ttl etc. p0f[1] was pretty good back then.

[http://lcamtuf.coredump.cx/p0f3/](http://lcamtuf.coredump.cx/p0f3/)

</comment><comment><USER8> My fonts gave me away... Damn fonts, I need those for various design files I open. Any way to limit my browser's access to my system fonts?

<comment><USER9> Version 52 of Firefox lets you use a whitelist [http://www.ghacks.net/2016/12/28/firefox-52-better-font- fing...](http://www.ghacks.net/2016/12/28/firefox-52-better-font- fingerprinting-protection/)

<comment><USER8> This works. (Don't forget to disable Flash.)

Canvas and Character Sizes are still making me fairly unique... Any ideas there?

<comment><USER9> Canvas is trickier! There's some add-ons out there that disable it in various ways so they're your best bet I'd say (assuming canvas not working gives away less information than it does normally, it's hard to tell). For character sizes I'm not sure if there's many useful defences against it, I would have thought it'll depend on a number of things, the Tor Browser might defend against it well, you'd have to give it a look.

<comment><USER8> Yeah, I can't find much that gave any meaningful protection.

I tried various Firefox and Chrome extensions, tried Tor...

The problem is that at a certain point with security, everything just stops working.

Wasn't able to get any sort of meaningful protection that still let me do much of anything... including run the Browserprint tool.

<comment><USER9> Sounds like the same problem I've run into in my college project :). It's really tricky to get the balance right with privacy/usability, unless the browsers put more work in to it one of the only good options is to either constantly switch browsers or use different browsers for different types of browsing.

</comment></comment></comment></comment></comment></comment><comment><USER10> "An error has occurred" while trying to fingerprint my browser in iOS, (not with the browser, but their toolset). Guess it failed to fingerprint me technically hah.

<comment><USER11> Same here, Safari on iOS 10.3.1. I was curious about the result on the iOS because there are not many things you can customize on Apple devices.

</comment></comment><comment><USER3> Is lower-level fingerprinting enough to detect the difference between ARM / x86 linux?

How far would I have to go to setup a truly legit honeypot on a Raspberry Pi? Is anyone already doing this? The following article doesn't get into userland IP stack:

[https://www.redpill- linpro.com/sysadvent/2016/12/19/raspberr...](https://www.redpill- linpro.com/sysadvent/2016/12/19/raspberry-pi-honeynet.html)

</comment><comment><USER12> Previous Discussion: [https://news.ycombinator.com/item?id=12198358](https://news.ycombinator.com/item?id=12198358)

</comment><comment><USER13> it guessed I had a variant of Linux, yet I'm running FreeBSD with no spoofing of any kind.

(which is corroborated in both the user agent and the javascript uname sections)

<comment><USER14> It guessed I had a variant of Windows, yet I'm running a Linux with no spoofing of any kind.

By transitivity FreeBSD is a subvariant of Windows ... or maybe not.

</comment></comment><comment><USER15> TorBrowser 7.0a3: indicates it's running on Windows, but my OS was fingerprinted as Linux. I'm actually running it on macOS.

<comment><USER16> Under a VM, or a BSD jail?

<comment><USER15> No.

</comment></comment></comment><comment><USER17> It failed to recognize my browser as Edge, it thinks it's Firefox

[http://browserprint.info/view?source1=UUID&UUID1UUID=fa204a9...](http://browserprint.info/view?source1=UUID&UUID1UUID=fa204a95-8046-441e-9e97-33a0eb6ddb80)

<comment><USER18> Wishful thinking?

</comment></comment><comment><USER19> I was a little concerned when it said I had a unique fingerprint out of the 25k tested so far, but then I remembered I'm spoofing a new user-agent every few minutes. It still managed to guess my true operating system of course :)

<comment><USER20> Perhaps I misunderstand you but I think you're placing too much trust in changing the user agent. The method they are using doesn't depend on the user agent string and ignoring the user agent could even improve its performance. Further, I think it should be relatively easy to detect spoofing of user agent strings. For instance, if your user agent says your using a Linux browser but your fonts include nothing but the standard fonts on OSX, it's pretty clear then that your spoofing your user agent.

<comment><USER19> I'm okay with the spoofing being detectable. The important thing is obfuscating myself to ad agencies. It's OK if I have a unique fingerprint, if that unique fingerprint is morphing every few minutes.

What is interesting is that my unspoofed user agent is 3x more rare than the spoofed one, even though the spoofed one usually throws browser versions that are out of date.

Unfortunately, my browser is still unique to the set of 25k whether spoofed or not. Enabling javascript helps a little, but then I can be audio fingerprinted which defeats the purpose.

I definitely have an exotic configuration. KVM / Firefox / No 3rd Party Cookies / Blacklisted social media sites / Addons (including NoScript) that take various steps to lock down information leaks and prevent loading of blocked resources. I don't allow web fonts which is probably fairly exotic as well.

If more would use script blockers and ad blockers maybe I wouldn't be unique, but it seems to be a trade-off between privacy and security. And I just kind of assume that privacy is off the table for now, so at least I can work towards having security.

If I have to choose between the two, I'm more concerned with malware and being tracked through 3rd party resources like Google Fonts, Google APIs (I cache them and prevent subsequent resource loading) than I am being fingerprinted.

<comment><USER21> The point of this project is to not use the user-agent for fingerprinting.

<comment><USER19> Are you saying it isn't worth spoofing your user agent?

<comment><USER21> I'm saying that user agents are a completely separate issue from what Browserprint is measuring and using for fingerprinting. Browserprint's fingerprint of your browser doesn't change when you change your user agent.

tmalsburg2 appears to have tried to make the same point.

<comment><USER19> I think we're all misunderstanding each other. I'm aware Browserprint isn't using user agents as their main source of information. It very clearly outlines the information they are using in the results.

I was just remarking about the uniqueness of my spoofed user agent vs a non- spoofed agent. After my initial post I went back and found I was still unique even without a spoofed agent. That's really all there was to my comment, I'm not insinuating that I was surprised to find I was uniquely fingerprinted by other means like font and plugin enumeration.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> My randomised user-agent happened to tell it the truth, but browserprint 'detected' that I was instead using a different OS and browser.

I'm also using a fingerprint-blocking plugin, which seems to be doing its job!

<comment><USER23> Randomized U-A makes you stand out.

You want single U-A that many other people use.

<comment><USER22> I'll double check my settings, but I believe it's randomised among a set common choices.

The may well be no additional value to that, though.

</comment></comment></comment><comment><USER24> Both Hulu and Netflix block Ubuntu, so this sucks for people like me who use Linux as their primary media OS.

Hopefully this doesn't catch on or we have to find another way to spoof these sites.

</comment><comment><USER25> Seems similar to Panopticlick which was released years ago: [https://panopticlick.eff.org/](https://panopticlick.eff.org/)

<comment><USER26> One of the first things listed on the page:

      Browserprint is a free open source project designed to
      provide the same and better functionality as the original
      Panopticlick.

</comment></comment><comment><USER27> What are the legitimate uses for fingerprinting?

<comment><USER28> We've made an online action website where people can vote on things and the people with most votes win prizes.

We thought it was a good idea to validate the user by email (by sending an email with a unique link, that when clicked, the vote was authenticated.) We thought it was good enough as a "security measure", but we thought wrong!

Some people made disposable email accounts and sent the emails to there, so there were some people with thousands of votes, while most only had a few dozen.

When looking in the database, we were glad that we stored some basic info like IP, Agent Strings and timestamps. These people were smart enough to (sometimes) change IP's but then when looking to the timestamps and agent strings, we saw that these people were cheaters with disposable email addresses.

We removed all these votes and the "winners" didn't win anything at the end, because they had much less votes than "normal" players. They started sending angry emails to the customer, and did not leave them alone.

We are currently making another action for that customer, but this time we have added browser fingerprinting, that checks a lot of variables (like fonts, canvas rendering, webgl, screen sizes, number of monitors, device pixel ratios, ...). This way we'll going to identify cheaters much easily, ... BUT you can still spoof it, so it's never a foolproof method of identifying users, it just makes our lives a little bit easier when there's some cheating going on ;)

// EDIT: some typos

<comment><USER29> I'm very curious to learn what website this is, perhaps via email. This type of thing sounds like a fun way to spend a few minutes. :)

</comment></comment></comment><comment><USER30> Heh, my WebGL renderer "ANGLE (AMD Radeon (TM) RX 480 Direct3D11 vs_5_0 ps_5_0)" is unique. And character sizes o_0

</comment><comment><USER31> Still hasn't guessed my MenuetOS box.

</comment><comment><USER25> I keep failing the CAPTCHA. Why is this part designed so badly?

<comment><USER32> That is exactly what a bot would say.

</comment></comment><comment><USER33> Apparently with firefox there is a request to enable flash (which i purposely dont install)

I'm led to assume adobe flash is the piece which actually divulges all the secrets about my machine. Not surprising.

<comment><USER9> Flash makes it easier to get some of the information like your system fonts, but JavaScript get the same information it's just more difficult. It has to cycle through a list of fonts and test for them individually rather than Flash which just gives the full list of fonts you have installed.

</comment></comment><comment><USER34> Hmm. Doesn't seem to work on iOS. ;)

</comment><comment><USER35> damn, it doesn't work on lynx. should i update my browser?</comment>


Meteor and React: Free Preview of First Three Chapters Available - <AUTHOR> http://kenrogers.co/meteor-react/ <comment><USER2> Better than the ones in Kickstarter who asks for vote on Javascript framework where most backers opted for Meteor with React and then the trainer never teach a proper Meteor course as promised.

[https://www.kickstarter.com/projects/azat/astonishing- power-...](https://www.kickstarter.com/projects/azat/astonishing-power-of- high-performance-js-without-h/)

Glad you have made a great choice on the teaching materials.</comment>


From Facebook account takeover to an empty bank account - <AUTHOR> https://badcyber.com/from-full-facebook-account-takeover-to-an-empty-bank-account/ <comment><USER2> As an aside, it drives me up the wall that Facebook's 2FA settings are stuck on SMS. Although other options exist like a Yubikey or a TOTP scheme, _even if you select one of those_ , Facebook still sends you a 2FA SMS whenever you try to login.

At this point I ignore it and use my TOTP app anyway, but it bothers me to no end, as it leaves my account that much more vulnerable to a hacker intercepting the SMS in transit and using it to break into my Facebook account. Facebook does not allow you to disable 2FA SMS without disabling 2FA altogether.

<comment><USER3> Are you sure about it? I use 2FA with authy and never got sms.

</comment></comment><comment><USER4> > (to avoid the bank calling and asking "are you sure you want to speculate > with cryptocurrency today")

Huh? Do banks actually do that?

<comment><USER5> I gather some banks have fraud detection systems that will flag suspicious transactions, triggering a phone call to the customer.

While I haven't experienced that personally, a friend reported getting such a call from his bank after he ordered $400 of fireworks online.

Unfortunately it's all pretty opaque and bank dependent - as far as I know, there's no way a merchant can trigger such a call, for example.

<comment><USER6> This happened to me in the 90's so not sure how possible it is today. Someone got hold of my account number - I think it was in Las Vegas when I used an ATM and didn't get the receipt, then when I realized it a couple of minutes later, walked up to get it and didn't find it. A month later at home in Austin, my ATM card was declined at the bank ATM and I was baffled because I knew I had enough money for the transaction. When I went into the branch for an explanation they told me that I had no money in my account because earlier that day someone of a different gender and race ( they had video) had used 12 different bank branches in a different city (Houston) to withdraw 2000 at a time via check. I had to a sign something that swore that I did not do that and the act was not connected to me before they would restore the stolen funds to my checking account.

</comment></comment></comment><comment><USER7> The scheme is very elaborate, multi-step process so the risk is quite low. Once in motion it is nearly impossible to prevent by a bank, but it would be trivially preventable by Facebook, if they just bothered to check the url and warn if they find them suspicious.

EDIT:

BTW this shows that sites like Let's Encrypt, which automatically issue certificates to websites kind of defeat the whole purpose of certificates - they only check that the site exists and requestor has admin access to it, but do nothing to check whether it is legitimate business or scam.

A green padlock in the address bar should mean that the site is trustworthy. Now it only means that site admin knows how to setup https.

<comment><USER8> Sure, in theory, but how do you solve a problem like this in practice? What is it about a given URL that makes it suspicious?

Is there a whitelist? Because then the press and the rest of the internet will cry censorship and stifling of innovation.

Is there an algorithm? Then the scammers simply learn how to game the algorithm and defeat it easily. (This applies to some easy checks like domain registration date too.)

Is it a team of humans? That's a lot of sites and a lot of humans to employ. What about user-reports? Now you have to deal with false reporting and abuse.

While it's possible for some combination of approaches to succeed here, it's not nearly trivial.

<comment><USER9> Most importantly, how could you create a trustworthy online business like an ecommerce, if you can't get an https site until you're trustworthy?</comment></comment></comment>


A few things Apple could learn from the Google Play Store - <AUTHOR> http://portablepixels.com/2013/12/20/a-few-things-apple-could-learn-from-the-google-play-store/

<comment><USER2> I agree with most of this but keep in mind that the review process keeps a lot of garbage out of the store.

Every time I go through the Play Store on someone's Android I feel like I'm walking through a minefield.</comment>