Stripe has frozen Gab.com's account - <AUTHOR> https://twitter.com/getongab/status/1047538991363489792 <comment><USER2> As it's been previously mentioned, it appears the pressure comes from MasterCard and Visa.

Can someone please tell me why we're letting payment processors control what kind of content we're allowed to pay for when tech giants are under near constant scrutiny for their moderation of user-generated content?

<comment><USER3> It comes down to fraud. MasterCard and Visa don't give a crap how nasty your content is (they fund terrorism, FFS). What they don't like is dealing with chargeback fees.

Stripe has pretty strict rules over prohibited businesses ([https://stripe.com/us/prohibited- businesses](https://stripe.com/us/prohibited-businesses)). For example, here's their list of "high risk businesses", prohibited by their financial partners:

> Bankruptcy lawyers; computer technical support; psychic services; travel > reservation services and clubs; airlines; cruises; timeshares; prepaid phone > cards, phone services, and cell phones; telemarketing, telecommunications > equipment and telephone sales; drop shipping; forwarding brokers; negative > response marketing; credit card and identity theft protection; the use of > credit to pay for lending services; any businesses that we believe poses > elevated financial risk, legal liability, or violates card network or bank > policies; any business or organization that a. engages in, encourages, > promotes or celebrates unlawful violence or physical harm to persons or > property, or b. engages in, encourages, promotes or celebrates unlawful > violence toward any group based on race, religion, disability, gender, > sexual orientation, national origin, or any other immutable characteristic

"Travel reservation services and clubs" bit me at some point, I wanted to build a flight reservation service and was surprised to hear I couldn't. But apparently, it's a high risk business because lots of people chargeback flight tickets.

Also, Gab completely fails that last criteria, they're not kidding anyone.

<comment><USER4> If fraud was the only thing they cared about, why was Alex Jones (and other conservatives) deplatformed by MasterCard? Why are some banks stopping every customer they have from allowing them to buy firearms?

<comment><USER3> > _why was Alex Jones deplatformed by MasterCard_

Oh I can't possibly think of a reason why someone would chargeback Alex Jones' Totally Legitimate Line of "BURN ALL YOUR FAT" products. Health & Wellness is a known high risk category.

> [...] _firearms_?

I'm talking about Visa and MasterCard. Banks have regulations to worry about.

<comment><USER4> I think it was Buzzfeed News or Daily Beast but they did an investigation into Alex jones products... they're legit products

<comment><USER3> I'm guessing you're referencing this? [https://www.buzzfeednews.com/article/charliewarzel/we- sent-a...](https://www.buzzfeednews.com/article/charliewarzel/we-sent-alex- jones-infowars-supplements-to-a-lab-heres)

I just skimmed it, looks like a good piece of investigative work. I don't see where you're reading they're "legit products", all the article seems to say is that they're not outright dangerous.

And this holds absolutely no value to payment processors, btw. Health & Wellness _is a high risk category, period_. I don't know why you think "but they're legit!" is even sort of relevant.

</comment></comment></comment></comment></comment></comment><comment><USER5> Wow, main stream society doesn't want to associate with a company that harbors extremists. I'm shocked.

So many commenters on this are jumping to a slippery slope fallacy as if Stripe has any moral imperative to uphold free speech. They are a private company and have their own reasons to disassociate from any client they wish. That is their prerogative, and as long as they are not discriminating against anything that is a federally protected class (and last I checked, hosting porn is not federally protected) they can cut off services to anyone.

<comment><USER6> there are extremists and pornographers all over other sites that use stripe.

the "private company" argument doesn't apply super well when there are only a handful of options and they all have the same political ideology.

<comment><USER7> Does Stripe know that one of their flagship clients listed on their site (Pinterest) hosts NSFW content?

[https://www.theatlantic.com/technology/archive/2012/03/cours...](https://www.theatlantic.com/technology/archive/2012/03/course- theres-porn-pinterest/329954/)

<comment><USER5> Literally from Pinterest's Community Guidelines:

"We always remove images of explicit sexual activity or fetishes, and nude or partially nude people in sexually suggestive poses."

Does GabTV have anything like this in their terms of service? Answer: No. They signed up with Stripe, agreed to the ToS, and now are generating moral outrage when Stripe comes knocking.

<comment><USER8> Then Pinterest is doing an absolute shit job of enforcing their own rules, I suppose.

</comment></comment></comment></comment></comment><comment><USER9> Despite all the hype, smoke and crypto, if the mainstream payment processors cut you off, what is a business supposed to do?

<comment><USER7> Change your content moderation to align with Stripe's realm of decency, duh /s

</comment></comment><comment><USER10> I'm struggling to find it, but there was a hackernews comment thread about NSFW payment processor alternatives to Stripe (which is pretty strict about NSFW content). Higher fees, though, of course.

<comment><USER11> Yeah - it was a ?blog about how hard it is to do payments for porn sites.

<comment><USER10> I'm pretty sure it was in this discussion: [https://news.ycombinator.com/item?id=17432801](https://news.ycombinator.com/item?id=17432801)

</comment></comment></comment><comment><USER12> Similar thing happened to me. STRIPE closed me at their discretion and yet my direct competitors are using Stripe (they've since asked me back but I declined, too risky).

One thing Stripe cited was their underwriting FI wouldn't allow it. IIRC that FI was Wells Fargo, we my company has had a happy relationship since we started five years ago.

</comment><comment><USER13> I did checked GAB's site and I can confirm that this place was full of racism and hateful comments towards anyone who believe their ideas. I honestly think you can get your message across without being a dick. Someone else here mentioned these guys promote "freedom of hate", I think that's very close to reality.

Downvote me all you want, but you can check for yourself, this is just a white supremacist cave.

Don't believe their freed of speech crap they promote.

<comment><USER14> I'm somewhat conflicted. Sometimes I wish these people were on mainstream platforms with their real names so their stances and motives would be clear. Too many people with these kinds of ideas have learned to disguise their hate speech with a touch of intellectualism.

</comment></comment><comment><USER15> If you're unfamiliar with Gab, it's Twitter for neo-Nazis.

[https://www.cnbc.com/2017/12/11/the-alt-right-created-a- para...](https://www.cnbc.com/2017/12/11/the-alt-right-created-a-parallel- internet-its-a-holy-mess.html)

[https://www.vice.com/en_uk/article/ywxb95/gab-is-the-alt- rig...](https://www.vice.com/en_uk/article/ywxb95/gab-is-the-alt-right-social- network-racists-are-moving-to)

[https://www.timesofisrael.com/growing-platform-gab-woos- alt-...](https://www.timesofisrael.com/growing-platform-gab-woos-alt-right- exiled-from-other-social-media/)

[https://www.fastcompany.com/3065777/inside-gab-the-new- twitt...](https://www.fastcompany.com/3065777/inside-gab-the-new-twitter- alternative-championed-by-the-alt-right)

<comment><USER16> It's twitter (youtube live & other services) for people are silenced by mainstream providers (currently, people with extreme views)

<comment><USER17> It's Twitter for neo-Nazis.

[https://news.ycombinator.com/item?id=17729028](https://news.ycombinator.com/item?id=17729028)

</comment></comment></comment><comment><USER18> Hey guys,

CEO of Gab.com here.

Here is our full response to Stripe:

Hello Stripe Support,

To our knowledge no one is using GabTV to specifically livestream adult content and certainly not charging to access this live content because that is not possible on Gab. Can you please cite any specific examples for our review if you have discovered any? Currently only GabPro accounts can livestream content, but Gab native video uploading can be used by anyone including free version users. I think you may be conflating GabTV livestreaming with Gab native video uploading. Further, anyone can view and access any native video or livestreaming content for free on Gab without processing any payments through Stripe or anyone else. We do not offer any form of "exclusive" video unlocking access features via GabPro.

Secondly, we have several protocols and user guidelines in place to prevent any illegal activity on the site. We work with law enforcement regularly and see to it that any illegal content is reported to the proper agencies. We also have several technical features in place such as PhotoDNA to scan for and report any illegal content, machine learning systems that detect nudity which is not properly labeled NSFW, and user guidelines that require any adult content to be marked as Not Safe For Work; which is a setting that is on by default for all users and public-facing links. Both our User Guidelines and our GabPro Content Creator Agreement state that we do not allow any illegal activity on our service.

We believe these guidelines and our user agreements already cover what your own guidelines require and we will certainly take action on any offending accounts if you can point us to specific violating examples. We will also work to add improved reporting features to GabTV videos to make it easier for users to flag this content in the future.

We are happy to jump on a call if it is easier to discuss because some of your requests are not clear. For example your demand that we remove all adult content from the entire site, which is a bit unreasonable considering the many technical and user guidelines we have in place to ensure the specific Stripe guideline you cite is not violated and that no illegal activity is happening on the site.

Please advise

Andrew Torba CEO, Gab.com

PS HN: We release our API today. Hit me up if you want to build something cool: email@example.com [https://developers.gab.com/](https://developers.gab.com/)

<comment><USER15> You were a lot more polite to Stripe than you were to Y Combinator:

[https://techcrunch.com/2016/11/12/pro-trump-ceo-gets- booted-...](https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from- y-combinator/)

>While Torba paints this as a free speech issue, YC told BuzzFeed that he was kicked out for "for speaking in a threatening, harassing way toward other YC founders" — particularly in this Facebook comment:

>"All of you: fuck off. Take your morally superior, elitist, virtue signaling bullshit and shove it. I call it like I see it, and I helped meme a President into office, cucks."

>Torba had also tweeted a screenshot of another founder's Facebook comment (the founder's name was removed) that "being a black, Muslim or woman in the USA is going to be very scary" with his own comment: "Build the wall." Then, in another thread, a YC alum alluded to Torba's behavior without mentioning him by name, prompting him to jump in: "Say my name when you talk about me, coward. Build the wall."

</comment></comment><comment><USER19> Why was Andrew Torba's comment (on this thread) - the CEO of Gab and subject of this discussion - downvoted and already censored ('dead') ? Absurd.

[https://pbs.twimg.com/media/DooMz4QV4AEEuv4.jpg:large](https://pbs.twimg.com/media/DooMz4QV4AEEuv4.jpg:large)

Here is the link to his comment if you wish to reply:

[https://news.ycombinator.com/item?id=18136380](https://news.ycombinator.com/item?id=18136380)

And make sure you turn on 'showdead' in your settings otherwise miss key comments like this.

<comment><USER20> Comments from banned users get killed automatically. I've unkilled that one. In the future, if you see a comment that shouldn't be [dead], that's what the 'vouch' feature is for: click on its timestamp to go to its page, then click 'vouch'. You're also welcome to email email@example.com and let us know, so we can unkill it. But please don't noise up the thread by posting offtopically about it.

<comment><USER19> Ok, fair enough - thanks for the prompt response.

</comment></comment></comment><comment><USER21> Really disappointed that the CEO's response has been censored / dead'd here. Not a great moment for HN.

<comment><USER20> That account was banned a long time ago for posting tons of comments violating the site guidelines. Obviously we ban any account that does that. We wouldn't be moderators if we didn't.

Banned users' comments get killed automatically. We often unkill good comments posted by banned accounts. I've unkilled that one.

If you see a comment that shouldn't be [dead], click on its timestamp to go to its page, then click 'vouch' at the top. (There's a small karma threshold before those links appear.) You can also email us at email@example.com to point out a comment that needs to be unkilled. Complaining off-topically in the thread does nothing but add noise, so please don't do that.

<comment><USER21> thanks

</comment></comment></comment><comment><USER22> Is there a slope to where everyone is a neo-nazi equivalent though? I realize these are not likable people, but at the same time slurs are thrown around these days at many undeserving groups.

It's a tough call: I don't want to see losers abuse a private company's terms of service, nor do I want to see businesses be constantly virtue-signalling.

Virtue-signalling is itself a dirty business: how long 'til we see the neo- communists (or whatever, you choose) who happily sell Che shirts on Stripe?

<comment><USER23> I'm not sure if you picked a bad example, or you're reaching for "both sides are the same", but [https://www.amazon.com/s/?url=search-alias%3Daps&field- keywo...](https://www.amazon.com/s/?url=search-alias%3Daps&field- keywords=che%20guevara%20t-shirt) .

<comment><USER22> Everyone has their own view on who is bad, is all. One person's virtue signal is another's evil.

</comment></comment></comment><comment><USER24> This is fucked up. I hate that companies are dictating culture. I get that this is really visa and MasterCard but god I can't wait for online payments to be a solved problem.

<comment><USER25> Surely the free speech heroes at Gab will understand that everyone else has also the freedom to not associate with them.

<comment><USER26> "Freedom to speak"

Does not imply:

"Freedom to use power to silence other people arbitrarily".

In fact it implies the opposite:

"Responsibility to uphold speech even if you disagree with it."

<comment><USER25> Freedom of speech does by no means entail that anybody has to a) listen to your speech, b) host you on their platform or do business with you.

<comment><USER26> It doesn't imply A), but it does imply B) to some degree.

To believe a right exists means to believe it should be upheld, which means you should uphold it.

<comment><USER27> OK. So make a list for me of causes and ideas you hate the most.

I'll arrange for you to tithe in support of organizations promoting those causes. I'll also arrange for someone to show up at your home, every day, and deliver a one-hour lecture on the ideas you dislike.

I'm sure you'll do this because, after all, you believe in free speech and you believe you must "uphold" it by requiring people to support ideas with which they disagree, Yes?

<comment><USER26> There's an obvious difference between actively supporting ideas with which you disagree (e.g by donating money), and simply not using power to silence those ideas.

You seem to think that your response to any possible political idea MUST be either to donate to it, or use all possible power to attack and silence it. It's obviously a ridiculous false dichotomy. It is possible just to live and let live.

<comment><USER27> You've declared, quite clearly, that you think the following things are equivalent:

1\. Not actively providing resources to a position you dislike

2\. "Using your power to silence" positions you dislike

I know you've said these are equivalent, because you're arguing that certain people _owe_ other people a platform and associated services (1), and you've used the language of (2) to shame them for not doing it.

The only thing left to do at this point is ask if you're willing to practice what you preach.

<comment><USER26> More absurd false equivalence.

Simply treating a customer the same as other customers is not equivalent to actively providing resources to a political cause.

And yes, payment processors do owe it to customers to treat them equally with regards to their politics and beliefs (as well as their race, gender, language, and so on).

You seem to want to live in a world where wrongthinkers are viciously persecuted by every person, every business, everyone in every possible way. Because you think you'll always be in the team with the power to do that. When you have the experience of being the hated minority, you'll understand the value of equal treatment and the norms of individual freedom.

<comment><USER27> _When you have the experience of being the hated minority_

Politicians of explicitly right-wing alignment control:

* The US Presidency

* The US Senate

* The US House of Representatives

* 33/50 US governorships

* Legislatures of 26/50 US states

and are about to install a conservative-leaning majority into the US Supreme Court.

Rosa Parks you ain't, bud.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Let's Code JavaScript 500th episode, free weekend - <AUTHOR> http://www.letscodejavascript.com/v3/account/start_here <comment><AUTHOR> James Shore's video learning series about TDD'ing with JavaScript hit the 500th episode and he's giving away free access for the weekend to celebrate.</comment>


The vicious cycle of reputation systems - <AUTHOR> http://www.signifyd.com/blog/?p=13

<comment><USER2> I don't think communities should directly rate the content. With more people the general consensus on what is good and what is bad becomes so subjective, to the point where it's what the user's that just happen to see it end up defining it as either "good" or "bad". Instead, the webserver should simply watch the activity levels of all content, including things like whenever a user hovers over a link and for how long to things like replies. And based on all of the available information it should give it a numerical value defining it's influence on the community. It probably can't be 100% accurate, but it can be pretty close and most likely better than what is in place in most communities.

<comment><AUTHOR> This is along the lines of what we're trying to do. Interesting ideas!

<comment><USER2> Thanks

Another big problem with both publishers and general discussion forums is that the type of content changes at certain times of the day, and more specifically, it changes whenever anything new is published. Why that's a problem is because it means that the community is different at different times of the day. In order to fix that the simple solution is to only enable publishing in intervals. The problem with that though is that people like new and interesting stuff. By giving a lag to new content it will increase the chances of the user's being bored. So, the next step would be only showing content that interests the user based on what's interested them before, and having that content be constantly updated. That just went from a reputation system to an individualized search engine. It's just a thought though.

<comment><AUTHOR> Yeah, that's more of an internal community thing. What we're trying to do is create an abstraction layer above all taht, that will either be agnostic to or be able to understand these kind of trends. Semantic analysis of content, for example, is one rabbit hole we're not planning to venture into.

<comment><USER2> Why not? Context/Individualized searches, or rather searchless searching has the ability to make Google Search irrelevant, amongst all other "players" in the search engine market.

<comment><AUTHOR> Yes, but it's solving a different problem than the one we're solving.</comment></comment></comment></comment></comment></comment>


Blazor Mobile, Uno Platform, and WebAssembly - <AUTHOR> https://platform.uno/blazor-mobile-uno-platform-and-webassembly-piling-up-the-tech/ <comment><USER2> I've used Blazor for one project, and it was a true joy to learn. All the good parts of React, but without some of the clunky design decisions that come from having to work with traditional browser javascript.

</comment><comment><USER3> Wow its great to see an actual working webassembly site in the wild. [https://todo-blazornative-wasm.platform.uno/](https://todo-blazornative- wasm.platform.uno/) Ive been looking for a while.

Its a bunch slower than I was expecting. I was hoping to be impressed, now I'm not sure. Is there a reason its slow?

<comment><USER4> As you can see in the top banner, it's using the "interpreted" mode, which is the slowest runtime mode for running .NET on mono-wasm. But it's also the "compatible" mode.

It would be possible to produce an AOT build which would be 50x faster, but it's a little more work and it wasn't the goal of this demo.

<comment><USER5> Impressing with performance is one hell of a goal for a demo.

</comment></comment></comment><comment><USER6> Will the challenge be that you cannot hook to low enough UI/human interaction events to build an alternative for DOM? E.g. Paste menu is impossible to do (needs CTRL+V in Google docs for Firefox), cannot get information about keyboard typing mode in multilingual setups and so on.

<comment><USER7> IIRC Flipboard once tried this approach, rendering everything to a <canvas>. As it stands right now, that will never be a viable solution for the reasons you mentioned, along with the fact you throw literally all accessibility features out the window.</comment></comment>


Camels and humps: a retraction [pdf] - <AUTHOR> http://www.eis.mdx.ac.uk/staffpages/r_bornat/papers/camel_hump_retraction.pdf <comment><USER2> Very interesting read--the immediate topic and the intertwined mental health discussion.

We generally approach science research as separate from the people making it (except for questions of reputation). There is a Scientific Method and if one follows it, Science results.

Of course, hundreds of small decisions are made by scientists all the time, each potentially introducing a bias (I find the catalog of cognitive biases alone impressive). Even the decision to pursue a particular hypothesis betrays a bias (albeit unavoidable if we want to rationally make use of past learning and accomplish anything).

But I hadn't considered mental health as a key factor--such things are quite rarely discussed (nor do they have a standard reporting mechanism in scientific papers). Apart from general stigma around mental health, I suspect it's also because it undermines the image if scientist as dispassionate seeker of truth. How much more interesting, nuanced and complex would our results be if that changed?

</comment><comment><USER3> I'd be interested to see the results of applying the test repeatedly at n-week intervals throughout the course.

One interpretation of the original finding that everyone who passes the test passes the course, but not everyone who fails the test fails the course, is that some people who did not have a consistent mental model before the course develop one during it (and nobody who has developed such a model loses it). That should show up in a longitudinal test: you would expect that as people develop a model, they switch from the failing to passing groups.

This would be consistent with the sequential learning model. If you did a basic class, and didn't have a model by the end of it, then when you do a more advanced class, you have even less of a chance of learning anything from it, and less of a chance of developing a model during it.

I wonder if a way of structuring a course would be to start with a sort of mental model bootcamp, where the teaching was aimed specifically at developing a model, and where nobody would progress to the rest of the course without doing so. That way, students who take longer to get ready are not confronted with later stages of the course that they will not be able to make use of, and have a progressively greater share of the teaching resources in the first stage to help them do so.

</comment><comment><USER4> > He didn't find a way of dividing programming sheep from non-programming > goats

Obviously [http://blog.codinghorror.com/separating-programming-sheep- fr...](http://blog.codinghorror.com/separating-programming-sheep-from-non- programming-goats/)

> My physician put me on the then-standard treatment for depression, an SSRI.

2014 is much better. [http://www.nice.org.uk/guidance/CG90](http://www.nice.org.uk/guidance/CG90)

> [...] asked some statistician colleagues if they could help us recover more > information from his data.

It's a shame more organisations don't have access to statistician helpers to ensure that they are being accurate and honest when seeking, interpreting, and presenting data. Perhaps this is something else that is a result of the dominance of Excel - people have collections of numbers and you can pummel them into a spreadsheet and produce some nice charts and graphs but that leads to people over-interpreting the data.

> After a lot of work, the answers were, by and large, that we couldn't see > any such differences in our data.

This is surprising to me. I remember reading the blogs around the time and it seemed like a sensible claim. I can't remember anyone digging into the data and pointing out flaws. Did they?

I think I believed it because I feel "unteachable".

EDIT: I freaking love this paper because of its discussion of a mistake made during a phase of mental ill health, and the recovery journey afterwards.

<comment><USER3> > 2014 is much better. > [http://www.nice.org.uk/guidance/CG90](http://www.nice.org.uk/guidance/CG90)

2014 looks pretty similar.

 _22.214.171.124 For people with moderate or severe depression, provide a combination of antidepressant medication and a high-intensity psychological intervention (CBT or IPT)._

So, for moderate or severe depression, the standard initial treatment is an SSRI and therapy.

For less severe depression, though, the guidance is to start with non- pharmaceutical options, and only move to drugs if those don't work.

<comment><USER4> I'm not saying that 2014 treatment is magical. But there are some important differences:

There's now a recognition of "subthreshold depressive symptoms" \- which are troubling and unpleasant but which either would have been missed in the past or would have been treated solely with medication.

Other stuff is much more important now. " _A wide range of biological, psychological and social factors, which are not captured well by current diagnostic systems, have a significant impact on the course of depression and the response to treatment._ "

We're using DSM IV, not ICD10, which "* also makes it less likely that a diagnosis of depression will be based solely on symptom counting.*"

To get the therapy in the UK the person would self-refer to an IAPT (improved access to psychological therapy) style course. That would carry some kind of assessment of need, and the person would thus have another check (the first would be the GP) to see if they need specialist secondary care.

The important stuff here for the OP is much more concentration on therapy not just medication; and much more concentration on how the person is coping with life not just counting symptoms. Of course, some places do this much better than others.

</comment></comment></comment><comment><AUTHOR> The 2006 "The camel has two humps" paper: [https://www.cs.kent.ac.uk/dept_info/seminars/2005_06/paper1....](https://www.cs.kent.ac.uk/dept_info/seminars/2005_06/paper1.pdf)

</comment><comment><USER5> Was anyone able to find an online version of the test?

Edit: Closest thing I could find: [http://vanisoft.pl/~lopuszanski/public/canihascs/](http://vanisoft.pl/~lopuszanski/public/canihascs/)

<comment><USER6> my result was: "Your answers are consistent on the C0 level." I am not sure that that means though?

<comment><USER7> I poked around the code and found this:

      var C = [
        [[1],[2],[3],[4],[5],[6],[7],[8],[9],[10],[11]],
        [[1 , 2],[3 , 4],[5 , 6],[7 , 8],[9 , 10 , 11]],
        [[1 , 2 , 3 , 4],[5 , 6 , 7 , 8],[9 , 10 , 11]],
        [[1 , 2 , 3 , 4 , 5 , 6 , 7 , 8],[9 , 10 , 11]]
      ];

That's the list of models in various combinations. C0 means C[0]. If you are consistent with a single model in your answers on more than 80% of the test then you are C[0]. If, say, you split between model 1 and 2 and in total they were 80% of your answers, then you'd be C[1]. If you were split between 2 and 3 then you'd be C[2], since that's the first time those are grouped together.

The test doesn't alert() you to what model you are. You have to set a breakpoint and poke around the code. When I took it I was consistent across all 12 questions with model 2.

You can see the what model each answer corresponds to here: [http://vanisoft.pl/~lopuszanski/public/canihascs/questions.j...](http://vanisoft.pl/~lopuszanski/public/canihascs/questions.js)

</comment></comment></comment><comment><USER8> It's kind of weird that one of the most logical answers to the first question is not in the answer sheets. I bet that if it was there 100% of non- programmers would tick it, and not be wrong.

The question:

        a = 10;
        b = 20;

        a=b;

The logical answer of course being that the computer should throw an error or return false, because a does not equal b. 14 years of schooling should have hammered that in quite thoroughly.

If you really want to test non-programmers native skill for working with computer, you should at least briefly explain how the computer will read this statements. i.e. the computer interprets the statements sequentially, and reads the '=' symbol as 'becomes', not as 'equals'.

<comment><USER9> Responding with "false" as the result seems logically incoherent, as it assumes that the first two lines of the the three-line program are "true" when there is no reason to assume that is the case.

Without any previous understanding of what computer programming is, what it does, or how it works, and relying solely on elementary mathematical learnings, is there a particular reason that one would assume that the first two lines are directives and the third line is what we are being asked to validate? I am too far down the rabbit hole to intuitively know if that is the case, can someone else suggest whether this is a plausible conjecture?

<comment><USER10> It's been maybe 15 or so years, so I'm similarly pretty far down the rabbit hole, but I definitely remember having a lot of trouble with:

      x = x + 1

At the time, it seemed patently obvious that it was a false statement, because there is no single value of x for which this is true.

If the situations _are_ analogous, my guess would be that you would assume that each of these statements is an assertion, and that at least one of them must be false. Intuitively, I'd guess that it's the _last_ one that people would assume would be false, because as you're reading from top to bottom, you've already "accepted" the first two.

<comment><USER11> X = infinity?

<comment><USER12> Depending on what you mean by "infinity", sure:

If you take it to mean "The cardinality of an infinite set", "X + 1" to mean "The set X with one more element added to it", and "X = Y" to mean "X and Y have the same cardinality", then "X = X + 1" is entirely true.

Mathematics, like programming, is ultimately founded on definitions.

</comment></comment></comment></comment></comment><comment><USER13> That article didn't seem very coherent. E.g. on the original test he says:

"His test is not a very good predictor: most of those who appear to use a model in the pre-course test pass the end-of-course exam but so do many of those who do not."

How many pass, how many do not? That is the information needed to determine a predictive test.

Reading between the lines, I would guess that he got in trouble because his original article wasn't politically correct. One line in the retraction reads "We hadn't shown that nature trumps nurture. Just a phenomenon and a prediction." I would guess he came under political pressure, and felt pressured to write this article in order to avoid further problems.

<comment><USER14> You're right that this article is a bit hard to read in places. But as for your "reading between the lines", give me some reason to believe you're not just projecting your pre-existing assumptions onto this article. What did he actually say that let you read between the lines.

<comment><USER13> The reasons were in my post:

He has no real criticism of his original article. What he says about it is incoherent, not merely hard to read, as I point out in my comment.

And he makes reference to nature vs nurture, which is completely irrelevant to the actual issue, and only makes sense in the context of a political apology.

<comment><USER14> The whole "our statisticians didn't find my claims supported by the evidence" didn't seem relevant?

<comment><USER13> where does he say that specifically? He refers to statisticians helping to do further analysis on the data, but I don't see where they showed that the main claim (that the test is predictive of success in the course) is refuted by statisticians.

</comment></comment></comment></comment></comment><comment><USER15> Fascinating, and brutally honest.

</comment><comment><USER16> Google Docs viewer view of the PDF (7 pages): [http://docs.google.com/viewer?url=http%3A%2F%2Fwww.eis.mdx.a...](http://docs.google.com/viewer?url=http%3A%2F%2Fwww.eis.mdx.ac.uk%2Fstaffpages%2Fr_bornat%2Fpapers%2Fcamel_hump_retraction.pdf)

<comment><USER12> Didn't the HN site used to do something like this automatically for PDFs?</comment></comment>


When We Say 70 Percent, It Means 70 Percent - <AUTHOR> https://fivethirtyeight.com/features/when-we-say-70-percent-it-really-means-70-percent/ <comment><USER2> It's a good point in the whole discussion that they are having on twitter.

After all, what's the point of statistics in ordinary life? It's easy to know those cases where money is directly related (e.g., probability of cards), but to make it signifficant to the average person?</comment>


How to defeat Ed25519 and EdDSA using faults - <AUTHOR> https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-faults/ <comment><USER2> The most important thing to understand about this attack is that it's premised on attackers physically flipping bits, usually in targeted memory locations, during particular phases of computation. Even for attackers with physical access to a device, it's not an easy attack to pull off. It's for the most part not a line of attacks relevant to client/server and cloud software (your cloud provider has less dramatic ways of destroying your security).

The textbook example of a setting where fault attacks matter is smart cards: they're computing devices that perform crypto operations and their users are naturally adversarial (the card controls their access to some resource they'd naturally prefer unfettered access to). The crypto in a smart card needs to work even when the custodian of the card is zapping it with lasers.

The paper mentions IOT as a setting that will increasingly implicate fault attacks. To some extent, maybe. Most IOT devices aren't adversarial with the people whose custody they're in; in other words, if you can get your hands on an IOT device once deployed, the threat model for that device basically already says you own all the "secrets" in the device.

Another pretty important thing to know is that while the paper is interesting, it's not unexpected that DFA attacks would compromise EdDSA; they compromise pretty much everything, don't they?

Finally: I think you really don't care what your crypto library has to say about DFA attacks on its EdDSA implementation. All the mainstream implementations will be "vulnerable" to the attack (EdDSA is unworkably slow with the most obvious workaround of checking the signatures you yourself generate). If you need protection against fault attacks in your threat model, you are _way_ past the point where library safeguards will help you. This is probably the point at which you can't responsibly ship products without getting an actual crypto consultancy to sign off on it.

These are relatively straightforward attacks, both conceptually (the paper has a pretty useful breakdown of "nine" attacks on EdDSA that are basically the same fundamental attack applied to different phases of the algorithm) and to simulate in software, so if you really want to get your head around it, boot up a Sage shell, get EdDSA working, and just play with fake "bit flips".

<comment><USER3> You seems to have read the second paper which got published on the same topic shortly after this work was presented at FDTC. However both papers are about the same kind of fault attacks. And since you mention playing around, the first paper and the blog post here also provide some python code for you to play with bit flips.

Regarding the IOT setup, I know first hand that Nest products are trying very hard to be secure even in case of physical possession. Especially on the firmware signature verification part. But they rely on some fun post-quantum scheme, not on EdDSA.

It's true that in the end it all boils down to your threat model, but I bet smartcard producers are glad someone researched this before they got on the EdDSA train.

<comment> floodyberry- > but I bet smartcard producers are glad someone researched this before they > got on the EdDSA train.

If the only thing controlling whether they implement something is if they can find negative results on google, I don't think they'll be glad for very long.

</comment></comment></comment><comment> loup-vaillant Crap, now I have to update my manual¹, and advise the paranoid to verify the signature they just generated. Perhaps even provide a helper function for it?

(I still think letting the user control `r` is too dangerous.)

[1]: [http://loup-vaillant.fr/projects/monocypher/](http://loup- vaillant.fr/projects/monocypher/)

<comment><USER3> You don't really want to verify the signature you've just generated, if you care about perf, because verification is twice as costly as signing.

<comment><USER4> Yet, if you then proceed to send your signed document over a network, for it to be rejected 10 minutes later because of a bad signature and then you have to start from the beginning again, that verification cost is irrelevant.

<comment> loup-vaillant How frequent do you expect failures to be? (That would attack induced failures). There's a threshold below which the "10 minutes later" cost less than wasting 3ms _every single time_.

</comment></comment></comment></comment><comment><USER5> It has always seemed like a footgun for the algorithm to totally cave if the 'r' value is reused for the same key and different message. This attack uses the deterministic 'r' generation using the key and the message (to ensure that the 'r' is only reused if the message is the same), but then glitches the hash function that is used on the message during signing (so the same'r' is used on a different message).

Edit: Removed silly question on why the order has to be 'r' before the second hash. Spolier: Signature is two parts - and at least one needs to be fixed to prevent an forger just modifying both. That needs to be the 'r' part, so it has to be before the S.

<comment> loup-vaillant I have another, perhaps less silly question.

The way EdDSA works, one needs to hash the message twice, in a way that makes incremental hashing impossible (you need to complete the first pass before you begin the second):

      r = Hash(secret_key | message)
      R = Base_point × r
      H = Hash(R | public_key | message)
      // use H to compute the signature

Because of this, we cannot have a streaming interface. Thus, signing and verifying huge messages is a hassle. I _think_ there are ways to avoid this, _if_ we're willing to mess with EdDSA (I'm not).

We could for instance change the second hash to this:

      H = Hash(public_key | message | R)

By _appending_ R to the rest, instead of _pre-pending_ it, we can perform the two hashes in parallel, and use the result of the first hash only for the last bit of the second hash.

A more involved tweak would hash the message first:

      r = Hash(message | secret_key)
      R = Base_point × r
      H = Hash(message | R | public_key)

That way you can hash the message _once_ , then duplicate the hash context to complete the two hashes.

\---

Now the question: would those modifications work? Are they still immune to collision attacks? How about length extension attacks?

Subsidiary question: if my modifications are secure, how DJB and al didn't think of it? DJB in particular is reputed to be quite performance sensitive.

<comment><USER6> EdDSA is NOT online, but it's trivial to use it in an online way: sign a hash of the data rather than the data. But now you're back to having collisions (EdDSA is collision resistant). So it's a trade-off you have to make. As for DJB's take on this, there were lengthy debates about this on the CFRG list, and you find out for yourself (spoilers: he's very big on collision resistance). Of course, the need for online algorithms is real, but there's more than one way to skin that cat.

<comment> loup-vaillant Do you have a link to those debates? I'm searching through the mailing list, no luck so far.

<comment><USER6> The list archives are difficult to link to.

Look for posts around June 2015, e.g., with Subject:s like "Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations" or subjects containing "IUF" (Init, Update, Final) here:

[https://www.ietf.org/mail- archive/web/cfrg/current/mail5.htm...](https://www.ietf.org/mail- archive/web/cfrg/current/mail5.html)

(The archives' main page is [https://www.ietf.org/mail- archive/web/cfrg/current/maillist....](https://www.ietf.org/mail- archive/web/cfrg/current/maillist.html))

</comment></comment></comment></comment></comment><comment><USER7> Anyone have any idea how does this affect Olm[1] (and possible NaCl and libsodium)? I know it uses Ed25519 signatures for both the device fingerprint and the one time pre keys.

[1]: [https://git.matrix.org/git/olm/about/docs/signing.rst](https://git.matrix.org/git/olm/about/docs/signing.rst)

<comment><USER8> On the Matrix side we're reading through the paper and seeing if/how it applies to Olm.

<comment><USER2> Why would you need to read through the paper to see if it applies? Are you deployed in settings where attackers can physically flip bits or not? That question, the only one that matters, is posed essentially in the abstract of the paper.

<comment><USER8> Yup, Olm could conceivably be deployed in settings where attackers could physically flip bits, but we're not aware of anyone doing so yet (all current usage is on non-embedded devices where the hassle of bit flipping would be enormous).

Assuming I've correctly skimmed the paper, it looks like it relies on your Ed25519 impl incorrectly reusing the same 'r' value when signing messages - and then deliberately flipping bits whilst it does so, in order to gradually recover the private key. Our usage of Ed25519 doesn't reuse 'r' values, so I think Olm is okay.

<comment><USER9> The article acknowledges RFC6979, which is the standard way to produce a deterministic r that doesn't have this problem intrinsically. It also refs RFC8032, which has EdDSA in it (both variants).

The fault attack acts after that deterministic generation, so tha fact that Olm doesn't reuse r values explicitly doesn't matter. You're not _erroneously_ reusing r: the attack involves you trying to sign the same message twice, with a fault occurring on the second signing.

</comment></comment></comment></comment></comment><comment><USER10> I wonder how long before someone demonstrates fault attacks triggered from a sandbox in the cloud..

I imagine something like rowhammer could be used..

<comment><USER11> This attack uses physical fault injection, so it shouldn't be trivial for remote attackers to use it, but it definitely is a nice demonstration, and exposes vulnerabilities on chips that generate and store such keys, like maybe pay-tv cards (remember the business of Kudekski/Nagra).

<comment><USER4> Just a while ago there was a paper here about how to create faults using the CPU's power management features, by software.

<comment><USER2> Sure, and Rowhammer flips bits from software too. The point here is you need relatively precise control not just in location but in timing of your bit flips to break crypto like this. Rowhammer attackers have the luxury of attacking bits that stay high-value for long periods of time. DFA attackers get very tiny windows.

</comment></comment></comment></comment><comment><USER12> For a moment, I thought somebody wrote an article on how to beat edw519's HN karma.

</comment><comment><USER13> I believe the only way to defeat Ed209 is also through exploiting its faults.

<comment> loup-vaillant Referring to its first demo? Really, the engineers were asking for that… "glitch":

1) Failed to test Ed209 on demo conditions (medium sized meeting room).

2) Failed to anticipate the failure of the sound recognition algorithm ( _gun on on carpet_ instead of _gun on concrete_ ).

3) Failed to implement software failsafes for the demo: a layer on the motor system so it never touches anything (especially moving things such as humans), a weapons system that doesn't actually fire…

4) Failed to implement a proper shut down button, such as a physical plug one could pull from behind.

5) _Loaded the damn thing with live ammo._</comment></comment>


Java developer says he built, launched basic open source office suite in 30 days - <AUTHOR> http://www.networkworld.com/news/2013/052313-java-developer-says-he-built-270087.html? <comment><USER2> I think that a lot of us on HN would not even try to write a word processor, as we know how difficult it is, and that the barrier to entry is high.

This shows that it is possible to make a minimum viable product with one person with persistence and skill. Thank you for sharing!

<comment><USER3> Yeah cheers to that guy who built the office suite. Why is there so much negative feedback towards said hacker?

<comment><USER4> I couldn't agree more. While it may not be a "show hn" project, the developer may still be a member of the hn community. If one is going to criticise the project, they should at least do so constructively so they can improve it. I don't think any of us would really want snarky remarks as the feedback to something we poured our free time in and shared with the community to garner feedback.

Treat other developers in the same way we would want to be treated if in a similar position :)

</comment></comment></comment><comment><USER5> The problem is that some people are trying to re-create "The Office".

Want to build the perfect tool, the better alternative? That's great, but why don't you start with a single product, say, a word processor, or a spreadsheet?

Start small, iterate, get feedback, and so on, and then expand.

If you were able to beat MS Office in a single product, you must be doing something right, and chances are you will get far more resources (developers, testers, etc.) to build other products.

<comment><USER6> I second that. The offering looks like a mish mash and I cannot even imagine how usable it is. I don't know how an alpha version qualifies as recreated MS Office in 30 days.

What they should have done was to start with a single product like you said work on the essential features, get feedback and cruft out all the additional advanced functionality that the MS Office version has so you'd have a cleaner, leaner offering.

Although sometimes, at the end of the day, the issue isn't so much the software being the perfect tool but how compatible is the tool with existing processes. We use MS Office on the business side and OpenOffice on the engineering side - so much pain when sending documents across the two divisions with documents not looking the same.

<comment><USER7> The article says that it's not ever supposed to compete with MS Office, but to be a basic solution for companies with specific needs ("such as obtaining data from a Java library").

<comment><USER8> The article does say, however, that the product is eventually meant to compete with Google Docs..

</comment></comment></comment></comment><comment><USER9> As much as I admire this guy's effort - and his intentions. This is a tool of the past. And he based it on NetBeans?

You know, I spend 8 hours every day developing in NetBeans. It's OK to work in, and you can create cool applications with it, mostly Java EE apps in my case. But basing something on top of such a heavy and bug ridden platform is not a viable long term approach.

And why call it "The Open Source Java Office Suite"? Users do not care whether it's Java or C# or what not, as long as it's better than current offerings out there.

I could go on. Sorry - I'm not excited by this, but perhaps someone else is?

<comment><USER4> > And why call it "The Open Source Java Office Suite"? Users do not care > whether it's Java or C# or what not, as long as it's better than current > offerings out there.

It seems to be a trend with developers sometimes to get so involved in what they make that they forget who their target audience is (I would guess in this case he wants more than developers to use it). If his only fault in target audience usability is the naming, then he's doing pretty well (don't know if it is or not yet and usability is subjective). Either way, still a great learning experience taking on a project like this and I don't think I would judge it past "proof of concept" so far.

</comment></comment><comment><USER10> > "The office suite was built with NetBeans"

The code was written in Netbeans? The code uses the Netbeans platform (which rocks). Or both?

<comment><USER11> As I can see in the screenshots and videos, it's built on top of NetBeans RCP, which is cool :)

<comment><USER12> Not really, it´s based on Swing. Fonts are going to look horrible.

<comment><USER13> It appears swing fonts actually are fixable, see for example this approach using patched JDK (on Linux). (Fixing issue for Idea on Linux, but actually fixes it for all Swing apps - <http://youtrack.jetbrains.com/issue/IDEA-57233> )

<comment><USER12> Thank you! There's also a fix for Arch, no idea if it's the same patch, though. [https://aur.archlinux.org/packages/jre7-openjdk-headless- fon...](https://aur.archlinux.org/packages/jre7-openjdk-headless-fontfix/)

</comment></comment></comment></comment></comment><comment><USER14> This is about how productive you can be by using mature technology with plenty of libraries and components. How long would it take with Go or ruby with their still small ecosystems?

</comment><comment><USER15> "BASIC" is probably the key word in that title.

</comment><comment><USER16> I have been writing a framework that supports building what I consider to be the Minimum Viable Product of any _successful_ social app. (One that will go on to success in this new environment of 2013, mobile phones etc.) We took care of everything, from user signup, to realtime updates and offline notifications, to access controls, roles, contacts, invitations, and even auto-scaling in case you get to millions of users. And it took me two years and help from two additional developers.

I guess that's a huge amount of effort for the number of people, but overall it's something that a large company like Google or Facebook already built in- house.

Just goes to show some problems require more than others to solve. And also, by leveraging existing libraries, you can more quickly build an MVP that may not scale but can show off the capabilities.

<comment><USER17> If your MVP requires you spending 6 man years building a framework, that's not an MVP.

An MVP doesn't need autoscaling, or most of the rest of the stuff you mention.

I always remember 37signals launching an app without writing a billing system, because they didn't need it until the end of the first trial period.

<comment><USER16> That's different. Our "product" is a framework that repeatably lets apps become viral and get millions of users, through mobile phone invitations instead of facebook. Bsaically it turns your mobile phone into a social platform, with the address book playing the role of the friend list.

<https://medium.com/musings-about-text-boxes/8157c364d26a>

Compare: [http://qbix.com/blog/index.php/2013/04/a-new-kind-of- platfor...](http://qbix.com/blog/index.php/2013/04/a-new-kind-of-platform/) :)

I guess it comes down to what you understand "viable" to mean. Because if:

1\. our app couldn't work on all mobile platforms => you wouldn't be able to invite many of your contacts, losing a lot of virality that could make the difference (<http://luckyapps.com/blog/?p=12>)

2\. we didn't produce native apps, e.g. with phonegap => lack of integration with addressbook would reduce virality and convenience for the user

3\. our app didn't have a one-step invite process => people would get tired of jumping through hoops and virality would suffer

4\. our app didn't have realtime updates in chat => people would have to keep refreshing the page on their mobile phone and not get rewarded for engaging with the app

5\. our app didn't have offline notifications => engagement would suffer, as the app wouldn't be able to notify people of relevant things via transactional notifications

6\. we didn't have ways to manage notifications => people might get annoyed they are getting too many notifications ... yes, this one we could have done later

7\. we didn't have ways to manage privacy / access => then everything would have to be public, making many people concerned ... yes, this one we could have done later

8\. didn't have auto scaling where we split shards that get too hot and bring up more machines => if all the virality and engagement was as high as we expect, then our machines would quickly crash and we would lose ALL our momentum.

So we decided to invest in 1-8 up front before launching. We have an unusual strategy, having built a distributed platform with all the features of a social network that puts the power into your hands, and works with realtime and mobile ... and having a completely distributed team that is based throughout Russia and Ukraine. We are now in a position to launch many viral apps very efficiently and manage all their common issues on one platform.

PS: We didn't just sit on our hands while building this framework. We already released two apps that have 250,000 monthly active users, so that is why we were worried about growing exponentially from there, once we made them "social".

PPS: Wow, this was a long post. I hope it was informative.

</comment></comment></comment><comment><USER18> I would be more grateful for one good word processor than another half baked fork of MS office.

<comment><USER19> If you're on Linux, AbiWord is excellent.

If you're on OS X, Apple Pages is excellent.

<comment><USER18> I am looking for something smart. That will have a distraction free editing, markdown support, pagination and all the good stuff. Some small git integration. So my girlfriend can do version control on her works. I really miss that.

<comment><USER20> Sounds like you know what you want, any reason you can't start working on it?

<comment><USER18> I just did git init about 5 minutes ago. With me luck!

<comment><USER19> Nice!

</comment></comment></comment></comment></comment></comment><comment><USER21> Intentionally or not, the nickname of the submitter is very telling.)</comment>


Sandboxed Mac apps can record screen any time without you knowing - <AUTHOR> https://krausefx.com/blog/mac-privacy-sandboxed-mac-apps-can-take-screenshots <comment><USER3> I was an AppKit engineer when the Mac app sandbox was introduced in 10.7. Much of our effort that release (and in following releases) was dedicated to making Mac features work within sandboxed apps. Think open and save panels, copy and paste, drag and drop, Services menu, Open Recents, etc.

We did our best but the fact is that sandboxed apps run more slowly, have fewer features, are more isolated, and take longer to develop. Sometimes this cost is prohibitive (see Coda 2.5).

IMO the app sandbox was a grievous strategic mistake for the Mac. Cocoa-based Mac apps are rapidly being eaten by web apps and Electron psuedo-desktop apps. For Mac apps to survive, they must capitalize on their strengths: superior performance, better system integration, better dev experience, more features, and higher general quality.

But the app sandbox strikes at all of those. In return it offers security inferior to a web app, as this post illustrates. The price is far too high and the benefits too little.

IMO Apple should drop the Mac app sandbox altogether (though continue to sandbox system services, which is totally sensible, and maybe retain something geared towards browsers.) The code signing requirements and dev cert revocation, which has been successfully used to remotely disable malware, will be sufficient security: the Mac community is good at sussing out bad actors. But force Mac devs to castrate their apps even more, and there won't be anything left to protect.

<comment><USER4> I agree, it's terrible. As a user, I often go to pains to avoid getting the App Store version of an app, if an alternative exists, because those apps are crippled to such a degree that they aren't worth using.

If I'm using the App Store stuff, then my text editor can't edit all my files, my video player can't open videos when I double-click them, my Evernote can't print to PDF, my disk usage analyzer can't analyze my disk because it can't ask me for authorization to do so, and so on.

At the same time, though, in theory I _do_ want sandboxing, at least by default. I _do_ want to have to explicitly authorize some random app before it can install a printer system extension, or before it can scan my entire disk.

I feel like the problem is more political/cultural: Apple prioritizes their low-information, low-computer-literacy users (hi, Dad!) so dearly, that they aren't willing to expend resources to find any compromise for their technically proficient ones. And through the sandboxing requirements, they force their third-party developers to either tell their power users to fuck off, or to give up on the App Store.

Or, I don't know, perhaps they just don't have enough engineers left for the Mac after moving so many of them to their higher-volume Candy Crush console business.

Regardless, though, if there were mechanisms for the _user_ to control the sandboxing enforcement to a greater degree, I would be all for it.

If we could tell our Macs "yes, dude, I hereby authorize DaisyDisk to see all the files" and "Computer, hey bud do me a favor, overrule this restriction that says CotEditor can't ask me to authorize modifying root-owned files", then I would actually not only be happy with, but even prefer, the App Store versions.

But we can't, and it's sad.

<comment><USER5> > If I'm using the App Store stuff, then my text editor can't edit all my > files, my video player can't open videos when I double-click them, my > Evernote can't print to PDF, my disk usage analyzer can't analyze my disk > because it can't ask me for authorization to do so, and so on.

I fail to see how the macOS sandbox prevents this. Disk usage analyser can ask you for disk access, sandboxed video players can surely open files double clicked in Finder, sandboxed apps can print to PDF.

A few example: QuickTime Player is sandboxed, Pages is sandboxed.

<comment><USER4> > _I fail to see how the macOS sandbox prevents this_

I think you might be thinking of the reasonable sandbox we wish we had, not the one we have.

[https://daisydiskapp.com/manual/4/en/Topics/Editions.html](https://daisydiskapp.com/manual/4/en/Topics/Editions.html)

(Apple's own apps do not have to follow the rules that third-party apps do.)

<comment><USER5> Ok, that's a limitation. What about the other ones you described? I wrote a bunch of sandboxed app, and it's good enough for a document based app (when working on a single document).

<comment><USER6> The sandbox allows apps to open files via three methods:

* Open dialogs

* A limited number of files that have been opened in the past via open dialogs (intended for e.g. recent files)

* Files that live in the app's sandboxed region of the filesystem.

That's it. So your text editor can't open ~/.bash_profile unless it pops up an open dialog and asks you to manually click it.

<comment><USER7> How exactly is that a problem? You can open an open file dialog that is in the user's home directory and you can even select ".bash_profile" for them. All they have to do is click "OK" to start editing it. This gives them the security that your app can't just go and erase or overwrite or add malicious stuff to their .bash_profile without their consent, which seems like a really good idea!

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> As an old person my assumption is that a desktop app can basically do whatever it wants with the screen, mouse, keyboard, or audio while it's actually running.

Isn't that what apps are for? This just seems like expected behavior. If you don't want apps doing stuff don't run them on your desktop computer.

<comment><USER9> I agree. This feels to me to be more like inducing paranoia to push some hidden agenda. The "open" design _is a feature, not a bug_ , and why mobile apps and their isolated design only encourage silo'd data and horribly wasteful workarounds (upload something from one app into some distant third- party cloud service, and download it again for another app to access it... provided those two apps' developers have explicitly decided to provide such a feature.)

Every binary I run could delete all my data or steal my passwords or whatever else. That's not something to be afraid of --- it's something to cherish and be proud of[1], and it's why you don't run anything you don't trust. This "free-for-all" sharing and access encourages the sort of ad-hoc and unpremeditated interactions which are beneficial to the software ecosystem as a whole.

I usually have a magnifier, color identifier, and clipboard-listening- translator running. None of those would be easily implementable or may not even exist, had computers started out as locked-down systems from the beginning.

[1][https://boingboing.net/2012/08/23/civilwar.html](https://boingboing.net/2012/08/23/civilwar.html)

<comment><USER10> A design that dooms even savvy users to being compromised is simply not acceptable anymore. Most people are not discriminating enough about the software they install. But okay, maybe you actually are and _never_ make mistakes[1]. But is all the software you use signed? By a certificate traceable to a real, accountable person? Can a software update, perhaps released by someone who has hacked the original developer, come along and turn it into malware? Because all of your apps have full-capabilities, it can now do things that you would never grant if explicitly asked.

Now you're completely screwed. All of your emails, pictures, medical information, other embarrassing personal information/media, bank logins, and so forth are compromised. Maybe you have two-factor authentication for all of your accounts (doubtful), but who cares? It can just read the memory of your browser process, quietly wait for you to login to the various services, and then hijack your sessions in the background.

So tell me: how in the world is this an acceptable situation?

[1] I sure hope you never use any of these new-school package managers for various programming languages, text editors, and such. You know, the ones that grab the latest commit from GitHub repositories run by total strangers and then run them with full privileges.

<comment><USER11> Everything you install from the core debian stable repositories, is pretty much guaranteed to not have any actively malicious code. Otherwise it would be discovered and removed. All debian packages are signed by the package-upload process. It's not perfect, but it's been good enough so far. This is a world that is now niche, but used to be practical!

It's very depressing to be transitioning into a world where you can't use a small trusted open-source mail client and IM client etc, where you have to install crazy huge untrusted piles of flaky and inefficient code in order to interact with real-world people and institutions, and you can't easily control which version you have installed, and mobile devices become obsolete after just 3 years. (Even iPhones - not because of Apple, but because Instagram and Snapchat got too heavy/shitty for the older models! This does not happen for communication over SMTP or XMPP!)

So I see the "we need super sandboxes around every little thing" as a sort of bandaid on a much bigger problem which is not going to be fixed in the foreseeable future.

<comment><USER12> Like the XScreenSaver time bomb that caused a nag screen to pop up on April 1 one or two years ago on peoples screens? Debian distributed this code for years without realizing because no one even glanced at the code. The developer didn't even try to hide the time bomb, he even provided angry comments why he added the code.

The only reason Debian didn't distribute some really bad malicious code (that we know of) yet is because they got lucky and no developer tried to mess with them.

</comment></comment></comment></comment></comment><comment><USER13> Are we ever going to end up with the practice of running every app in their own independent VM?

Should anything at all run in the host OS?

The advantage of running every app in their own VM means that apps won't get necessarily tossed to the side in this constant arms race of upgrades, especially for apps that don't need internet. Imagine still actively using several perfectly good apps that were last updated 10 or 20 years ago?

<comment><USER14> > Should anything at all run in the host OS?

Isn't that equivalent to saying that the set of available kernel calls should be more restricted?

(User mode is a kind of sandbox, after all)

<comment><USER15> Not just the set of kernel calls but the scope of the calls themselves. A text editor should be able to fopen the file I'm editing but it doesn't need to be able to access ~/Documents/top-secret.txt. You can do this type of thing with SELinux though I've yet to see it done in a user friendly way.

<comment><USER16> You're looking for capability-based systems.

</comment></comment></comment></comment><comment><USER17> I get that this is about the Mac apps, but doesn't this apply to any general OS? On Windows this is trivial, on any Linux distro using X11 too.

<comment><USER18> Just goes to show that not all sandboxes are created equal (though I don't think I've ever even used a properly sandboxed Windows or Linux app, so those OSes don't get any points anyway). For example, reading other tabs or processes out of the web browser sandbox isn't possible short of exploits like Spectre and Meltdown, and even seeing something like the history of visited links requires cleverly tricking the user (and coarse guesswork) e.g. [https://tinsnail.neocities.org/](https://tinsnail.neocities.org/) and [http://lcamtuf.coredump.cx/yahh/](http://lcamtuf.coredump.cx/yahh/) . I imagine the behavior in the OP is impossible on both Android and iOS too?

<comment><USER19> There was a pre-Spectre proof of concept of a program telling what tabs you have open in your web browser: [https://github.com/defuse/flush-reload- attacks](https://github.com/defuse/flush-reload-attacks)

This was a program rather than another webpage, and I haven't bothered to read how it worked beyond the general idea of exploiting a cache side-channel. I expect the bit-rate is low compared to Spectre/Meltdown. But it made me leery of confidentiality in current systems.

<comment><USER20> I think you have the idea of sandbox (or at least the idea of sandbox in the context of a web browser) backwards: it means an application (webpage) running _inside_ the sandbox cannot access resources not granted. This side channel access does not run inside a sandbox at all.

<comment><USER19> If you don't consider an OS process a sandbox at all, why are even talking about security here?

<comment><USER20> That's not the point of GP though? The whole premise of virtualization is that _an OS process is not a perfect sandbox_. There's a hierarchy of sandboxes. Protecting other processes from accessing something inside the sandbox is not the job of a browser sandbox. This actually just goes to show the GP's point: _not all sandboxes are created equal_.

<comment><USER19> I was not arguing against kibwen, I was sharing some more points. People have implicitly expected OS processes to be better isolated from each other than they are. (I think there's a related problem that people tend not to think about which of the properties of integrity, confidentiality, and availability they rely on.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> So apps need to ask for location but not to see everything you do? WTF

<comment><USER22> I imagine a world where every application that wanted to read and write to displays was required to go through an authorization-flow before it worked?

That sounds terrible. This behavior is how desktop applications are meant to work. I'm surprised this surprised anyone.

<comment><USER21> Please humor me, why in the world does an app need to read/write your screen? It is provided a window for that.

If it doesn't need to read/write your screen in order to provide its features, and then does it, wouldn't you agree that something is fishy? Wouldn't you like to know when fishy things are going on?

What is the point of security if any app you download can see everything you do?

<comment><USER23> > Please humor me, why in the world does an app need to read/write your > screen?

The most obvious answer would be to take screenshots, like GIMP's "Create from screenshot" command or a dedicated program like the snippet tool in Windows. Many graphics tools offer that functionality, even some that you can run from the command line.

Other, similarly widely available functionality, is to record the desktop - <USER2> common functionality needed for screencasting and video streaming (think Twitch) programs. This also need to capture audio. Also a more niche tool is to create captures directly to GIF files (i have such a tool both in Windows and Linux).

Of course less commonly implemented but still very useful functionality is for remote access/remote desktop (in which case you also need to also capture input events but also create fake input events indistinguishable from the user's events).

Finally several utilities also benefit from being able to read the screen, like utilities to magnify and perhaps enhance part of a screen (that can be useful for people with sight issues, or for developers to inspect the output of a graphics program at the pixel level without flattening their face on the monitor) or utilities like color pickers or even just funny toys that manipulate the screen contents (i've seen a game at the past grab a screenshot of your desktop and then zoom it out when you launch it).

> What is the point of security if any app you download can see everything you > do?

I'd turn that around: what is the point of security if the apps you download cannot do their job because of it? At the end of the day computers need to be useful, not to be burned and buried in a waste disposal field (where they'd be in their most secure state).

<comment><USER24> > not to be burned and buried in a waste disposal field (where they'd be in > their most secure state)

This is just a simple strawman.

It's not that hard to have a middle ground, just disallow apps from using things like your webcam or screen without your explicit permission. Just because 1 program uses that functionality doesn't necessitate it to be common to every single program you ever run.

iOS already manages this. Just have a notification pop up when you use the program to allow X access from system settings. Certain programs already do something similar by requesting access from Accessibility, like window managers (albeit that's to get around certain limitations).

<comment><USER23> If someone figures out a way for this sort of thing to be unintrusive while still being effective, i wouldn't mind it but i haven't seen anything like that. The notification popups you suggest are both intrusive _and_ ineffective because, honestly, if i want to do some task anything that tries to alert me about something unrelated to that task ("hey, this needs net access" \- sure, ok whatever... i cannot think about that right now, i need to actually do what i want to do) is something i am very unlikely to put any thought over so i'll just accept. I mean, i used to check the permissions on my Android mobile but after a year or so i stopped because at the end of the day the question is "do you want to run this program or not"? And considering i already downloaded the program to run it, the answer is obvious.

This stuff is really barely a notch above expecting people to read EULAs.

<comment><USER25> How often do you think most users read the screen, especially using something other than the screenshot tool of the operating system?

As an iOS developer I run Xscope to check details of designs, I don't know, maybe once every two weeks? And I guess I've probably used Acorn's color picker outside its own window during the last year, but I'm not sure about that.

I'd imagine that most users need apps reading arbitrary pixels off their screen less often than I do. I'd appreciate a warning from the operating system when an app tries to do that.

<comment><USER23> > How often

I do not think the frequency of needing that functionality is really relevant when you need to use it - you can either do it or you cannot.

But there are users who do need to use applications that capture the screen way more often than once every two weeks. One example would be Twitch and YouTube streamers (not necessarily about games - many stream other things, like creating art, programming, composing music, etc) who do that for several hours every day.

> do you think most users

There is no point talking about "most users" because really anything can be attributed to what "most users" do or do not - "most users" is not something that is well defined. We can only talk about specific use cases.

After all, all users (which by definition include most users) start as not being able to do anything, that doesn't mean the OS should not be able to do anything.

> As an iOS developer I run Xscope to check details of designs, I don't know, > maybe once every two weeks? And I guess I've probably used Acorn's color > picker outside its own window during the last year, but I'm not sure about > that.

These are also useful examples for cases where you need screen reading, but these are really niche. The most common is probably streaming, as i mentioned above, but there are also other cases where you need frequent screen reading capabilities - for example documentation writers will often need to capture parts of the OS, either as screenshots or as short video segments (for interactive docs) to use as part of the documentation. It is also very helpful for customer support - in both sides of the equation (in a company i worked many years ago, the employee responsible for tech support had SnagIt open all the time).

> I'd appreciate a warning from the operating system when an app tries to do > that.

I suspect that if that warning comes as part of your screenshot or video capture you wont appreciate it that much :-P

<comment><USER25> But this is not about removing the ability to read screen content. It's about removing the ability to read screen content without telling the user.

That's why I think questions about frequency and "most users" (nebulous term, I admit) come into play: yes/no permission dialogs aren't the best and many users do just click through them without thinking, but there's a world of difference between asking several times a day and asking a couple of times a month.

If my usage is far below average, then I agree that it's probably better not try to restrict it. If, as I would guess, I use it more than most, then it feels exceptional enough that letting the user know when it's happening would be fine.

If you could give a permanent permission to a given app, I'd imagine even the daily streamers wouldn't be too badly inconvenienced.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> The Sandbox became the reason I left the mac app store and instead started selling my directly from my website using Paddle and I haven't looked back since.

It's been one of the most catastrophic decisions apple have ever made and IMO is hindering actual progress for desktop apps.

</comment><comment><USER27> Felix Krause works for Google these days. Since he got hired he got a bit more critical to the platform. Perhaps no more "I hope this doesn't piss off Apple" mentality?

</comment><comment><USER28> The login dialog for the Itch.io desktop client is magically excluded from the accessible canvas on my OS X instance.

<comment><USER29> Knowing its dev, this doesn't surprise me:)

</comment></comment><comment><USER30> I was worry about a kind of this too. I was worry an app could steal my passwords from clipboard. I checked, at least a website can't just read from the clipboard. At least in theory .. I still fill the clipboard after the use to transfer a password (often) with random stuff ..

<comment><USER31> >I checked, at least a website can't just read from the clipboard. At least in theory

AFAIK the logic is that any user initiated event (click, keystroke, touch, etc) allows the page to see (and modify) clipboard contents for that instance. So if you accidentally click in a rogue page, it's possible for your clipboard contents to be stolen.

</comment></comment><comment><USER32> Something has to give with the Mac ecosystem. The Mac App Store sucks, the Mac has continuously for the past years of been having security issues, serious security issues.

I believe Apple is at a crossroads, something needs to be done with the Mac.

<comment><USER33> Don't panic.

</comment></comment><comment><USER34> Maybe Krause can also make an article on the paste board and get some more clicks

</comment><comment><USER35> I remember in the windows xp days there was an app you could run that would show an alert any time a program tried to hook into your keyboard input or display. I wonder why nothing like that exists any more.

<comment><USER36> Seems like a nice feature for something like Little Snitch.

</comment></comment><comment><USER21> Viewing your screen should be subject to permissions simply because it can supersede all permissions to access sensitive data.

</comment><comment><USER37> This is why I run Qubes. Trusting all software running on my system is unreasonable. Other OS's need to catch up ASAP.

</comment><comment><USER38> Why wouldn't we assume that?

</comment><comment><USER39> You are sitting on this OS as an administrator/root and apps can do anything that they want. I dont really see this as an issue. Its always been this way! Go run Qubes OS if you want to protect against this.

</comment><comment><USER40> > > How can I protect myself as a user? > To my knowledge there is no way to > protect yourself as of now.

That is the most FUD bit of this. There's a very easy way for a user to protect themselves: don't download any untrusted applications. Only run code you trust. Don't trust the sandbox that much.

Vulnerabilities like the android MMS one where anyone could send any number an image and pwn it were "as a user you can't protect yourself".

Local roots and things like this require a user to opt-in to being exploited by running a malicious app. That's significantly different and less scary.

<comment><USER41> How can you know the app you're using hasn't been compromised? Publishing a blog post about this specific topic next Thursday</comment></comment>


Ask HN: 2015 13" Macbook Pro vs. Latest 15" for Coding? - <AUTHOR>

I am trying to decide what laptop to get.  Will that extra 2 inch vertical and quad core be something I won't be able to live without?  Additionally, I'll be traveling up to a couple hours a day with it. <comment><USER2> I went for the 13", after buying a 15" MBP 6 years ago and a 14.7" System76 Pangolin in between. No regrets. I love the new 13" MBP.

</comment><comment><USER3> do you like a higher res? 15" retina scaled comes in at 1900x1200, which is perfect imo. i find less than 1200 vertical too short, but that's just me. 13" is 1600x1050, which is barely taller than a mba.

<comment><USER4> I think this is the key difference. At next-to-highest resolution, the 15" gives you a heck of a lot of workspace readable even with these old eyes (with reading glasses ;-).

</comment></comment><comment><USER5> I love my 15". It's thin and light enough to have a cover. 13" is too small a screen for me. 17" is too large. Hence, 15".

</comment><comment><USER6> Screens are measured diagonally the vertical difference is:

      >(- (* 15 (sin 10/16))
          (* 13 (sin 10/16)))
      1.17....

<comment><AUTHOR> Er my bad, meant diagonal.

</comment></comment><comment><USER7> I bought the 13 and I added a 24 inch ultra wide LG 2560x1080 monitor and this setup is nearly perfect.

<comment><USER5> tn91 sounds like they are trying to be mobile with the laptop. Bringing a 24" monitor would defeat that purpose.</comment></comment>


Remote Procedure and Event Protocol - <AUTHOR> https://github.com/Tixit/RPEP <comment><AUTHOR> I'm resubmitting this since 11189399 got a couple ups but didn't get any comments.

I wrote and implemented a similar protocol to RPEP in 2013 and have been using it personally, but haven't released it. In my recent search of something similar I found the unfortunately named WAMP (Web Application Messaging Protocol). Despite its goal of being simple and easy to implement, I found the spec complex and bloated. It doesn't stick to being a messaging protocol, also defining routing and brokerage - unnecessarily so in my opinion. I subscribe to the single-responsibility principle, and WAMP seems to violate that. So I wrote up this RPEP spec and want to know what people think about it.

If anyone wants to contribute to RPEP by either making implementations or discussing changes to the spec, please let me know.

<comment><USER2> SRP is not quite good thing to quote, as it's too vague to be applied sensibly. And some people have allergy for Robert Martin.

I think it would be easier for a reader if you included terms "asynchronous call" and "synchronous call" along "fire and forget" and "request and response". The former pair is already used, at least in some circles, and the latter pair seems your own terminology.

<comment><AUTHOR> I understand what you mean about SRP being vague, but I don't think its so vague as to be useless. And about the 'asynchronous call' vs 'synchronous call' terminology, the problem there is that all the calls are asynchronous, so they aren't really good substitutes for 'fire and forget' and 'request and response'.</comment></comment></comment>


UK gov suspends publication of daily COVID-19 death toll over accuracy concerns - <AUTHOR> https://www.independent.co.uk/news/uk/politics/coronavirus-uk-death-toll-nhs-phe-covid-19-government-england-scotland-a9626336.html <comment><USER2> This isn't as big a deal as some people seem to think.

Most people were not using the daily updates because the problems are well known. There's lags in the data (especially around weekends and public holidays), the data can't be compared across the UK, and this data (even with this method) tends to under count deaths. It's a mistake to think it has lead to an over count of deaths.

Most people are using the weekly ONS data instead.

EG, this tweet: [https://twitter.com/ActuaryByDay/status/1284468751790936065?...](https://twitter.com/ActuaryByDay/status/1284468751790936065?s=20)

</comment><comment><USER3> The time between diagnosis and eventual death is not key. What's key is the cause of death and whether a patient had been cured in the meantime.

If someone is successfully treated, discharged from hospital then dies from an unrelated cause (a scenario they mention in the article) then they do have a point. I doubt these are common cases, though, but they should indeed be evaluated and corrected.

But their proposal to have a hard cut-off of 21 days after diagnosis is equally flawed although I can see the government being keen on lowering official stats...</comment>


Welcome to Facebook Horizon - <AUTHOR> https://www.youtube.com/watch?v=Is8eXZco46Q <comment><USER2> Here's a quick list of common HN comments about Facebook announcements so that we can get them out of the way and actually discuss this product announcement:

1\. I don't use Facebook.

2\. It's been X years since I deleted my Facebook account.

3\. Facebook is a threat to democracy/society/open web/news

4\. Something something stealing/selling/sharing data.

5\. Something something tracking users.

Reminds me of reading the comments on any article about Microsoft on Slashdot 20 years ago.

<comment><USER3> What a surprise that someone who works at Google would support another mass surveillance company. Some of us care about privacy, morals, and mental health more than big checks

>I don't use Facebook.

As should everyone

>Facebook is a threat to democracy/society/open web/news

It is

>Something something stealing/selling/sharing data.

Because that is their business model, being a googler you should be well aware

>Something something tracking users.

Again, because they are and it's something you're well aware of

</comment></comment><comment><USER3> Cool, now you can actually scream at people about your political and religious beliefs instead of just angrily typing

</comment><comment><USER4> No thanks</comment>


ARDUINO WIFI RGB LAMP [IKEA DUDERÖ MODDING] | Open Electronics - <AUTHOR> http://www.open-electronics.org/arduino-wifi-rgb-lamp-ikea-dudero-modding/ <comment><USER2> The article is interesting, but with the ALL-CAPS title it looks like spam. Next time, try changing the title to something like: "Arduino Wifi Rgb Lamp [Ikea Duderö Modding]"</comment>


The Bloodbath of B-R5RB, Gaming's Most Destructive Battle Ever - <AUTHOR> http://community.eveonline.com/news/dev-blogs/the-bloodbath-of-b-r5rb/

<comment><USER2> So many spreadsheets, crumpled and thrown in the trash.

</comment><comment><AUTHOR> Quote:

 _The Economic Impact

11 TRILLION ISK.

According to some PLEX conversions that could equate to approximately $300,000-$330,000 USD_</comment>