Float Toy - <AUTHOR> http://evanw.github.io/float-toy/ <comment><USER2> The thing that made floating point easy to understand for me was the concept of a dyadic rational [1]. Those are just the rational numbers whose denominator is a power of two (e.g. 1/2, 3/16, 61/32). Fundamentally, binary floating point represents dyadic rationals (not counting special stuff like NaN, infinity, etc.) To represent such a number in floating point form, just write it as a/2^b. Then the mantissa is a, and the exponent is -b.

This intuitively makes it obvious why, for example, 1/3 can't be represented. I find the rational form like a/b easier to understand than the "scientific notation" form like a×2^b.

[1]: [https://en.wikipedia.org/wiki/Dyadic_rational](https://en.wikipedia.org/wiki/Dyadic_rational)

<comment><USER3> I think of a float as an integer with a shift. Take the mantissa, stick on the implicit leading 1, put it in the middle of an infinitely big string of zeroes with a decimal (well, binary) point at the right-hand end, then shift it by the exponent (which can be positive or negative).

If you're comfortable thinking about shifting integers, then perhaps this is a simple way to think about floats. For me, it's easier than thinking about them as fractions.

<comment><USER4> Yep, this is how the Unix `bc` tool works; all numbers are internally simple decimal but have a `scale` and `length`.

Scale is the number of dec digits after the decimal point and length is the number of significant figures.

See `man bc`

</comment></comment></comment><comment><USER5> I wrote something similar ~25 years ago, when Win32 first appeared, and still use it today on the (relatively rare) occasion that I need to debug something that uses floating-point.

One interesting thing you'll notice about IEEE754 is that the values sort naturally if you interpret them as sign-magnitude integers:

        00000000  0
        00000001  1.4e-45 (smallest representable positive value)
        00000002  2.8e-45 (next-smallest representable positive value)
        007fffff  1.1754942e-38
        00800000  1.17549435e-38
        3f000000  0.5
        3f800000  1.
        3fffffff  1.9999999
        40000000  2.
        40400000  3.
        60000000  3.6893488e19
        7f000000  1.7014118e38
        7f7fffff  3.4028235e38 (largest finite value)
        7f800000  Infinity
        7f800001  first NaN
        7fffffff  last NaN

In other words, if you count up in floats, it starts at 0 and goes up by increasingly larger amounts, then the number right "after" the "largest" is Infinity, followed by all the NaNs to the end of the range. The negative side is a "mirror image", the only difference being the highest (sign) bit is set.

<comment><USER6> Just a little nit-pick: The NaNs always compare false, so this property only holds for values up to +inf (0x7f800000).

</comment></comment><comment><USER7> Wow, I didn't expect a four year old project of mine to hit HN front page! If you're interested in this, you might enjoy some of the stuff we're working on at Figma. Here's a link to learn more: [https://www.figma.com/careers/](https://www.figma.com/careers/)

<comment><USER8> I use figma at work and it's really neat. Keep up the good work! Now if you could only convince the designer to give me write access ;)

</comment></comment><comment><USER9> I feel like I groked floating point numbers easier when looking at 16bit floating point numbers. The values are much smaller and easier to juggle in your head. The fact that the fraction part literally translated to x / 1024 suddenly became clear to me when you're staring at just 10 bits

[https://en.wikipedia.org/wiki/Half-precision_floating- point_...](https://en.wikipedia.org/wiki/Half-precision_floating- point_format#Half_precision_examples)

<comment><USER10> It's even easier if you use 8-bit floats. Then there are only 256 of them and you can plot them all.

</comment></comment><comment><USER11> A similar probably more well presented site: [https://float.exposed/0x40490fdb](https://float.exposed/0x40490fdb)

<comment><USER12> It's certainly got more information but that combined with the "exact" values makes it a bit overwhelming/hard to understand, especially if you're trying to get a feel for it the first time and the half and the double have the same number of digits on screen. It's almost made more for investigation of something you ran across or need to hardcode than gaining intuition.

But most importantly I think best feature of the one in the submission is something it doesn't even mention in the description - it has a "click and drag to write bits" feature that I think is much easier to use/follow than the 2 dragging section on that one.

<comment><USER13> You can click to flip individual bits on float.exposed too, and they don't have "the same number of digits"…?

<comment><USER14> They do have the same number of decimal digits displayed. You can see it by clicking between "float" and "double": the decimal representation stays the same.

<comment><USER13> What is wrong with that?

<comment><USER14> It makes it look like they have the same precision (well also, going from 64 to 32 bits zeros out a whole lot, which contributes to that impression). In fact, both decimal representations are usually truncated, and don't accurately represent the binary floating point number. It's a neat and useful tool regardless, and I'm being a bit pedantic.

</comment></comment></comment></comment></comment></comment><comment><USER15> I was playing with this yesterday for about an hour... getting so frustrated trying to figure out how to count from 0 to 20. But when I got there, I suddenly had a "omg, I know floating point!" moment.

Then this morning on the train I started wondering: "wait, but how does floating point addition even make sense?!"... I'm still stumped on that one - I need "Float Addition Toy" ;)

(Pro-tip: it took me way too long to figure out that you can click and drag to set/clear the bits quickly)

<comment><USER16> [https://ciechanow.ski/exposing-floating- point/](https://ciechanow.ski/exposing-floating-point/) is the clearest and most coherent explanation of floating-point numbers I've found; it was really what gave me the lightbulb moment I had been missing. This site is a great companion to it though.

<comment><USER17> Thanks, that's a great write-up.

</comment></comment></comment><comment><USER18> I think I found a bug: If you set all bits to 0 except the sign bit you get 0 when you should get -0. In IEEE floating point representation 0 and -0 is not the same. This is why:

f *= 0;

Is not the same operation as:

f = 0;

Since the former will retain the sign bit.

<comment><USER19> Thanks for that bit of information, pun intended. I hope I'll never have to rely on it in production.

</comment></comment><comment><USER20> With the 32-bit one, if I set the highest bit of the exponent from 1 to 0, the exponent goes to -126 (ok), but if I then toggle the lowest bit of the exponent (rightmost green bit), it modifies the mantissa, not the exponent.

Is that a bug or do I not understand how IEEE754 works (very likely :p)?

<comment><USER21> That's called a 'subnormal number'.

[https://stackoverflow.com/questions/8341395/what-is-a- subnor...](https://stackoverflow.com/questions/8341395/what-is-a-subnormal- floating-point-number)

        If the exponent is 0, then:

            the leading bit becomes 0
            the exponent is fixed to -126 (not -127 as if we didn't have this exception)

        Such numbers are called subnormal numbers (or denormal numbers which is synonym).

All normal floating-point numbers have an implicit leading significant bit of 1. If the exponent field goes from 1 to 0, then this corresponds to changing the implicit leading bit to a 0, not to decreasing the exponent.

<comment><USER22> Hmm. But if the exponent's significant bit goes from 1 to 0, why would that affect the mantissa at all? Also, if the significant bit is always 1, how are negative exponents represented?

I understand there's an implicit "hidden" bit, but what conditions cause it to become 0 instead of 1? And does that bit represent the sign of the exponent, or something else?

After reading [https://stackoverflow.com/questions/8341395/what-is-a- subnor...](https://stackoverflow.com/questions/8341395/what-is-a-subnormal- floating-point-number) more carefully, I am more confused than ever. Both visualization sites seem to be leaving out key details. And subnormals only seem to apply when exponent = 0; the visualization problem that OP mentioned happens whenever the leading exponent bit is set to 0, but the rest of the bits can be anything.

<comment><USER23> > But if the exponent's significant bit goes from 1 to 0, why would that > affect the mantissa at all?

It's not a matter of the "significant bit", but whether the WHOLE exponent is 0 or not. An exponent of 0 is a special case; as soon as you set ANY bit in that exponent, the mantissa goes back to the "implicit 1" prepended bit.

> Also, if the significant bit is always 1, how are negative exponents > represented?

Exponents are represented in a "biased representation", counting up from 2 __-127.

> I understand there's an implicit "hidden" bit, but what conditions cause it > to become 0 instead of 1?

Exponent bits being all 0.

> And does that bit represent the sign of the exponent, or something else?

It represents the leading bit of the mantissa.

<comment><USER22> Ah! I get it now. I was confused; float toy is correct here.

Thanks for the explanations.

</comment></comment></comment></comment></comment><comment><USER24> This is awesome, I honestly learned more about floating point in five minutes of playing with this tool than I have in all my years as a coder. One of the main takeaways should be that 64 bits is usually way more precision than we need, 32 is usually more than enough. It would be cool if the tool also showed the new Bfloat16 type, so we could get some intuition for that as well. IIRC, Intel created Bfloat16 to better suit the needs of deep learning practitioners, who don't need much precision (especially for large values).

<comment><USER25> 32 is plenty to represent the numbers we care about, but you'll find you probably want 64 to do math with those numbers. 64 has always been enough for me to never have to care about the precision, but whenever I've used 32 to save some ram, I've ended up having to think carefully about how some operation would reduce the precision in a material way.

<comment><USER26> At 32-bit you already have a whole 16 number gap per-bit in the 200 millions:

210,828,704

210,828,720

</comment></comment></comment><comment><USER27> Does anyone have a similar "toy" for Unicode? (UTF-8 _vs._ UTF-16 _vs._ UTF-32)

</comment><comment><USER28> Suggestions for improvement:

Add a (+) and (-) button to move up or down to the nearest floating point number.

Show the local precision (not sure if this is the correct term), i.e. the maximum difference between the current float and the two nearest ones.

<comment><USER29> Nice. Also, if you make the css transition for what bits flip on ++ and -- slowish, you can see what's going on.

</comment></comment><comment><USER30> I really like this one: [https://bartaz.github.io/ieee754-visualization/](https://bartaz.github.io/ieee754-visualization/)

</comment><comment><USER31> This rocks! I bet I grokked it way faster with this toy compared to a written explanation. An ounce of demonstration is worth a pound of documentation.

<comment><USER32> Did you grok infs and NaNs (the two different kinds, and their payload) and zero (both zeros?) and subnormal numbers?

Otherwise a pound of written explanation might still make sense.

</comment></comment><comment><USER33> I just realized I did not actually understand how floats worked. I just kind of assumed I knew ... and I did not actually know the details correctly.

Thanks for this!

<comment><USER34> well, the details are an IEEE standard, after all. most people should be fine knowing why 9.999999999 is equal to 10 without having to go to infinity.

</comment></comment><comment><USER35> I built something similar [https://www.isfloat.com/](https://www.isfloat.com/) It also tells you whether the decimal value given can be exactly represented as a float. For example [https://www.isfloat.com/?v=0.3](https://www.isfloat.com/?v=0.3)

</comment><comment><USER36> So great! I believe it could also show the difference between quiet and signaling NaN

</comment><comment><USER37> So it's scientific notation in base 2

<comment><USER38> He could've explained the red bits better, it's 2^-1, 2^-2, 2^-3, etc

So if the third red bit is 1, it's 1 x 2^-3, i.e 1 x 1/(2^3), i.e. 1 x 1/8, i.e. 0.125.

<comment><USER37> And +/-0 are special cased.

</comment></comment></comment><comment><USER39> [https://www.h-schmidt.net/FloatConverter/IEEE754.html](https://www.h-schmidt.net/FloatConverter/IEEE754.html)

</comment><comment><USER40> Definitely looking forward to the Unum Type III alternative to floats. This is a nice visualization and it gives you an idea of how many NaN's waste the bits being used.

<comment><USER41> yeah I was going to ask, what's the deal with all those wasted bits?

I'm not a floating-point fan (I do all computations in integer wherever possible/feasible), but I've been following the universal number story since it was announced because it seems less painful/gross than IEEE floating-point on many fronts, here's a github with a good about page about it: [https://github.com/stillwater-sc/universal](https://github.com/stillwater- sc/universal)

</comment></comment><comment><USER42> Nice work on the "mouse down to toggle" and "drag to copy value" interaction, a much underused but useful tool to set a collection of boolean states.

</comment><comment><USER43> Awesome. It would be cool to incorporate it into the Wikipedia article (or at least, link to it).

</comment><comment><USER44> Neat, but it should special case -0.

</comment><comment><USER45> Nice!

Would be nice to get various 16-bit float formats as well. They're getting more and more common in graphics and NN domains.

Or perhaps generic n-width exponent and m-width mantissa.

<comment><USER46> rreusser made a more generic version inspired by Float Toy: [https://observablehq.com/@rreusser/binary- input](https://observablehq.com/@rreusser/binary-input)

</comment></comment><comment><USER47> Click, hold and swipe to quickly replicate a bit value across a range of places.

</comment><comment><USER48> Very valuable. Thanks!

</comment><comment><USER49> I deep dove into ieee754 binary and decimal float (DPD and BID) while researching how to compress floating point values [1]. For 25 years it had been a magic black box that I couldn't trust for comparisons or printing, but now I get it. I get why it happened this way, what the benefits were, how to mitigate against its weirdness, and why ultimately decimal float needs to replace binary float in future. It's definitely worth learning.

[https://github.com/kstenerud/compact- float/blob/master/compa...](https://github.com/kstenerud/compact- float/blob/master/compact-float-specification.md)</comment>


C to Java Translation. Automatic, Complete, Correct. Free for Open-Source. - <AUTHOR> https://www.mtsystems.ch/ <comment><AUTHOR> Main author here. Let me know if you have any questions. I'd be happy to answer.

<comment><USER2> I tried so hard to break main arguments (char __argv), on my last try I sent char __argv to a function and It wrapped main, and inserted program name to beginning and called the wrapped main with new arguments. I give up.

<comment><AUTHOR> Hahaha, cool!

</comment></comment></comment><comment><USER3> Interesting how gotos are translated to switches

90% of C should be pretty easy to translate, but of course, the devil (and a lot of functionality in existing libraries) is in the details.

There would be probably money in translating COBOL to Java, but maybe there are solutions already?

<comment><USER4> The main problem being undefined behaviour that is actually undefined and varies from compiler to compiler!

<comment><USER3> Yeah, you might need a config switch to configure what would you want to do with the most common undefined behaviours (or "just change" your C code)

(Because "just change" usually ends up creating other problems. Been there, done that, "code is wrong but works" and when you try to fix stuff breaks)

</comment></comment></comment><comment><USER5> This looks pretty nice. Pointer/array arithmetic seems to be handled nicely, (double)malloc(sizeof(double)*100) looks pretty ugly but it's hard to tell what's going on under the DoubleContainer hood.

For OSS (or other projects) that just need running JVM byte code, checkout the GCC Bridge component of Renjin, which uses a combination of GCC to Soot to compile C and Fortran code to bytecode: [https://github.com/bedatadriven/renjin/tree/master/tools/gcc...](https://github.com/bedatadriven/renjin/tree/master/tools/gcc- bridge)

<comment><AUTHOR> Thanks!

malloc() we only optimized for char* so far (there are endless possible optimizations when translating C the way we do).

"(double* )malloc(sizeof(double) * 100)" should be translated as "new DoubleContainer(100, true)". We'll add that add some point.

</comment></comment><comment><USER6> NestedVM was able to do this over a decade ago.

[http://git.megacz.com/?p=nestedvm.git;a=summary](http://git.megacz.com/?p=nestedvm.git;a=summary)

And is actually open source, not "free for open source".

Kudos to the developers though, I'm not trying to bash your skills or diminish the quality of your work... I'm sure many enterprises can/will benefit from this. Just wanted to let the free/open source community know that you don't have chomp on the "free for open source" carrot.

</comment><comment><USER7> I think I saw this the other day in the VIM discussion. Great job! Are the other examples, e.g. micro http, also available for download?

<comment><AUTHOR> We translated dozens of open-source projects and decided to list only the interesting ones on the website and upload only the most interesting ones; The ones that are very well known and have a nice GUI.

Feel free to send us an email and we'll be happy to send you the other programs you're interested in.

You can also ask for translations of open-source software we didn't translate yet if you want to see the translation of a specific project.

</comment></comment><comment><USER8> It says the translation is correct, is there any proof of that ?

<comment><AUTHOR> Only in the form of translating and running dozens of C applications (programs and libraries) and running their testsuites. E.g. libcurl comes with a great extensive testsuite (a perl script running against the binary).

Translated applications still need to be thoroughly tested and usually some bugs are still found.

So we didn't formalize and verify our translation. Interestingly enough, we run into bugs in javac and ecj (Eclipse Java Compiler) surprisingly often. So verifying our translation would still lead to translations with bugs ;-)

Another fun fact: Since our translation knows the limits of allocated memory (and many other things), we found many illegal memory accesses in C programs that were unknown before (libgmp, micro httpd, vim, ...) since they didn't (or only very seldomly) lead to segfaults.

<comment><USER9> This sounds like a great spin off - bug finding in C code. Have you put much thought into pursuing this?

<comment><AUTHOR> Didn't think too much about it since there are many C specific analyzers and tools that do the same. Well, they do it way better. E.g. Valgrind.

<comment><USER9> I would guess the value would be if you find bugs that other tools don't. If you just find the same bugs as Valgrind then I agree that there would not be too much value, but if you find unique bugs then it would be useful.

</comment></comment></comment></comment></comment><comment><USER10> What do I need to do to get opensource software translated? I would like to have this [http://stjarnhimlen.se/comp/sunriset.c](http://stjarnhimlen.se/comp/sunriset.c) as java code..

<comment><AUTHOR> Send us an email. We're currently getting overrun with requests but will handle it as fast as possible.

Please note that the software needs to be in some public repository (github, bitbucket, sourceforge, ...).

</comment></comment><comment><USER11> Pretty neat. I did find a bug while I was playing around with it though: it doesn't correctly translate Duff's device.

<comment><AUTHOR> Can you elaborate on that? What's the C code, the translated Java code and your expected Java code?

Thanks!

<comment><USER12> [http://lmgtfy.com/?q=duff%27s+device&l=1#](http://lmgtfy.com/?q=duff%27s+device&l=1#)

<comment><AUTHOR> I saw that ;-) The translation is:

      do {

        to.set((from = from.shift(1)).get(-1));

      } while(--count > 0);

which looks correct to me. Hence my question what orodley thinks is wrong.

<comment><USER13> I think you might be looking at the wrong thing on the Wikipedia page. The core feature of Duff's Device is interleaved switch and do statements:

      n = (count + 7) / 8;
      switch (count % 8) {
      case 0: do { *to = *from++;
      case 7:      *to = *from++;
      case 6:      *to = *from++;
      case 5:      *to = *from++;
      case 4:      *to = *from++;
      case 3:      *to = *from++;
      case 2:      *to = *from++;
      case 1:      *to = *from++;
              } while (--n > 0);
      }

(extraneous register statements removed for conciseness)

<comment><AUTHOR> That would be a bug in the translation. We'll investigate. Thanks!

<comment><AUTHOR> Yes indeed. We handled goto into do-while statements wrong. Fixed now. Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Is there any tool that does the opposite?

<comment><AUTHOR> I've seen many research papers on Java -> C translation during my PhD. Some of them came with a prototype tool. But as with previous work on C -> Java translation, none of the tools actually really worked completely.

I actually wrote a Java -> Eiffel translator:

[http://se.inf.ethz.ch/research/j2eif](http://se.inf.ethz.ch/research/j2eif)

Based on that experience I can say it would be quite a big effort to write a Java -> C translator. But not impossible.

<comment><USER9> Thanks for the post. What was the big sticking point with the Java -> C translators?

<comment><AUTHOR> It's easy to do a minimal prototype when doing research. But writing real translators means to get all the details right. In research we usually don't have the time for that.

Translating Java - in my experience - is very hard because of the extensive runtime system (reflection, base classes, synchronization, ...). E.g. if your application does System.out.println("Hello"); you already need the System and PrintWriter classes. They in return depend (among many other things) AWT which needs the security classes. And so on. A HelloWorld pulls in 1208 classes of the base library. They in return depend on java.dll which you have to re- implement from scratch. Or you rewrite all base library classes which is even harder.

I hope this gives you a basic idea of the problem.

<comment><USER9> It certainly does. I can't imagine even starting on a project like this.

</comment></comment></comment></comment></comment><comment><USER14> One million Dollars for a couple of days of work?

<comment><USER2> You can always format your whole source code into 1 line, so it will cost only 1$.

</comment></comment><comment><USER15> Do you translate open source free of charge?

<comment><AUTHOR> Yes. As long as it's non-commercial software.

</comment></comment><comment><USER16> C++ to Java would be more interesting.

<comment><AUTHOR> True. But also adds a lot of complexity on top of an already very complex translation. But it's certainly something we'll look at in the future (together with supporting Cobol and Fortran).

But I heard there are C++ to C translators. I don't know how good they are and how the resulting code looks like. But if they're decent, you could do C++ -> C -> Java :)

<comment><USER17> On the C++ to C translators: The first actual C++ compiler was actually a trans-compiler to C (actually the language was still called cFront back then, but basically it's the first version of C++[0]).

So in that case, the C++ to C compiler was there before the first real C++ compiler which appeared some time later.

[0] [http://www.cplusplus.com/info/history/](http://www.cplusplus.com/info/history/)

</comment></comment></comment><comment><USER18> I want a Java-to-Java translator.

</comment><comment><USER19> I wonder what the performance impact is.

Why do young students no longer learn C? Don't you want to be closer to the underlying OS?

<comment><USER20> > _Why do young students no longer learn C?_

Who said they don't? This project is about porting existing stuff, for interoperability, etc. Not as a way to "avoid learning C".

> _Don 't you want to be closer to the underlying OS?_

No, why would I want to do that unless I have a specific need for that?

<comment> vezzy-fnord _No, why would I want to do that unless I have a specific need for that?_

At least if you're using a Unix-like system, then understanding POSIX is essential for knowing how things work starting on an intermediate level.

<comment><USER21> And why would I want to understand how things work down in the OS?

Anyway, C is a horrible language. Between Fortran and Ada it's unclear to me why C should be chosen for anything, inertia and herdthink aside.

<comment><USER22> Have you used Fortran or Ada?

<comment><USER21> Have used Fortran. It's pretty nice, actually. I mean, it does have unstructured programming, but its structured alternatives feel pretty natural. Fortran code, like C code, feels a bit fragile but unlike C, Fortran doesn't seem to be actively malevolent. I only know Ada by its (excellent) reputation.

EDIT: Only true if you use the implicit-none flag when compiling Fortran.</comment></comment></comment></comment></comment></comment>


Whats a book, philosophy, or idea that helped you make big positive changes? - <AUTHOR> <comment><USER2> A Guide To The Good Life by William Irvine (on the Stoics)

</comment><comment><USER3> Awareness by Anthony de Mello

</comment><comment><USER4> Daily Stoic</comment>


Modular robot reassembles itself when kicked apart (YT video) - <AUTHOR> http://uk.youtube.com/watch?v=uIn-sMq8-Ls <comment><USER2> I don't know about anyone else, but my first thought after watching this was... Replicators!

Self assembling and repairing machines are pretty neat though. Anyone know what kind of software techniques they used (if any) to make the parts work together?

</comment><comment><USER3> very neat, how about programming languages that not only find bugs but use a discovery tree to try solutions and test them, then report back to you the options (which include the option to do it manually) This already exist?

<comment><USER4> How would it tell the difference between desired and non-desired behavior?

</comment></comment><comment><USER5> My favorite part was the end (when it commits suicide). Still, this was very cool to watch. I hope that this progresses very quickly. I want to see iRobot style servants in my lifetime.

</comment><comment><USER6> T1000, version 0.1</comment>


New Vulnerability Found in Apps Using Wi-Fi - <AUTHOR> http://bits.blogs.nytimes.com/2013/10/29/new-vulnerability-found-in-apps-using-wi-fi/?hp&_r=0&gwh=C271E3989891B58B303031189CCA2D3F

<comment><USER2> No comment on the actual announcement.

However, this is a good opportunity to point out that if you're building an iOS or Android app, you should not only use TLS for all your connections, but also _pin your certificates_ and only confirm a connection after validating that certificate.

There aren't many good reasons why a mobile app should need to depend on the CA system for security. In fact, in a mobile setting, if you're willing to create a separate API endpoint for your app, you can replace the CA system entirely; just create your own CA, sign your own certs, and ship your app with your own root certificate.

</comment><comment><USER3> _facepalm_ Security company learns that HTTP MITM + cache poisoning is a thing that exists. (Edit: If it wasn't obvious, 301's are a common and well known form of cache poisoning in this scenario)

Next I bet they will discover that you can pretend to be anyone you want in e-mail!

<comment><USER4> Yeah, I does sound like that but it also says persistently DNS poisoning or ARP poisoning isn't very persistent. So there COULD be something here...but I don't think so

In my experience, most mobile apps use cert pinning or regular ol https. Only a few that I have seen actually use http.

The biggest thing mobile apps do is client-side checks instead of server-side, since an assumption of network connectivity can't be made. It's pretty funny the types of things you'll find. Anyways...

edit: Oh wow. I watched the video. That's embarrassing. "We haven't done a responsible disclosure because everyone knows HTTP is just like that"

</comment></comment><comment><USER5> The original article is at [http://www.skycure.com/blog/http-request- hijacking/](http://www.skycure.com/blog/http-request-hijacking/)

This is just a little enhancement for the the usual non-tls http mitm on shared media. They use a 301 moved permanently code, making some http clients cache the new attacker-controllled url for a little longer after the active attack stops.

<comment><USER6> That is a very nice little enhancement though. If the app trusts the cache headers, this widens the scope from "your use of this app is compromised while on the rogue AP" to "your use of this app is compromised wherever you connect from once you've used it on this rogue AP". That's a non-trivial difference!

<comment><USER7> I agree it sounds like a non-trivial difference. An app could present new information over time, to fool the user into clicking on an external link in the app. The victim is now on the attacker's website, which suits the attacker more than trying to manipulate the app.

</comment></comment></comment><comment> mike-cardwell Sounds like a plain old fashioned MITM attack to me. Nothing new here.

<comment><USER8> Indeed. And Apple my have been trying prevent apps from being overly vulnerable from the start: the approval process will reject:

2.7 "Apps that download code in any way or form will be rejected"

2.8 "Apps that install or launch other executable code will be rejected"

<comment><USER9> Those clauses are to prevent the application from downloading code that is not reviewed. Blocking HTTP requests and requiring HTTPS requests would block several categories of legit applications but it would be nice to have them explained.

</comment></comment></comment><comment><USER10> I was at their presentation earlier today. Maybe not a big thing, but I liked their conclusion. they demonstrated a mitm-proxy that gave 301s so that ignorant native apps loaded and cached external trusted resources. They also mentioned using malicious iphone profiles with new certificates or configured proxy. Demoed also using faked captive network, maybe also with pineapple/wifigate

Thy also claimed many apps had this vulnerability. They also said it was easy to fix. Think about caching in native clients, and ignore 301s in native apps. They didn't mention 302s

More info here [http://www.skycure.com/blog/http-request- hijacking/](http://www.skycure.com/blog/http-request-hijacking/)

</comment><comment><USER11> Is this really worthy of a HN post? This is a pretty basic attack.

</comment><comment><USER12> Is this Apple only? The articles do not mention Android.

<comment><USER13> It might be. This is a compound attack. The attack makes a couple of assumptions that are dangerous for both iOS and Android:

1) The app communication is using HTTP.

2) The attacker has some means of executing a MITM (man-in-the-middle) attack.

The portion that appears to be unique to iOS (maybe it's not), is the default cache policy for 301 redirects. Specifically, once the attacker has targeted some HTTP traffic, they use the MITM attack to redirect iOS to the attacker's server instead of the intended one. The default cache policy on iOS makes this redirect more or less permanent. That's bad because once you leave the compromised network, your phone will continue to talk to the attacker's server instead of the intended one.

The reason this exploit is seeing such an apathetic response is because the cache poisoning is pretty lame in comparison to having executed a MITM scenario. Once you have MITM, you have complete control over the traffic a device receives. For HTTP communications, this is not specific to iOS devices.

The best mitigation for MITM attacks is to simply use HTTPS instead of HTTP. Unfortunately, it's not easy for iOS users to see whether an app is using secure back-end communications.

<comment><USER14> _The portion that appears to be unique to iOS (maybe it 's not), is the default cache policy for 301 redirects._

Its in the HTTP spec:

> This response is cacheable unless indicated otherwise.

\- [http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10...](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.2)

I'm fairly certain without doing any research whatsoever, that most every browser on most every platform is vulnerable to this attack. It is literally a DNS cache poisoning and MITM. Nothing more. The difference with a mobile platform is you're dealing with apps that don't have a URL bar to tell you that you've actually on qwerty.info/paypal instead of paypal.com, which is an indicator of an attack.</comment></comment></comment>


Hacker Andrew 'Weev' Auernheimer attempts to overturn conviction - <AUTHOR> http://www.theguardian.com/technology/2014/mar/19/hacker-andrew-auernheimer-try-overturn-conviction

<comment><AUTHOR> Apparently, the hearing focused mostly on issues of the appropriateness of the venue and not much on the computer crime aspects. That means the appeals panel may not actually rule on the merits, but may dismiss the case on what amounts to "a technicality". That would leave the gray area of the form of the original ruling against Weev about what does or does not constitute a CFAA violation.</comment>


ESPN uses map of China complete with nine-dash line, Taiwan, Arunachal Pradesh - <AUTHOR> https://shanghaiist.com/2019/10/10/espn-uses-map-of-china-complete-with-nine-dash-line-taiwan-and-arunachal-pradesh/ <comment><AUTHOR> Purported letter that was sent to employees [https://imgur.com/2pkIFNu](https://imgur.com/2pkIFNu)

You have likely seen the news that we made the decision to remove an app from the App Store entitled HKmap.live. These decisions are never easy, and it is harder still to discuss these topics during moments of furious public debate. It's out of my great respect for the work you do every day that I want to share the way we went about making this decision. It is no secret that technology can be used for good or for ill. This case is no different. The app in question allowed for the crowdsourced reporting and mapping of police checkpoints, protest hotspots, and other information. On its own, this information is benign. However, over the past several days we received credible information, from the Hong Kong Cybersecurity and Technology Crime Bureau, as well as from users in Hong Kong, that the app was being used maliciously to target individual officers for violence and to victimize individuals and property where no police are present. This use put the app in violation of Hong Kong law. Similarly, widespread abuse clearly violates our App Store guidelines barring personal harm. We built the App Store to be a safe and trusted place for every user. It's a responsibility that we take very seriously, and it's one that we aim to preserve. National and international debates will outlive us all, and, while important, they do not govern the facts. In this case, we thoroughly reviewed them, and we believe this decision best protects our users.

</comment><comment><USER2> ESPN is owned by Disney, and Disney has no problem collaborating with the CCP by spreading their propaganda.</comment>


The Best Email I've Ever Received - <AUTHOR> http://sheddingbikes.com/posts/1281413656.html <comment><USER2> There is no satisfaction like adding value to someone's life through your work.

<comment><USER3> Being able to build a successful company based on that model is probably even more satisfying.

<comment><USER4> I understand your sentiment but it's not all about the money.

<comment><USER5> Building a successful company isn't all about money.

</comment></comment></comment></comment><comment><USER6> Yeah, that's the cool thing about my business too. I get e-mail all the time about how people were on the brink, and now their life is turned around. It's awesome.

</comment><comment><USER7> I too used your book to get started in Python. It was a great introductory lesson, and definitely my learning style. Thank you!

Going to try Python for Fun this month (<http://openbookproject.net/py4fun/index.html>) to get a bit more advanced and pick up Learning Python ([http://www.amazon.com/Learning-Python-Powerful- Object-Orient...](http://www.amazon.com/Learning-Python-Powerful-Object- Oriented- Programming/dp/0596158068/ref=wl_it_dp_o?ie=UTF8&coliid=IQCH5A5AIF344&colid=1Q57C3U55EHX2)), unless anyone else has any other better suggestions?

<comment><USER8> Awesome. I posted a whole bunch more lessons, so not sure when you stopped reading LPTHW but try grabbing it again. Learning Python is a great book, and it's huge so you'll have tons of things to work on. I haven't heard of python 4 fun before.

</comment></comment><comment><USER9> It is a great introduction to Python, so I'm happy Zed is getting some positive feedback. Way to go, Zed.

</comment><comment><USER10> How come Zed uses temporal nouns ("today") but there's nary a timestamp on his blog posts!?

<comment><USER11> post url is a unix timestamp, eg 1281413656.html => Tue, 10 Aug 2010 04:14:16 GMT

<comment><USER12> Oh, wow, why didn't I ever think to do that? That makes so much sense...

</comment></comment></comment><comment><USER13> I'll be at Antidote in Houston tonight for the informal Learn Python The Hard Way Tuesday. No big deal. We just sit there going through Zed's book and if you get stumped, I help you figure out the answer. You can also try this userid on Skype or at yahoo by email. Tonight, I may be preoccupied by someone from okcupid.

<comment><USER14> >Tonight, I may be preoccupied by someone from okcupid.

Like a date? Or someone who works there?

<comment><USER13> Neither.

</comment></comment></comment><comment><USER15> Finding my way to your book, nice way to learn Python, thanks!

</comment><comment><USER16> _really change my families living conditions and quality of life_

Does this mean he was able to get a job with his Python skills?

<comment><USER8> He emailed me more details. Basically, he's a system administrator who learned Python through my book, and actually just an early version of it. He hadn't been able to learn programming before. He then wrote some software at his company that got him enough of a raise that he could move his family out of a bad neighborhood and buy a house. He then got a promotion and has been on the up ever since.

This is why I liked it so much. When I tell system administrators they have to learn to code, I really mean it will help them. Hopefully my book can do that for even more of them (and others).

<comment><USER16> I'm not very religious, but within Judaic law, teaching someone a skill which allows them to better their financial situation is considered the highest level of charity.

It comes from Leviticus 25:35

       וכי-ימוך אחיך, ומטה ידו עמך--והחזקת בו, גר ותושב וחי עמך

"And if thy brother is of lesser means than you, you shall strengthen the stranger and the dweller in your midst and live with him, [so that he no longer be in need]"</comment></comment></comment>


The beginnings of a BSD licensed bignum library - <AUTHOR> http://wbhart.blogspot.com/2010/09/bsdnt-introduction.html

<comment><USER2> The code hasn't been updated in about a year: <https://github.com/wbhart/bsdnt>

The author appears to be planning a restart of the project, but that won't happen until next year: <http://wbhart.blogspot.com/2011_10_01_archive.html>

<comment><AUTHOR> One big interruption is that I have been writing an FFT implementation completely from scratch that can eventually be used in BSDNT. You can find the code here:

<https://github.com/wbhart/mpir-fft>

For the time being it is implemented against the MPIR bignum library. But once BSDNT is up to it I will install it in BSDNT.

</comment></comment><comment><USER3> In my experience imath is the best (near) BSD licensed arbitrary precision integer arithmetic library. It also has a bunch of special purpose optimized functions for scientific computing.

imath: <http://spinning-yarns.org/michael/sw/imath/>

<comment><AUTHOR> For my purposes I need a bignum library with an FFT, assembly optimisation, a bignum format based on full 32/64 bit words and the latest algorithms for performance.

If I don't want this to become a multi-decade effort I have to compromise somewhere. The particular compromise I make is that the library will initially compile with GCC only and will use inline assembly.</comment></comment>


Tips for saving power and How it will save you. - <AUTHOR> http://www.techerator.com/2010/09/save-energy-and-lower-your-electricity-bill-without-losing-the-tech-you-love/

<comment><USER2> The most important thing you do when optimising for low energy use is to measure how much energy your appliances actually use. For example, if you have a modern phone charger, you will find that it draws about 1W when switched on but not charging your phone: that costs (just) under £1/year.

The second most important thing is to pay attention to energy consumption when buying new appliances. If low energy use is important enough to you to justify obsessively switching things off at the wall, it's important enough to you to justify paying more up front to reduce your energy costs long term.

(Even this ignores insulation.)</comment>


Secret's founder returns with anti-loneliness app Ikaria - <AUTHOR> https://techcrunch.com/2020/02/18/just-imagine-ikaria-secret/ <comment><USER4> Oh good. Another app.

When will people learn that more technology is not only not always the answer, but often the problem?

The biggest fallacy of the 21st century is the idea that the shortcomings and collateral effects of the advance of technology can be addressed with more technology.

I'm not against technology. I'm not a neo-Luddite. But at the same time, the conception that all of the problems we've created or exacerbated through technology can be resolved by more of it is painfully naive. It's "when all you've got is a hammer..." logic.

New technology won't replace or repair the decline in social centers. New technology won't fix our increasing sense of disconnection with our localities. New technology won't help us engage with local politics (in the sense of trying to do good by collective action).

Building new apps and new technologies isn't a cure-all or necessarily a solution for the problems were facing right now. It's time for us to recognize that we (the tech community) don't have all of the right answers, and it's time for us to reach out and try to learn, and try to participate in fixing the problems we helped create.

<comment><USER5> _It 's time for us to recognize that we (the tech community) don't have all of the right answers, and it's time for us to reach out and try to learn, and try to participate in fixing the problems we helped create._

Is this like when people in the past said the postal system couldn't ever replace visiting someone, and that the telephone would never replace letters, and that chat apps couldn't beat a phone call..

People in tech (all tech since the beginning of the human race) have believed their inventions will nudge people to do things they might not otherwise do. Better swords and armour encouraged more battles, better farm tools encouraged more farming, better housing encouraged bigger families, better eduction encouraged more inventiveness, and so on. That's what tech _is_. Today that means Google's adverts push us to click on links and buy things, Facebook's status updates push us to share more, Instagram encourages us to take more selfies and pictures of our dinners, Twitter's retweets make us show people we discovered things they might want to see. The idea that people in tech _wouldn 't_ come up with apps that try to fix the lonely people by making them sociable is ridiculous. Apps and tech are _all about_ behaviour manipulation.

And, mostly looking at all the evidence around us, it works _really_ well.

<comment><USER6> have you been outside recently? I mean outside without a phone for a couple of months. Give yourself a no-data diet, and just observe what is going on in others. Wait alone at a bus-stop or alone at a pub or cafe. You can see them addicted to their screens everywhere. It's the norm now to immediately reach for the phone because god forbid they might otherwise feel 2 seconds of boredom. They are no longer human as far as I'm concerned. The problem is never that AI and technology will replace us. We are becoming (actually we have already become) so much like AI/robots that it's impossible to stomach. Everyone isolated into their own little algorithmic prisons without any need to listen to others. It's much much worse than any hard drug you could be addicted to because with hard drugs you still have others who you can do them with. Just do yourselves a favor and never unplug because what you see might be so upsetting that you might wonder if it's still worth living.

I won't even get started on the problem of "fixing loneliness" with an app. You don't "fix" loneliness with an external tool. The only solution to fix this is inside you (and it hurts if you do it right). Pain is part of it and anyone who claims they can take away the pain, or make it easy should be metaphorically incinerated.

These things aren't increasing empathy. They're the opposite: They are empathy sinks!

y'all do yourselves a favor and read Jacques Ellul "La Technique" (The Technological Society) and stop peddling and defending more Tech just for the Benjamins.

<comment><USER5> _You don 't "fix" loneliness with an external tool. The only solution to fix this is inside you (and it hurts if you do it right)._

Thinking this way is utterly toxic. It puts 100% of the onus to resolve an issue on the individual with no room for people to help each other. You might as well be telling depressed people to "think happy thoughts more" or telling anxious people to "snap out of it and be more resourceful".

No amount of claiming "tech is bad" will change the fact that tech is a great way of connecting people. If an app is useful to bring people who need help together with people who want to help them then that is a very good thing.

<comment><USER7> You are very right but it's also true that there's a low hanging fruit factor with 'application' to solve anything which often just shapeshift the problem.

Let's not forget the good old 'use the right tool'

late ps: half kidding, I often wonder what would happen if internet got cut for a long time (week~).

</comment></comment></comment></comment></comment><comment><USER8> I invested in Ikaria and feel like someone should speak up here.

I was early investor with Chrys Bader previously on his startup Secret. He was a YC batchmate of mine from 2008. I watched him build an initial prototype that had the chance to be a real social network that had very high long term retention, but in the end the company didn't invest deeply enough into moderation and the long term retention cohorts went down steeply past 6 months of use.

Chrys is a great designer and product manager who caught lightning in a bottle previously, and lost it. Founders often catch lightning in a bottle and then fail to keep it because scaling operations like moderation, or sometimes even just keeping the servers online, through hyper scale, is hard.

Many founders never find lightning in a bottle even once. Even in my experience I felt like we caught lightning in a bottle with Posterous and failed to properly bring it to the scale I wish we could have.

I realize I am going out on a limb to defend him here, but founders going back into the arena deserve at least a little bit of defense because it's hard enough to take the chance to make anything ever.

You'll hear more about how Ikaria really works, and I realize the post is light on details, but don't write this startup off before you actually try the software itself.

<comment><USER9> Friendships are everything — keep them close and cultivate them. If it's through investments, building tech, do it.

The market is a beautiful thing; it will quickly and swiftly tell you if you're right or not. No need to fret over any apologetic comment.

<comment><USER10> I'm curious about whether the most successful products to solve loneliness will be ones that help people connect virtually, versus connect in person. Maybe a healthy balance of both?

<comment><USER4> "Solve" loneliness. With a "product".

Try to get out of your bubble. To anyone who isn't entirely immersed in that bubble this is absolutely insane talk. It sounds sociopathic and out-of-touch.

Maybe, just maybe, this isn't a problem you can "solve" by engineering. And maybe, just maybe, the solution (if it exists) isn't a "product".

<comment><USER11> > Maybe, just maybe, this isn't a problem you can "solve" by engineering. And > maybe, just maybe, the solution (if it exists) isn't a "product".

Or maybe it is. In all your comments in the various threads here you fail to give a reasoning for your position which is not "it is my opinion". Instead you have now started attacking others. "sociopathic talk"? Really?

</comment></comment></comment></comment></comment><comment><USER12> Incredibly vague statements parroting known talking points with 0 substance to show for it.

I hate to be cynical but all this `tech to fix the social problems created by tech` really brings out the cynic in me.

Realistically I know that we _do_ need new solutions but the solution to a drinking problem isn't to deliver better, more mindful alcohol.

Edit: To the comments below, I am not asserting that tech has actually _created_ an entire new set of problems out of nothing, just that that is the narrative on display here and in other places. This is part of why it makes me so incredibly cynical.

<comment><USER13> I agree with your evaluation of the article, but I'm tired of this "social problems created by tech" narrative. I grew up in the world before the internet. It was NOT better.

<comment><USER14> I actually think it was worse before, just like in many areas. The bullying and fighting then was physical and real.

Everything keeps getting better over time (measured in say decades) but the one constant we will always have is complaining.

Yes there are always real problems and new ones are also created, but on the whole we are doing better in many matters.

<comment><USER15> Yes, I think the personal computer sucked in many people who previously would have idled their time elsewhere, having nothing better to do. It was often a life saver or at the very least a more productive use of time - for me it certainly was.

</comment></comment></comment></comment><comment><USER16> Loneliness is because people have convinced themselves that the cost of being with someone is bigger than the reward of being with someone.

The immediate cost of being alone is going down.

We need to understand, no matter how much a person has read or introspected their behaviour or are kind at their heart - no one will every be able to live up to the expectations of millions of people on internet.

This is why relationship advice on internet is such a joke, whenever anything happens, advice that's given to them is "leave this person, this person is abusive, manipulative, you deserve better". They follow the advice and end up alone and convince themselves that being alone is best.

Now, about the people who want to pursue romantic interests,the game is soo different now.

Long ago, girls from my town only dated local boys. They had to do with what's available to them locally but these days, one girl tells me that their boyfriend is coming to see them on weekend from Italy, while others boyfriend is coming from Greece, etc... Meanwhile men of town have drowned themselves in video games, porn and drinking/drugs because they've no meaningful relationships - they told me they feel like loser because girls aren't interested in them.

Yes, the men they are with are wayy better than what's available locally. Better according to preference of those girls, not according to me. Can I blame women for choosing best available to them? No. Many guys will do same provided they had the opportunity.

If romantic interests is not what you wanna pursue, it hardly matters if you are not very attractive - you can find plenty of people are church, at beach or anywhere where you see people. Finding people to spend time with us not difficult at all provided you can fulfill the minimum required to not put off the people.

I am pretty sure when people say they are lonely - they are talking about absence of people in their life who care about them or make efforts to make them happy or go out of their way to make them feel special, cared for, treasured. Who doesn't want this?

How technology can solve it?

<comment><USER17> On the other hand, leaving abusive or manipulative person is a good idea - <USER2> are better off alone.

And dating addicted gamer that also drinks or takes drugs sounds like special kind of hell. It would just make her suffer in bad relationship where she has no meaningfull companion and partner.

No girl can cure any of these. And guys like this won't change after starting to date a girl - not for long. The idea that she will civilised him by her presence is bonkers.

Hardcore gamer culture is not the "you found a girl stop playing that much" culture. It is "you don't play enough you are weakling get gut looser, if girl stopping you from hobby she is bad partner" culture.

Amd real life dating activities are boring compared to excitement of gane for gamers. Even if he wanted to stop instantly, it is trully hard.

<comment><USER16> >And dating addicted gamer that also drinks or takes drugs sounds like special kind of hell. It would just make her suffer in bad relationship where she has no meaningfull companion and partner.

That happened once they accepted that they'll find any relationship - <USER3> they were interested in, rejected them and they gave up.

>No girl can cure any of these. And guys like this won't change after starting to date a girl - not for long. The idea that she will civilised him by her presence is bonkers

Do we always live for ourselves? Do we never try to live up to expectations of our family or friends? Or those who believe in us, being on our side in life?

<comment><USER17> This is simply false. Gamers don't start at 27 when they gave up on dating. They just keep playing more and more from pre-teenage years as social thing with friends.

Nor do people start drink after they have been without partner for years. Instead, they are friends with peers and drink with them progressively.

> Do we always live for ourselves? Do we never try to live up to expectations > of our family or friends? Or those who believe in us, being on our side in > life?

Sure not. But what you want there is a person whose only role is to make you better by making you feel like she expects from you - without getting much in return.

That is not how relationships work, both sides need to have their needs met. Both sides need the other side to give.

Including girls.

<comment><USER18> To make some perspective, you started in a "clueless dad" mode about gaming and then went that route (gamers social grouping, etc) to justify the phenomenon.

There is nothing to justify though. Someone is choosing a partner from a different country, who can fly over for a weekend. It is not "better" or "worse", it is a selection from a bigger set of beautiful he-dogs, and all- time high expectations. You can see that even not crossing a country border, just look at a small town near a big one. All males in there fall in shadow of any confident big city citizen. With technology, the discussed outcome was inevitable.

I bet that our parent commenter did not speak about NY, Paris or Tokio downtowns.

<comment><USER17> There is nothing clueless about observation that people start playing games way sooner then they seek partners. There is nothing clueless about observation that it has social component - bonding among guys. In particular gamers tend to have whole social life composed of other gamers.

The guys you described are not failing to meet some super high expectations. You described people with drug and alcohol issues who have game addiction issues on top.

Romantic relationship is not the only source of company and relationships. You can't depend on one person for all your social and emotional needs.

There are slightly more girls then males at any given moment. There are plenty of single women around the world. They don't blame missing guys for their alcoholism (through plenty of them have other issues)

<comment><USER18> >You described people with drug and alcohol issues who have game addiction issues on top.

I had no such thing in mind at all. Not sure if me or you misread this subthread, but blaming guys who cannot find a local match for their depression (if they take place; this idea was brought out of nowhere) seems too prejudicial, while more prosaic explanations exist - they cannot compete at their best.

Op was like "girls in town choose foreigners so local guys feel like loser", and you jumped to "they are all game addicts, and drugs, and alcohol, their fault".

<comment><USER17> Nah, it was not merely depression. Full quote: "men of town have drowned themselves in video games, porn and drinking/drugs". Which is way more then being depressed. It does not matter whose is to be blamed, but dating anyone like that is receipt for unavailable alcoholic partner. And she won't meet him anyway, cause he is moving solely among males.

His explanation is "because they've no meaningful relationships", but then he proceed to define meaningfull relationships as romantic only.

No girl can fix any of that. They can't fix lack of friendship, can't fix lack of familly relationships, can't fix no roots in local community. Women are not rewards for good behavior nor cure for mental health problems. If you expect any of that, you will end up ressentful of partner who won't be able to provide that much.

Having long term partner is not cure all, nor cure for depression or loneliness. Not in long term, not after initial honeymoon passionate period ends.

I doubt that majority of town girls have foreign long distance intercultural partners. Such relationships are quote hard to keep and generally rare. Despite there being some girls with foreign boyfriend, majority will date local or not at all.

And plenty of girls have depressions on their own, mental health problems, bad habits, possibly own addiction struggles. Problems in families with relatives or on the job.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> In a world where there are literal conferences on how to psychologically abuse people to spend money in your app I feel that I'd never trust any sort of app that aims "help my psychologicall health".

Combined that with the fact that this whole "reveal article" has no actual substance and trying to sell me the idea and emotion rather than a feature makes feel that I'm being manipulated already and I hadn't even opened up the app yet!

I feel that the "app" medium has lost any credibility for providing solutions of this sort.

<comment><USER4> It never actually had any credibility for these sorts of deep and complex social problems.

That was just a lie we told ourselves and investors during the heyday where we naively believed we were going to solve all of the world's problems through apps.

It was never real. No one ever actually believed an app could fix loneliness or depression outside of bored investors with too much money and time on their hands and starving startup developers desperate to break even.

And yes, dear HN reader, that likely means YOU.

HN readers love to rightfully talk shit about Gwyneth Paltrow and GOOP, but apparently can't see that many of them are pushing the exact same kind of bullshit for a different audience.

<comment><USER20> Meetup has actually been pretty effective for me. Granted it's more of a website than an app, not sure the distinction is important though.

</comment></comment></comment><comment><USER21> > "I don't feel good about that. That sucks," Chrys Bader-Wechseler reflects > when asked about the bullying that went down on the anonymous app Secret he > co-founded in 2013. After $35 million raised, 15 million users and a > spectacular flame out two years later, the startup was dead. "Since I left > Secret I feel alive and aligned with my values and my purpose again."

I wonder what his values and purpose are.

<comment><USER22> > "Since I left Secret I feel alive and aligned with my values and my purpose > again." > I wonder what his values and purpose are.

Few people know the founder and whether he's actually a good person or a fraud, but we do know that: he was the recipient of huge VC largess, created an app with shaky moral foundation that caused actual harm, and then shut it down after lots of bad publicity.

Not reasons to totally discount a person, but good reasons to be skeptical.

</comment></comment><comment><USER23> Wow had a flashback to the web 2.0 bubble. They must be really convincing at sales to get funding for something they can't even explain, again.

</comment><comment><USER24> In my opinion, with regards to friendship, there is simply no substitute for an in person conversation. I happily drive 6 hours to see my best friends for a weekend; that's at least $70 in gas as well. FaceTime just isn't the same and I have a hard time imagining the people in my circle (the same type of people I would like to meet) spending their time trying to meet people on an app.

<comment><USER25> I also value in-person conversation. But my experience has increasingly been that my circle of friends is up for having dinner or whatever, but during the meal everyone is looking down at their phones and they only have half of their attention on the conversation. When your friends aren't entirely present mentally, then even in-person meetups can make you feel lonely.

<comment><USER26> Try to get your circle of friends more engaged and present if you can.

</comment></comment></comment><comment><USER27> Hannah Arendt claims that loneliness was necessary for the rise of totalitarianism in the 20th century.

She writes:

> Loneliness, the common ground for terror, the essence of totalitarian > government, and for ideology or logicality, the preparation of its > executioners and victims, is closely connected with uprootedness and > superfluousness which have been the curse of modern masses since the > beginning of the industrial revolution and have become acute with the rise > of imperialism at the end of the last century and the break-down of > political institutions and social traditions in our own time. To be uprooted > means to have no place in the world, recognized and guaranteed by others; to > be superfluous means not to belong to the world at all. Uprootedness can be > the preliminary condition for superfluousness, just as isolation can (but > must not) be the preliminary condition for loneliness. Taken in itself, > without consideration of its recent historical causes and its new role in > politics, loneliness is at the same time contrary to the basic requirements > of the human condition and one of the fundamental experiences of every human > life. Even the experience of the materially and sensually given world > depends upon my being in contact with other men, upon our common sense which > regulates and controls all other senses and without which each of us would > enclosed in his own particularity of sense data which in themselves are > unreliable and treacherous. Only because we have common sense, that is only > because not one man, but men in the plural inhabit the earth can we trust > our immediate sensual experience. Yet, we have only to remind ourselves that > one day we shall have to leave this common world which will go on as before > and for whose continuity we are superfluous in order to realize loneliness, > the experience of being abandoned by everything and everybody.

Dealing with "uprootedness and superfluousness" is one of the most perplexing questions facing modernity. I doubt an app can address this but...good luck.

</comment><comment><USER28> I read through around 75% of the TechCrunch article and I am yet to figure out what exactly this app is supposed to be. Seemed like a lot of feel good jargon but it couldn't tell me how exactly it will make my life better or improve upon other social media (if that's what this app is??)

</comment><comment><USER29> The phone's off button is the ultimate anti-loneliness app.

</comment><comment><USER30> Sorry, I missed the parent thread.

This all started with a very simple question: Do we fundamentally believe that technology can help us create more meaningful relationships and increase our social wellness?

If we believe the answer is yes, then we absolutely must do everything in our power and ability to try to find the answer. That's why we decided to build Ikaria.

We are not ignorant to the value of real, in-person communication and interaction, and we're not trying to replace it. We've done deep research on the psychology of relationships and loneliness, and the mental health impact of it. The problem exists with or without social media, although numerous studies have shown the problem can be exacerbated by social media.

Since we cannot avoid technology, we must reclaim it and give people spaces where they can form healthy habits and healthy relationships with their phones and each other. Very much like the fitness industry was born from a junk food epidemic, it's time for a shake-up in junk social nutrition.

Our goal is to bring healthy relational practices to the forefront. Very much like Calm and Headspace have done for mindfulness and mental health, we would like to do for social health. From what we've seen, the behaviors we learn in a digital space are transferable into the physical world.

We are working directly with experts and mental health professionals to help inform our product decisions and include them from the very beginning. This is bigger than any one person or idea, and we believe it's going to take a village.

So far, in our closed beta, people are reporting feeling closer to everyone in their groups, increased levels of happiness, and a positive relationship with the app. (i.e. "This is the only app where I allow notifications other than text")

For me, personally, it's brought me much closer to my parents and I keep in touch with them more than I ever have. I'd love for more people to have that experience.

We welcome criticism and support equally, thank you to everyone who has shown interest and has shared their views.

</comment><comment><USER31> Suspicious app.

This might be another clever way to harvest private user information. Are you lonely? Hey, how about some therapy? Here's a list of some good therapists. (Your name was auctioned off to the highest bidders.)

Or how about some Zoloft? It cures everything. Buy now, for a 25% discount. (Your name and demographic was auctioned off to the highest bidder.)

If I was a lunatic, then, I don't think I want to be in some random company's insecure database, just waiting to be hacked.

</comment><comment><USER32> Why do these sites obnoxiously hijack the browser back button ?!

</comment><comment><USER33> "Ikaria...named after the Greek island where a close-knit community helps extend people's lifespans."

"Bader met Dadashi through an _offline_ men's group for discussing life, love and everything in the wake of Secret's collapse and a rough romantic breakup. After just a few weeks of these meetups, they say they felt closer to each other than to most of their friends."

"Basically, since 2004, technology has created this monumental shift in the human social experience. We're more connected than ever technically but all the studies show we're lonelier than ever," Bader explains. "It's like eating McDonald's to get healthy."

And the conclusion is to take VC money to make a slightly different McDonald's. I just can't even.

</comment><comment><USER34> It should be an app in the form of a huge EPFCG EMP. ;) Only when:

0\. people's survival depends on them interacting

1\. the established ruling-class is dethroned from atomizing and monetizing people into individual, lonely, learned-helpless products who are taught to spend 10% of their pay on a laptop every 3 years, forgo single-payer healthcare and spend 10x more for medications

2\. people can afford housing, start a family and put down roots instead of going in insane debt, gig economy pseudo-jobs, changing jobs/moving like a pinball or living at work to burn-out

3\. return to solidarity, cohesion, the Golden Rule and basic decency as the prevalent modality

... will they do so.

</comment><comment><USER35> I'd argue that modern day issue of loneliness is an urban design problem way more than it is a technology problem.

The suburbs are isolating, and building strip malls instead of walkable downtowns (for both suburbs and denser areas) just adds to that. We pushed for the quiet and privacy of suburbs but took it so far that we eliminated the human interaction.

We need to start prioritizing spaces and urban design that encourage social interaction. Build walkable downtowns around commuter rail stations. More parks, coffeeshops, community spaces to suit different hobbies, etc.

</comment><comment><USER36> Hype laden, manipulative article with no substance.

Is the product going to be similar?

</comment><comment><USER37> "Since I left Secret I feel alive and aligned with my values and my purpose again." - Bader, co founder

What Bader learned from watching Secret's users "do this in the dark" was the realization that "actually, we need to learn to do this in the light, to have that same kind of dialogue, but do it openly with each other."

Hell of anti workplace toxicity spot if you ask me.

We need to regain this piece of our humanity back.

Im doing l my share, are you ? HN does lean towards the light from what i can see.

<comment><USER38> > Im doing l my share, are you ? HN does lean towards the light from what i > can see.

I think, in general, HN leans a little towards the light but that is true of humanity in general.

But, there is a boat load of toxicity in this very discussion.

<comment><USER37> Point it out! Im actually eager to be told my shortcomings. Unconscious things are hard to aolve

</comment></comment></comment><comment><USER39> Solve loneliness by giving people another reason to stare at their phone. Sigh.

I sometimes feel like the tech industry is an episode of black mirror.

</comment><comment><USER40> An anti-loneliness app? What's wrong with M-x doctor?

</comment><comment><USER41> Solution to loniliness on the internet is be decent looking, hot or the vision of what ppl want (aka the beauty standards we're programmed to desire). Those who fit that mold probably aren't the target audience for this app.

Overall the Internet and the dating/hook up apps I believe are one of the problems to the loneliness epedemic Ive read about (all or many of us are too judgy online). People being immediately judged and swiped right on (throw to the bin) without ever getting to know someone. Someone who might make you pee your pants with laughter!

<comment><USER26> I have made close friendships from people on IRC without ever knowing who they look like.

Sure, that's what tinder is, but you don't have to use tinder.

<comment><USER42> Me, too. But I wouldn't be able to imagine IRC chat as a VC-fueled iPhone app without ruining it's charms.

</comment></comment></comment><comment><USER43> Is the guy on the right not the sycophant of Gavin Belson?

</comment><comment><USER44> The root cause of this is pretty much entirely greed.

Greed in the form of housing policies where that is used as a tool for investment, rather than an investment in the community.

Greed in the form of a missing integration in to society and support for all who are in it to at least a basic level of guarantee. (Popular example, Star Trek utopia)

Greed in the form of profits being squeezed upward rather than shared as prosperity for all.

-

If everyone had their own, quality (private, outside noises/smells/etc excluded by good design and build quality), living spaces nearer to each other that would be far better for the design of our cities and the environment.

If everyone had a useful, non-broken-window, job and place where they added value to society, that would be better for everyone.

If everyone needed to expend less and less of their day working as things got more efficient, we would have the time to actually exist as humans / intelligent emotional beings among Family, Friends, and those we don't yet know.

-

I really believe that if people were treated like people, and had the time to be better people, much of our social ills would sort out sooner rather than later.

<comment><USER45> I'm guessing you've never actually been lonely. I am not lonely because of greed.

I am lonely because my friends have all married and moved away to start families.

I am lonely because I have always been socially awkward and being in my mid 30s with less time and energy than ever the prospect of trying to make new friends is a terrifying maze. I go to meetups and other social events and put myself out ther but connecting with people I don't already know on anything more than a superficial level has proven impossible.

I am not lonely because of greed.

<comment><USER16> >I am lonely because my friends have all married and moved away to start families.

Why don't you have a family and kids?

<comment><USER45> My wife and I have been trying to conceive for 4 years but it has been a complicated and emotional roller coaster.</comment></comment></comment></comment>


Hacking Neural Networks: A Short Introduction - <AUTHOR> https://github.com/Kayzaks/HackingNeuralNetworks <comment><USER2> If you like this kind of thing, I wrote a little document summarizing the security and privacy weaknesses of neural networks during grad school a couple years ago: [https://matt.life/papers/security_privacy_neural_networks.pd...](https://matt.life/papers/security_privacy_neural_networks.pdf)

I _think_ most of the content in there is still relevant/valid, but the field moves so fast (with dozens of papers written every day on average, it's actually one of the main reasons I switched my emphasis from ML to Internet security)...

<comment><USER3> Nice read, thanks.

Yeah, I've always had a weird feeling about whether I should have pivoted to deep fakes, cryptonets, or ML for security applications since I was a few months into PhD.

Think I've found me a good non-image niche though (thank Christ for no free lunch theorem.)

</comment></comment><comment><USER4> I think this sort of thing is handy for reinforcing to people that neural nets are still just code, and should be treated as such. That means testing and reliability standards built into deployment. The last exercise in particular rams it home really well - you don't need to do adversarial attacks by means of inferring gradients and all that jazz, when you can just spot a buffer overflow. This is a great repo, which I'm (ML Lead) going to make my co- workers read.

</comment><comment><USER5> It has come. Guess the trick is do you understand your own neural network so that you can hack it and defend it as well.

</comment><comment><USER6> NeuralOverflow... sweet hacker name.</comment>


This might be last post you read - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2010/10/next.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+typepad%2Fsethsmainblog+%28Seth%27s+Blog%29 <comment><USER2> Let me guess, stop reading blogs and go sell something?</comment>


The Atir-Rosenzweig-Dunning Effect: When Experts Claim to Know the Unknowable - <AUTHOR> http://bigthink.com/neurobonkers/the-atir-rosenzweig-dunning-effect-when-experts-claim-to-know-the-unknowable <comment><AUTHOR> Here is a direct link to the new paper:

"When Knowledge Knows No Bounds: Self-Perceived Expertise Predicts Claims of Impossible Knowledge" [http://emilkirkegaard.dk/en/wp-content/uploads/When- knowledg...](http://emilkirkegaard.dk/en/wp-content/uploads/When-knowledge- knows-no-bounds.pdf)</comment>


SFPD statement on aiding Apple - <AUTHOR> http://news.cnet.com/8301-13579_3-20101412-37/full-text-sfpd-statement-on-aiding-apple/

<comment><USER2> It seems like a pretty empty statement. Apple tracked the item to that location - but it wasn't there. No mention of whether the officers misrepresented that the other two men were not police officers, no mention of what evidence was brought forth to search this guys home, definitely not a warrant. I don't feel like we've been given a clear picture as to what really happened and it's a cover your ass statement.

<comment><USER3> It's their intent to not give a clear picture. The only way they'll do so is in a court of law.

The whole saga is pretty sickening from all ends. The cops should've never let Apple employees search his home and the cops should've identified these people searching his home as not being cops. This guy has at least some relation to the theft because they tracked it back to his house. If he didn't take it then he most likely knows who did.

<comment><USER4> it seems to me that someone who knew what they were stealing would have an incentive to have the trail point to anyone other than themselves.

<comment><USER3> You're taking it from the point of view as someone who posts on Hacker News that knows a lot about tech. At some point, not too soon after the theft took place, that prototype was in that house. Since Apple hasn't been able to track it since, the logical conclusion is that whoever stole it became aware that it can be tracked and turned the phone off.

The story that you're creating only exists in movies. Only someone as devious as Keyser Söze would do that.

<comment><USER5> "At some point, not too soon after the theft took place, that prototype was in that house."

You have absolutely no proof of that. If you do please link to it. Statements from Apple goons aren't evidence. I could state that you are a terrorist pedophile so we should search your house for child porn and bombs. That doesn't make you one unless there is actual evidence shown to a judge in order to get a search warrant.

<comment><USER3> I have the same news which you are basing your own assumptions on. Apple didn't search his house for no apparent reason. Do you really believe that the GPS and cellular triangulation they were using were wrong? This is the same as Homeland Security are using to capture terrorists.

I'm not arguing this on a legal basis. I will leave this up to the courts. I grew up on the streets and, while I may not have stolen something in my youth, I can tell you I would've been the guy to tell him to shut the phone off.

There is this belief among many of the absolute of good and evil. Most times this is not the case. It's always complicated and not always clear.

If you disagree, please explain the reason why anyone was there in the first place.

<comment><USER4> they had evidence pointing to a location. this does not mean the resident of the nearest house is culpable. perhaps the thief was walking by at the time. theres a lot of leeway I feel you may be overlooking.</comment></comment></comment></comment></comment></comment></comment>