Privacy or Data, a Convenient False Dichotomy - <AUTHOR> https://www.0x65.dev/blog/2019-12-02/is-data-collection-evil.html <comment><USER2> > Let us start with the need for data, going straight to the point: one cannot > build a competitive search without data collected from people.

Google had a very good search engine before they started to collect data from everyone, not after.

I don't have a metric to decide whether the search results from google got better or worse over the years. Subjectively and for me personally, they've gotten worse. And I'm not the only one who thinks this. I could be (and probably am) wrong, but I think the more personal data a search engine has, the worse the results.

When I think about it in that way, it makes senses why it has gotten worse. The search engine pays more attention to the data it think it has collected from me and how it relates to advertisers, etc... instead of paying attention to the actual words I wrote in the query.

<comment><USER3> Google search results have definitely gotten worse over time. I can think of a few reasons.

* Search is now optimising to direct users to where Google wants users to go rather than where users want to go (i.e. to sell shit)

* Search is now heavily censored to be 'mainstream'

* Google disproportionately biases search towards ideologies and political leanings that Google prefers (remember that time they arbitrarily decided to remove all results for guns and inadvertently also made it impossible to search for water guns?)

Switching up to foreign search engines like baidu and yandex really opened my eyes to how heavily Google manipulates what I get to see.

Google search in the 2000s was significantly more useful than it is today, but most of it has nothing to do with collecting personal data and more to do with Google transitioning from a search company to a pseudo internet hegemony.

A better example of personal data collection leading to worse results is Youtube. Youtube puts people into weird tiny bubbles of content that the algorithm thinks will get viewing time from that particular individual, and prevents that individual from easily discovering vast swaths of other content they may find interesting. Anyone else have a Youtube home page full of videos from 3-10 years ago that they've already seen?

Google is starting to feel like the paperclip optimiser. I'm sure the way its products work is currently optimal for whatever metrics they set, but it's certainly not optimal for me as a user. Google makes me feel exploited.

<comment><USER4> Or Google simply could not keep up with the pace of web growth. The web is already 100x bigger than it used to be 10 years ago and the external environment is actively gaming with Google (SEO, Spam, etc...) while the information available from a user query is still effectively same. Personalization may add more implicit information to a query (e.g. If you're tech-savy, then a keyword "Rust" more likely means PL than game), but most of the time it lacks the actual context so its usefulness is somehow bounded. Most of the useful information still comes from a query itself. Hopefully, advancement in the field of NLP may allow a longer query to be more effective but I don't see any straightforward way to keep the search quality with a 1~3 words query.

</comment></comment></comment><comment><USER5> The question is why do companies even have to see our data? In the old days of the internet universities and government institutions dealt with data, the companies were only there to provide the hardware.

<comment><AUTHOR> I understand why universities would get the benefit of the doubt, but I am not sure having search engines be a government service would be a very good idea.

<comment><USER5> Yeah, many problems to solve here.

But let's take another example: Google going into the space of deep learning based health diagnostics. Why does Google need to have access to our medical data when they can sell their solutions as hardware and software to hospitals? Even if they have to use our data for testing purposes, they could sign an NDA so the use of our data would be severly restricted and they would not _own_ our data.

And for many other services, _owning_ our data should not be the default, and even the necessity of _seeing_ our data should be questioned.

<comment><AUTHOR> I agree. That data should stay with their rightful owners - the data subject.

I believe that we have fundamental issues with personal data ownership in the web for two reasons:

1\. People do not believe web is real life. In the physical world, it is very easy to see how your rights are violated. If there's a person following you for days (when you shop, when you buy your medicine, when you talk to friends), you call the police. The majority of users have no idea of third party trackers. They have no idea what (or rather how much) information they are emitting at each point in time.

2\. People have access to amazing products for "free", and they do not know the price of their data. Imagine if you were given a TV, but you would have to babysit a boring kid 2 hours a day for years. I guess not many would want that TV. Force each company to offer two plans (legally): one free + (ads / tracking), one premium (no ads / no tracking), then see how much people care about their data.

<comment><USER6> > Force each company to offer two plans (legally): one free + (ads / > tracking), one premium (no ads / no tracking), then see how much people care > about their data.

I like this idea but only if you force companies to price the non-free version no higher than the actual monetary value of the data they collect. Otherwise you'll have Gmail's "We'll stop reading your private emails" plan priced at 100,000 a month. I don't want to create a situation where only the ultra wealthy can protect their right to privacy.

</comment></comment></comment></comment></comment><comment><USER4> While the approach mentioned in this article seems interesting, there's multiple other approaches to mitigate privacy issues in data collection, cryptographic approaches like homomorphic encryption or decentralized approaches like federated learning. Still wonder what is the differentiation of this approach from the others.

<comment><USER7> [Disclaimer: I work at Cliqz]

Yes, we are not the only approach. Even when we started collecting data back in 2014 it wasn't the only one. But we did not find any suitable off-the-shelf solution back then.

Homomorphic encryption was discarded because some data to be send needs to be on the clear. For instance a url we need to fetch, so cannot transform it. Also, computationally is very expensive.

Federated learning is actually closer to what we do, take our approach as federated learning where each node is a single user and where all aggregation of records need to happen there, so that record-linkage on the final collector is impossible.

Tomorrow and the day after tomorrow we are releasing the technical details on different blog-posts, this one was more a motivation/introduction to the main dish.

<comment><USER8> How about differential privacy?

<comment><USER9> (Disclaimer: I work at Cliqz)

Just saw this one. It is an old comment, but let me try to answer as I find the question interesting.

The post on Human Web ([https://0x65.dev/blog/2019-12-03/human-web-collecting- data-i...](https://0x65.dev/blog/2019-12-03/human-web-collecting-data-in-a- socially-responsible-manner.html)) has a brief section regarding differential privacy. Maybe check that one out first.

My take on it: although we do see value in differential privacy, we do not believe it fits well in our particular case. The critical moment is to decide what data should be sent by the client. Once data it is out, it is out. It is not possible to apply anonymization once it is on the server. If someone knows how it can be done safely, I would be highly interested.

We consider our chosen approach - breaking record linkage before sending - safer for our use-case and simpler. Do not underestimate the simplicity argument. Differential privacy is a powerful technique, but it is also very complex; there are lots of pitfalls and it is crucial to make good choices for the parameters.

Would be a good topic for another blog post. ;-)

</comment></comment></comment></comment><comment><USER10> seems to be like day 2 of the advent.

from day 1: The world needs more search engines [1].

[1] [https://www.0x65.dev/blog/2019-12-01/the-world-needs- cliqz-t...](https://www.0x65.dev/blog/2019-12-01/the-world-needs-cliqz-the- world-needs-more-search-engines.html)

<comment><USER11> Indeed, the idea is to use each day until Christmas to unveil a new post about search, privacy and security. Today is about opening a discussion about data collection practices. It's often presented as a "all or nothing" (more often than not it's "nothing"). But data is needed to create independent and viable alternatives to the giants so maybe there is a middle ground if it's done with privacy at heart from the ground up.

Edit: For those curious about the details, we've started a new page where we gather research, talks and blog posts from the past about these topics: [https://0x65.dev/pages/dissemination- cliqz.html](https://0x65.dev/pages/dissemination-cliqz.html)

</comment></comment><comment><USER12> There should be a way to store data so that aggregate queries like "count how many different people are in a given location" can be answered without compromising individual privacy. Approaches like k-anonymity or L-diversity come to mind

The problem is that there is no incentive for businesses to do so. Even regulations like GDPR & CCPA mostly don't touch upon the privacy of first- party data. As long as you give an option to delete the data (which often is hard to implement), you don't have to do anything more.

<comment><USER13> Hi soumyadeb,

It is true that there needs to be a way to store the aggregate queries "per user". In the current approach of collection this place happens to be on Server, but aggregation per user can easily be done on client-side by leveraging Browser storage.

Approaches like k-anonymity or L-diversity are good but they tackle the problem from a different perspective - making sensitive data available for querying without revealing actual content. The approach suggested in this article talks about methodology which removes the need to collect such data in the first place.

You can also check our paper: [https://www.0x65.dev/pages/dissemination- cliqz.html#GreenAna...](https://www.0x65.dev/pages/dissemination- cliqz.html#GreenAnalytics)

We will talk in detail about this methodology- Human Web and how we use to collect data for our search, without compromising users privacy and based on client-side aggregation.

Disclaimer: I work with Cliqz.

<comment><USER12> Thanks for the reference. I quickly browsed through the paper. The problem you mention seems to arise from the fact that GA is able to tie the user across different domains (about.me, depressionforum.org etc) using a shared cookie etc. Is it still an issue if 3rd party cookies are blocked and the GA is forced to set a first-party cookie. In that case, the ID GA will get for about.me would be different from depressionforum.org? Assuming the owners for these websites are different and only care about their respective stats (depressionforum doesn't care about about.me analytics), why do we need 3rd party cookies?

Am I missing something here?

Well, it can probably fingerprint the browser but there is no reason to store that information.

<comment><USER12> OK got it. You guys @ Cliqz want aggregate stats across websites so GA is not the right example.

Depending on the aggregates you want, client-side aggregation may still be leaking privacy. You would probably need to implement differential privacy on top before you store the data.

<comment><USER7> Of course client-side aggregation can still leak privacy, it needs to guarantee that there are no explicit or implicit elements that would allow record-linkage on the server-side. On the diff. privacy, note that you mention before you store the data, the problem is not only there, we want to prevent the data to be send at all. Diff privacy on the client-side is tricky if distributions are unknown. That's why we go for a "simpler" approach, all records send by any user should be unlikable, always. If aggregation is needed to satisfy the use-case, it can only be done on the client itself. Re- identifiability only becomes possible if a mistake is done, no a priori distributions are needed. IMHO this approach is easier than diff. privacy at the cost of being less expressive. Diff. privacy data allow for multiple use- cases where we do not (as all records) have to be independent from one another.

I'm sure it's obvious that I work at Cliqz and on this very topic :-) Tomorrow there is a more technical article about our data collection, hope you like it.

Also, I would like to add that any methodology applied to protect the data of the user is welcome, does not have to be ours at all. There is one caveat though, the privacy protection has to be on origin, a solution that send data that then has to be anonymized is no good in our book; because there is no guarantee that the raw data is removed.

For our use-case we believe it was the easier way to get the data we needed while respecting the privacy of the user.</comment></comment></comment></comment></comment>


Personal File Backup Server - <AUTHOR> https://github.com/Max00355/MatchBox <comment><USER3> It's such a misleading title. It's nothing like Dropbox.

We're talking about 60 lines of python for the "server" and 90 lines of python for the "client".

That's a weekend hack, not a Dropbox clone.

It happened so many times in the past, that I'm patenting a method of getting on first page of HN:

1\. Write something

2\. Call it a dropbox clone

3\. Congratulations, apparently no-one bothers to check if that "something" does anything even remotely similar to dropbox:

\- does it have a GUI client with a highly polished interface?

\- does it have an installer?

\- does it have conflict resolution to reconcile changes made on different computers?

\- does it try to not corrupt files if download/upload fails in the middle?

\- is it self-contained or do you first have to install, say, python interpeter?

<comment><USER4> It's not even rsync yet alone dropbox!

</comment></comment><comment><USER5> It looks like this doesn't work with folders... or have some kind of hash to detect alteration. While I appreciate you sharing the project, this is probably premature at this point.

Here are somethings that I would consider adding:

        * a README  (update: done! :) )
        * consider making this work with virtualenv by default. This way you can install
          Flask as a library without making me install it for the system. Adding a short
          bash wrapper script really helps here.
        * support for folders
        * sha1 hashes to ensure your files are consistent
        * de-duplication of chunks would be a good thing to add too
        * The way you are sending data now looks like you are using GETs for everything.
          If you are really going to make this work, you should use GETs for downloading and PUTs or POSTs for uploading.

<comment><AUTHOR> Yes, this is still very premature, and more of a learning project for me.

I know about no support for folders, I didn't have time to fix that yet, but I will!

Virtual enviornment is interesting, I will look into that.

* It does check for alterations actually then uploads the altered file, look at the main loop in the client.

The way I am sending files now is awful! I plan on fixing all thos, thank you for the response. :)

<comment><USER5> Good luck to you. I hope that you come up with a worthwhile project that you can learn a ton with.

But, you it probably shouldn't have been submitted to the wolves in this state :).

<comment><AUTHOR> Haha, thank you sir! And don't worry, I take pleasure in feeding the wolves. :p

</comment></comment></comment></comment><comment> thomas-st os.system("touch files/"+file)

Oops. What if my file is called " && rm -rf ~"?

</comment><comment><USER6> I know it is a fresh project but a README would be really cool to have.

<comment><AUTHOR> I know, I'll be honest I just uploaded it to Github and thought it would be a good idea to share! I will add a README.

<comment><USER7> Put a LICENSE on there too.

</comment></comment></comment><comment> aj-code This has some fairly serious security issues, which is fine for a something not designed to be seriously used (or at all). However, the readme implies you could use this and your files will be safer than with some third party. Which is dangerous, to say the least.

I'll outline a few obvious issues I see:

\- No explicit protection against directory traversal attacks (../../etc/passwd type stuff) on upload and download.

\- Shell command injection on the file name on upload.

\- Naive authentication. \- Unsalted, fast hash sent in the URL. \- Password stored in clear text server side.

\- No transport security (HTTPS).

This is cool as a interesting project to work on, but it should be made clear not to use this for anything just yet.

<comment><USER8> >\- Naive authentication. - Unsalted, fast hash sent in the URL. - <USER2> stored in clear text server side.

I don't understand the point of hashing the password in the client anyway... The hash is as good as the password to an attacker.

<comment> aj-code Sure is!

It would be possible to use a challenge response authentication scheme ([http://en.wikipedia.org/wiki/Challenge%E2%80%93response_auth...](http://en.wikipedia.org/wiki/Challenge%E2%80%93response_authentication)) but just doing things over HTTPS is generally fine.

</comment></comment></comment><comment><USER9> The author needs to rid himself of using any os.system post haste. Just say no.

<comment><AUTHOR> I know, I was in a rush! I didn't have much time and I needed to put this idea into action, I realize it isn't the correct way of doing it :P

</comment></comment><comment><USER10> Your server request handlers could use decorators for checking if the user is logged in.

Here is an example decorator: [https://github.com/kamalgill/flask-appengine- template/blob/m...](https://github.com/kamalgill/flask-appengine- template/blob/master/src/application/decorators.py)

In use: [https://github.com/kamalgill/flask-appengine- template/blob/m...](https://github.com/kamalgill/flask-appengine- template/blob/master/src/application/views.py)

</comment><comment><USER11>
        urlopen(self.url+"/list/"+self.username+"/"+self.password)

>.<

What?

Basically you need to run this over SSH or SSL to obtain any kind of security. Dropbox has security out of the box.

Dropbox also has: A GUI, a website UI, conflict resolution, support for folders, local sync. The list goes on.

As others say, this is very, very, very immature and incomplete.

I'd rather use Dropbox. Or `rsync`.

</comment><comment><USER12> I'm surprised no one commented about ownCloud yet -- like a locally (or privately hosted) dropbox clone with extra features to boot.

</comment><comment><USER13> for efficient diffs, I suggest the author (and anyone else who cares to explore having an efficient diff based backup of lots of data) look into rolling hashes. great way to split data into chunks that are robust against insertions in the middle of a file! (uniformly splitting a file every X bytes means you resync the entire file after an insertion!)

</comment><comment><USER14> Should have the client use fnotify or similar.

<comment><USER15> I was thinking an appropriate solution would be watchdog:

<https://pypi.python.org/pypi/watchdog>

</comment></comment><comment><USER16> Maybe an option to use HTTPS?

<comment><AUTHOR> Yes, that would be nice.</comment></comment>


Poland's surprisingly beautiful cheese - <AUTHOR> http://www.bbc.com/travel/story/20180327-polands-surprisingly-beautiful-cheese <comment><USER2> Why surprisingly? Is Ursula Carlton surprisingly pretty UK lady then?

<comment> racer-v People commonly think of cheese as tasting good but not particularly beautiful to look at.</comment></comment>


Cave discoveries suggest humans reached Americas much earlier than thought - <AUTHOR> https://www.nature.com/articles/d41586-020-02190-y <comment><USER2> From the linked Wikipedia article on Beringia [1]:

> Today, the average water depth of the Bering Strait is 40–50 m (130–160 ft), > therefore the land bridge opened when the sea level dropped more than 50 m > (160 ft) below the current level. A reconstruction of the sea-level history > of the region indicated that a seaway existed from c. 135,000 – c. 70,000 > BP, a land bridge from c. 70,000 – c. 60,000 BP, intermittent connection > from c. 60,000 – c. 30,000 BP, a land bridge from c. 30,000 – c. 11,000 BP, > followed by a Holocene sea-level rise that reopened the strait.

30-25 kya fits the data OK and there may have been open north-south corridors at that time. The question is how solid the Mexican evidence is.

[1] [https://en.m.wikipedia.org/wiki/Beringia#Geography](https://en.m.wikipedia.org/wiki/Beringia#Geography)

<comment><USER3> It seems like there are other bits of evidence of pre-clovis human habitation, but taken individually they could be dismissed as due to some sort of misidentification, contamination of the site, etc. One the other hand this site seems to have very extensive evidence of long term habitation, backed up by several independent but mutually consistent dating methods. Add back in all those 'one off' finds as well and the clovis first theory starts to really break down.

<comment><USER4> I've been fascinated by this one since visiting the Natural History Museum in San Diego:

"A 130,000-year-old archaeological site in southern California, USA"

[https://www.nature.com/articles/nature22065](https://www.nature.com/articles/nature22065)

<comment><USER2> Interesting. MIS5e [1] would be a parallel to our current interglacial period. I think the evidence for 50-60 kya out-of-africa event for Homo sapiens is solid so I'm assuming this site would support the global reach of another Homo species like Neanderthals.

[1] [https://en.wikipedia.org/wiki/Marine_Isotope_Stage_5](https://en.wikipedia.org/wiki/Marine_Isotope_Stage_5)

<comment><USER5> I've never understood that number. I've read that modern humans have been around for 200k years, but I'm supposed to believe that for 3/4 of that time they stayed in Africa? BS. Maybe proof hasn't been found, yet. But we know from our own experience that modern humans love to explore. I don't believe that love of travel and adventure and exploration is cultural. Our modern ancestors would've been exploring out of Africa long before 50kya.

<comment><USER6> There's an important distinction between anatomically modern humans and behaviorally modern humans. Behaviorally modern humans were the ones that were able to migrate all over the world.

[https://en.wikipedia.org/wiki/Behavioral_modernity](https://en.wikipedia.org/wiki/Behavioral_modernity)

</comment></comment></comment></comment></comment></comment><comment><USER7> Look at Göbekli Tepe as well. The general trend seems to be pushing human history back, which makes sense as the human species has existed in its near modern form for quite a bit longer than the history we know. There is no reason to believe these ancient humans lacked critical cognitive faculties that we have.

From what I've read of the debate on humans in North and South America, it seems that both sides are ignoring the possibility of multiple colonizations and that earlier colonizations may have either failed entirely or resulted in only very small populations in limited areas.

If genetic evidence suggests that Native Americans are descendants of a stock that migrated here around 10K years ago, maybe they were just a later migration that really "took" and expanded across the whole land mass (until Europeans).

Or maybe the newcomers or their diseases exterminated the existing indigenous peoples? Maybe the story of the last colonization of these lands has occurred multiple times? If so, we're really screwed when the extraterrestrials arrive.

</comment><comment><USER8> Question: how do experts tell something like this might be a tool? As a layman it looks like a rock to me:

[https://media.nature.com/lw800/magazine- assets/d41586-020-02...](https://media.nature.com/lw800/magazine- assets/d41586-020-02190-y/d41586-020-02190-y_18201476.jpg)

<comment><USER9> I think they look for "Conchoidal fractures", and then where they find the thing.

[https://www.sandatlas.org/conchoidal- fracture/](https://www.sandatlas.org/conchoidal-fracture/)

<comment><USER10> Not always, but it's one of the common indicators. The general process for survey identification goes like this: you walk around looking at the ground and notice the _unnatural_ ones. This is a purely intuitive sense, so you pick one up and look closer to see that yep straight edges, conchoidal fractures, common material, found in a bed with other clear lithics, etc. Bag and tag.

</comment></comment></comment><comment><USER11> An interesting question related to this is the exact time period of the "last glacial maximum", at which point in time northern latitude glaciers were at their maximum extent, and sea levels were considerably lower. Related to the Bering strait land bridge.

[https://en.wikipedia.org/wiki/Last_Glacial_Period](https://en.wikipedia.org/wiki/Last_Glacial_Period)

[https://en.wikipedia.org/wiki/Last_Glacial_Maximum](https://en.wikipedia.org/wiki/Last_Glacial_Maximum)

If the claim of 30,000 years is true (vs 11,000 years) this would mean people crossed the Bering strait at a time when the terrain was different, or possibly even when it was submerged.

[https://en.wikipedia.org/wiki/Beringia](https://en.wikipedia.org/wiki/Beringia)

<comment><USER12> Hoping along the Commander Islands, Near Islands then Aleutian Islands chain from Kamchatka was likely possible with primitive tech. And those places must have been hunting paradises to neolithic people so reasons to settle them.

<comment><USER13> Humans made it to Australia without any Land Bridge. Island hopping is completely plausible: once you have crossed one waterway, the next is easier.

We know that populations of humans subsisted on coastal shellfish 50kya. There is no reason to assume they stayed at one place on a coast that had shellfish everywhere along it.

Of course all those shell middens are now 30-50m below sea level.

If there is an Atlantis, that is, too, for identically the same reason, although the timing would differ. It would be hard to credit an Atlantis originating before, say, 12,000 years ago--sometime in the Younger Dryas cold spell--although up to 20,000 years ago is conceivable.

<comment><USER14> > _Humans made it to Australia without any Land Bridge._

For that matter they also made it to Hawaii without any land bridges. Polynesian navigators and sailors proved that neither land bridges nor high technology are needed for these sort of daring ocean crossings. Who is to say that other early seafaring cultures couldn't have accomplished similar feats?

<comment><USER12> The Pacific settlement happened much later (during European middle age for Hawaii), benefiting from 40000 year of technological improvement...

<comment><USER14> What specific technology are you referring to? I'm unaware of any Polynesians technology that couldn't plausibly been independently used tens of thousands of years earlier. The accomplishments of the Polynesians seafarers was primarily a matter of skill and oral tradition (something like 4,000 years of seafaring experience, not 40,0000.)

Their most important technology was sea-worthy outrigger canoes. Numerous independent canoe cultures exist around the world dating back thousands of years ago. While canoes 40,000 years old haven't been found, I see no real reason to discount the possibility. For navigation they may have used stick charts, although that's not known for sure and the Polynesians may have relied on oral tradition instead. Either way, these technologies or their functional equivalents were plausibly available to cultures predating the Polynesians by thousands of years. There is no evidence that the Polynesians were using astrolabs, sextants, or any other instrument like that, so the relative level of technology used by contemporary European/Islamic/Classical navigators doesn't seem relevant. They used Mark 1 Eyeballs to collect information and processed that information into navigational guidance using their brains, packed with experience.

Edit: I've been thinking about the matter of canoes some more. It seems to me that sea-fairing canoes would not preserve well; the earliest known canoe is from around 10,000 years ago and was found in a peat bog in the Netherlands. Peat bogs are well known for preserving buried organic matter. Conversely the oldest polynesian canoes found are only hundreds of years old. We know they were using canoes thousands of years before that because of their oral tradition and clear evidence that they were traveling in the area _somehow_ during that time period, but archeological evidence for the boats is scarce. I don't think sea-fairing canoes are likely to be preserved for thousands of years, so I don't think the lack of archeological evidence for sea-fairing cultures thousands of years ago means much of anything.

[https://en.wikipedia.org/wiki/Pesse_canoe](https://en.wikipedia.org/wiki/Pesse_canoe)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4205625/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4205625/)

<comment><USER12> The main one is the outrigger canoe, but celestial navigation must have taken a while to master too. The earliest examples of astronomy come way later than 40000 year ago...

<comment><USER14> This sort of astronomy used eyeballs and oral tradition. What archeological traces would that leave?

<comment><USER13> It has left traces in stoneworks all over the world. But many of them may be old enough; usually we have no way to discover how old one is.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> The picture in the article is of an alleged limestone tool; it looks like the tool was shaped like a scraper or cutter of some sort, and is fairly small. But afaik, no one ever made scrapers or cutters out of limestone; that rock is far too soft. They were preferentially made of flint, but in regions where there wasn't flint, obsidian or quartz could substitute for smaller tools, and hard metamorphic or igneous rocks for larger tools (axes).

But surely an archeologist would not make such a mistake. So is my assumption about the uselessness of limestone for cutting tools wrong?

<comment><USER3> Googling for limestone stone tools came up with plenty of hits, like this one.

[https://indianexpress.com/article/technology/science/mysteri...](https://indianexpress.com/article/technology/science/mysterious- stone-tools-discovered-in-the-uk-4882247/)

This article shows a much more comprehensive collection of tools from Chiquihuite.

[http://www.sci-news.com/archaeology/stone-tools- chiquihuite-...](http://www.sci-news.com/archaeology/stone-tools-chiquihuite- cave-mexico-08667.html)

<comment><USER15> Thanks, but I'm still skeptical.

The first article, in an Indian news site (and reproduced in several similar sites) is about some stones that a group of amateur archeologists found. It doesn't appear to have been published in any professional journal, and the comments make it clear that these are unlike anything seen elsewhere, and their purpose is unknown. My guess: they're not tools, they're random rocks.

The other article, as you point out, shows a greater variety of the alleged tools from Chiquihuite. I'm no archaeologist, but to me they look like rocks that were carefully chosen out of a bunch of randomly shaped rocks. The picture of the cave entrance show that it is full of breakdown (caver for "rocks that fell off the ceiling of the cave"), and I wouldn't be surprised to discover things that look sort of like blades or points in such a pile of rocks.

So I'm afraid I'm still skeptical.</comment></comment></comment>


TCP incast: What is it? How can it affect Erlang applications? - <AUTHOR> http://www.snookles.com/slf-blog/2012/01/05/tcp-incast-what-is-it/

<comment><USER2> It turns out that I haven't been the only person surprised by the TCP incast pattern, including folks who don't use Erlang at all (e.g. Hadoop users). I was happy to write about it, to help spread the word. Even if I'd stumbled upon Kyle Brandt's posting [http://blog.serverfault.com/2011/06/27/per-second- measuremen...](http://blog.serverfault.com/2011/06/27/per-second-measurements- dont-cut-it/) ("Per Second Measurements Don't Cut It"), I don't think I'd've realized the full consequences of packets dropped by microbursts of traffic when there's "obviously plenty of bandwidth available".</comment>


The incentives are all wrong (causal inference edition) - <AUTHOR> https://statmodeling.stat.columbia.edu/2019/11/05/the-incentives-are-all-wrong-causal-inference-edition/ <comment><USER2> Not sure what that's about, but I just do not see the fitted line as reflecting the bubbles.

Why not draw a straight line sloping slightly upwards towards the north side?

Basically, there's a gap near 74 on the north side, and if you think that actually means something then what does it reflect in the real world? If it doesn't mean anything, then the claim of statistical significance seems fishy.

<comment><USER3> That's exactly Andrew Gelman's point. A different, more sensible analysis, could have (most likely would have) resulted in a nothing-to-see-here conclusion. That conclusion would not be a publishable result, and publishing is the main incentive in the field. Ergo "the incentives are all wrong".

Andrew Gelman by the way, is the father of the MCMC (Markov Chain Monte Carlo) engine STAN (together with Bob Carpenter [1]).

[1] [https://en.wikipedia.org/wiki/Stan_(software)](https://en.wikipedia.org/wiki/Stan_\(software\))

<comment><USER4> The point was much clearer to me after I had read the precursor article:

[https://statmodeling.stat.columbia.edu/2013/08/05/evidence-o...](https://statmodeling.stat.columbia.edu/2013/08/05/evidence- on-the-impact-of-sustained-use-of-polynomial-regression-on-causal-inference-a- claim-that-coal-heating-is-reducing-lifespan-by-5-years-for-half-a-billion- people/)

"What I am suggesting is a two-step: the authors retreat from their strongly model-based claim of statistical significance, and the journal accept that non-statistically-significant findings on important topics are still worth publishing."</comment></comment></comment>


Common Lisp: The Untold Story (2012) - <AUTHOR> http://www.nhplace.com/kent/Papers/cl-untold-story.html <comment><USER2> Interesting to hear an insiders perspective of the 'Lisp Wars'.

My outsider's perspective, at the time, was disappointment. I really liked InterLisp-D on my Xerox 1108 Lisp Machine. That said, Xerox provided a Common Lisp implementation that still had the UI wonderfulness and I think they still supported DWIM. I now have about 35 years of frequent Common Lisp use/experience, and my latest project/product is written in Common Lisp ([http://kgcreator.com](http://kgcreator.com)).

</comment><comment><USER3> "In 1992, Symbolics Inc. was doing poorly financially because it was continuing to sell hardware and its computers were not hitting the price point demanded by the market. A last-minute effort was underway to produce a software-only emulator of the architecture".

The emulator they built Open Genera was for the Alpha, and after Symbolics the defuncted ported to Linux 64bit: [https://static.loomcom.com/genera/genera- install.html](https://static.loomcom.com/genera/genera-install.html)

<comment><USER4> There's a Docker recipe for it too: [https://github.com/sethm/docker- vlm](https://github.com/sethm/docker-vlm)

<comment><USER3> That repo is 3 years old. Does it work with more recent versions of Docker? (I'm on windows right now, so can't check, as it requires NFS on the host).

</comment></comment></comment><comment><AUTHOR> > Change was happening to MACLISP very rapidly in the late 1970's and early > 1980's. It was common for MACLISP users to read their mail only to find that > some critical semantics in the language had changed and that it was time to > update programs they had already written to accommodate the new meaning.

> Jokes were made about the frequent and extreme nature of the changes.

</comment><comment><USER5> 2016: [https://news.ycombinator.com/item?id=11789288](https://news.ycombinator.com/item?id=11789288)

2012: [https://news.ycombinator.com/item?id=3918032](https://news.ycombinator.com/item?id=3918032)

</comment><comment><USER6> I'd be curious to see more on the advantages of using raw TeX instead of LaTeX. Feels like that should be backwards, but didn't surprise me, either.

<comment><USER7> I'm an '82 PhD mathematician who has used TeX and LaTeX since near their beginnings, to typeset math papers. There was a long period when TeX was essentially instantaneous, while LaTeX was plodding. Also, if one pried into various LaTeX packages, there was a general tone "User won't do this for themselves or even know we're doing this, so let's also clean up this related situation" that felt like coming home to find a team of house cleaners crawling up your chimney with toothbrushes. Directing mathematicians is like herding wolves; this didn't sit well with everyone.

Struggling to agree on TeX vs LaTeX for collaborative projects, I ended up writing a few pages "begin.tex" that at least managed automatic theorem numbering and reference handling, and a few other basics, so we could live without LaTeX. This too was essentially instantaneous, and spread from collaborator to collaborator for a few years until machines got faster.

Speed matters: Look at the Vim / Neovim split. Some found the Vim delays acceptable, while others had a vision of the future that required far more sophisticated evolutions to not impose user delays. Vim was forced to catch up.

</comment></comment><comment><USER8> I think it is strange.

LISP people hated Common LISP circa 1990 for various reasons. Most users were still stuck on 16-bit micros on which LISP was tough to fit, and Common LISP didn't make it any easier.

LISP people look back at Common LISP with nostalgia now since it was so much better than Blub languages like Java, Python, Haskell, Go, Rust, ...

<comment><USER9> I hated it at first because it had lexical scoping by default and I was used to dynamic extent. I don't want to be unkind to my former self (MFS), but MFS was pretty stupid.

<comment><USER10> That was it. I made my own Eval in Symbolics, just because I truely did not understand the scoping issue.

</comment></comment></comment><comment><USER11> Interesting that he didn't add the aftermath inside of his own mistakes in the standard. He was the best person to write it down and defend it later publicly. but he also added a chapter by himself, the nes (new error system), the new conditioning system, which was by far the worst part of the standard. Almost nobody uses it, way too overarchitectured. All the rest is very solid, people only complain that threads and ffi are missing from the standard.

<comment><USER12> I think that the condition system is one of the _better_ parts of Lisp, and miss it in every language where the libraries I use unwind the stack to provide me an error.

It's true that it's not used too much in small programs, because small programs don't need it. But in large systems, it's invaluable.

<comment><USER11> Conditions are invaluable, but not Ken's. It faces the same problems as my stderror AutoLISP library: overarchitectured. Slim and small, not so big and fragile. CLOS is small and easy compared to the conditions.

scheme did it right

<comment><USER13> > CLOS is small and easy compared to the conditions

CLOS is much more complex than conditions.

> scheme did it right

Not at all.

Scheme was not providing any error handling in the language up to R5RS and had then zillions of different implementation specific extensions, many of them influenced by Common Lisp's condition system.

Compare:

[https://www.gnu.org/software/mit-scheme/documentation/mit- sc...](https://www.gnu.org/software/mit-scheme/documentation/mit-scheme- ref/Error-System.html#Error-System)

[https://docs.racket-lang.org/reference/exns.html](https://docs.racket- lang.org/reference/exns.html)

[https://wiki.call-cc.org/man/4/Exceptions](https://wiki.call- cc.org/man/4/Exceptions)

[https://www.scheme.com/tspl4/exceptions.html](https://www.scheme.com/tspl4/exceptions.html)

For R7RS large they are still finding out what to do.

[https://bitbucket.org/cowan/r7rs- wg1-infra/src/default/Excep...](https://bitbucket.org/cowan/r7rs- wg1-infra/src/default/ExceptionsErrorsAndConditions.md)

<comment><USER14> Indeed, right through R5RS, Scheme specified that certain situations in the processing of a Scheme program constitute an "error", without explaining what that word means, or any mechanism to catch such a thing, recover from it, or generate it on purpose (without provoking an erroneous condition). A conforming R5RS Scheme implementation can crash or abort upon encountering an error.</comment></comment></comment></comment></comment>


Ask HN: Online video monetization - <AUTHOR>

I've gotten an idea for a video based site, but I worry about it not being able to cover its own costs, and ending up being an expensive experiment.<p>Should I just setup adsense/adsense for video and hope for the best?  How have other user generated content video sites bootstrapped? <comment><USER2> You could also monetize it on youtube. Though that leaves very little control with you and you are just uploading videos.

<comment><AUTHOR> I suppose it may be possible to host the video on youtube and just embed it, rather than hosting myself. The huge drop in bandwidth and storage costs may very well be worth the loss of control.

What do you see as the major downsides to that loss of control? I think the biggest problem from my perspective is that youtube videos are limited to 15 minutes, unless you're a special partner, iirc. While a bit of a crimp, I don't think it's a showstopper.</comment></comment>


Introducing Spash - <AUTHOR> https://github.com/nerdammer/spash <comment><USER2> You could've explained it in the title? Spash is a command line tool for Big Data platforms that simulates a real Unix environment, providing most of the commands of a typical bash shell on top of YARN, HDFS and Apache Spark.</comment>


Google Maps Gets a Makeover [video] - <AUTHOR> http://mashable.com/2012/10/27/google-maps-makeover/ <comment><USER2> Positive iteration for sure but a 'redesign' this is not.</comment>


Happy Little Words – Analyzing the Bob Ross Twitch Chat - <AUTHOR> http://stevelosh.com/blog/2015/11/happy-little-words/ <comment><USER2> As a participant, the chat was fun actually. Usually chat can be super toxic or even useless at the speed at which it was happening on Bob Ross. The RUINED and SAVED meme was interesting and enjoyable. I don't know why it was such fun, but it felt like a great and huge temporary community considerably limited in their ability to interact. One could really only join in the mob at the right time and when I did so it felt pretty rewarding and fun.

<comment><USER3> I think my favorite meme was "blue OP plz nerf" whenever Bob mentioned he was using more crimson than blue, because blue was much stronger. I thought that was an interesting mix of gaming and art culture.

<comment><AUTHOR> Similarly "VAC" [https://en.wikipedia.org/wiki/Valve_Anti- Cheat](https://en.wikipedia.org/wiki/Valve_Anti-Cheat) whenever he does something seemingly impossible (like knowing about the stream or doing a particularly impressive save).

</comment></comment></comment><comment><USER4> I really enjoy Steve Losh's blog. I found his post[0] on returning to Vim during a formative part of my own career, and it really influenced my adoption of vim. He's got a great guide[1] on getting mutt set up on OS X for command- line email. And the minimalistic design suits my personal aesthetic. He wrote a post[2] on the design of it, like using the ratios of the dominant 7th chord, implementation of print accessibility/context headers, and even credits his inspirations.

[0]: [http://stevelosh.com/blog/2010/09/coming-home-to- vim/](http://stevelosh.com/blog/2010/09/coming-home-to-vim/)

[1]: [http://stevelosh.com/blog/2012/10/the-homely- mutt/](http://stevelosh.com/blog/2012/10/the-homely-mutt/)

[2]: [http://stevelosh.com/blog/2010/09/making-my-site- sing/](http://stevelosh.com/blog/2010/09/making-my-site-sing/)

<comment><USER5> Thank you for the mutt reference. I've been meaning to overhaul my email configuration and this seems like a great place to start.

I too am fond of both the content and design of Steve's blog. He chooses to write about really interesting topics I find. Love the git koans :)

</comment></comment><comment><USER6> I stumbled upon the channel by mistake once. What I found to be really interesting was the reactions flooding in the chat. You could, for example, like the author said, see 'gg' appearing in mass at the end of a painting, but not only! There was a beautiful moment where Bob decided to use a large brush and applied brown in a vertical band on the left side of an almost completed canvas ; you could instantly see the 'RUINED' and crying emoticons spawning in the chat. Then, he went on reassuring the audience and starting to add details, so the large band was gently becoming a tree ; he made a very kind comment and this instantly triggered a wave of hearts emoticons.

It was very strange to witness the involvement of thousands of people through the chat of an online streaming platform, and I think it was a lot like watching a pet asking for food. Or something like that.

</comment><comment><USER7> Absolutely titilating work.

Off-topic: Never heard of you before, but you paint yourself as quite the polyglot for someone your age, I'm a bit dumbfounded and frankly a little upset at myself for not even coming close to what you've produced/created. What's your secret(s) to being so productive?

<comment><USER8> There's a lot of hours in the day and a lot of years to life. Steve does seem very accomplished, that's quite a blog and set of projects he's got going on there.

If you just set out to accomplish things though, you'll be surprised at how much you can complete,

Also exercise (he does it through dancing it seems), you get a lot of energy from that.

He's likely bilingual (or tri, or quad, or more) since he's from Iceland. That's super healthy. And he's clearly exercising all the areas of his brain by playing music, writing, engineering, and dancing.

Probably doesn't spend _too_ much time reading the news (it's easy to get lost in the rabbit hole that is reddit or hackernews sometimes), probably doesn't spend _too_ much time binge watching things, _probably_ doesn't party _too_ hard _too_ often. That's very different from assuming he never does any of those activities, it's probably just not his de facto constant.

So I guess, and this is just an educated guess based on what I can see from him and my own personal experiences, my recommendation to you (and you didn't ask for my advice I know!) would be to limit the amount of time you spend doing things which are easy (reddit, hackernews, reading the news, watching TV), make sure to exercise, make sure to do something creative, and set singular goals for yourself (This week I want to write a blog post, my next goal is to develop a small program to do X). Finally, as you grow and continue to develop healthier habits it gets easier and easier to continue.

So if you spend one week making sure to work towards your current singular goal, you're more likely to do so the next week.

Also, starting is always the hardest part. Sometimes it's as simple as just opening the computer, closing the browser, and starting to futz around with some code. It takes about ten or fifteen minutes for me and then I'm in there like swim wear! And I can keep going for quite some time. But starting is always a bit arduous.

Anyways, this is a bit winding but that's my opinion on your question.

<comment><AUTHOR> > He's likely bilingual (or tri, or quad, or more) since he's from Iceland.

Not quite, unfortunately. I just moved here a couple of months ago (I'm from the US). I am taking Icelandic classes though, and I do speak a bit of American Sign Language from my undergrad time at RIT. So I'm working on it.

Also yeah, getting the hell off of reddit/facebook/hn is extremely important. Sometimes HN is good for finding interesting reading (I hit hckrnews.com once or twice a day to find good links) but always remember the golden rule of the internet: [http://shouldireadthecomments.com](http://shouldireadthecomments.com)

<comment><USER9> I don't have twitter, so I'll just leave this here: perhaps it'd be fun to graph the time delay between RUINED and SAVED?

>but always remember the golden rule of the internet: [http://shouldireadthecomments.com](http://shouldireadthecomments.com)

Rather ironic you should post that here :).

</comment></comment></comment></comment><comment><USER10> Semi-related curiosity question: When viewing twitch chat as a logged-out user, if someone enters a banned word, it shows me " _< message deleted>_." However when there are dozens of messages per second like the bob ross chat, the message deleting seems delayed, because you can sometimes catch a glimpse of the bad words before they are "removed". I assume the removal is done with javascript? Are you seeing the non-censored version of the chat when scraping?

<comment><USER11> I believe the message removal is done by a moderator. This may be a human being or a bot. In either case the message has to appear in the chat before either party can decide whether to leave or remove it.

<comment><USER12> It's a bot. It's called XanBot [0]

Twitch's chat protocol is compatible with IRC, but IRC doesn't support all new features, so things like replacing banned words with <Message Deleted> won't show up.

[0] [https://www.reddit.com/r/Twitch/comments/2dkro7/a_detailed_g...](https://www.reddit.com/r/Twitch/comments/2dkro7/a_detailed_guide_on_howto_configure_and_operate/)

</comment></comment></comment><comment><USER13> BTW, is there any way to get the chat archive from the original marathon? Is it saved at all somewhere? rechat.org does a similar thing, but its retention period is only one week.

<comment><AUTHOR> Not as far as I know. Let me know if you do find it -- I'm kicking myself for not thinking of scraping it then.

</comment></comment><comment><USER14> Fascinating to see how much information you can extract from text files and terminal commands (+ lots of piping). Makes you wonder how efficient GUIs really are for data analysis.

<comment><USER15> Using terminal commands (w/ "lots of piping") for reproducable analysis that you intend to show to others is not recommended. More importantly, it increases the chance of _making a mistake._

There's nothing wrong with GUIs for statistical analysis.

<comment><USER16> I disagree, sort of, a little bit.

If I'm writing a shell pipeline for data analysis, I rewrite it as a Makefile. Make is a great tool for this sort of thing.

(Use whatever works as long as it's a single command to reproducibly rerun an analysis.)

</comment></comment></comment><comment><USER17> This looks like it was so much fun to do. One of these days I hope inspiration strikes me out of thin air to do something similar.

</comment><comment><USER18> OP: possible typo? from 2015-11-16 14:30 to 2015-11-16 14:30 (all times are in UTC)

<comment><AUTHOR> Yep I'm bad at copy/paste. Fixed, thanks.

</comment></comment><comment><USER19> gold</comment>


Ask HN: Linux, too many changes in not many years - <AUTHOR> I learnt linux years ago and now, after managing lots of servers and systems I find out problems about networks and other that I can not resolve in the way I knew.
/etc/resolv /etc/interfaces, netstat, ifconfig (hey!, I prefer "i a s" over ifconfig though ) ... not working properly and as its supossed ten years now, and 90% google says... is wrong now
Every distro linux has his way to manage network. Last bug in Kde Neon I was using about proxy configuration (https://bugs.kde.org/show_bug.cgi?id=410843) took me two hours to fix.
So I'm going to try BSD or something without systemd.
Sure I'm tired and old but I don't see advantages win over the problems can occur. It's a mess for me now...
I like the most updated applications, libreoffice,bash ...and love shortcuts with keybindings
for which distro I look? <comment><USER2> I understand your frustration, I sometimes have it myself when trying to figure out something obscure. And this kind of "knowledge rot" is indeed becoming a huge issue in the main search engines.

Arch Linux provides awesome documentation though. Slackware still follows the old ways iirc.

For *BSD, I'd personally stick with OpenBSD, but not sure how great you can expect it to be as a distro.

</comment><comment><USER3> There are some systemd-less distributions like devuan, or what I would personally recommend, Void Linux[0]. Void has been my daily driver for over a year now, and it's been lots of fun, while also being rather stable.

Be aware that it is a rolling release distro, much like Arch Linux and it comes with its drawbacks as well. It uses runit as its init system, which is easily configured via shell scripts, and certainly won't change in the near future, because it's feature complete.

Void comes with it's own package manager, "xbps" (X binary package system), which is used a lot like pacman on Arch Linux. You can even freeze packages if you don't want to upgrade them.

All in all, I'd recommend it, but be sure to play around with it for a bit before settling on it. (Oh, and the installer is a lot easier thatn Arch's too, and there are live CDs with desktop environments pre-installed if that's your thing)

[0][https://voidlinux.org/](https://voidlinux.org/)

<comment><USER4> Alpine Linux may also be a good option if you're looking for something light- weight.

</comment></comment><comment><USER5> What is the big issue with systemd? I would recommend re-learning somethings.. it seems like any distro worth using in production is using systemd or migrating towards systemd. BSD (which isn't linux) being the exception.

<comment><AUTHOR> Its not only systemd.

Every DE uses different programs to manage network, so you can not check the same files in order to fix a problem.

And the last problem I had with systemd was wanting to use port 53... you cannot because systemd uses it

<comment><USER6> That sounds like systemd-resolved. You don't have to use it, and it's easily stopped by normal systemctl commands if you want to use normal libc resolver behavior.

</comment></comment></comment><comment><USER7> Things evolve. If you're looking for something more conservative, try Slackware Linux, CentOS, or one of the BSDs.

</comment><comment><USER8> Linux is evolving and diversifying fast. I'm afraid this will be more so in the future.

</comment><comment><USER9> Fedora, but that uses systemd.

</comment><comment><USER10> Works on my machine.</comment>


Delta Chat is a messaging app compatible with email infrastructure - <AUTHOR> https://f-droid.org/repository/browse/?fdid=com.b44t.messenger <comment><USER2> Nice idea! I wonder why nobody else has done this before.</comment>


Yahoo Is for Sale After All - <AUTHOR> http://www.theatlanticwire.com/technology/2011/09/yahoo-sale-after-all/42903/

<comment><USER2> The title is total linkbait. "a number of potential options" does not equal "selling" - not to say that's not their intention, but it's a large jump to make.

It seems Yang and co. are progressing on the "defining Yahoo" question - they've determined it's "an internet company."

This "memo" seems more like it was written as a press release. At least, PR- speak abounds. Is it standard practice for large companies to write employee memos as such?

</comment><comment><USER3> In my opinion, the only thing Yahoo has that is worth anything is Flickr. Otherwise, they are AOL without the dial-up subscribers.

<comment><USER4> I wouldn't say that completely, they do have other products that people seem to love. Yahoo mail is still very popular. Yahoo finance is still very popular also. They do have a bunch products they bought that they never seemed to be able to use properly (delicious, the now sold zimbra...) I really think they should have ignored search a few years ago and continued developing products like Flick, delicious, zimbra and other cloud services. They had the engineering talent for it.

Maybe I'm way off but I still think they did do good ideas that they never fully developed.

<comment><USER3> Regardless, I feel that any company buying Yahoo is wasting their money, unless Yahoo is willing to sell Flickr by itself.

</comment></comment></comment><comment><USER5> I remember when Microsoft tried to acquire Yahoo sometime back and how difficult Yahoo played. The company is still profitable to the tune of about $1 billion a year. even with their different properties that are still popular I don't think it's unfair to say the M's future seems uncertain at best. Weighing their options while they're still attractive to potential acquirers is not a bad idea.

<comment><USER6> I think M already got out of yahoo what they wanted. Why buy the cow when you can get milk for cheap? It appeared like a win-win for both now only if yahoo could execute on their mission to be a great media company...</comment></comment>


Want your mobile app to succeed? Grow first, monetize later - <AUTHOR> http://www.alphagamma.eu/entrepreneurship/to-succeed-with-your-app-grow-first-monetize-later/ <comment><USER2> I am not buying the "grow first, worry about money later" strategy. In my honest opinion, Growth, retention, and monetization are all part of a great app or service. Focusing on one (or two) aspects means it is unsustainable.</comment>


German hospital hacked, patient taken to another city dies - <AUTHOR> https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 <comment><USER2> The best defense is actually a good backup system. Modern ones can make snapshots every 10 min or something like that. Allowing blackmail to happen is probably a bad decision as it supports the industry, which has a revenue of multiple million $.

Still surprised that dysfunctional networks prevented such an important operation though. Careful network segmenting could probably have prevented this, but it takes considerable IT resources that probably were not available.

That they killed the network of the hospital for a week is unacceptable and they say it will take a long time to restore it properly. I expect more investment in IT resources.

I couldn't find any mention about "add-on" software in German articles, maybe it is a translation error?</comment>


Using Phones/SMS as 2FA – Why I am not a believer - <AUTHOR> http://dcid.me/notes/2013-apr-19.html

<comment><USER3> This is utter stupidity. Somehow voicemail PIN weaknesses translate to being able to intercept SMS's?

Security is about systems, not individual components. Take a random Internet service protected by passwords and add a second factor to the login step where after login and password you must enter a code that gets SMS'd to your preconfigured phone number. The number of fraudulent logins will drop to near zero as password guessing is no longer sufficient to break in to an account. The number of attackers that will be able to attack your login page and intercept SMS's for a specific user within the phone network is limited to three letter agencies.

The best security is security that people will actually use. Virtually everyone has a mobile phone and thus why the SMS channel is attractive.

Sure, this isn't the be all and end all in security and an app like Google Authenticator is more secure but SMS as a second factor is ideal for most consumer applications.

<comment><USER4> In the case he cited with CloudFlare, the phishing the voicemail was a pretty effective attack vector. Also, where does he tie PIN weakness to SMS interception? They're uniquely vulnerable.

> Take a random Internet service protected by passwords and add a second > factor to the login step where after login and password you must enter a > code that gets SMS'd to your preconfigured phone number. The number of > fraudulent logins will drop to near zero as password guessing is no longer > sufficient to break in to an account.

I think you're mitigating one set of risks while adding others.

EDIT: just want to add, I do think UX should be a primary concern of security; I just disagree with your analysis of his post.

<comment><USER3> Oh really? You think that login+password is a trade of equal risk with login+password+sms? Sorry, but the second is clearly has much less risk.

Twitter introduced SMS authentication as a second factor. Do you really think that their number of fraudulent logins for users protected by that second factor hasn't gone down to near zero?

<comment><USER4> I think some of the use-cases are getting mixed, including by myself and by the author.

I do agree that 2FA, even with cell-phones, will improve the security of the web interface. The CloudFlare breach was caused by using the phone as an independent authenticator (overriding the password) which is not 2FA, as I understand it.

And I agree, the likelihood of SMS interception or spoofing during the verification process seems pretty slim. I'm going to bow out to the security experts at this point.

<comment><USER5> IIRC, GSM has been cracked. I'm not an expert, so I'm not sure how this affects SMS, but as SMS is done via a control channel (that was not originally intended to be used for text messaging), I'm assuming that there are no extra protections there.

Granted, this requires physical proximity though, which definitely raises the bar for any attacker.

</comment></comment></comment></comment></comment><comment><USER6> "No 2FA. If the only option available is SMS or call-based authentication, do not use 2FA."

I see no problem with password + SMS or password + phone. The big problem is that some companies think that their second factor overrides the first factor, and choose a weak second factor. 2FA must be an && operation, not an || operation, for all modes of authentication. Otherwise, you are exactly right, and attackers will compromise the weakest link in the chain.

<comment><USER7> Agreed. If BOTH are required than even if the second factor is relatively weak, it's still better than password-only.

<comment><USER3> If both are not required it's not a second factor. Two factor is something you know (password) plus something you have (a phone number).

</comment></comment></comment><comment><USER8> I'll chime in because theres a lot of mis-information here.

My credentials: I am the founder of Authy, we do two-factor authentication using SMS, Phone Calls, TOTP App and Hardware Tokens - we protect over 80,000 accounts including CloudFlare, Coinbase etc, so I am very familiar.

On 2FA using SMS:

1\. Yes it's not as secure as a dedicated TOTP App but:

2\. SMS phishing doesn't matter here. SMS phishing would allow the attacker to send message as you but not receive messages. In order to compromise Two- Factor SMS auth he would need to be able to receive them.

On VoiceMail Security:

1\. True, voicemail is insecure. But if your Two-Factor Auth provider knows anything about security, he can help you. For instance we just helped Coinbase with Voice verification. In order to protect the verification codes going to VoiceMail, we require the person to input a number before reading the token.

Eg. Hello, this is Coinbase, if you are expecting this call, please press 1. [ Only on 1] your code is, "1,2,3,4,5,6,7". Again "1,2,3,4,6,7", last time "1234567".!

So if you can only use SMS or Phone Call Two-Factor Authy, by all means use it. If you have a Smartphone it's better if you move onto a dedicated TOTP App.

The biggest weaknesses this days on Two-Factor Auth is not SMS or the carriers, it's the implementation. Unfortunately although implementing TOTP is easy, a secure Two-Factor system is not. Most are using recovery codes, e-mail and defective recovery mechanisms, which is how this systems are being by- passed.

[http://www.slashgear.com/dropbox-hack-allows-bypass-of- two-f...](http://www.slashgear.com/dropbox-hack-allows-bypass-of-two-factor- authentication-05289228/)

Find yourself a good Two-Factor Authentication provider. I would recommend Authy, but I am biased so I'll recommend Duo-Security.

<comment><USER9> Good tip about the voicemail. Though in theory, with VOIP becoming more popular, it's still just a matter of time before more people run into the phone-call-redirect or even text-message-redirect if services like Google Voice pick up elsewhere. In addition, there's the social engineering hacks of last year, where the attackers added a credit card, then gained access by verifying that same card. At the end of the day, humans always play more of a role in security than people assume. Thanks for the tips, though! I'll revisit this thread later for 2FA.

</comment></comment><comment><USER10>
      If you have the option to use RSA SecurID or Gemalto
      devices (used by Amazon), use them first.

RSA SecurID was famously compromised back in 2011: [http://en.wikipedia.org/wiki/SecureID#March_2011_system_comp...](http://en.wikipedia.org/wiki/SecureID#March_2011_system_compromise)

Any system where the manufacturer has a copy of the secret key on the token is theoretically vulnerable to this attack.

<comment><USER11> Reminder also that OTP is NOT a strong factor, anyways. Even if the manufacturer doesn't hold the secret seed (i.e. the device lets you regenerate it - vendors usually don't let you do that so that you're forced to buy again from them all the time).. so yes, even if they don't hold that secret seed, the target servers hold them.

There is no encrypted version of the secret seed. There is no hashed version. You and the opposite party (the server you authenticate to) both have to be in possession of the secret seed.

That means if any server containing those keys is compromised, your OTP token is suddenly just paperweight (yeah, people like these crappy analogies, i heard.)

Using something like an opengpg smartcard and true challenge/response type authentication is much better than the "2FA" provided by password + OTP.

Something you have (the keys on the smartcard), something you know (the passphrase to decrypt those keys), the key never leaves the smartcard, nobody else has your key.

<comment><USER9> Something you have, something you know ... I can see the utility in requiring just those. But I've found it useful to get messages from service providers when, for instance, my ATM card is used, or when I login at a new computer. So I'd like to add to that list "something you monitor" whether through SMS-based 2FA, push notifications, or just plain emails or further challenges if something looks suspicious (e.g. logins from Africa when I'm also logged in from the US)

<comment><USER11> While I don't consider the notifications to be part of the authentication - <USER2> agree, yes, notifications are good.

We're doing something like that at my company as well (its not a bank or anything). If you log from other countries, have too many repeated failed (or even successful) attempts in a time period, etc. you get notified on a dashboard/you can optin for an email (or /and an email that forwards to your SMSes).

then you can decide if/when you want to see it and to notify security if you think there's a problem. saves a lot of time for the sec team as well which only will manually check when the alerts reach a higher threshold.

</comment></comment></comment></comment><comment><USER12> My biggest problem with 2FA that relies on a phone is that I can lose my phone. If I do, the system can then do one of two things:

a) it locks me out forever. I'm screwed.

b) it has a way to reset my auth. Meaning an attacker doesn't actually need my phone.

So getting the phone involved is either a huge risk or a pointless feel-good factor that can be bypassed. Either way, I'm not on board.

<comment><USER13> Losing your phone is not the same as losing your phone number.

<comment><USER9> +1. And in a world of VoIP that can be both good and bad ;-) That said, if you use Google Authenticator, it's just a backup away. And you can add additional numbers, which again provides that tradeoff between security and convenience. At the end of the day, high value targets should be defended in depth, with least exposure to attacks and easily dropped if compromised. Which means maintaining inbox zero on servers others monitor but are less shared (so you can phone someone) and implementing login systems without failsafes. Of course, IMAP wasn't built for much of this 2FA stuff ;-)

</comment></comment></comment><comment> brown9-2 This is an argument against using SMS or phone calls as the second factor, apps like Google Authenticator are still a really great option (as the article states).

</comment><comment><USER14> Here's the story of a banking trojan attack that redirected the victim's phone to authenticate large transfers:

[http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...](http://williamedwardscoder.tumblr.com/post/24949768311/i-know- someone-whose-2-factor-phone-authentication-was-hacked)

Scary when it really happens.

(My blog post)

</comment><comment><USER15> A problem for security geeks is they frequently forget about 2 things: 1) the balance between usability and security, and 2) The risk acceptance/appetite of the person for the security they want/need to use.

The two are intertwined closely. For something that isn't that important, a user isn't going to jump through complex hoops every time they have to login. What they will end up doing is finding workarounds (Hello Mr. Post-It).

For most folks, they don't really need complex solutions to reset their email password. What needs to be asked is "What am I protecting, and what is it worth to me?"

Oh, and I'd suggest certificate-based auth is way better than complex passwords.

Daniel's been around for a while (I've loved OSSEC for years) so I suspect this post just wasn't meant to be a complete essay on the topic...

</comment><comment><USER16> This was an easy choice for us when we setup two-factor auth for our app. We chose TOTP. The only real con (if you can call it that) is requiring the user to install a TOTP app (eg. Google Authenticator) but given our target userbase that was a non-issue.

Here's a quick summary of pros/cons:

TOTP pros:

        * Assuming the initial secret is delivered securely (eg. HTTPS) no MITM vulnerability
        * Free as in beer
        * Simple to implement
        * Instantaneous
        * No additional personal information asked of user[1]

TOTP Cons:

        * Requires user's to install an app or have a physical TOTP device
        * Clocks must be kept in sync[2]

Phone SMS pros:

        * Nothing to install assuming your user has a phone

Phone/SMS cons:

        * Not free as in beer
        * Could be MITM by telco or anyone with access to telco data (wireless scanner)
        * Requires asking for the user's phone number
        * SMS is *not* instant, could be minutes or more to receive a message

[1]: I don't like giving out my phone number and I assume most other people are like that as well. Less is more when it comes to sharing personal info.

[2]: Clock sync is really important. If you're going to do a TOTP implemenation make sure you run ntpd/ntpdate to keep your clock in sync.

<comment><USER17> What about losing your device? How is that handled with something like Google Authenticator? Don't you then have to fall back to some sort of manual verification?

If you lose your SMS authenticated Phone, you can get a new one and transfer your number to it.

<comment><USER16> If you lose your device then you restore it from a backup. For Google apps's 2FA setup they also have one time use codes. It s a special list of 10 codes that you're supposed to save somewhere safe offline (eg. wallet, deposit box, trusted neighbor, ...). If you lose your device you can use one of the codes to login and configure (or disable) 2FA.

<comment><USER17> I've had backup restore to a new device not work for google authenticator (I assumed that was by design), which is what has made me wary of it.

But for your app, I assume you use manual re-authentication if someone loses their device?

<comment><USER16> I've upgraded my phone 3 times so far (3G -> 4 -> 4S -> 5) and no issues with migrating Google Authenticator settings. I do have the habit of wiping out all my music but that's because I never bothered to setup iTunes properly (plus my desktop is Linux so I run it in a Windows VM).

I'm not too worried about the restore not working as I have the single use codes securely saved as well (and tested). If I lost my phone or bricked it during an upgrade I can just use those to set things up again in ~15 minutes.

I consider that process superior to waiting to get a new phone. More importantly on a day to day basis (eg the normal case where you don't lose your phone) it's more secure as it can't be MITM without getting the TOTP secret either from my phone or from the system I'm authenticating against.

</comment></comment></comment></comment></comment><comment><USER18> He gives an example of what can happen with voice-based authentication but not SMS. What can an attacker do, collect the text as it passes between the cell tower and your phone then use it before you get the chance to?

Or is it the scenario where they've stolen your password and your phone? If it's a smartphone, they'd have to be able to unlock it and once they've done that, SMS doesn't seem any worse than Google Authenticator.

<comment><USER6> If you could social engineer an employee to change a voicemail number, you may be able to convince them to port a number to a new account.

<comment><USER19> There have been bank account hacks where the perpetrator has had an accomplice inside a cellular service provider who intercepted the SMS and prevented it from being sent to the account-holder's phone while retrieving the code.

</comment></comment></comment><comment><USER20> "And please remember 2FA is not a substitute for a good password policy."

2FA is not a replacement no. What it does is increasing security in environments where you might risk that your main password is compromised.

This doesn't mean you are free to reuse passwords but it still significantly raises the bar for a successful attack.

<comment><USER21> I can't help but think maybe this is similar to having only the login screen https, but the rest of the site http with the auth cookie being passed around in clear text... Initially, we thought we were being more secure because we secured the transfer of the password to the website, but in reality the auth cookie is just as important.

In the case of typical 2 factor authentication via phone - if I can reset your password via a code being sent to your phone, then you've lowered the security of your password from maybe an 8 digit password to a 4 digit numeric pin...

Of course, I would need to know your phone number, which may be difficult to guess?

<comment><USER22> Basic 2 factor authentication doesn't even cover the scope of password resets, so the idea that 2FA is flawed when used in conjunction with cellular networks is a terribly unthought out argument. If any service uses a token reset code sent to a phone as SMS or voice message, then that service is using a flawed password reset mechanism using the idea that cellular networks are highly insecure, regardless if it's also using 2FA. _Any_ single authentication mechanism over cellular networks is flawed using the same logic. 2FA, arguably, is more secure over cellular networks because it requires an authentication mechanism (the password) that is not transmitted over SMS/voice cellular in a plain format (assuming the authentication itself is sent over TLS/SSL).

<comment><USER21> great points, clearly i was misunderstanding, the reset mechanics i was describing are clearly a very bad idea and not 2 factor. thanks!

</comment></comment></comment></comment><comment><USER23> _Easy to phish. If you know some basic information about the person, you can get the PIN changed._

That's not what _phish_ means. Phishing in this case would mean the victim gives you her PIN, assuming you are trustworthy.

<comment><USER4> I'm not sure phishing is limited to situations where you attack the account owner, though I could be wrong. Going off of the Wikipedia entry (though this doesn't prove anything either):

> Phishing is the act of attempting to acquire information such as usernames, > passwords, and credit card details (and sometimes, indirectly, money) by > masquerading as a trustworthy entity in an electronic communication.

[https://en.wikipedia.org/wiki/Phishing](https://en.wikipedia.org/wiki/Phishing)

</comment></comment><comment><USER24> Is there a problem with a system whereby a business already has clients phone numbers and uses them to send the client a temporary PIN when the client enters their phone number as a username on the business's website?

<comment><USER25> Yes: call/SMS forwarding. It depends on how good your first factor (e.g. password policies) are, and how your reset process works. Getting someone's phone number and setting up call forwarding doesn't require much social engineering savvy to pull off.

[http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat- hona...](http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan- hacking/)

<comment><USER3> Call forwarding doesn't forward SMS. I don't think you can do SMS forwarding (at least for any carrier I'm aware of). You'd need to social engineer the carrier to port your target's number to a different phone -- in which case the target is going to be exposed to a ton of trouble...

</comment></comment></comment><comment><USER26> I don't really understand the argument the author makes about SMS being easy to spoof. Most of the 2FA systems I've seen using SMS use it to communicate a secret that the user needs to type back in on whatever screen they were at. If an attacker spoofs the SMS message, the user is just going to get some secret that doesn't work when they type it in.

</comment><comment><USER11> I"ll just go ahead and remind that many people use google authenticator to authenticate accounts ON THE SAME PHONE. It's dumb, inconvenient, but yeh.</comment>


Detecting fake flash - <AUTHOR> https://blogs.gnome.org/hughsie/2015/01/28/detecting-fake-flash/ <comment><USER2> There is a similar program called H2testw that can test flash drives and memory cards on Windows. (The link to F3 mentions H2testw, but anyone who doesn't click through will miss it.)

If you get a "great deal" on a flash drive or memory card at certain online store sites like AliExpress, there is a very, very good chance that the product is counterfeit. Sadly, this is a well-known scam that many people are taken in by.</comment>


Start of Lightning Bolt Caught on Camera - <AUTHOR> http://www.realclearscience.com/journal_club/2015/10/20/start_of_lightning_caught_on_camera_109418.html <comment><USER2> Great video, the nature article is much more informative than the one linked.

From the nature article, it seems this was the first video of natural bidirectional lightning, not triggered by rockets or aircraft: "In contrast to studies of rocket-triggered lightning and lightning initiated by aircraft, which found delays of 3–6 ms between the onset of negative and positive leader branches, this natural event exhibited a delay of less than 90 μs (i.e. one video image)."

This was a negative polarity lightning strike. the most common type. Less than 5% of lightning is positive polarity but they can carry ten times the charge and exceed a billion volts of potential.

When you read about people surviving lightning strikes it's almost certainly a negative polarity strike. [https://en.wikipedia.org/wiki/Lightning#Positive_and_negativ...](https://en.wikipedia.org/wiki/Lightning#Positive_and_negative_lightning)

<comment><USER3> Are the positive ones the "bigger" ones?

EDIT: From the linked Wikipedia entry: "Because of the much greater distance to ground, the positively charged region can develop considerably larger levels of charge and voltages than the negative charge regions in the lower part of the cloud."

<comment><USER4> I didn't know about positive/negative polarity types of discharges, thanks!

Also, having Cloud to Butt extension installed made reading that Wikipedia quote quite interesting...

</comment></comment></comment><comment><USER5> I also like this 10,000 fps video [0] credited to Tim Samaras.

[0] [https://i.imgur.com/W1X1qFI.jpg](https://i.imgur.com/W1X1qFI.jpg)

<comment><USER6> I was wondering how you could talk about a video and then link to a single image (I think jpg doesn't support animation). But it turns out all of

[https://i.imgur.com/W1X1qFI.jpg](https://i.imgur.com/W1X1qFI.jpg)

[https://i.imgur.com/W1X1qFI.gif](https://i.imgur.com/W1X1qFI.gif)

[https://i.imgur.com/W1X1qFI.png](https://i.imgur.com/W1X1qFI.png)

link to the same GIF. :)

<comment><USER7> Ah good thing, so imgur abstracts extensions apparently

Better if you request with .gifv extension, then it's a much smaller (than a gif) html5 video)

<comment><USER8> The only issue with gifv is that if you open one on iOS it will pause whatever music you're listening to at the time. Kind of a bummer and something that will hopefully eventually get fixed.

</comment></comment></comment></comment><comment><USER9> Here is the Nature article that this video goes with. [http://www.nature.com/articles/srep15180](http://www.nature.com/articles/srep15180) .

<comment><USER10> That's obviously more substantive, and HN prefers original sources, but unfortunately it doesn't include a link to the video, so I guess we'll leave the URL as is.

<comment><USER9> It is unfortunately hidden at the bottom as .mov in the supplementary information section: [http://www.nature.com/articles/srep15180#supplementary- infor...](http://www.nature.com/articles/srep15180#supplementary-information) .

</comment></comment></comment><comment><USER11> 11k fps. Wow. I will never get tired of watching this stuff.

That got me thinking, is there any theoretical limit to the number of frames that can be captured in one second?

<comment><USER12> Not that it isn't awesome how fast cameras are, just keep in mind, the clip is 25ms. So at 11,000 fps, that would be 275 images (11 frames per ms). Not sure if we actually have a camera that can take 11,000 images in 1 second. (I guess that depends on the resolution)

<comment><USER13> We do have those, but it does indeed depend on the resolution.

These can do 25k fps at 1280x800 pixels (and 1 million fps at 128x32 pixels): [http://www.visionresearch.com/Products/High-Speed- Cameras/UH...](http://www.visionresearch.com/Products/High-Speed-Cameras/UHS/)

</comment></comment></comment><comment><USER14> lightning is enigmatic

and the internet facing community surrounding its research seems divisive

can anyone speak to the sort of research currently being done on the study of lightning and its initiation?

are there efforts to recreate assumed initial conditions?

thoughts on the source of the huge amounts of directed energy? does the strike harvest from the vast collection of charged particles within the cloud or is it created by electrostatic interaction of individual ions, similar to [http://www.nature.com/nchem/journal/v7/n3/full/nchem.2161.ht...](http://www.nature.com/nchem/journal/v7/n3/full/nchem.2161.html)?

</comment><comment><USER15> Site down.

<comment><USER2> Direct link to the video: [https://www.youtube.com/watch?v=4dwBS9nLPbE](https://www.youtube.com/watch?v=4dwBS9nLPbE)

<comment><USER15> Thanks. Seems to be back now.

</comment></comment></comment><comment><USER16> a) overloaded site

b) very nice, but is this "Hacker" News? More like Discovery Channel. How is this interesting from a tech point of view? High FPS cameras. Got it. Got it long ago.

<comment><USER17> "High FPS Camera" is a lot more impressive than the latest twitter-controlled todo-list app or whatever.</comment></comment>


Activist Challenges a Sweeping Revision in Patent Law - <AUTHOR> http://www.nytimes.com/2012/08/27/technology/mark-stadnyk-challenges-sweeping-revision-in-patent-law.html?pagewanted=all

<comment><USER2> I don't think he has much of a chance. The Constitution doesn't say anything about first to invent. It just says Congress has the power to grant limited monopolies to inventors for their discoveries.

Note that even under the old "first to invent" law, you did not ACTUALLY have to be the first person to invent something in order to get the patent. A prior inventor whose invention did not qualify as prior art and who did not apply for a patent would not disqualify the second inventor from getting a patent.

The new "first to file" system still requires that the patentee to be an inventor, and that seems to me to be enough to satisfy the Constitutional requirements.</comment>


Clinton Pollster: It's 'Likely' Hillary Will Lose to Sanders - <AUTHOR> http://townhall.com/tipsheet/leahbarkoukis/2016/06/03/former-bill-clinton-pollster-its-increasingly-likely-hillary-will-lose-to-sanders-in-california-n2172333 <comment><USER2> Please stop posting political horse-race and sensational stories to HN.

 _The worst thing to post or upvote is something that 's intensely but shallowly interesting: gossip about famous people, funny or cute pictures or videos, partisan political articles, etc. If you let that sort of thing onto a news site, it will push aside the deeply interesting stuff, which tends to be quieter._

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

[https://news.ycombinator.com/newswelcome.html](https://news.ycombinator.com/newswelcome.html)</comment>


Using data to determine if Die Hard is a Christmas movie - <AUTHOR> https://stephenfollows.com/using-data-to-determine-if-die-hard-is-a-christmas-movie <comment><USER2> Talk about overthinking it! This thread highlights the recurrent conflict that arises because my Myers-Briggs personality type is INFJ, but most programmers are not.

To me a Christmas movie is a movie with the spirit of Christmas running through it, however weakly. Another definition I have is this. A Christmas movie is a movie that is fun to watch around Christmas. Die Hard meets both of these definitions.

Die Hard is not, however, a typical Christmas movie. It's a movie more for people who are sick of the normal Christmas movies and want a break. Because of this special status, people who think of Die Hard as a Christmas movie feel a greater camaraderie than people who think, say, White Christmas is a Christmas movie. For example, at a Christmas party one of my friends wore, as his "Christmas sweater," a gray sweatshirt with the words "Ho ho ho" written in red.

Another thing that makes Die Hard special is the thought and care that the director put into it, [https://vimeo.com/76739972](https://vimeo.com/76739972)

<comment><USER3> >Talk about overthinking it! This thread highlights the recurrent conflict that arises because my Myers-Briggs personality type is INFJ, but most programmers are not.

Meyers-Briggs has a number of issues[1] and is frankly, unscientific. But because it uses a survey, it evokes feelings of rigor. Sometimes I feel that engineers are so obsessed with rigor, they'd rather use a solution that is wrong but "goes through the motions" than a simpler solution.

For example, whether something is a a "Christmas Movie" is at it's heart, a matter of opinion. To answer it, simple polling a diverse sample of the US population could answer the question. But that's not a "sexy" answer - we want to buy into this idea of One Ground Truth that if we only framed our experiment perfectly, we can uncover.

The real truth is that qualitative research is messy. Doing a "good" job is easy, but doing a "great" job is a still unsolved problem... and sadly all to often we choose the appearance of rigor over actual useful research.

[1] [https://en.wikipedia.org/wiki/Myers%E2%80%93Briggs_Type_Indi...](https://en.wikipedia.org/wiki/Myers%E2%80%93Briggs_Type_Indicator#Criticism)

<comment><USER4> This comment is exactly what the OP was talking about...

</comment></comment></comment><comment><USER5> Know what? I'm fine either way - I'd rather argue with my dad about whether Die Hard is a Christmas movie than politics and the economy any day.

So here's my vote - arguing ABOUT Die Hard being a Christmas move HAS BECOME a Christmas tradition.

</comment><comment><USER6> This is only an argument because of different ways of defining what a "Christmas movie" is, which aren't mutually exclusive:

a) Whether the movie is unambiguously set during Christmas, and if so whether that's clearly an artistic choice, or as much of a coincidence as a movie that has nothing to do with the weather being set in the summer or winter.

b) Whether the movie is aimed at the "Christmas movie market". I.e. released around Christmas, this'll usually coincide with a movie being more Christmas themed.

The article weaves between criteria that'll fall under one or the other, without ever really acknowledging the difference between the two.

Die Hard meets a) but not b), but the article doesn't mention whether or not skipping b) was intended.

The studio had a hard time casting the protagonist. Was it initially meant for a Christmas release, but ended up slipping into July without the script being changed to de-Christmas theme it?

More importantly, is there a reason to avoid b) without a)? Do mildly Christmas-themed movies such as Die Hard (it's not integral to the plot) get penalized in the market as a result? Why don't we see more of them?

<comment><USER7> Also C: Its a christmas movie if we all decide it is.

If it becomes one more of the christmas-centric traditions, then it becomes a christmas movie.

<comment><USER8> Great Escape is a Christmas movie to me, it was always on around Christmas or new year as a kid.

<comment><USER9> Italia 1 shows "Trading Places" each year in Italy: [https://www.imdb.com/title/tt0086465/trivia?item=tr2330606](https://www.imdb.com/title/tt0086465/trivia?item=tr2330606)

</comment></comment></comment></comment><comment><USER10> Aha. A local bar was playing 1948 Rudolph the RNR followed by Die Hard, and I thought it was just a hipster ironic incongruity. Now I'm understanding some consider Die Hard a Christmas film.

</comment><comment><USER11> It has lots of Christmas music and Christmas themes that are the basis of every Christmas movie. Not sure why people are contrary.

</comment><comment><USER12> All that 'analysis' and not one mention of the fact that McClanes wife is named Holly!

<comment><USER13> Wonderful

</comment></comment><comment><USER14> My initial sense is it's not a Christmas movie because the typical example of such is a movie that has something like _" the joy of Christmas"_ as its core message or theme. But I'm hardly the most buff of film buffs, so I wonder: are the any movies with something of a negative message, or just any counterexample that is clearly a Christmas movie that doesn't meet this criteria of "joy" etc.?

<comment><USER15> " _Bad Santa_ " is absolutely, unironically, my favorite Christmas movie of all time. And while Billy Bob Thorton's character does have a measure of redemption at the end, it overall is a dark comedy that is clearly the opposite of what you describe.

<comment><USER14> Okay, that has to be the most absolutely perfect counter example. Excellent choice, thanks!

</comment></comment></comment><comment><USER16> A Christmas Story is the tradition in this household.

<comment><USER17> And in millions of other American households.

In just a few hours, TNT will begin its annual "24 Hours of _A Christmas Story_ " marathon.

In 2013, each airing had between three and five million viewers: [http://www.achristmasstoryhouse.com/a-christmas-story- movie-...](http://www.achristmasstoryhouse.com/a-christmas-story-movie- facts/viewership/)

</comment></comment><comment><USER18> I wasn't aware this was even an argument. Is this a joke or an American thing? I must admit my initial reaction was bof but now I'm slightly intrigued. Maybe it's a meme?

<comment><USER19> Seriously, does anyone actually think Die Hard _isn't_ a christmas movie?

<comment><USER20> The author lost me when he said that "Last Action Hero" is not a great movie, so I wouldn't take anything he writes about movies as serious. John McTiernan is a genius.

<comment><USER21> I never understood why that movie bombed. 1993 was a huge year for blockbuster movies, so I think it just got lost in the shuffle. Anyway, underrated flick.

<comment><USER22> It's a Hollywood story cliche. There are so many continuity problems in that movie, but if I recall, they were designed to be that way. Here's a decent write up about the whole preposterous nature of the movie: [https://film.avclub.com/why-last-action-hero-failed-and- why-...](https://film.avclub.com/why-last-action-hero-failed-and-why-it- deserves-to-be-r-1798241845)</comment></comment></comment></comment></comment>


Ask HN: Are There Any Popular/Interesting Non-English Programming Languages? - <AUTHOR> <comment><USER2> It would depend on what you mean by "are" (only now?, in the past? in the future?), by "popular" (is a programming language used by one person popular? by two?), by "interesting" (is brainfuck interesting), by "non-English" (is APL non-English?).

[https://en.wikipedia.org/wiki/Non-English- based_programming_...](https://en.wikipedia.org/wiki/Non-English- based_programming_languages) [https://www.quora.com/Are-there-programming- languages-in-lan...](https://www.quora.com/Are-there-programming-languages-in- languages-other-than-English-language) [https://news.ycombinator.com/item?id=7700691](https://news.ycombinator.com/item?id=7700691) [https://news.ycombinator.com/item?id=9874488](https://news.ycombinator.com/item?id=9874488)

</comment><comment><USER3> Ramsey Nasser's languages in Arabic:

Scheme-like: [https://github.com/nasser/\---](https://github.com/nasser/---)

Ruby-like: [http://animalnewyork.com/2014/artists-notebook-ramsey- nasser...](http://animalnewyork.com/2014/artists-notebook-ramsey-nasser/)

<comment><AUTHOR> Thanks for the pointers.</comment></comment>