Memex - <AUTHOR> https://en.wikipedia.org/wiki/Memex <comment><USER2> _As We May Think_ (the origin of Memex) is still one of my favorite papers.

[http://www.theatlantic.com/magazine/archive/1945/07/as-we- ma...](http://www.theatlantic.com/magazine/archive/1945/07/as-we-may- think/303881/)

</comment><comment><USER3> An electronic brain. What would you do with one of those, if you had one? In 1940, you'd probably stick it in a machine of some kind. Not one of Dr. Satan's recycled Atlantean robots, but something practical. Say a machine that could weld leaf-springs in a Milwaukee tractor factory.

This, really, is about what science fiction writers call "Steam Engine Time". The observable fact that steam, contained, exerts force, has been around since the first lid rattled as the soup came to a boil. The ancient Greeks built toy steam engines that whirled brass globes. But you won't get a locomotive 'til it's Steam Engine Time.

What you wouldn't do, in 1940, with an electronic brain, would be to stick it on your desk, connect it somehow to a typewriter, and, if you, had one, a television of the sort demonstrated at the 1939 Worlds fair in New York. At which point it would start to resemble… But it's not Steam Engine Time yet, so you can't do that. Although you would, or anyway you'd think about it, if you were a man named Vannevar Bush, but we'll come back to him later. Vannevar Bush almost single-handedly invented what we now think of as the military- industrial complex. He did that for Franklin Roosevelt, but it isn't what he'll be remembered for.

[http://www.williamgibsonbooks.com/archive/2003_01_28_archive...](http://www.williamgibsonbooks.com/archive/2003_01_28_archive.asp)

</comment><comment><USER4> Some more historical echoes:

<http://en.wikipedia.org/wiki/Mundaneum> <http://en.wikipedia.org/wiki/Yongle_Encyclopedia>

(Check out <http://www.wolframalpha.com/docs/timeline/>, it shows some fascinating landmarks in the history of knowledge)

</comment><comment><USER5> A Memex is also featured several times in The Laundry Files by Charles Stross. I can highly recommend reading this series.

      https://en.wikipedia.org/wiki/Charles_Stross#The_Laundry_Files

</comment><comment><USER6> Two neat modern memex implementations:

<http://quantifiedself.com/2009/09/the-social-memex/> \- Mark Carrenza's memex implementation that he's been using for decades

<https://github.com/novoid/Memacs> \- memacs, a memex-like implementation using python to turn social streams into searchable emacs org-mode files

</comment><comment><USER7> As per always, someone has implemented a memex system with emacs and org mode:

<https://github.com/novoid/Memacs>

</comment><comment><USER8> See also the bookend piece The Computers of Tomorrow, Martin Greenberger, Atlantic 1964. Both articles linked here: [http://www.theatlantic.com/past/unbound/flashbks/computer/te...](http://www.theatlantic.com/past/unbound/flashbks/computer/tech.htm)

</comment><comment><USER9> As mentioned in Serial Experiments Lain, an anime really worth checking out.

</comment><comment><USER10> This stuff is very interesting to bring into conversation with early work on cybernetics

<comment><AUTHOR> I think it's even more relevant than that. This article pretty much directly inspired Douglas Engelbart and Ted Nelson, who in turn went on to work on the first hypertext systems (Engelbart on NLS [1] and Nelson on Project Xanadu [2]). Although today's web doesn't quite live up to the standards set for Project Xanadu (it involves microtransactions, link rot [3] prevention, the ability to trace back what links to any given page, transparent creation of compilation documents and other such things) those projects are part of history that led to us being able to have this discussion right now using a HTML-based medium.

Looking back at _As We May Think_ and the systems it directly inspired today may be a way to help us make the internet better. It's not hard to imagine how with a few tweaks Xanadu-like micropayments + trasclusion [4] could a least partially replace banner advertising and help revitalize web journalism by making it not dependant on ad revenue.

[1] <https://en.wikipedia.org/wiki/NLS_%28computer_system%29>

[2] <https://en.wikipedia.org/wiki/Project_Xanadu>

[3] <https://en.wikipedia.org/wiki/Link_rot>

[4] <https://en.wikipedia.org/wiki/Transclusion>

</comment></comment><comment><USER11> While this is interesting I thought a while ago we agreed on three rules:

1\. No posting Wikipedia articles directly. Write a post about it.

2\. No linking to individual essays by pg. (<http://www.paulgraham.com/articles.html>)

3\. No racing to post who is hiring posts. There is a helpful bot for that.

<comment><USER12> When was 'a while ago'? Who is 'we'? And what do you mean by 'agreed'? (Are you part of the site management which had a discussion/decision on these matters?)

None of these are mentioned in the 'Guidelines' linked at the bottom. On the other hand, the guidelines do mention: "Please don't submit comments complaining that a submission is inappropriate for the site."

<comment><USER11> I really wish they would incorporate these in the guidelines. I am not a part of the site's management. By "we" I mean the community.

Unfortunately, this was all discussed in an ad hoc fashion in comments to random stories but I'll do my best to find it.

 _time passes_

First, <https://news.ycombinator.com/user?id=whoishiring> is the bot that submits the "Who is hiring?" posts. It started a few years ago as you can see by the registration date for this user. The problem was that these posts generate a lot of upvotes, and people started trying to beat each other to the punch to try to get more karma points. The problem came to a head when multiple "Who is hiring?" posts made it to the front page, which has the obvious negative consequences.

I just spent about 30 minutes searching for the other two discussions and cannot find them (hnsearch, Google, and my own story upvotes proved unhelpful). Best I can offer is this: about two years ago, IIRC, there was a trend to link directly to Wikipedia. The front page was filled with random posts on there, like the one about the illegal numbers. Wikipedia is great, but often times it was not clear why a post was relevant to HN. The conclusion of the discussion was that we shouldn't post Wikipedia articles directly and the trend died down. @gojomo, I wager you have been here long enough to remember this trend, and I'm sure you noticed that one day it stopped. That's probably the best proof I can offer on this point.

Something similar happened with pg's essays. Every time he posted one, it would show up on the front page. At that point someone posted a master submission, linking to all of them, and in the discussion there was agreement that since pg is so well known here and his essays are so closely watched that it is taking away from other stories to post the content that almost everyone will discover anyway. Additionally, this once again lead to karma farming by multiple people trying to post the same essay as early as possible. Interestingly enough, I just tried posting the link to all the essays and the duplicate matching engine let it through, so I wonder what happened to that post (and/or my memory of it). In either case, it looks like this trend is also starting to slowly come back.

Once again, I really wish I could find these discussions and/or compel the site admins to clarify some of these points in the guidelines. Alas, I do deserve the downvotes in my original post for not including any references.

<comment><USER12> Thanks for explaining. I think it's important to note that any perceived- consensus in some random-thread doesn't mean much - it's not necessarily a real consensus or conclusion, and in any case the actual site managers have their own ideas about how things should work. (And, while they clearly welcome some input, they also seem to frown upon most meta-discussion, complaint threads, coordinated-voting-pacts, and lobbying-polls.)

Personally, the occasional posts of Wikipedia articles and PG essays (even repeats when related to current topics) are valuable to me. I think it'd be a misuse of the 'flag' to suppress these. Of course anyone is free to misuse their click-power like that... I just don't want anyone to misleadingly claim that's a consensus norm, with the vague assertion "we already decided this". That seems like a rhetorical trick.</comment></comment></comment></comment>


HealthCare.gov's head tech guy is out - <AUTHOR> http://www.washingtonpost.com/blogs/wonkblog/wp/2013/11/06/healthcare-govs-head-tech-guy-is-out/ <comment><USER2> Whatever happened to the "CTO" of US - [http://en.wikipedia.org/wiki/Chief_Technology_Officer_of_the...](http://en.wikipedia.org/wiki/Chief_Technology_Officer_of_the_United_States)

Park has been running his part of the massive government agency "like a Silicon Valley company," according to the Atlantic. That approach was particularly relevant in the development of HealthCare.gov, the first government website that provides consumers with a searchable database of public and private health insurance plans available across the U.S. by zip code - [http://en.wikipedia.org/wiki/Todd_Park](http://en.wikipedia.org/wiki/Todd_Park)

<comment><USER3> He's still going strong.

</comment></comment><comment><USER4> Purely cosmetic move. At that level, that "tech guy" is probably 3-5 levels above any real key decision makers and managers involved in the actual implementation. Blaming this on him is like blaming Sepp Blatter for Barcelona's under-13 team's shortcomings. Having worked on federal software projects not even half this large there's a lot of layers. A lot of buffers.

and btw, "head tech guy"? Really? Is the Washington Post a serious news organization?

<comment><USER5> It's a blog, and this is a prime example of why I don't consider blogging on the same level as real journalism.

<comment><USER6> I'm not going to comment on the blogs vs. real journalism debate, but I'd say Wonkblog is probably one of the best American political blogs running today.

Politics is such a polarizing and passionate issue that these blogs easily gain readership among people who already agree with their political agenda. It's incredibly easy to start a political blog that is purely speculation, vitriol, or outright lies. A lot of political blogs even devote themselves to minutiae like dissecting every single word out of Senator John Doe's mouth to advance some ridiculous pre-formulated conclusion -- "Senator Doe ate French Fries! Clearly he hates America!"

Wonkblog does none of those things, often posting only about actual reports or expert's interviews. It's both rare and relieving to see a political blog that at least _attempts_ to stick to non-partisanship.

Even here you can see that they aren't declaring this event to be any bigger than it is. The guy who oversaw healthcare.gov resigned, here's his resume, here's what he's doing, here's what the CMS said about it. The end.

</comment></comment></comment><comment><USER7> What this should read is he awarded huge bloated crazy contracts to the private sector and he now has a job at one of those companies.

</comment><comment><USER8> Here is an interview with the guy, uninspiring stuff...

[http://www.youtube.com/watch?v=wghDZagJ_nM](http://www.youtube.com/watch?v=wghDZagJ_nM)

<comment><USER9> Now I know why I don't work for the government. Who would ever create or watch that crap?

</comment></comment><comment><USER10> He probably didn't leave by choice.

Jumping off what is perceived to be a sinking ship like that (by choice) before it was fixed would be career suicide. It is however very understandable that he would be found a job to get him out of the way for someone else to do damage control.

</comment><comment><USER11> Do you guys have any link where the whole HealthCare.gov disaster is explained? When I first heard of it, I visited the website and saw no problem - actually found it quite nice.

<comment><USER12> Here's one source: [http://arstechnica.com/information-technology/2013/10/the- se...](http://arstechnica.com/information-technology/2013/10/the-seven-deadly- sins-of-healthcare-gov/)

</comment></comment><comment><USER13> Anyone else look at that title and think that it's pretty hilariously unprofessional? Haha

EDIT: To print an article with that title, not job title.

</comment><comment><USER14> "Our chief operating officer announced yesterday Tony has accepted a position in private sector,"

so long and thanks for all the rotting fish?

<comment><USER15> I suspect that the 'private sector' is one of the contracting companies that did the site to begin with. The guy is lobbiest gold since he knows who is and who isn't able to be influenced in the department.

<comment><USER14> yeah, he likely went into some private consultancy firm that'll be contracted to fix the issues with the abomination (Obamanation?) he knows best, because he built it! But all at private sector rates, still paid for by the taxpayers.

nothing pays like ongoing maintenance contracts :)

</comment></comment></comment><comment><USER16> At least the private-contractors are finally facing the consequences, in the beginning the outrage would have let you to believe that it was the President himself who was the one programming away the exchanges!

</comment><comment><USER17> Sacrificial lamb. Executing this SNAFU required layers upon layers of incompetent and unmotivated people completely detatched from the consequences of their lack of performance. Since this describes a vast majority of the people who work for government it is easy to imagine a one million dollar website turning into a six hundred million dollar website that does not work. In any other universe people would have been fired by the hundreds and some even brought up on charges. Not in government.

Until we have a system that makes them all fully accountable for their actions this will not change. Many of you are just waking up to the horrible reality that this is how nearly everything is done in government. Just. Like . This.

</comment><comment><USER18> It's easy to blame one guy, but I'm sure his task was next to impossible.

It's not just some independent website where you have full control of your creation. It had to interact with a dozen of other systems, and I'm sure a bunch of APIs were created just for that, and I'm sure bugs in just some of them could render the whole system nonfunctioning.

And yes, maybe it is this guy's fault. We don't really know.

<comment><USER19> It's even easier when you read the guy's biography :

[http://www.cms.gov/About- CMS/Leadership/ois/index.html](http://www.cms.gov/About- CMS/Leadership/ois/index.html)

This guy is a typical management idiot. He has no qualifications except "leading" (not specified any further, of course), and making decisions about other people's money. While it's hard finding disastrous decisions in his CV, I'm not seeing anything that suggests he did more than show up.

As for leading, he has zero qualifications in either healthcare or IT.

I see this at a lot of companies, and someone really should explain it here, where I can ask the question anonymously : how the fuck do these guys get their positions ? Suppose I came in for a job interview about programming cars. First thing I say is that I have zero knowledge about either programming or cars. But I've got "executive awards" and I managed a few people in a completely unremarkable company in a project no-one's ever heard of, or ever will hear off, they were that important.

Would you hire me ? I hope not. Why the fuck did this guy get hired ?

I can't even fault the guy himself. Of course he's not the right person to lead anything, but he's responding to incentives put in place by the US government, and by companies more generally. Given what he gets paid, of course he's doing whatever his superiors want him to do, without question, and without taking reality into account. Of course he's extremely motivated to lie to everybody to keep that job for just a few more months. The guy who hired him to make responsible decisions about IT, or healthcare, that's the guy that needs firing.

Really, I'd love to understand. What, assuming it isn't flat-out corruption or nepotism, motivates someone to hire people like this into important positions they flat-out know nothing about ?

<comment><USER20> Here's my theory.

There's domain skills, the actual skills and knowledge about programming or cars or whatever your business does.

Then there's skills at _getting ahead_ itself. Politics. Skills at making the right people happy so you get a promotion.

You _need_ the 'getting ahead' skills to get to top levels in a large organization, right? We know that domain skills _alone_ aren't going to cut it, if you're not good at the office politics, you are never going to be a department head or CIO -- in a large corporation or government or a university or large nonprofit: in any large organization.

Well, there's only so much room for so many skills. To actually get to the top levels of a large organization you need to be _so_ good at the political part, that there's no time or room left in your psyche for any actual domain skills at all. Or, really, any skills at all except for skills at making people higher up than you think you are good.

<comment><USER21> > You need the 'getting ahead' skills to get to top levels in a large > organization, right?

The problem isn't attaining these skills; it's using them. Sure, I can use people as a means to an end in all sorts of colorful fashions to climb the ladder, but could I go home and sleep at night? I've made that decision, and it's a firm "No."

Climbing the corporate ladder doesn't seem to be so difficult, as long as you can rationalize the soul selling required to do so. Perhaps my point of view will change later in life, but right now one of the most important ideologies I maintain is that I should only be evaluated based on work I can directly represent, not credit derived from others.</comment></comment></comment></comment>


Yubikey with USB-C - <AUTHOR> https://www.yubico.com/2017/01/yubikey-usb-c-ces2017/ <comment><USER2> No word on switching back to open source. Their YubiKey NEO was open source; not sure why insist on proprietary code for the YubiKey 4. I'm frankly not comfortable with this kind of "security by obscurity".

[https://github.com/Yubico/ykneo- openpgp/issues/2#issuecommen...](https://github.com/Yubico/ykneo- openpgp/issues/2#issuecomment-218446368)

Edit: Never mind, there's actually a reasonable explanation for the change: [https://www.yubico.com/2016/05/secure-hardware-vs-open- sourc...](https://www.yubico.com/2016/05/secure-hardware-vs-open-source/)

<comment><USER3> I believe it has been discussed here previously, but open source on a propietary firmware (Java VM) wouldn't be considered open source by many.

[https://news.ycombinator.com/item?id=11691655](https://news.ycombinator.com/item?id=11691655)

It is interesting how it allowed revealing the details of a bug in the implementation, though.

[https://developers.yubico.com/ykneo- openpgp/SecurityAdvisory...](https://developers.yubico.com/ykneo- openpgp/SecurityAdvisory%202015-04-14.html)

<comment><USER4> > _open source on a propietary firmware (Java VM) wouldn 't be considered open > source_

It's significantly better than completely closed though!

<comment><USER5> Why? You still can't control, fix or trust the software as a whole.

It's like a parachute that _almost_ opens.

<comment><USER6> Then it's at least a parachute and not a backpack with an anvil.

<comment><USER7> And yet you'll still be in trouble when you impact the ground

</comment></comment></comment></comment></comment></comment><comment><USER8> It's unfortunate that there is no Yubikey nano for USB-C yet. I really like the nano form factor, especially because I can't accidentally break a USB port like I could with the normal sized one.

I guess it's really hard to fit all of the electronics in a port as small as USB-C though.

<comment><USER9> I like the form factor, but as a second factor it sucks. Effectively your computer becomes the second factor, and it's much more likely that your laptop (with the Nano plugged in it) is stolen, than a keychain with a bigger Neo.

It's acceptable if you only use it for OTP, but I can't get myself to put GPG private keys on a Yubikey Nano...

<comment><USER10> Why? Your GPG key is airgapped and inextricable (except possibly via something like a DPA-style attack), and you can set a PIN required to perform any private key operations, complete with a configurable number of attempts before the device wipes itself.

There are DPA attacks to be worried about, but if you set a decent PIN and limit the number of failed attempts your GPG keys will probably be safe if your Yubikey is ever lost/stolen.

<comment><USER11> I figure I can get a lot more security with a practical-length passphrase than a practical-length PIN.

<comment><USER12> I have a 6 digit pin (8 digit admin pin) with 3 retries before the device wipes itself. The chances of an attacker cracking that are negligible - I'm more concerned about someone observing my typing (applies to passphrase as well) or actual physical attacks on the yubikey (stolen, decapped, ...) but I'm not the target demographic where such effort would be warranted (or at least I hope so). An attacker could backdoor my PC and intercept the passphrase dialog - but in that case he'd still need my yubikey which makes remote attacks impractical and makes me notice the theft. This is not the case with a passphrase on a secret key - a machine compromise may silently take everything without you ever noticing.

</comment></comment></comment></comment></comment><comment><USER13> A security token is an excellent concept, but usually fails when applied to 'typical' use-case scenarios.

Are you military personnel who is in charge of turning the key and launching the nukes? -Excellent reason to have a key that is impossible to forge. -Also, "key discipline" is likely very high.

Are you a paranoid nerd that wants to make sure that you cannot be compromised? -Excellent reason to have a key that is impossible to forge. -But what happens when you lose that security token?

i.e. "Honey! I can't find the car keys, have you seen them?"

We desperately need _BETTER_ 2FA. Bio-metrics are not the answer. I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.

<comment><USER14> > But what happens when you lose that security token?

Pretty simple: you use your backup key to revoke the lost key. This is possible with e.g. Lastpass and Google. Of course, if the attacker logs in before you revoke the key, you are hosed, but the same would be true in your car analogy.

> i.e. "Honey! I can't find the car keys, have you seen them?"

With car keys, too, you have a backup key. Arguably, the physical car keys are easier to copy.

> I would be in favor of an implantable RFID chip or whatever 'better' tech > comes around.

Nothing new, see this article from 2004 [1]. As you can read in the article, its first headline was even in 2001 (to put in perspective this is 15 to 16 years ago). Company's name is VeriChip.

The problem is that the signal can be intercepted (AFAIK it doesn't use a form of OTP), and the key cannot be easily replaced/revoked. A YubiKey doesn't suffer from this issue. The issue a YubiKey has is that it can be easier lost than an implant.

The YubiKey Neo ('large' version, _not_ the 'laptop' version) supports NFC.

> We desperately need _BETTER_ 2FA.

Why? How?

[1] [http://www.wnd.com/2004/04/24179/](http://www.wnd.com/2004/04/24179/)

<comment><USER15> I'd love something like a Yubikey Neo (NFC) with a fitness band type form factor (that I can shower/swim with), and an intention indicator (button of some sort) before the NFC would respond.

<comment><USER14> Right now I use a Pebble smartwatch (which I use for fitness, too) with Bluetooth 4 to unlock my Android phone. Not very secure since (as you put as well) I don't verify the unlock via my smartwatch, and I'm not sure about impersonating Bluetooth 4. Then again, I'm not sure if NFC (RFID) can be impersonated, either. And, if yes, how feasible it is.

</comment></comment></comment></comment><comment><USER16> Maybe I'm going about this the wrong way but how do people handle 2FA across multiple machines with multiple keys?

I have multiple desktops, laptop and several mobile devices that I often context switch across. I'd like to use 2FA without having to plug and unplug the key every time I want to switch devices.

<comment><USER17> IDK if this is the right way to go about it.

But I have one long password (30 characters) for logins and disk encryption, and everything else is 1Password/2FA. If you allow cookies, you won't get asked to use the key again. Most sites allow you to also use an authenticator app on your phone (some even force you to also set this up when you add a key). And I have GPG subkeys for every machine, so the key is only needed for the initial bootstrap. So this way, the amount of times you actually have to use the key is low. I'd say I use mine one a week, maybe less.

<comment><USER18> > some even force you to also set this up when you add a key

Which is a good idea if your key gets crushed.

</comment></comment></comment><comment><AUTHOR> What I really want is not USB-C but rather a Yubikey 4 the supports NFC. None of the sticks support all features, is quite vexing. Now I have to carry different sticks for different reasons.

<comment><USER19> NFC is the thing that's got me still using my Neo. It's the only reasonable way to use one with a phone for 2FA.

<comment><USER20> Apple phones support neither USB-C nor NFC, so for those it's a non-issue. Android phones (from the last few years onward) have NFC but also have USB-C, so why exactly would you need to have both?

<comment><USER11> S7 doesn't have USB-C, and that's about as recent as it gets. And even if my phone had USB-C, NFC is more convenient.

</comment></comment></comment></comment><comment><USER21> It would be nice to have USB C at one end and normal USB at the other.

<comment><USER22> Yeah, for the moment at least USB-C isn't universal enough that I'd be comfortable carrying a key that _only_ works with devices that have USB-C ports. Maybe in a few years...

</comment></comment><comment><USER23> What is a Yubikey, I asked:

"Your YubiKey provides a second factor of security for your logins, beyond a username and password. Your YubiKey needs to be registered or paired with each computer, service, or site you use it with. "

<comment><USER22> Yeah, it's basically a smart card you can use with a bunch of popular sites like Google, GitHub, Dropbox, etc. (See [http://www.dongleauth.info/](http://www.dongleauth.info/) for a more extensive list.) Based on an open standard (FIDO U2F). Some versions also support storing PGP keys and the like.

<comment><USER24> Why would one prefer to use a dedicated device like this, now that smartphone- based 2nd-factor is an option?

<comment><AUTHOR> There are a number of reasons.

\- Clicking button is far easier and faster (it really does make a difference).

\- Your smartphone is complex software and often attacked. Secrets can be stolen.

\- Based on public-key crypto, no secret on the server.

\- Built in phishing protection

\- Your own private key is secure hardware that you can't read the key from

To be fair, a smartphone could also implement U2F and you would get some of the same benefits. Samsung phones for example already support UAF (the other FIDO) protocol.

<comment><USER25> Doesn't this mean that Yubi has the potential to know what your private key is (since they have to bake it into firmware before selling you the device)?

<comment><USER26> Most key dongles or smartcards let you load your own key on the device in a write-only fashion, or use the inherent secure cryptographic operations from the device to generate a key (which could subsequently tested if it is random enough through examining the public key portion and multiple tests).

<comment><USER11> > use the inherent secure cryptographic operations from the device to generate > a key (which could subsequently tested if it is random enough through > examining the public key portion and multiple tests).

It's not really possible to verify randomness this way - particularly for a device that already has a decent chunk of storage and crypto operahtions. Suppose the "random" number generator is actually an AES keystream coming from a key controlled by the NSA - how would you tell?

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> It's unfortunate that they went closed source but I still have a Neo here that survived several months in my washing machine (it got silently caught between the rubber manifold and the drum). Eventually when I found it again, plugged it in expecting nothing, but was greeted with the green flashing led and the button worked just fine. I still have it but don't use it anymore, the closed source thing grates a little with me so use other methods now.

<comment><USER3> Would you mind taking the time to share the details of your current open source authentication solution?

<comment><USER27> Yes, certainly. I ended up using TOTP with an authenticator on my phone. Try FreeOTP[1] or if you're not fussed about pure open source, Authy is worth a look. On the systems you can link it into PAM using Google's OTP plugin[2], either locally or via SSH etc.

It's definitely not that ground breaking but it works, provides reasonable extra security and meets my requirements. It lacks some of the feature of Yubikey like storing GPG on there or HMAC etc, but I don't need those functions in reality.

[1] [https://freeotp.github.io/](https://freeotp.github.io/) [2] [https://github.com/google/google-authenticator- libpam](https://github.com/google/google-authenticator-libpam)

</comment></comment></comment><comment><USER28> Worth mentioning that it seems that the USB-C OpenPGP app may support RSA 4096. I'd love to upgrade my yubikey ssh key from RSA 2048 -> 4096.

Currently my YubiKey Neo only supports RSA 2048 as it's a hardware limitation of the NXP A700x chip used inside.

[0] [https://www.yubico.com/2015/02/big- debate-2048-4096-yubicos-...](https://www.yubico.com/2015/02/big- debate-2048-4096-yubicos-stand/)

<comment><USER29> YubiKey 4 supports 4096-bit RSA. But it's not USB-C.

<comment><USER30> But that's what the article is about?... The YubiKey 4C. A YubiKey 4 that supports USB-C.

</comment></comment></comment><comment><USER31> Have they ever figured out compatibility with iOS? I feel like this is the biggest thing holding them back from broader adoption.

<comment><USER32> Have you tried to setup a Yubikey with RSA-keys and click-to-sign? It's things you expect "just to work", but the tooling around the Yubikey sucks big time and thats what holding them back. It's a shame though cause they make really good hardware.

Their strategy has been to gain tracktion through the major tech players. Think it's time for Stina to realize they cannot ignore the rest of us if they want to make it big.

<comment><AUTHOR> What competitors have tools that just work?

For the most part there provided guis work wunderfully.

GPG is of course always a mess.

I agree with click to sign, that seems to be a bit hacky, otherwise however its fine.

</comment></comment></comment><comment><USER33> Great! The reason I bought a Yubikey Neo over the Yubikey 4 is that I need access to the key on all my devices - computers _and_ my phone(s). It's a way to do secure and user-friendly way to solve the key distribution problem to have access to your TOTP tokens, FIDO credentials and/or your PGP keys on all your stuff. I would not use PGP otherwise, as it leaves key distribution as an exercise to the user [2].

Since USB-C is going to be the standard on computers, phones and tablets this new product will be very versatile and usable secure authentication across almost all devices [1]. Only question is - do apps like Yubico Authenticator and OpenKeyChain support this on Android already?

[1]: You're out of luck on iDevices of course, but you're out of luck with iDevices and Yubikey already.

[2]: This was much less of a problem for the first ~15 years of PGP's existence of course, but it feels old-fashioned nowadays.

<comment><USER34> I regularly use OpenKeychain with the YubiKey 4 Nano USB-C bundle on a Nexus 5X.

[https://www.yubico.com/product/yubikey-4-nano-usbc- bundle/](https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/)

</comment></comment><comment><USER28> I'd love to replace my YubiKey Neo with the USB-C version because it looks more rugged. That said my Neo works fine but I fear it destroying a USB port after a minor accident.

However, my problem with USB-C is while it works great on my laptop, my desktop doesn't have a USB-C port anywhere near my desk or keyboard. I'd have to buy a hub or something. I'm sure this will get better as I find excuses to replace parts of my desktop hardware.

<comment><USER35> Exactly my thoughts. Finally a yubikey I don't have to worry about breaking. Admittedly, I've never broke one, but I still live in fear of doing so.

I'm surprised folks like the Neo though. I rarely use mine anymore as I kept accidentally triggering it when I carried my laptop to meetings.

<comment><USER36> The Yubikey Nano is pretty great in this regard - doesn't stick out enough to really worry about breaking.

<comment><USER35> The Nano (not Neo) is the one I was referring to (said wrong thing). It's the one I used to trigger at least once a day accidentally, usually in a chat window as luck would have it.

</comment></comment></comment></comment><comment><USER37> What are the options for handling loss or theft of your YubiKey if using as an individual? I love the concept of a physical token as a second auth factor, but last I checked, there were no good loss-recovery scenarios when used as an individual (versus in a corporate environment where IT manages the Yubikeys).

<comment><USER38> Far as I can tell, the best strategy when using any 2FA system personally is to enroll at least 2 authenticators, and keep one in a safe place (preferably that a family member or trusted friend can get to while you are traveling).

If either is compromised, you can use the other to log in and block it.

<comment><USER37> Thanks, this makes sense. I suppose you can buy as many Yubikeys as your paranoia dictates and potentially even distribute your backups in different physical locations.

Is there any potential for the Yubikeys to get "out of sync"? Or do you just initialize both Yubikeys upfront, and then distribute them to a safe place?

<comment><USER39> You do them upfront, then store one in a safe place (ie: for github I have yubi and yubibackup registered)

</comment></comment></comment></comment><comment><USER40> I use the yubikey, and I wish it had a blinking LED while it was in the slot, to let me know that it was still there, and should not be.

The first week I had it, I left it inserted in the computer a number of times. Now I keep it on my keys so that I don't forget to remove it.

Now I

</comment><comment><USER41> It needs A on one end and C on the other, because nobody I know works on only one device.

(OTG too for various devices, of you want really wide compatibility)

</comment><comment><USER42> Does anyone know why the yubikey 4 supports RSA 4096, but ECC only goes up to 384 and not 521? Sure 384 is likely "enough" but ECC 521 is both faster and smaller than RSA4096. I just can't seem to figure out why they would impose that limit.

<comment><USER39> Strange they mention supporting 521 here [1], but on the compare page they only list 384?

[1] [https://www.yubico.com/2016/05/secure-hardware-vs-open- sourc...](https://www.yubico.com/2016/05/secure-hardware-vs-open-source/)

Edit: looking at the PIV tools manual they provide; I can see no mention of the tool supporting 521, it fails when I try to generate a key.

Looking through the .h files, I do see mentions of p521 ;)

      int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
      int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
      int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
      int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
      int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);

</comment></comment><comment><USER43> Anyone else using a similar product, OTHER than Yubikey? I've read on certain forums about Yubikeys being "flimsy" and less durable than similar products; is this true? what is your experience with it?

<comment><USER44> I have had a yubikey neo on my keychain for almost 4 years now. It is thin plastic and seemed like it might not hold up this long, but it has been going strong. I think they have changed designs to make it smaller since (which would be stronger). They do make solid products.

That said, I would rather use Google Authenticate (TOTP) for two factor. Getting my phone out is a regular thing. Getting the yubikey out and plugging it in seems more of a hassle. Passpack is the only thing I have to use the yubikey for -- would be happy if they provided TOTP. Spending $40 for two factor these days is kind of ridiculous.

<comment><AUTHOR> Why not just leave it plugged in. That might be tricky in a train or so, but normally its fine. I use a Nano and just leave it in most of the time.

Its not only more convinient, its also far, far safer then TOTP.

The will not support TOPT because that would require constant power.

You can get a U2F only stick for 18 bucks from them. Once in a while (for example when github interduced U2F the sell 2 for 5$).

<comment><USER45> Yubikeys support TOTP...

[https://www.yubico.com/support/knowledge- base/categories/art...](https://www.yubico.com/support/knowledge- base/categories/articles/how-to-use-your-yubikey-with-authenticator-codes/)

<comment><AUTHOR> TOTP requires an app, Yubico Authenticator.

<comment><USER44> Exactly, and if you are going to use an app anyway, you may as well have the app keep the token.

<comment><AUTHOR> I actually still use it because this was I can use somebody else phone or some other device if I need to. That has come in very handy before.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> Couldn't there be a passthrough? I guess that means making the key a two port hub (one internal for the key itself, one external for connection additional devices).

</comment><comment><USER47> Great to hear. Seems like very fast turn around addressing the needs of USB-C. Looking forward to the snag free version.

</comment><comment><USER48> Lovely to see USB-C, I hope it will be plug and play for all USB-C phones as well!

</comment><comment><USER49> "We are working on an additional smaller YubiKey form factor with a USB-C design akin to the YubiKey 4 Nano, but do not yet have a time frame for availability."

This is what I'm waiting for. Besides lower prices. There's just no way these things should cost more than $2.

<comment><USER50> > There's just no way these things should cost more than $2.

Absent R&D costs, support costs, sales costs, and you know - actually making money...

<comment><USER28> Don't forget things like standing behind your product and replacing it when things go wrong, because this is security after all.[1]

Alternatively, I bet they could sell them for less and deny all future security issues or ask that you throw them away when they are inevitable discovered.

[1] [https://www.yubico.com/2015/04/yubikey-neo-openpgp- security-...](https://www.yubico.com/2015/04/yubikey-neo-openpgp-security- bug/)

</comment></comment></comment><comment><USER51> yubikey can still be circumvented by bribing or blackmailing a user. idk seems like another security illusion.

and it's proprietary so only yubikey knows what kind of extra shit they're running on it.

</comment><comment><USER52> 50USD for what I'd guess is about 1USD of components.

Not that this isn't justifiable... just the way it goes when most of the cash goes into development perhaps.

<comment><USER28> > 50USD for what I'd guess is about 1USD of components.

These are crypto hardened chips with obfuscated ASIC layouts and other details to prevent things like power line attacks and decapping. These aren't quite your run of the mill commodity chips.

Furthermore, Yubico stands behind their product. When someone hacked the key with a power line analysis attack, they released updated firmware [1]. When someone hacked the OpenPGP applet that I use for SSH, they replaced my Yubikey Neo in a hassle free manner [2].

> Not that this isn't justifiable... just the way it goes when most of the > cash goes into development perhaps.

When you factor in the cost of pretending that security devices don't have issues and compare it to the cost of actually handling those issues, it may not be so bad.

[1] [https://www.yubico.com/2014/04/improvements-physical- yubikey...](https://www.yubico.com/2014/04/improvements-physical-yubikey- attacks/)

[2] [https://www.yubico.com/2015/04/yubikey-neo-openpgp- security-...](https://www.yubico.com/2015/04/yubikey-neo-openpgp-security- bug/)

<comment><USER53> I have a rather favorable impression of the company based in their responses to the incidents that you mentioned. They replaced my YK Neo without any hassle after the OpenPGP applet vulnerability was disclosed.</comment></comment></comment>


Cops won't need a warrant to pull the data off an autonomous car - <AUTHOR> https://arstechnica.com/tech-policy/2018/02/why-self-driving-cars-may-be-heaven-for-investigating-crimes-and-accidents/ <comment><USER2> 'I felt like I was in heaven,' the cop said. 'It's like instant replay in the NFL, I can tell what happened.' The engineers looked at each other like, 'Aw, crap.'

As engineers, we have an obligation to think through privacy concerns.

These (and nearly all) devices should either not retain data or should encrypt it. Also my self-driving car better not be phoning home or getting updates over the air. I've seen what happens in Fast and the Furious 8… [https://fsmedia.imgix.net/19/8a/19/0d/3e81/44e8/ab9d/679cbb2...](https://fsmedia.imgix.net/19/8a/19/0d/3e81/44e8/ab9d/679cbb29bbb6/hack- the-cars-why-not-hack-the-planet.gif)

<comment><USER3> Aircraft, even private aircraft, are tracked and recorded. Why should automobiles be any different? Far more people are killed and injured by vehicles than are killed by aircraft. In general I'm pretty pro-privacy but I've had way too many close calls and accidents with bad drivers who were found to be at fault. Maybe there's a better way to get to vision zero, and if so I'd love to hear it.

<comment><USER4> Cars, especially in the US, is very closely linked to the location of a person. For private aircraft that is generally not the case I assume.

I work for a semi-governmental organization in the Netherlands and we track ships. Tracking company-owned commercial ships is no problem, but we are heavily restricted by law in what we can do with the location data of privately owned ships because people live on them.

<comment><USER5> If you want privacy maybe don't drive around on what is literally government property.

<comment><USER6> Privately owned boats and autonomous cars are government property?

<comment><USER7> That post probably means public roads.

<comment><USER6> I guess I can understand the argument but I don't see what kind of world view thinks that you can go out into the world r have privacy. Roads are what connect the vast majority of all land. It's not like you can just trespass into other people's land and expect privacy either

<comment><USER7> The world view is that what happens in public space is not private; you can't expect privacy for things you do in public.

If you go to a public concert, people can look at you, note that you were here and tell that to others. That doesn't violate privacy because you had no privacy there to begin with. And in a similar manner, if you drove last thursday on a particular road, whoever bothered to look at you and your car is allowed to do so, note that you were there, write it down and tell that to others.

Privacy is about your private stuff - what you do in your private space, what you have in your private items. If you go out in the public, the things that you do (and where, and when, and with whom) are not private anymore.

<comment><USER8> In a public space a random person might 'see' you there - but they would not know who you were and may not even remember you correctly. A machine on the other hand remembers perfectly and records constantly. As far as your car-the random observer may be hard pressed to note the fact of your license plate number while trying to remember what kind and color your car was.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I think there is an aspect of privacy that folks may be ignoring. Privacy from commercial entities.

Consider the following scenario:

Driver A and driver B are involved in an accident. Driver C is in an autonomous vehicle that "witnesses" the accident, by being in close proximity to the event.

If driver A or B have the same insurance company as C, that company could get the data from C to determine fault in the accident that C's vehicle witnessed... or better yet, show that both drivers were at fault and they will not pay anyone anything.

As the number of autonomous vehicles rise, the amount of data available to companies will grow, too.

I would be surprised if there isn't language in the policies being underwritten today that would make such a thing possible... possibly even mandatory.

<comment><USER10> For automobile insurance, I don't find the idea of the insurance company getting detailed information about a collision disturbing at all.

There's probably reason to make sure that policies don't contain weird provisions related to that data collection, but there isn't really a strong case for hiding driver information, there is enough variation in drivers to justify varied premiums.

</comment></comment><comment><USER11> This is an aspect of autonomous vehicles that I had never considered before.

Given each AV has complete 360 degrees camera coverage (for detection of other vehicles, if Tesla, for debugging, if others which rely primarily on Lidar) and this camera data is very valuable for debugging and as a liability reducer, this data is very probably to be kept, then transferred to a datacenter. So each AV is also a bunch of mobile security cameras.

LE officers can access those recordings with the same ease they access fixed security cameras, once an investigation starts. Very easily, even without a warrant.

One increased difficulty is the need to ask AV makers which vehicles were near the incident at the time, so as to know which AVs camera recordings to ask for. That location data is protected, at least in some US states.

<comment><USER12> I don't think that data is likely to be kept, raw or otherwise, on anything other than a very small rolling window, if even that. What the author of this article missed is the boot full of server racks that have the storage and processing abilities to even consider storing the raw data from a multitude of cameras, LIDAR and associated sensor systems.

For development, sure, in test fleets, sure, but production cars won't bother with that.

<comment><USER13> In all the vehicle recording systems I've worked with (for a local municipality's police video recording) the only video data that would be stored is video data that is pertinent.

So you wouldn't record and store an officer's complete shift. When the officer turned on his lights or siren, the device would rewind 30-45 seconds and start recording. It would then record until the lights/siren were disengaged. That is the video that would be uploaded.

So I think a more likely scenario is that the autonomous cars would in fact permanently store and share all GPS data, but data from the sensors would only store what was recorded with a reasonable buffer around a fault event such as a collision.

<comment><USER14> Ubiquitous 5g could allow for constant data egress.

</comment></comment></comment></comment><comment><USER15> Imagine a world with less centralizing force, where owners of devices are encouraged to decentralize data storage. In such a world, autonomous vehicles would ask you to specify where to store the data they collect. The owner could select to choose on-vehicle storage, vendor-provided central storage, or a data server they personally own and operate. And in all cases, given an option to encrypt using a key selected by the user/owner.

I would prefer such a world. It provides a different legal context where law enforcement would need to compel each individual owner to turn over data. Such compulsion could certainly still be realized, but it's a more significant hurdle than forcing the manufacturer rather than the user, and it's more likely to see challenges.

<comment><USER16> I'd love that, but there are three problems with it, even if you put aside the commercial benefits:

1\. Means people have to build and test two systems

2\. It's confusing to the normal user

3\. It's better for the product if it's shared as they can iterate and improve based on the data.

This actually applies to loads of products, like voice recognition (Google has recorded and stored everything you've ever said to 'ok Google's on their servers).

So I don't think we'll see a solution until we see a massive shift in privacy becoming a key election issue. Which it probably won't for decades or until a ruthless dictator takes over a developed country (sort of happening in Turkey).

<comment><USER17> In my ideal world, data should go to the vendor by default. As you said, it helps the product improve by feeding it more data, and it's simpler for most users.

With that being said, privacy concious people should have the ability to opt out, and either not have their data stored permanently at all, or allow them to store it on a personal server. If you chose to do that, it's on you to make sure your server is setup in a way to ingest the data, so no additional work for the vendor.

I suspect in reality most vendors would not provide that option, because data is so valuable, which is why it's important to have laws that allow us to protect it.

</comment></comment></comment><comment><USER18> They won't "pull the data off your car" anyway, because all the interesting data will be elsewhere.

Also considering that all the big car manufacturers are working on business models where usually driver and owner are different entities this even gets more involved.

We had an interesting case in Germany where data ended up in the court room neither the manufacturer nor the car-sharing provider claimed to have.

<comment><USER19> Well, I think the essential mistake here is that it's not _your_ car to begin with. You may fully or partially own the hardware, but the actual autonomous vehicle core is not your property - it's only licensed to you.

</comment></comment><comment><USER20> This is interesting, but a bit of a side-show.

For the more significant stuff -- where you go and when, who you communicate with and what you communicate about -- data from autonomous vehicles probably isn't going to be the main issue.

It will generally work a lot better -- cheaper, easier, more reliable, etc. -- if they get their surveillance data from a system designed for their purposes. And, of course, they don't have to wait for the widespread adoption of autonomous vehicles to build such a system. In fact, they haven't waited.

The big question is how our norms and laws around privacy reset after the explosion of information technology has wiped away all the assumptions on which our traditional notions rested.

</comment><comment><USER21> They'll need a warrant to pull the data from the manufacturer. Chances are no LEA is even going to ask your permission as you won't have the tools nor know how to pull that data.

<comment><USER22> > _They'll need a warrant to pull the data from the manufacturer._

Can you elaborate?

<comment><USER7> As the article says "As such, Tesla's terms and conditions—like those of other non-automotive tech companies, including Apple, Google, and more—say that the company will hand over data to law enforcement when legally compelled to do so."

"Legally compelled to do so" means a warrant or a court order or something like that; which in my mind seems reasonable; in general, we _do_ want courts to get evidence to determine what actually happened in (potentially fatal) accidents, instead of having to do without and have a greater chance of making a wrong judgement because they didn't have that information.

</comment></comment></comment><comment><USER23> The scariest thing is that the government could just ban non-autonomous cars completely, under the guise of "safety", meaning there would be no opting out of being tracked for any long-distance travel. I've never been a fan of self- driving cars, and everything I've seen hasn't convinced me to change my opinion.

"If you outlaw freedom only outlaws will have freedom."

<comment><USER24> Even if everyone were to opt out of autonomous vehicles, law enforcement bodies would just continue deploying and upgrading their own sensor networks. Cameras that read license plates are pretty much standard equipment now; face and gait recognition can't be far behind.

</comment></comment><comment><USER25> Yeah, but we already knew this. Of course they will collect all the data they can all the time and store is as long as they can. What I'm more interested in is how they plan to treat the vehicles themselves. In an autonomous vehicle world, there should be no more moving violations and being pulled over a thing of the past, especially if the vehicles are not owned by humans. Or not, who knows? That's the kind of information that would be much more useful and would potentially save many more lives from ruin than the accident avoidance technology.

</comment><comment><USER26> This is interesting. A true comprehensive rethink is required.

When you rent a safe deposit box the law doesn't get automatic access (warrant etc is required). They law could consider buying just a ride from an AV service to be "renting" the car as you would a safe deposit box, house, or apartment and require a warrant for police access.

But you'd have no authority over the cameras and other systems of all the other cars around you -- those would still be available.

Tricky.

<comment><USER27> I wonder whether, along with the rollout of the infrastructure needed to support mass AVs, the govt will just be adding in traffic surveillance cameras as well? It seems to me that the infrastructure to support mass AV traffic would involve lots of sensors, cameras, and other electronic devices.

<comment><USER26> > I wonder whether, along with ... mass AVs, the govt will just be adding in > traffic surveillance cameras as well?

I don't wonder -- it seems quite certain this will happen. It seems whenever new systems are put in place, surveillance is built in: Automatic bridge toll payment? Could have been done with a reloadable token but no, you have to tie it to a particular vehicle and identity, and _that_ information has been used by law enforcement. Driver's licenses? They really need only a photo and an expiration date but instead they are belarded with all sorts of information (weight, address etc) which have nothing to do with driving.

In this case it will likely be shrouded by the overstretched and abused "third party doctrine" (if a third party has the info the govt can just go see it -- so the DEA doesn't have a license plate database, it can simply contract with a third party to make one instead). The government will simply require that AV fleets provide all their telemetry data including optical camera info.

> It seems to me that the infrastructure to support mass AV traffic would > involve lots of sensors, cameras, and other electronic devices.

What sort of infrastructure should be built that is specific to AVs (and why should the government, rather than the fleet operators or other third parties implement it)? Why should they need even as much as humans require today?

</comment></comment></comment><comment><USER28> Why is raw sensor data needed for longer than a few minutes? Is it not sufficient to update models and discard the raw data?

<comment><USER29> Because you might want to process it differently?

<comment><USER28> For development/debug, yes.

How/why would a _production car_ need to process it differently and why couldn't all processing be done in real time? Safety certification means the car's functionality has to be static, until the next certified software update. Data does not need to leave the car, since the purpose of the data is for the car to drive, which is a transient state.

<comment><USER7> If you're driving a production car version 1.23, then the manufacturer (obviously) wants data from that car to be used in development of production car version 1.24.

The technology needs improvements, and the process of making those improvements is hungry for data. Every manufacturer will be in development/debug mode of their self-driving systems at least for the coming decade, so sensor data from every mile of every car is wanted and useful, and manufacturers are configuring production cars to upload as much raw sensor data as is practical.

<comment><USER28> That logic applies to every product ever made in the history of technology. Somehow their R&D departments did not need 7x24 data feeds.

Each society can decide whether to permit this particular product to collect unlimited data. The presumption is that the data belongs to no one. Let's see what happens when more than one large corporate entity lays competing claim to the same data subset, embedded by a wide-ranging data dragnet.

<comment><USER7> I do think that the logic does _not_ apply to every product ever made, that there's a major conceptual difference between products purely designed by humans and products where key features are driven by machine learning and availability of raw data.

A 24/7 data feed from your toaster is not going to make your toaster better. It _might_ help an R&D department identify some ways how the next toaster model should be different, but that's about it.

However, a self driving car is data-starved and is still going to be data- starved years from now. At any moment of time, your car could drive better and safer simply if it had more "experience" \- the v1.24 software release can be meaningfully better than the v1.23 software release even if R&D department does nothing else but simply import the data received from millions of other cars; if your car is allowed to learn from what other cars saw.

Ensuring that the quality of driving systems increases as fast as it can is important for the society, with a major impact on injuries and casualties. I feel that it would be best for the society if we ensure that this learning (and the required data transfer) is not prohibited, as long as we can solve/restrict the potentially harmful uses of the data.

<comment><USER28> Or maybe we could save more lives by using technology to augment human drivers?

We don't actually know that self-driving cars are possible in unrestricted environments. The industry is asking for highly invasive surveillance but has no liability for failure to deliver. What happens if "more data" turns out to be insufficient? Will the next request be "restrict the environmental context" or "pass new laws to change human behavior"? Where does it end? Other industries have to deliver results before changing the market. Uber et al promised the moon to their investors, then ignored local laws, then promise to save lives, then ignore privacy concerns, then ..?

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Laws take a while to catch up with new technology. This will be fixed in 8-14 years after enough people are affected by this and congress finally gets lobbied enough. Early adopters will get hit the hardest though.

<comment><USER31> Or in 8-14 years they have a critical mass of people who grew up being tracked 24/7 that they just shrug and say "1984? You mean like that weird Apple commercial from, what, the Super Bowl or something? And yes, please pass the Soma."

</comment></comment><comment><USER32> Big Brother on wheels: Why your car company may know more about you than your spouse:

[https://news.ycombinator.com/item?id=16299464](https://news.ycombinator.com/item?id=16299464)</comment>


Which password storing technique better? - <AUTHOR>

I am working on Code Igniter and using MD5 for hashing my password.
I have read at a lot of places that it isn't a good practice to use MD5. Should I use a Salt or should i use bcrypt?
Also, if I need to use bcrypt, how do I do it? <comment><USER2> Modern GPUs can calculate 250 million MD5 hashes per _SECOND_ \- so even a salted MD5 hash isn't much help.

Since you're using Code Igniter, that means PHP -- bcrypt forces you to use a salt, plus its a slower hashing method which means the passwords are much more secure should your database ever be compromised.

Final not its not "bcrypt or salt" its "bcrypt and salt" -- a salt is a string you add to the plaintext password before hashing, to prevent the use of rainbow tables for an attacker.

</comment><comment><AUTHOR> Asked on Stock Overflow too ...

Will be using bcrypt :)

[http://stackoverflow.com/questions/7044785/what-is-the- safes...](http://stackoverflow.com/questions/7044785/what-is-the-safest-way- to-store-a-password-using-code-igniter/7045061#7045061)

</comment><comment><USER3> As many people here will tell you, just use bcrypt. <http://www.google.com/search?q=bcrypt+php></comment>


A Petition for Etsy to Recommit to Its Values - <AUTHOR> https://www.coworker.org/petitions/recommit-to-etsy-s-values-and-support-the-etsy-community-for-the-long-term <comment><USER3> This is great. Maybe they could work in something about the fact that an enormous, unmissable portion of etsy's products are manufactured in china and flipped by lazy faux-hippies under the guise of being "artisan".

If their stated goal is "To reimagine commerce in ways that build a more fulfilling and lasting world.", eliminating blatant trinket arbitrage sounds like it falls squarely under that umbrella.

<comment><USER4> Been a bit of a running joke between my partner and I that if you want to get a discount on something from Etsy, reverse image search it and buy it off Aliexpress for 50 cents.

<comment><USER5> If you're buying a lot of stuff then just turn around and get it off taobao for 30 cents.

</comment></comment></comment><comment><USER6> I'm a supporter of the original Etsy vision and company... but.. how, exactly, is this petition supposed to change the company's direction? The company IPO'd. These changes reflects the new owners, investors, and their vision is a niche Amazon competitor.

When the company has been brought to market, cut up and sold as stocks, when the CEO + CTO have left and 20% of the staff have already been laid off - <USER2> battle is over.

The software doesn't seem revolutionary or deeply technical, maybe it's time to regroup as a competitor? By no means easy - but certainly more actionable than a nebulous unanswered petition.

</comment><comment><USER7> Paradise lost and understandably they want it back.

It's not about values but about spending more money. But if you want to spend 25% of money on lavish living, which is fine, instead of the industry level of 10%, you should have not gone public and took IPO money.

</comment><comment><USER8> The problem is that Etsy's fundamental value proposition is ill defined and hard to define, and therefore hard to enforce.</comment>


The Bunny, the Witch, and the War Room - <AUTHOR> http://spectrum.ieee.org/geek-life/history/the-bunny-the-witch-and-the-war-room <comment><USER2> Wouldn't it be odd if, after all this research, they actually discovered a way for humans to develop Telepathy?

Do you think, if they did, they'd announce it - or would they cover it up as a 'total hocus-pocus fail' and leave it at that?

Because this seems like one of those things where its possible we're being deceived by this story. I don't know how I know, I just 'feel' like we shouldn't really take it for granted that this kooky agency wouldn't try to hide its success in this regard, just as well as it has hidden its multiple failures in other areas ..

</comment><comment><USER3> Slightly off-topic, but I enjoyed this horror film about research into telepathy: [http://www.imdb.com/title/tt3280916/](http://www.imdb.com/title/tt3280916/)

</comment><comment><USER4> Also relevant: The Men Who Stare at Goats (2009)

[http://www.imdb.com/title/tt1234548/](http://www.imdb.com/title/tt1234548/)

</comment><comment><USER5> tl;dr Soviets supposedly wanted to use a bunny based messaging system, Witches are really cool, and parapsychology is observed to be make believe

<comment><USER6> No. The article advocates scientific inquiry into outlandish ideas, and while parapsychology did not yield fruit other ARPA endeavours mentioned did.</comment></comment>


Fast food and obesity in developing countries - <AUTHOR> https://www.nytimes.com/2017/10/02/health/ghana-kfc-obesity.html <comment><USER3> Is there actually any agreement among scientists that there is a causal relationship between fast food consumption and obesity? I mean at an epidemiological level -- obviously if I eat ten Whoppers a day, I'm going to have a problem.

My favorite recent hypothesis for the obesity epidemic is the increase in snacking [1]. It seems very easy to believe that highly preserved snacks are becoming more available in these countries at the same time as fast food does.

[1]: [https://www.vox.com/2015/2/17/8051367/obesity- snacks](https://www.vox.com/2015/2/17/8051367/obesity-snacks)

<comment><USER4> A teacher lost ~60lbs on a McDonalds-only diet.(1)

As the article states, the reasons for obesity are "complex," and 'involve blaming society, and everyone else' for individual choices.

The most interesting thing about this topic is why does if fit entirely into the "can't blame them category," when there are still so many examples--albeit on a diminishing list--of other personal choices that one may be acceptably villified for--many of which don't even involve environmental destruction and animal rights abuses?

Yes culture, wealth, consumer products, job opportunities, and corn subsidies all participate; but perhaps the biggest problem is one of personal responsibility.

By contrast, in Japan obesity wins you an automatic trip to counseling(2).

1-[https://www.today.com/health/man-loses-56-pounds-after- eatin...](https://www.today.com/health/man-loses-56-pounds-after-eating-only- mcdonalds-six-months-2D79329158)

2-[https://www.bu.edu/themovement/2011/05/29/the-fats-on- fire/](https://www.bu.edu/themovement/2011/05/29/the-fats-on-fire/)

<comment><USER5> I think Japan is a great example of personal responsibility. Food in Japan or at least the major cities is ridiculously easy to come by. Convenience stores every 2-3 minutes open 24 hours with loads of food, snacks, pastries, donuts, ice cream, liquor, beer. Liquor and Beer are as low as $1.20 a can. All the super markets now also carry tons of ready to eat foods and meals (because convenience stores were eating into their market) as well as chips, desserts, liquor, etc... Many more restaurants than anywhere else I've lived are open until morning. And there is fast food of all sorts as well, way more bread/pastries stores than just about anywhere on the planet. And yes, they have tons of greasy salty and sugary foods available.

And yet Japanese aren't nearly as obese. That would seem to suggest either genetics or self control.

Certain things help like often (not always) portions are smaller but you can always buy 2+

<comment><USER6> Randomly bought bread/snack in Japan (or Europe) has less sugar then bread/snack in USA. Seriously. Everything in USA is much much sweater and bread tastes like a cake. At least my personal experience was that when I eat whatever till I feel full in Japan, I am loosing weight and in USA it is very much gaining weight.

Even coke (or pepsi not sure) has different amount of sugar in it depending on region - here comparing eu vs usa.

<comment><USER7> _Randomly bought bread /snack in Japan (or Europe) has less sugar then bread/snack in USA._

Is that true? When I was in Japan a couple of years ago I found that at least their 'US/European' style bread and cakes where all sickly sweet sometimes verging on being almost being inedible. More traditional snacks though did seem less sugary.

<comment><USER8> Isn't European bread different than the US bread? Even within EU bread may be totally different based on the location.

</comment></comment></comment></comment></comment></comment><comment><USER9> One thing people keep thinking is this is somehow a "poor" people problem. This is true when looked through a developed country citizen perspective - <USER2> terms of lifestyle. But please read the article before applying the same standard here.

In developing countries KFC and McDonald are costly. Not everyone, specially the poor, can afford it. For the people who can afford it, the upscale nature, clean-looking environment and the lure of eating something "western" is the driving factor.

<comment><USER10> As a person who moved from Pakistan to Germany, I can confirm. In Pakistan an average person will only eat fast once in a while, on occasions like a birthday party as the article suggests; in developed countries on the other hand fast food is a cheap no-brainer lunch and dinner option

</comment></comment><comment><USER11> Honestly, the cleanliness and the "elegant" appearance of fast food restaurants are factors that add a lot to the allure. I noticed this in China where even places like Starbucks can really stand out in comparison to the other venues surrounding it.

Taste aside, people really do value the safety of the food and the amenities that the restaurant provides. These are reasons why I think Western fast food restaurants are able to take root so quickly and in so many places. There's the atmosphere that extends beyond just the food that's sold.

<comment><USER12> Sure, I bet it has nothing to do with the fact that it's quick, cheap, and addictive. Poor people must really love the elegant atmosphere of their local KFC.

<comment><USER13> Those are for sure factors, but McDonalds just a pretty good place to hang out if you're poor, especially in the developing world. Lots of them have free wi- fi, power outlets. They're air conditioned / heated. You can basically hang out all day for next to free. Really, it has all of the amenities of somewhere like Starbucks, just at a lower price point.

I'm not a fast food apologist, just saying that you're missing the perspective the gp is trying to bring.

<comment><USER14> McDonalds often seems to serve as a local community center for the retired and young, most of them I go to outside of the PNW, have 4-10 older guys sitting together for coffee in the mornings.

</comment></comment></comment></comment><comment><USER15> Some of the reason for obesity might be fast food but some of it is just rising incomes along with unique cultural things.

For example, in the Philippines, you look healthy if you are chubby and people show concern if you are skinny. People encourage you to eat until you feel full. The food is generally fattening, but poor Filipino's can only afford enough that they won't get fat. Much of the fattening dishes are reserved for special events. Back in the day, a bottle of coke was a special thing. Now people can afford to keep the fridge always stocked.

ETA: Fast food restaurants are relatively high-end. Even then, the food is relatively expensive. I see a lot of Filipino's ordering drinks and then sharing the biggest order of fries on the menu.

</comment><comment><USER16> Notice how all the US diets are always about consuming 'different' and never about consuming 'less'? I'll leave it at that as the food industry has successfully manipulated public discourse pointing out the emperor has no clothes to be taboo.

<comment><USER17> Consuming 'less' in general is not an option.

<comment><USER18> Why?

<comment><USER17> Telling people that they need less not more does not make you revenue. Except if you are selling self help books.

</comment></comment></comment></comment><comment><USER19> Same story in Asia. Go to Thai cities and be surprised how many overweight children and adults you'll see. It's not just fast food, its anything processed. In India you often see kids eat raw instant noodles as snacks.

</comment><comment><USER20> What is about fast food that increases waist lines? Is it just the fact that its cheap so people consume more? At the end of the day its just calories right? So do people tend to over eat when it comes to fast food?

<comment><USER9> It is about net calories per serving. For example a big Mac meal with soda is 1050 calories:

[http://www.myfitnesspal.com/food/calories/mcdonalds-big- mac-...](http://www.myfitnesspal.com/food/calories/mcdonalds-big-mac-meal- medium-size-with-soda-86722281)

Combine it with average daily average intake:

[https://en.m.wikipedia.org/wiki/List_of_countries_by_food_en...](https://en.m.wikipedia.org/wiki/List_of_countries_by_food_energy_intake)

Let's take India for example. So 2380 calories a day. The big Mac will constitute nearly 50% of calories in a meal.

Then people do have other meals too - breakfast, lunch and snacks. That means the calorie count is near to 3k calories. So a 700 calories or 30% in excess to average calories consumed.

If this happens for say only for weekends ie 8 days in a month. That is 5600 calories in excess. Without any exercise this is going to hit hard on the waist line and weight.

<comment><USER21> But there is nothing special about that McDonalds food. In India, you can buy street food which is way more caloric that a Big Mac. Fried starchy food, loads of cheese, salty sauces. And they are just as addictive as the McDonalds stuff... probably more addictive given how awesome and flavorful some of them are.

<comment><USER9> The meal was taken as a reference only. All three things you mentioned would mostly still go into the category of fast foods. So let me clarify, fast food is not a copyright trademark of McDonalds or KFC. It refers to general moving away from a properly prepared meal to using processed and easy to prepare meals.

</comment></comment></comment></comment><comment><USER22> Could availability and ease of purchase of alcohol play a role here ? Alcohol has plenty of calories e.g. beer and wine. Used to be you didn't have it as readily available at a corner store.

</comment><comment><USER23> It's sad there are still many (including in this thread) who minimize the role of fast food outlets in raising obesity rates by appealing to some moralized and frankly religious notion of "personal responsibility."

What the science tells us is that if you put people in different environments, they will behave differently. Especially when the reward is designed to be as compelling as possible.

Obesity is one of the greatest epidemics in the world today. There is no reason why anyone should have to compete against thousands of food scientists trying to tear down their willpower as a matter of daily course. Their failure to do so is in no way a failure of "personal responsibility." It is a failure of the designers of their world to be on their side in the first place. To assert otherwise is not only cruelly ideological, but utterly unscientific.

<comment><USER24> The fact that in an experiment people changed their behavior based on environmental cues does not disprove the notion of personal responsibility. If you think you have disproven personal responsibility, then you have disproven free will. And if you have disproven free will, then who is your comment trying to convince?

That being said, the truth of this particular matter lies somewhere in the middle. It's personal responsibility and it's exploitation on the part of the fast food chains. Saying it's all one or all the other is equally wrong.

</comment></comment><comment><USER25>
       Ghana, a coastal African country of more than 28 million still etched with pockets of extreme poverty

Ugh New York times.

On the issue of obesity however, like someone has already addressed in the thread, has more to do with individual choices than the availability of fast food joints. There have been arguments about people who frequent Macs or KFC everyday of their lives, and have managed to stay fit/in shape(Though not an argument for overall good health).</comment>


Ron Paul: Believer in small government predicts 15-year depression - <AUTHOR> http://www.ft.com/cms/s/0/ee3e07f0-16b2-11de-9a72-0000779fd2ac.html?nclick_check=1

<comment><USER2> Ron Paul as a case study in how tribal marketing works on the Internet: perfectly appropriate for this site.

Ron Paul as anything else: take it to another social news site. Please.</comment>


Berlin Key - <AUTHOR> https://en.wikipedia.org/wiki/Berlin_key <comment><USER2> The English description on that page doesn't make it easy to understand what this key does.

 _"Its name comes from the fact that it has two key blades (the part which activates the bolt) at each end of the key, rather than the usual single blade"_

How does that lead to the name "Berlin key" or either of the German names? I would guess "Berlin key" comes from the fact that it predominantly is used in Berlin.

 _"After unlocking the lock, the key must be pushed all the way through the lock and retrieved on the other side of the door after it has been closed and locked again"_

I think the main features are:

\- the key cannot be removed when the lock is open.

\- you can remove the key from the other side of the door from which it was inserted.

It seems you can lock the door from the side it was unlocked from, and remove the key from that side, too. You only have to push it all the way through if you want the door closed and locked with you and the key on the other side of the door.

I also think you can close the lock and remove your key when the door is open.

<comment><USER3> The Berlin key ("Berliner Schlüssel") was mostly used in tenements with multiple backyard houses with a common front gate that should be closed at certain times. These kind of arrangements were mostly used in Berlin, hence the name.

The other German names for the key describe different aspects of it: "Durchsteckschlüssel" translates to "push-through-key" and "Doppelschlüssel" translates to "double-key".

If you are more curious about the thing, there is a book by philosopher Bruno Latour on the Berlin Key where he describes the thing with the sociological situation that lead to it if I remember correctly (was a few years ago when I read it).

Edit: The basic idea is that in this kind of multi-party environment they wanted to make sure the door is always locked in the evening (when people return). To unlock the door you have to push the key through. Once you are inside you can get the key back, but _only_ if you lock the door behind you. So once the door is locked, it stays locked, unless someone from the inside leaves it open on purpose. This way people cannot "forget" to leave it open.

<comment><USER4> Please contribute to the Wikipedia page, you seem to have some better information than is there currently.

<comment><USER5> It would be reverted immediately. Requires external sourcing.

<comment><USER6> The other names are already on the German wikipedia page: [https://de.wikipedia.org/wiki/Durchsteckschl%C3%BCssel](https://de.wikipedia.org/wiki/Durchsteckschl%C3%BCssel)

</comment></comment></comment></comment></comment><comment><USER7> Video showing how it is used, really neat!

[https://youtu.be/UW4jZLEgaiU](https://youtu.be/UW4jZLEgaiU)

<comment><USER8> It seems that you can accidentally, or not, lock the door without fully closing it, thus leaving it essentially unlocked, so the key isn't quite fool- proof.

<comment><USER9> > _so the key isn't quite fool-proof_

Yes, it's from another era, when the consumer was not expected to be a fool...

<comment><USER10> That's one way to describe problematic design. In other words, the key doesn't fulfill its intended purpose considering (as the comment you replied to noted) one can do this either accidentally or not which can have little to do with being a fool.

</comment></comment></comment></comment><comment><USER11> I'm surprised some houses still use this. As it's impossible to leave the building without a key in case of a fire.

I suspect it may even be illegal today.

<comment><USER12> As an American living in Switzerland one thing that has consistently surprised me is the difference in fire safety rules: not having any smoke alarm or fire extinguishers in homes is common, and it's also common to be able to lock people inside rooms/apartments/buildings so that they can't leave without having a key. It's possible to lock someone in my apartment even if they have the key if the door is locked with the key left in on the other side.

In the US if I checked out a rental home as a possible place to live and it had any one room where you could lock someone in and they would be trapped I'd wonder what weird shit happened there.

<comment><USER13> Don't know about Switzerland, but as an European living in the US, I think the American fire safety rules are what they are mainly because most houses here are basically matchstick houses built from prefab low quality wood which would get devoured by flames in minutes. And the fire-resistant building materials are super toxic when they actually burn. So fire is a very big deal...

Anecdotal, we had a fire in my building because the wrong type of lightbulbs were installed in the hallways and because of their size, they were too close to the drywall which in turn caught fire. So.. yeah. Matchstick.

<comment><USER14> I stayed in a house in Germany in which the walls were filled with dried-straw for insulation. It was several hundred years old. There was a no-smoking rule.

<comment><USER3> > There was a no-smoking rule.

Which to be honest says not a lot about anything, because this isn't that unusual in Central Europe.

Also: a lot of the old wooden houses are far better in terms of fire resistance than you'd suspect on first glance, wood often outperforms concrete and steel when it comes to structural integrity in a fire.

I don't know about the straw thing, I only know it mixed with clay.

<comment><USER14> The no-smoking bit was me being a bit, ah, dry. Sorry it didn't come across better.

The home in question belonged to the extended family of my host family while I was an exchange student. I went with them to a maintenance day and did wallpaper. I got a very close look at the walls, not to mention the repeated lectures on what a firetrap it was.

Trust me, it was.

</comment></comment></comment></comment></comment></comment><comment><USER15> This is super clever, but I bet some of its potential applications conflict with egress safety requirements/laws.

(If a door is part of an exit route, you probably can't require a key to open it.)

<comment><USER16> Makes me wonder: how are prisons handling fire safety?

<comment><USER17> Cynically, probably through legal exceptions and active 24/7 staffing that can double check fire alarms.

</comment></comment></comment><comment><USER18> It's kind of confusing but easier to understand when you consider the primary goal which is to force people to lock the door.

This is achieved by only allowing the key to be inserted or removed when it's in the locked position. The push through is to allow them to lock the door on either side.

1: it's a key that can only be inserted or removed when in the locked position.

2: It can be only be pushed from one side to the other when in the unlocked position

Therefore you can unlock the door on one side to let someone in, lock the door on the same side and remove your key again. Alternatively you can unlock the door then push the key to the other side, lock the door on the other side and remove your key.

</comment><comment><USER19> [http://www.bruno- latour.fr/sites/default/files/P-36-Berliner...](http://www.bruno- latour.fr/sites/default/files/P-36-Berliner-KEY-GBpdf.pdf)

This is the original technical document on this key.

<comment><USER20> That is not correct. This is an essay by sociologist Bruno Latour about the key, not a technical document.

</comment></comment><comment><USER21> On a side note, what is the rationale behind the fact that there are doors that can be locked without a key? The horror stories of having the door slammed and getting trapped while outside are so common. If a key was necessary no matter what to lock a door, this wouldn't happen and people wouldn't have to spend a kidney calling a locksmith in the middle of the night.

<comment><USER22> In certain areas, the risk of forgetting to lock the door after returning and having someone unwanted make their way in to the house is higher than the risk of getting locked out after forgetting a key.

There is a larger group of areas where this is perceived to be true, even if it isn't.

</comment></comment><comment><USER23> I suppose this is now superseded by modern locks, but this is a great example of solving a problem with technology that would otherwise be left up to human behavior. You could ask people to please make sure to lock the door, but there would always be people who would forget, or just not care enough to bother.

</comment><comment><USER24> "Also, locking an open door is usually not possible."

A good feature to have on otherwise normal doors so that they only ways to lock it is to be inside or outside with the key. I now have a greater appreciation for deadbolts.

<comment><USER25> This is what I did when I moved into my house. Dead bolts only, and dummy handles below.

<comment><USER26> deadbolts can still have a key on the outside & a paddle-knob on the inside. That's the normal case here in Canada.

<comment><USER25> Right, but I can't lock myself out with one.

</comment></comment></comment></comment><comment><USER27> I've actually came across this key in an apartment building in Berlin once, so they really are still in use. The person living there did complain about it though, as (at least in the evening) you had to collect guests from the main gate and escort them back there when they leave, since using the key was the only way to open it. Understandably this is quite annoying when you're living at the fourth floor.

</comment><comment><AUTHOR> Discovered via tweet: [https://twitter.com/historyned/status/1178272006334242819?s=...](https://twitter.com/historyned/status/1178272006334242819?s=21)

Seems like an elegant, physical embodiment of resource acquisition, state management, and release. Albeit uncomfortable in your pocket.

Comparisons to C++ std:: on some of these counts may be valid.

</comment><comment><USER28> My house in Berlin, the Corbusierhaus[1][2], used to have this type of key for the front (car) gate.

The gate was usually open, and then couldn't be locked with the key. If the gate was closed, it could only be left again in the closed state.

The house is next to the Olympic Stadium, so the gates are closed when there's a football game, concert or other event.

[1] [http://www.corbusierhaus-berlin.de](http://www.corbusierhaus-berlin.de)

[2] [https://en.wikipedia.org/wiki/Unité_d'Habitation_of_Berlin](https://en.wikipedia.org/wiki/Unité_d'Habitation_of_Berlin)

<comment><USER29> A bit off topic, but how do you like living in the Corbusierhaus?

</comment></comment><comment><USER30> I'm reminded of an old Weekly World News article in which a man tiring of losing his keys so often took the drastic step of having a surgeon implant keys at the end of of his fingers, so he could never lose a key again!

The photo they used to accompany the outrageous story was hilarious. Nowadays, that doesn't seem as far-fetched of an idea, with somewhat similar futuristic key implant methods becoming more readily available.

</comment><comment><USER31> What is the closest crypto analog to this kind of key?

<comment><USER32> I think it depends how you translate the locking analog. E.g. decrypting your key with {gpg,ssh}-agent keeps the plaintext key in memory in the agent. If the machine reboots or a timeout elapses, the memory is cleared and the key has to be unlocked again.

<comment><USER33> On-the-fly encryption, Truecrypt as the canonical example, has this property too. The key is always in memory, decrypting text on the fly, but a reboot or period of inactivity will wipe the key.

</comment></comment></comment><comment><USER15> So Aldi shopping carts and Berlin keys are isomorphic.

You stick your token in, you gain access to a facility, and then to get your token back, you must restore the facility to its proper state. Additionally, in both cases, the facility you're unlocking happens to involve physically moving an object around.

<comment><USER34> That's all Germany shopping carts, not just Aldi. Though I suppose Aldi has the largest international presence.

</comment></comment><comment><USER35> _The mechanism makes it impossible to forget to lock the door, without also forgetting the key in the lock. Also, locking an open door is usually not possible._

</comment><comment><USER36> My father lives in Berlin, and before his last move a few years ago he had one of these for his house key. Never knew they were so specific to Berlin.

</comment><comment><USER37> > _The mechanism makes it impossible to forget to lock the door, without also > forgetting the key in the lock._

Which I have done, multiple times.

</comment><comment><USER38> Any sociologists want to summarize the Latour essay?

<comment><USER39> I'll take a shot.

The subtitle of the essay is "Doing Words with Things", which is a reversal of the famous essay of John L. Austin "Doing Things with Words". Austin pointed out that words have practical effects. Consider the speech act 'I do', when two partners marry: it are the words that have a specific effect in real life.

Now Latour claims that we -- philosophers, sociologists, but others as well -- have to pay attention to the effects material objects have on people interacting with them. He claims that a specific _way_ of acting can be inscribed in an artifact.

So the key is an example of this: you can only take your key out, if you lock the door behind you. Rather than having a message next to the door saying "Please lock the door behind you", this type of behaviour is enforced through the artifact itself.

So social mores or norms can be inscribed in and enacted through material objects (and not just through words).

At least that's an ELI5 version of what the essay intends to convey.

</comment></comment><comment><USER40> Is there a technical analogue to this?

</comment><comment><USER41> [https://en.wikipedia.org/wiki/Mengenlehreuhr](https://en.wikipedia.org/wiki/Mengenlehreuhr)

<comment><USER42> Why are you posting this? It doesn't appear related to the OP insofar as they are both encountered in Berlin.

Also this clock design seems unnecessarily inefficient. Why divide 24 hours in multiple of 5 hours instead of the much more natural 6? This way it would be a lot easier to decode AM/PM.

I realize that it's about art more than practicality but I don't really understand why that encoding was chosen.

<comment><USER43> I think it has to do with design. They wanted to make the two top rows have the same amount of lights. Using 6 would mean one row of 6 lights and one of 4. 5^2 is the smallest square that provides enough values to fit 24 hours.</comment></comment></comment>