Development and testing of the Stuxnet worm - <AUTHOR> http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?pagewanted=all

<comment><USER2> It's seemingly safe to believe that there is a very high probability that the US and Israel are behind Stuxnet.

According to Wikipedia, if this is true than 2010 had the first occurrence of cyber-warfare between nation states in our history.

<http://en.wikipedia.org/wiki/Stuxnet>

<comment><USER3> The first occurrence? Very unlikely.

It goes back farther than you'd think. The first incident that I've heard about was in 1982. See <http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage> for details.

<comment><USER4> Electronic and signals warfare has an even longer history; RDF in WW1 and earlier, and of course Enigma/Colossus and the RADAR war of ww2. I wouldn't consider these unrelated to cyberwarfare.

</comment></comment></comment><comment><USER5> I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, _period_. On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

<comment><USER6> _Iran doesn't get nukes until later_

So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good?

Consider things from the Iranian's perspective. Back in the day, they were establishing a legitimate democratically elected government. The US overthrew that government and pushed a brutal dictator into power, who tortured and murdered many Iranians. From their perspective, the US is an evil nation that does evil things. Nuclear weapons look like the only thing that could give them security against the US. And we're hellbent on stopping them. Heck, the US has never even apologized for overthrowing their government and installing a murderous dictator: can you really blame the Iranians for believing that the US government is trying to screw with their country?

The only way this ends well is with a deal and deals require trust. Does Stuxnet promote that trust? Or does Stuxnet just provide further evidence that the hardliners are right, that the US is trying to screw with their country?

 _industry figures out that they need to lock down their machine controllers_

This seems like wishful thinking. We have a terrible track record of getting large scale systems secured, even in areas where those systems are under continuous public attack. Industrial software is not one of those areas, so developers of such software are unlikely to take security very seriously. But even if they did: we don't know how to get them to build secure systems.

Microsoft spends a huge amount of developer time and money on system security. They're not very successful. But they devote a much larger fraction of their budget to that goal than any industrial software shop. So expecting industrial software shops to produce code that is even as secure as Microsoft's seems...unlikely.

<comment><USER5> _So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good?_

All I want is for nobody to get nuked. I think it's more likely that nobody will get nuked if Iran doesn't have nukes. But you're right that Stuxnet is a dirty move that erodes trust, that's why I'm conflicted.

 _We have a terrible track record of getting large scale systems secured, even in areas where those systems are under continuous public attack. Industrial software is not one of those areas, so developers of such software are unlikely to take security very seriously._

Surely going from complete obliviousness to awareness is the biggest step the industry will ever take to being secure, even if subsequent progress is slow. But I think they will fare better than corporate or home users, because there are less of them and they are more technically inclined and disciplined.

<comment><USER6> _I think it's more likely that nobody will get nuked if Iran doesn't have nukes._

But this doesn't stop Iran from getting nukes, it only delays them. And I don't see why Iran getting nukes increases the probability of anyone getting nuked. A nuclear Iran is an Iran that still responds to deterrence.

 _Surely going from complete obliviousness to awareness is the biggest step the industry will ever take to being secure_

Discovering that you have untreatable cancer will not alter how long you live.

 _they are more technically inclined and disciplined._

Wrong. Do you know anyone who does instrumentation and control work for power plants? These are people who are very skilled...in their field. In my experience, they don't know a lot about security because they don't have to. They don't have millions of script kiddies and organized crime hammering their code looking for exploits so they can afford to be blissfully ignorant. And they're no more disciplined than any other developer.

<comment><USER7> >But this doesn't stop Iran from getting nukes, it only delays them.

Eating doesn't stop hunger, it only delays it.

"Stopping" something is inherently temporary. You can say the exact same thing about stopping anything.

Exercise doesn't stop obesity, it only delays it.

Delay is exactly the goal.

Eventually the Iranian public is going to overthrow their theocracy and create a democracy. Then they will probably stop striving so hard for nukes because the leaders will turn to creating prosperity rather than attempting to achieve a false security through apocalyptic weapons.

</comment></comment></comment></comment></comment><comment><USER8> Stuxnet: forcing Israel haters everywhere to come sulking out of the woodwork.

</comment><comment><USER9> Why is it so surprising/impressive that the worm was tested on centrifuges similar to those it was targeting? More than once, the article emphasizes that this is unusual and interesting...am I missing something?

<comment><USER10> They are complicated, large and extremely expensive. Nothing one could do in a garage.

<comment><USER9> Okay...I didn't know anyone was still considering the possibility that Stuxnet was developed in a garage.

</comment></comment></comment><comment><USER11> You Americans don't get it. Israel and US murder our scientists. They try to stop our progress towards nuclear energy. They put sanction on us so we can't buy things like air planes and our planes are old and they crash and people die. ... All because of what? Because they believe we want to build stupid nuclear bomb -which we don't- and they have no evidence of it. So we stay in a war. Peace is never going to become a reality. And It's Americans fault.

<comment><USER12> Why is Iran developing long-range missiles with the capability of carrying nuclear warheads in parallel to its nuclear program?

Iran has been involved in multiple wars by proxy for a while now, it is unlikely an opportunity to arm itself with nukes will arise and they will not take it.

<comment><USER13> Most likely because it is a non-Arab power in the Middle East that is threatened on two sides by the world's only standing super power -- a super power that has routinely threatened invasion of Iran. Look at the WikiLeaks cables that exposed the pressure from other Middle Eastern governments for the US to invade Iran. Given the geopolitics, Iran's desire for nuclear weapons is perfectly rational.

</comment></comment></comment><comment><USER14> This story would be more interesting if Microsoft and/or Siemens actually helped develop this malware.

<comment><USER15> I think the story would be more interesting if the malware appeared to have come from aliens from outside our solar system who knew that Iran getting nuclear capability would destroy the world and eventually set the galaxy out of balance. They send a virus back through time to stop Iran.

This reporter finds evidence of this in the virus, and additionally finds indications of future events that have yet to unfold, but which this virus will also disrupt.

Otherwise, I think you're left with a pretty mundane story.

<comment><USER16> The story could definitely use some Nicholas Cage.

</comment></comment></comment><comment><USER17> the net positive is that cyber-security is brought to the forefront for the US gov, more importantly this will be a great movie staring colin farrell as an Israeli ruby developer that came up with the plan

<comment><USER17> <http://en.wikipedia.org/wiki/Unit_8200>

<comment><USER18> Also, <http://en.wikipedia.org/wiki/Twenty-Fourth_Air_Force>

This stuff isn't new -- it's just new to most people.

</comment></comment></comment><comment><USER19> I probably shouldn't be surprised by willful ignorance anymore, but it amazes me that everybody in the article can celebrate this achievement and at the same time admit that it's just "pushing back the clock." Israel's still going to get hit by a nuclear weapon some time, because the technology to build one is just going to keep getting cheaper and more accessible.

<comment><USER20> You think it's inevitable that Israel gets nuked? I find that very unlikely, especially since the attacking nation would definitely be destroyed as well.

Iran doesn't want nukes so that they can destroy Israel. They wants nukes, because obtaining them immediately makes them powerful on the world stage. (and I say that as someone who really doesn't want to see them get nukes too because they're a crazy religious theocracy)

<comment><USER11> Think for one minute. Who is the craziest nation in this regard? Who has used nukes twice to murder people. US of course.

<comment><USER21> Never remind Americans that they deliberately slaughtered over 100,000 civilians with nuclear weapons - they don't like it.

<comment><USER7> Would Muslims abstain from killing civilians in a world war?

Moral arguments are pointless. We need results oriented thinking.

Is it better or worse for everyone if Iranian leaders have nukes?

I think even most Iranians would agree that it is worse. Their government is not exactly popular.</comment></comment></comment></comment></comment>


With Rifle and Bibliography: General Mattis on Reading - <AUTHOR> http://www.strifeblog.org/2013/05/07/with-rifle-and-bibliography-general-mattis-on-professional-reading/ <comment><USER2> (2013; content from 2003)

Original submit, 100+ points:

[https://news.ycombinator.com/item?id=5683611](https://news.ycombinator.com/item?id=5683611)</comment>


The Telkelakh (Syria) Truce of 2013  - <AUTHOR> http://adandachi.com/istanbul/the-telkelakh-truce-of-2013/

<comment><AUTHOR> In diplomacy this is to be viewed as a reminder that Assad and his regime is really rubbish at upholding reforms or truces.

In hackeracy this is to be viewed in the light of the BlueCoat[1] surveillance log leaks from hardware the regime was using at ISP level to monitor sexual, religious, political users during what was now considered relatively peaceful times. Street level gestures matter little to the surveillance state or it's monitoring of you and your family.

[1] [http://bluesmote.com/](http://bluesmote.com/)</comment>


The Browser Compatibility Master Table - <AUTHOR> http://www.quicklycode.com/cheatsheets/browser-compatibility-master-table <comment><USER2> I think a direct link would be more appropriate: <http://www.quirksmode.org/compatibility.html></comment>


Dash the Robot controlled from Kano Computer Kit for three year olds - <AUTHOR> https://corepox.net/blog/dash-controlled-from-kano-computer <comment><AUTHOR> I set this up in about 4 hours. I hate the thought of buying toys that have a learning ceiling, so I was very happy to get Dash the robot working from an API. Its a great platform for building stuff as its child proof, robust and a fully packaged thing. 4DOF robot for $150, bargain!</comment>


Ask HN: What's Missing from Covid19 Reporting? - <AUTHOR> What questions do you have about covid19 that seem important but aren't being asked/answered in public forums?<p>(I'll post my own below) <comment><AUTHOR> I've heard that high blood pressure is a risk factor for the severity of a covid19 infection. But does that mean...

(a) People who have actual, uncontrolled high BP?

(b) People who _would_ have high BP, but don't because it's controlled by medication?

(c) People who are taking specific BP-controlling meds?

(d) Some combo of (a), (b), (c)?

<comment><USER3> Iirc, it's about ACE2 inhibitors used in many BP drugs: they mess up with ACE receptors and the virus has an easy way in.

<comment><USER4> So should we treat corona with the opposite of an ace inhibitor?

<comment><USER3> You're asking a mechanic what technique we should use in this brain surgery. As a mechanic, I'd say that a good wrench is a safe proven choice.

</comment></comment></comment></comment><comment><USER5> Reliable data on asymptomatic cases. The models we have at the moment are trying to fit parameters based on the known data, but of the known data, the only reliable one is the death rate. So there are a lot of degrees of freedom here with regards to the spread of the virus. (Because carriers are only identified on a limited basis, mostly in hospitals, it presents a skewed picture, so this data is not hugely useful) Once antibodies tests are available, you can get a sense of how many people in a sample population have had the disease with mild-to-no symptoms, and that can say a lot about how it's spread.

<comment><USER6> > _of the known data, the only reliable one is the death rate_

Back of the napkin numbers to get someone's attention:

        deaths today / CFR of 0.009 = cases three weeks ago

        cases three weeks ago * 7 three day doublings = cases today

In much more detail:

[http://hyperdrive.ca/coronavirus/index.php](http://hyperdrive.ca/coronavirus/index.php)

And in the "4 out of 5 dentists agree" category:

[https://fivethirtyeight.com/features/experts-say-the- coronav...](https://fivethirtyeight.com/features/experts-say-the-coronavirus- outlook-has-worsened-but-the-trajectory-is-still-unclear/)

</comment></comment><comment><USER7> 1\. How do frequency and density of exposure correspond to infection rate?

I'm assuming there are some basic principles that apply to any virus, but I don't know what they are and have found it difficult to get find meaningful information.

2\. If lowering frequency and density of exposure reduces infection rate - <USER2> the papers that Google surfaces when querying this kind of thing suggest - does this mean that social distancing could be more than a knee-jerk means of reducing the stress of the healthcare system? Could it form the basis of a long-term containment strategy?

3\. Would it be possible to randomly test high-traffic areas (grocery stores and gas stations in the US) to get a better sense for how this disease is spreading? Why are we not doing this?

</comment><comment><USER8> The origin of the virus. The mainstream media assumes the virus was created in a natural process of mutation and jumping species, while there's this little paper [1] in Nature Medicine from 2015 where authors (virologists) confirm that they created a novel, human-transmisible coronavirus, based on a new virus they discovered among bats. Some of the authors of the paper are from Key Laboratory of Special Pathogens and Biosafety at the Wuhan Institute of Virology...

[1] [https://www.nature.com/articles/nm.3985](https://www.nature.com/articles/nm.3985)

<comment><USER9> "This was created in a lab" has been the whisper of conspiracy-theorists. How likely is it? And a vial broke and it got released like in a Marvel comic?

<comment><USER8> Coronaviruses are actually created in labs as part of virology research (see my original link). It just seems that, in light of links that people posted, it did not escape/was released from the Wuhan lab - the strain that created the pandemic originated via natural processes.

<comment><USER10> Nah, see my comment above. Those links only tell us that we did not find evidence of the use modern gene-editing technology in the virus. It's misdirection with a straw man.

The lab was breeding viruses the old-fashioned way long before modern gene- editing technology was invented. Bat coronaviruses would be mixed with other viruses and repeatedly passed through human cells. That leaves no evidence in the genome. It looks just like natural selection.

The virus labs in China have had several other dangerous accidents that let viruses get out. Those previous accidents were gotten under control. With this one, we weren't so lucky. I think the lesson is clear: don't screw around making deadly viruses when your biohazard containment is substandard. Maybe just don't attempt it under any conditions.

<comment><USER9> There's a lot of supposition here. If this extraordinary claim is true, why isn't it screaming at the top of headlines?

<comment><USER10> Lots of reasons:

There is a difference between "seems obviously correct" and "proven well enough to avoid a lawsuit".

China exerts control over American media companies. Ones that don't play ball get banned in China. Remember that these companies are usually involved in many businesses, including the sale of movies to China's large population. Everybody is afraid to upset China.

Even the publisher of Nature has ditched about 1000 articles that were upsetting to the Chinese government.

Much of the US media is strongly in opposition to the US president. (They even stopped airing his virus updates, despite good ratings, because it was making him look good.) There is no desire to spread any news that could support his opposition to China.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> We hear stories about production ramps for personal protective equipment, for healthcare providers and regular citizens. But what are the actual projections for the need-curve vs. the availability-curve of those commodities in various places?

</comment><comment><USER11> What is the _true_ mortality rate? All the numbers are based on positive test counts, but testing isn't being done for most people with nominal (casual) symptoms.

This has led to a situation where we think (for example) 2% of positive cases die, when in reality, there may be millions of positive _untested_ cases resolving without issue.

</comment><comment><USER12> Which medical centers are overwhelmed and which ones are operating normally.

</comment><comment><USER13> Numbers related to the outbreak that are meaningful without denominators (since we don't have any and won't until long after things get back to some semblance of normalcy). Seems like this would be hospitalizations (due to covid) and deaths (due to covid). Those are numbers where the volume (as opposed to the rate) are the signal.

</comment><comment><USER14> As per: [https://www.arcgis.com/apps/opsdashboard/index.html#/bda7594...](https://www.arcgis.com/apps/opsdashboard/index.html#/bda7594740fd40299423467b48e9ecf6)

In China: Total Confirmed = 81,782 Total Recovered = 74,181 Total Dead = 3,291 \</comment><comment></comment><comment></comment><comment></comment><comment>-- Remaining = 4,370

* I am assuming the number 4,370 will fall either into Recovered or Dead.

Can someone confirm this theory?

Is this going to the same for US?

Total Confirmed Cases = 69,684 Total Recovered = 619 Total Dead = 1,049 \</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-- Remaining = 68,016

Does this mean the fate of 68,016 not known yet in US? A similar concerning number exists for Italy too.

<comment><USER15> 80%-85% of the 68k are probably mild cases that will recover without medical help.

15-20% will need hospitalization. ~5% will need ICUs.

0.5%-5% will die depending on whether the medical system is overwhelmed.

<comment><USER16> Maybe. If most are mild, how did they ever become confirmed cases? I would assume that mild cases would never get tested.

</comment></comment></comment><comment><USER17> Fully anonymized medical history/demographics data across countries and open to the public.

This would allow crowd sourcing and statistics to be applied by the best minds in the world.

I know regulations can make this difficult but many difficult boundaries are being pressed now.

</comment><comment><AUTHOR> Some anecdotes of covid19 infection talk about people being in severe pain. What's the relationship between that symptom and final disease outcome?

</comment><comment><USER18> more granular or qualified statistics.

e.g. yesterday, Gov. Newsom went on the radio and said something along the lines of "half of people hospitalized were 18-60" (paraphrasing, don't remember the numbers exactly, etc). But something like 2/3rds of our population is that age!

Another thing would be statistics on triage as the outbreak overwhelmed Italy. I'd like to know who was going to the hospitals, who was admitted, who needed to be in the ICU, etc, and how the profile of patients changed as beds got filled.

Nutrition. I've already noticed food purchasing has changed at my local stores. I would like to know if we're exasperating our public health crisis by ruining our diets and if we should be concerned about that moving forward.

And finally, alcohol and drug consumption - particularly by millenials. Anecdotally, many of my peers are drinking a lot more regularly than they normally would during the day and week. There are plenty of memes about it, but I'd like to know if we're looking for hope at the bottom of a bottle for the next few months.

</comment><comment><USER19> A detailed break down by age.

Then bonus points would be a column showing the mortality rate of a person in that country.

For instance an 80 yo in the US has a 6% mortality.

<comment><USER20> Here you go. This shows a breakdown of fatality rate by age. [https://www.worldometers.info/coronavirus/coronavirus-age- se...](https://www.worldometers.info/coronavirus/coronavirus-age-sex- demographics/)

</comment></comment><comment><USER4> Why does almost everyone I talk to report having a flu like illness in January that tested negative for flu?

</comment><comment><USER21> 1\. What happens in the middle, between a lock-down bringing down the infected numbers and vaccine.

I've read a few things from epidemiologists, but there seems to be little discussion in the wider media.

[https://medium.com/@tomaspueyo/coronavirus-the-hammer-and- th...](https://medium.com/@tomaspueyo/coronavirus-the-hammer-and-the-dance- be9337092b56)

2\. What's going on with the PCR reagent shortage? Where are they produced? Why is it hard to make it quickly? etc.

</comment><comment><USER22> What does successful containment look like 3 months, 6 months, and a year from now?

</comment><comment><USER22> What should governments be doing for maximum practical containment?

</comment><comment><USER22> To what extent will lies, half-truths, spin, and disinformation increase preventable fatalities? What can be done within existing legal frameworks to stop this disinformation?

</comment><comment><AUTHOR> What are the current projections of test-kit availability vs. need for different regions? E.g., when do we expect that doctors can test everyone that suspect of having covid19?

<comment><USER23> We actually need more testing than that. Yes, we should be testing every suspected case, but we should also be mass testing everybody, or, at least random samples of everybody. We need to know where this virus is and is not and what the extent of asymptomatic carriers is. Information is the only weapon we currently have against this virus, and we have shockingly little.

</comment></comment><comment><USER24> A discussion of how regulatory structures contributed to problems in the US (lack of tests, number and variety of providers and services, and so forth).

</comment><comment><USER4> I'd like to see the rumor that people can't develop an immunity to this put to bed. Surely we have enough data at this point.

<comment><USER23> Is that the rumor? Last I had heard, the best science is essentially a guess, but the thinking is that people will develop some kind of immunity. We know this happens with other coronaviruses, and we have found antibodies in people who have recovered from the disease. I don't really know how we can definitively and ethically say "yes, people do develop some immunity to the virus" without deliberately attempting to reinfect people. Maybe an _in vitro_ study would add to the evidence, but _in vitro_ studies frequently don't scale up to whole humans.

</comment></comment><comment><USER4> Why don't we get any information on if the shutdowns are working? Why is nyc still so bad?

</comment><comment><USER25> Why did/does China lie so early and so often about the progression of the epidemic?

</comment><comment><USER26> What is the sensitivity and specificity of the Coronavirus tests?

</comment><comment><AUTHOR> In early public reporting on covid19 in the U.S., when the patient died it was common to hear that he/she had "underlying health issues".

Why be so vague? It seems like more detail would help people identify their personal risk level.

(Edited for tone.)

<comment><USER27> Privacy?

<comment><AUTHOR> I've heard that idea floated before, sometimes in conjunction with references to the U.S.'s HIPAA law.

But I've only heard speculation about this - never an explanation from someone closer to the source.

<comment><USER27> I don't know about the US but at least in Norway it's stated as a reason. Age, geography and diagnosis is sometimes enough to identify a person, and there are regulations governing that here.

</comment></comment></comment></comment><comment><USER4> Why do medical personnel seem to get hit harder with this?

</comment><comment><USER4> I think we should be following all of these vaccines and clinical trials really closely.

We all watch what the stock market does every day. Let's start watching what these trials are doing every day. Really put the spotlight on these folks.

I feel like as a population we're acting too much like victims. Let's take charge of this.</comment>


Thoughts on Tor appliances - <AUTHOR> https://frederik-braun.com/thoughts-on-tor-appliances.html <comment><USER3> Routing all of your traffic through Tor indiscriminately is a really, really bad idea - and not solely for the reason described in the article. When you use Tor, you're accepting the risk that the exit node could be sniffing and/or manipulating your traffic as a tradeoff in order to hide your IP address from the remote server and anyone in between. For that reason, if you really need to use Tor then you need to be aware of every connection you make - <USER2> should be over SSL with pinned or otherwise verified certificates.

I'd recommend against even enabling Tor globally for a single machine, unless that was a dedicated box that's only used for anonymous browsing. You don't want to get tripped up by that browser window you accidentally left minimized with some Javascript periodically reloading content, or perhaps some auto- update program running in the background that you didn't realize was leaking some unique identifier.

Routing all of your network's traffic through Tor is just begging for bad things to happen, nevermind the fact that it essentially negates any anonymity that Tor afforded you to begin with. If you absolutely must use Tor for something, the safest way to do so is to connect to Tor, make whatever connections you need to make (and _only_ those connections), then immediately get off.

<comment><USER4> Indeed: Client fingerprinting--when you're doing nothing unusual as well as when you're doing something "secret"\--is just as deadly with Tor enabled, even if your true IP address isn't visible.

</comment></comment><comment><USER5> Just an FYI on Anonabox, it might not be what people thought it was:

[https://www.reddit.com/r/privacy/comments/2j9caq/anonabox_to...](https://www.reddit.com/r/privacy/comments/2j9caq/anonabox_tor_router_box_is_false_representation/)

<comment><USER6> Wow. That was awesome. Highly recommended read. Reddit OP goes into an impressive amount of detail showing it's nothing but a scam. I hope those who donated via kickstarter get their money back.

<comment><USER7> Its not technically a scam, in the legal sense of the word. So, unless they cancel they won't get their money back.

<comment><USER8> It may be in violation of the Kickstarter ToS, though.

Also, it's likely fraud, in the legal sense of the word, because they're materially misrepresenting the product in order to get consumers to pay for something they otherwise might not.

</comment></comment></comment></comment><comment><USER9> I actually think the WIRED piece [1] to which OP refers does a good job of addressing this point. In particular, the WIRED article mentions PORTAL, a competing device called the SafePlug (which we did some research on to show that it does this job rather poorly), and something I'd never previously heard of called OnionPi.

Also, the article states very clearly states: "If you use the same browser for your anonymous and normal Internet activities, for instance, websites can use "browser fingerprinting" techniques like cookies to identify you.", which is basically the point of this post.

The WIRED piece even goes further, offering the same solution as is offered in this piece: "[an expert] suggests that even when routing traffic over Tor with Anonabox, users should use the Tor Browser, a hardened browser that avoids those fingerprinting techniques."

So while I understand the gripe that a transparent Torifying proxy doesn't necessarily do what you think it should, I would also praise WIRED for doing a pretty good job of handling these difficult and subtle issues in their article about the Anonabox.

[1] [http://www.wired.com/2014/10/tiny-box-can-anonymize- everythi...](http://www.wired.com/2014/10/tiny-box-can-anonymize-everything- online)

</comment><comment><USER10> We've thought about this with PORTAL/Masquerade (should be available on Amazon Prime shipping by December for $25, with free downloads for a few COTS $20-30 routers -- sorry, was very busy with CloudFlare stuff for the past 4.5 months, and Grugq was working on an awesome phone project which launched at HITB KUL which I dearly want to buy one of).

It's not strictly "run Tor for everything", it's more like "inexpensive, fairly intelligent firewall for $0-25.) I'll post more info later; finishing up a talk for Black Hat EU in 4h43m.

Not a fan of anonabox, personally -- I think it's scammy to sell hardware from a Chinese OEM on kickstarter, and to run ~unmodified OpenWRT + Tor on it, but more seriously, it's a problem because it doesn't provide meaningful security OR anonymity to users.

Someone's going to buy one of these, take it to Syria, expect it to provide what a reasonable person would expect it provides, and end up, if lucky, in jail -- more likely, dead.

(We're pricing everything at cost, plus maybe $1-2 for fuzz factor; I'll donate anything left over to Tor Project, OpenWRT devs, or some other reasonable open source project we use.)

<comment><USER11> Can you share a bit more details on the PORTAL/Masquerade?

<comment><USER10> Www.portalmasq.com

Presentations at hope, DefCon, hitb, and next toorcon

</comment></comment></comment><comment><USER12> Tor is so useless for regular browsing. Nearly every site flags your IP as source of spam making the user experience poor at best. I can see how tor is useful in some instances but for 90% of web activities it's more trouble than its worth.

</comment><comment><USER13> Does getting Anonabox help me stop paying for a VPN? For example, I use PrivateInternetAccess now.

<comment><USER14> That depends on what you use a VPN for. Tor will overlap, kind of, with some use cases (more anonymised exit points) but the two are not interchangeable. I believe from previous HN discussions (and am happy to be corrected by those more knowledgeable than I) that using both is probably your best bet for covering all use cases.

</comment></comment><comment><USER15> Wow, 500k for a project which wanted only 7500!

Clearly shows there is need for such a product.

<comment><USER5> We'd all be better off giving 500K to the OpenWRT developers at this point.

</comment></comment><comment><USER16> Repeating a comment I made 3 days ago: ([https://news.ycombinator.com/item?id=8449909](https://news.ycombinator.com/item?id=8449909))

      Note that Tor is still being actively funded by US law enforcement
      (http://pando.com/2014/07/16/tor-spooks/) and that Tor's security
      has been repeatedly broken by US law enforcement in order to take
      down sites illegal under US law. (http://www.wired.com/2014/09/fbi-
      silk-road-hacking-question/)

      It is debatable if Tor provides any more security than just using
      someone else's open wifi point. Great for evading bans on online
      forums, worthless against the DEA.

<comment><USER17> This comment is really off base (and so is the pando story it's based on).

First, TOR is being funded by the DoD, which is not a US law enforcement agency. The US government conflates the military and police enough for everyone without its critics doing so as well.

Second, yes, TOR is funded by the DoD because having a network that enables US agents to anonymize themselves from entities other than the US government is in the interest of the US government. And yes, the US government is also trying to deanonymize TOR traffic because TOR users being knowable by the US government is /also/ in the interest of the US government.

None of this is surprising or strange or fishy at all. And none of it is evidence that the TOR developers have made any compromises on anonymity. The US government may be able to deanonymize TOR traffic; that's bad, but I have ever confidence that the TOR developers are trying to do something about it.

<comment><USER18> > I have ever confidence that the TOR developers are trying to do something > about it.

The basic architecture of TOR is limited theoretically with regards to some types of attacks it can handle.TOR developers probably cannot do anything about that.

And in some sense , supporting TOR is taking funding and attention from better anonimity technologies , that might be able to do the job , with enough development. That's another reason why the US government is investing in TOR.

<comment><USER19> > The basic architecture of TOR is limited theoretically with regards to some > types of attacks it can handle.

Would you mind providing some links on this topic? This is the first I have heard of this particular assertion and I would be interested to read more.

<comment><USER8> The original Tor proposal has a pretty good summary of the threats they do and don't deal with, and other sections cover the project goals and how they address these threats.

> A global passive adversary is the most commonly assumed threat when > analyzing theoretical anonymity designs. But like all practical low-latency > systems, Tor does not protect against such a strong adversary. Instead, we > assume an adversary who can observe some fraction of network traffic; who > can generate, modify, delete, or delay traffic; who can operate onion > routers of his own; and who can compromise some fraction of the onion > routers.

> In low-latency anonymity systems that use layered encryption, the > adversary's typical goal is to observe both the initiator and the responder. > By observing both ends, passive attackers can confirm a suspicion that Alice > is talking to Bob if the timing and volume patterns of the traffic on the > connection are distinct enough; active attackers can induce timing > signatures on the traffic to force distinct patterns. Rather than focusing > on these traffic confirmation attacks, we aim to prevent traffic analysis > attacks, where the adversary uses traffic patterns to learn which points in > the network he should attack.

> Our adversary might try to link an initiator Alice with her communication > partners, or try to build a profile of Alice's behavior. He might mount > passive attacks by observing the network edges and correlating traffic > entering and leaving the network — by relationships in packet timing, > volume, or externally visible user-selected options. The adversary can also > mount active attacks by compromising routers or keys; by replaying traffic; > by selectively denying service to trustworthy routers to move users to > compromised routers, or denying service to users to see if traffic elsewhere > in the network stops; or by introducing patterns into traffic that can later > be detected. The adversary might subvert the directory servers to give users > differing views of network state. Additionally, he can try to decrease the > network's reliability by attacking nodes or by performing antisocial > activities from reliable nodes and trying to get them taken down — making > the network unreliable flushes users to other less anonymous systems, where > they may be easier to attack. We summarize in Section 7 how well the Tor > design defends against each of these attacks.

From the Tor proposal: [https://svn.torproject.org/svn/projects/design- paper/tor-des...](https://svn.torproject.org/svn/projects/design-paper/tor- design.html#subsec:threat-model)</comment></comment></comment></comment></comment>


How Pixar's Toy Story 2 was deleted twice (2012) - <AUTHOR> https://thenextweb.com/media/2012/05/21/how-pixars-toy-story-2-was-deleted-twice-once-by-technology-and-again-for-its-own-good/ <comment><USER2> How would git perform as source control for large binary files like the ones Pixar are working with?

<comment><USER3> Absolutely terrible. Don't do it without Git LFS.</comment></comment>


US government rescinds 'leave Internet alone' policy - <AUTHOR> http://www.theregister.co.uk/2010/02/27/internet_3_dot_0_policy/

<comment><USER2> I'll be writing my congress people with something to the effect of "do not want". You should too.

<comment><USER3> Absolutely. Will do.

Also note that this article quotes an administration official. Everybody who voted for this administration should write them and tell them that this is a Very Bad Idea.

<comment><USER4> With Joe Biden as a member of this administration, it should not come as a surprise to anyone.

Biden opposes encryption, loves the patriot act, and wanted to legalize permanent detention of non-U.S. citizens without judicial review (this was Feb 1995, before the war on terror). Is it any surprise that the government now wants control of the internet?

<http://news.cnet.com/8301-13578_3-10024163-38.html>

</comment></comment></comment><comment><USER5> I can't really tell if this is something legitimately new and scary, or if it's just a mix of political grandstanding and journalistic FUD.

<comment><USER6> It's very real. Countries across Europe are passing similar laws, pressured heavily by US copyright lobbies. It's no surprise that the US is finally following suit.

Ironically, these very laws are driving internet users to purchase anonymous VPNs to completely protect their privacy - preventing ISPs and government agencies from knowing anything at all concerning their online use. So, yes, it's real, but the ultimate outcome may be greater privacy.

</comment></comment><comment><USER7> Here's another HN post that actually has the NTIA release on this: <http://news.ycombinator.com/item?id=1157482>

This is very bad.

</comment><comment><USER8> Hmm, this article is a little light on the facts. Internet "regulation" can mean so many things that I'll wait until they make a proposal. For example, if they make some law requiring "internet security," I'll just laugh in their faces. Technology doesn't work some way just because you'd like it to.

</comment><comment><USER9> I wonder how the government will define copyright infringement -- does this mean anyone with copyrighted material on their computer will be "banned from the internet"? (also - what does that even mean?)</comment>


Ask HN: Best way to make diagram for GitHub project? - <AUTHOR> I want to make great documentation for my open source Github project related to data engineering.
My project involves parsing and rearranging blocks of data extensively. This makes it confusing to describe in writing, but trivial to understand visually (for that kind of thinker).
The diagram is basically lots of multicolored rectangles being grouped and rearranged.
What do people here recommend? <comment><USER2> Generate SVG files with Inkscape, then link them to your GH MD files like so: [https://github.com/potherca- blog/StackOverflow/blob/master/q...](https://github.com/potherca- blog/StackOverflow/blob/master/question.13808020.include-an-svg-hosted-on- github-in-markdown/readme.md)

</comment><comment><USER3> I really like PlantUML, because you can just define diagrams as plain text.

I use the VS Code plugin for PlantUML + Markdown - easy generation of PNG for use on GH.

Needless to say: works best with UML diagrams, but also supports general diagrams (untested by me).

[http://plantuml.com](http://plantuml.com)</comment>


A transportation engineer has a simple solution to potholes: pave better roads - I-M-S https://www.thestar.com/news/gta/2018/03/09/pothole-problem-can-be-solved-carleton-professor-says.html <comment><AUTHOR> Reminds me of this section[2] from "How Engineers Create the World" by Bill Hammack - an interesting but perhaps scattered read.

      Well, a pothole is not just a technological thing,
      it's also a political entity. Usually we think of
      European nations as steeped in governmental regulation,
      and the United States as a free market, but actually
      the opposite occurs in building roads. In the United States
      the government sets specifications and asks contractors
      to meet them. Once done with the road they have no
      more responsibility.

      Contrast this to France where the contractors must come
      up with their own specifications and guarantee their work.
      This means that if a pothole developers the contractor has
      to fix it. But in the united States, once the job is done,
      as long as it has met specifications, the contractor is no
      longer liable.

1\. [https://www.amazon.com/How-engineers-create-world- commentari...](https://www.amazon.com/How-engineers-create-world- commentaries/dp/0983966109)

2\. [https://i.redd.it/uthzdyul53fy.png](https://i.redd.it/uthzdyul53fy.png)

<comment><USER2> Reformatted for those on mobile:

> Well, a pothole is not just a technological thing, it's also a political > entity. Usually we think of European nations as steeped in governmental > regulation, and the United States as a free market, but actually the > opposite occurs in building roads. In the United States the government sets > specifications and asks contractors to meet them. Once done with the road > they have no more responsibility.

> Contrast this to France where the contractors must come up with their own > specifications and guarantee their work. This means that if a pothole > developers the contractor has to fix it. But in the united States, once the > job is done, as long as it has met specifications, the contractor is no > longer liable.

(Please don't use code blocks for quotations.)

<comment><AUTHOR> I like that you copied it typos and all ;)

I retyped it from the screenshot on my way out the door at work and now note a number of mistakes.

</comment></comment></comment><comment><USER3> This strikes me as a classic separation of buyer interests from vendor interests leading to misaligned incentives. The contractors have no incentive to update their equipment. In fact if this is scientifically proven to be a major solution they should want to avoid this. If the province could incentivize the vendor to pay them more for every year there is no pothole and punish them for every pothole they would totally adopt this tech.

<comment><USER4> I would argue that lack of adoption is likely a discovery and design problem rather than an economic one. In a free market other people can choose to enter into the contracting business. If I have a leg up on my competition (paving better roads for the same cost) I will eventually out compete people who fail to adapt to the new method. This doesn't happen immediately, but you can't fool everyone forever if there truly is a better way of operating.

This technology likely has not been adopted due to difficulty and expense of manufacturing a robust machine and lack of marketing. How many people even knew this solution existed? What is the measurable benefit to paving roads this way? How much does the machine cost vs traditional roller method? All of this work is expensive and there isn't a guarantee of success. While the hypothesis seems reasonable you have to do all the math/science to figure out if this truly is cost effective. Ideas are great, execution is hard.

<comment><USER5> Actually in this case the answer is fairly simple: it's corruption. Most people living in Ontario or Quebec know that the construction industry there is dominated by the mob. You gotta be real careful not to step over the wrong people's feet, especially if you're going after public contracts.

So, suffice to say, there is little real competition because most new competitors get literally threatened for their lives if they try to compete.

<comment><USER6> I don't know about the rest of Ontario, but this is 100% not true for the Toronto area. I used to be in the industry and I saw something shady only once and it was very, very minor. My brother is also a higher up at Ellis Don and he complains about concrete trucks getting stuck in traffic, not mob grift.

<comment><USER7> I know current senior engineers that see plenty of corruption and shady practice, including on road construction on a regular basis in Ontario, and yes, the Toronto area.

Construction companies routinely don't build each layer of road up to code. Thus potholes appear much sooner than they should.

<comment><USER6> Corruption is bribing the construction inspector to look the other way—it's not laziness or poor workmanship. I've both worked for pavers and for the TTC as a construction inspector. Never once saw real corruption or a bribe over 5 years. I bent the rules a tiny bit once when a concrete placement was going sideways in the interests of expediency (but followed up with additional testing to make sure everything was ok) and the CEO got me a 26 of Crown Royal as a thanks. That's the full extent of the shadiness that I'd witnessed.

<comment><USER7> Since we're talking roads - layers of gravel, and asphalt - it is very easy to save a a lot of money by shaving off some thickness at any level. Construction companies the world over do this and a mm here and there are usually tolerated. Toronto area construction companies skim so much that the roads cave in.

If it isn't corruption, then how are they getting away with it?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Nichols said the AMIR "has great potential" to extend the life of roads, and > "save significant taxpayer dollars." In 2016, an MTO analysis found that the > province would save $50 million annually if roads on the MTOs highways could > last even one year longer.

And there you go... goes against the contractors' interests to use more efficient means, so this compactor's use will have to be mandated by city governments who want to avoid the political backlash of public awareness of wasted budget. Or in other words, good luck with that grassroots campaign.

<comment><USER9> I wonder if that could be resolved by the government offering an annual bonus for every road that requires no pothole maintenance. If the bonus were bigger than the profit they'd make from filling in the pothole, it would be free money for the contractor + a savings for the government because they don't have to pay to fix something that isn't broken.

Mostly, I wonder how different the world would be if there was an incentive to build things that don't break.

<comment><USER10> There are plenty of incentives to build stuff that's resilient; usually financial profit is opposed to it, which I presume was your point.

</comment></comment></comment><comment><USER11> The article calls the invention a paver but it is a compactor (what everyone calls a steamroller).

This article is a little more sciency:

[https://canada.constructconnect.com/dcn/news/Technology/2017...](https://canada.constructconnect.com/dcn/news/Technology/2017/3/AMIR- compactor-to-disrupt-asphalt-paving-by-keeping-roads-grounded-1022176W)

The paver is the machine that catches the asphalt out of the dump truck and spreads it across the road.

<comment><USER12> Took me awhile to figure this out as well, this isn't even a paver, it's a better roller.

IMHO that just makes the difference it produces even more impressive, I thought this was a totally different paving machine.

</comment></comment><comment><USER13> I've always read that road damage was caused by heavy vehicles(semis) which stress fracture the roads, which in turn fill with water, freeze, expand, rinse and repeat. This article seems to imply it's caused by the road design itself, though. Wonder which is true (or both)?

<comment><USER14> We have potholes in Florida. No freezing.

<comment><USER15> But we don't really have potholes in CA, at least not the quantity and quality that I experienced living in PA. It's a minefield there right now, so I would imagine freezing is part of the problem, or at least exacerbates it.

<comment><USER16> What? I never seen worse road in my life than in LA..

<comment><USER17> Is that because in LA you have time to scrutinise in depth a great deal of tarmac? ;)

</comment></comment></comment></comment></comment><comment><USER18> I've always wondered why we still have such crappy roads, given that roads are possibly the oldest technology there is, and every civilized place on earth has paved roads, thus making an enormous potential market for a better solution. Either:

1) Most people don't care as much as I do about the bone-jarring, car-ruining potholes that are ubiquitous in every cold climate on earth, and thus aren't willing to spend their tax money on fixing it, or

2) Engineering a better road is simply too hard of an engineering problem, so what we have is the best we can do at the moment. Or equivalently, any better roads we do know how to make are too cost-prohibitive.

Maybe I'll forward this article to my local representatives.

<comment><USER19> > 2) Engineering a better road is simply too hard of an engineering problem, > so what we have is the best we can do at the moment. Or equivalently, any > better roads we do know how to make are too cost-prohibitive.

This is essentially the case. Asphalt roads as they exist today are basically a really good compromise of all the variables you care about in a road. They are farely durable, are easy to repair, can be laid across various terrains, give good traction, offer a continuous driving surface, shed water farely well, and are realtively cheap. For example cement roads last longer but are not continuous. They have those breaches every few yards that make that obnoxious bump... bump... bump experience. They also have inferior grip.

It's basically the same reason you probably have vinyl windows. Everyone kind of knows they aren't ideal but they are a good compromise of strength, cost and energy efficiency.

You can easily beat asphalt in any one given area but it's hard to do as well across all areas.

<comment><USER20> > relatively cheap

This is a surprisingly big factor: we get bitumen from refining crude oil whether we want it or not, and the endless demand for the lighter fractions of crude means we're gonna do a lot of refining regardless, so the market had to find _something_ to do with the left-over sludge.

Also pushing the price down, asphalt is almost completely recyclable: when a worn-out road surface finally gets dug up & replaced, the old asphalt doesn't go to landfill - it can be crushed up, melted down, and re-layed somewhere else. So much of the demand doesn't actually much reduce the amount on the market.

Compare to, say, concrete: we don't make concrete unless we want concrete, it's not a byproduct of an otherwise-useful process; and once you dig it up, you can only re-use it as ugly gravel, you can't turn it back into fresh concrete.

<comment><USER21> I wonder what shifts in road construction we will see as petro offcast becomes less common, and go up in price? Lubricants, plastics, etc all stand to see a hike.

</comment></comment></comment></comment><comment><USER22> If self-driving cars start to catch on, it seems that the standards for roads must improve. There are some roads in my area that could be an excellent Turing test. If you follow what the lane markers are telling you to do, you die and are probably a robot. If you ignore the markers and survive, you are probably human.

I'd rather increase road standards and accelerate the evolution of self- driving technology than require the development of technology that is capable of driving on today's terrible roads. I know this is not a binary choice -- realistically, both would happen. But I don't think anyone's even talking about better roads for self-driving cars. If even just major roads had to be maintained to a minimally machine-readable standard, it would be a good thing for drivers -- whether human or machine.

</comment><comment><USER23> I was literally wondering about this question the other day. It's 2018; we can make CPUs with 12nm features but we can't make a long lasting asphalt?

Fascinating:

        Nichols said the AMIR "has great potential" to extend
        the life of roads, and "save significant taxpayer
        dollars." In 2016, an MTO analysis found that the
        province would save $50 million annually if roads on the
        MTOs highways could last even one year longer.

        "The MTO is not planning on buying or specifying the use
        of AMIR asphalt rollers..."

Might be of interest, too: [http://www.dykespaving.com/blog/why-use-asphalt- instead-of-c...](http://www.dykespaving.com/blog/why-use-asphalt-instead-of- concrete/)

<comment><USER24> > Asphalt resurfacing simply involves applying new asphalt over the old. > Damaged areas are filled with fresh asphalt, and a steamroller goes over the > entire surface to yield smooth, even pavement.

Florida native, I can tell you this is very temporary. Big chunks will eventually come up and you can see the previous pavement underneath. I'm assuming that between the heat here and the cracks mentioned in the original article that let water seep between the layers, this is just a bad way to fix a road.

<comment><USER25> Up here in Canada, I've universlly seen them grind up the very top layer of the old asphalt before laying down the next layer. I presume that's to improve adhesion. Can't say I've seen many places where obvious delamination of the layers happens. Are they not taking that step in florida?

</comment></comment></comment><comment><USER26> In the North, it seems the interstates and highways tend to get cracks across the entire road at relatively even intervals. I suspect they form where they lay down the rebar supports/holders. It makes sense to me that cracks/"potholes" would form there as it seems that at that point compression of some sort would occur from the weight of vehicles causing the asphalt/road to crumble. While more work to initially build and lay... What would happen if they laid the supports and rebar down like elongated tile or vinyl siding on a house... Never having adjacent pieces ending near each other?

<comment><USER25> I've never seen rebar on asphalt highways. Do they top the concrete highways with asphalt where you are?

<comment><USER26> Yeah you're correct. They are concrete.

</comment></comment></comment><comment><USER27> I've often wondered, especially as I cringe, clench and brace as I encounter another pothole (or chasm) why this is still an issue? Particularly since there are very well known and enduring roadways capable of handling much heavier loads and stresses - specifically airport runways and taxiways.

I can't recall ever seeing a runway shutdown abd inoperable for months on end due to "road work". I can think of a few reasons around why this isn't a thing, most of them being human factor (no money on building something I won't get paid again to fix later). The only "true" reason I can fathom is that runways are much more expensive to build. Order(s?) of magnitude more expensive.

Am I way off the mark, or is there something I've clearly missed?

<comment><USER28> > I can't recall ever seeing a runway shutdown abd inoperable for months on > end due to "road work".

I'm guessing you haven't flown through Phoenix recently? They have had a runway closed for repaving (might be reopened now) since early January.

Runways are generally concrete rather than asphalt and there are plenty of concrete highways. It tends to be a louder and less comfortable surface to drive on and when repairs do need to happen, they're more disruptive than a simple asphalt resurfacing. I'm sure there are other reasons to prefer asphalt, but I'm not a civil engineer.

</comment></comment><comment><USER29> I'm a bit suspicious of the claim that metal rollers cause substantial cracking, or at least enough cracking that this machine with special rubber belts would fix it. I have no experience with this, but it seems that hot asphalt is gooey and would flow enough to seal any cracks that are created during construction. Second, usually a top coat or slurry coat is poured on top of asphalt to seal the surface. I'd think that would seal up any cracks far more effectlvly than this new roller machine.

</comment><comment><USER30> I'm curious how this machine addresses seams in the roadway. Obviously this machine isn't 4-lanes wide, so how to they prevent potholes from forming between seams (often seams are aligned with lanes but they still end up allowing cracks to form.

</comment><comment><USER31> It does not solve anything, just pushes the problem a little further.

<comment><USER32> I recall there was an article on the front page of hacker news not long ago that argued that it was a better use of public money to _not_ pave every road and to let some roads just be dirt roads because the maintenance cost was not justified by the amount of road traffic. This was not the article but similar to it: [https://www.wired.com/2016/07/cash-strapped-towns-un- paving-...](https://www.wired.com/2016/07/cash-strapped-towns-un-paving-roads- cant-afford-fix/)

<comment><USER33> That's how it seems to work with smaller roads in northern Sweden. They have a surface which is kind of compacted sand/gravel, which isn't all that robust long-term but can't really crack and is very easy to fix: a specialized machine drives over it and basically breaks up the top layer, re-applies it and smoothly and compacts everything again, and the road is good again.

</comment></comment></comment><comment><USER34> Wait, you mean they put asphalt on the roads!?!?! More and more I see this step skipped and concrete cross-cut every 50 feet or whatever. Guess where the potholes form...

</comment><comment><USER35> > _"It's not my fault it's not being used, I've done everything a researcher > can do," El Halim said._

What's wrong with much of traditional education summed up in one sentence.

<comment><USER36> Researcher != Educator. There are countless researchers in colleges and universities around the world producing things(useful or otherwise) that don't teach a single class and only mentor grad students because they have to.

And as somebody else mentioned he can't force others to use his technology.

</comment></comment><comment><USER37> Haha I _really_ expected the "pothole problem" to be some kind of mathematical conjecture.

Nope, literal holes in literal roads.

<comment><USER38> Same here, especially with the original title of "a 30 year old machine that solves the pothole problem", gave me visions of a Commodore 64 doing something which could also have been done on a musical gift card nowadays (but isn't). Pity, really, physical pothole problems are so simple to solve...</comment></comment>


Show HN: Fun, simple feature tours for your website or app - <AUTHOR> http://tommoor.github.com/crumble

<comment><USER2> I used to use a system like this for my software, and unfortunately I found that it did a terrible job of educating users. People would work through the entire tutorial (~5 minutes), get to the end, and then email/call me with questions that were covered in the tutorial.

I switched to just showing a few short videos demonstrating things and it works much better. It's disappointing because I was really excited about the potential of an interactive guide (and I spent a long time building it), but I can't argue with the numbers. My guess is that users were so focused on completing the steps that they didn't bother actually looking at the software, so they didn't retain anything. I can confirm that this is what happened with me when I clicked through to the link above. I clicked through all of the bubbles and finished the tutorial without reading a single word of text on the actual page.

<comment><AUTHOR> Great feedback, I don't know what your tour looked like and what the level of text was but I would hope that by keeping the individual points very simple and visually attractive they would stand a higher chance of being read?

<comment><USER2> The guide itself was definitely being read. I built it directly into the app, so users could only advance the guide by completing the step described (like, they'd have to actually create a new contact before the guide would advance). A surprisingly high number of people completed the entire thing (~45% if I remember correctly) but very few of those people seemed to actually retain anything. We received way more support requests, and the conversion from trial to paying customers decreased (relative to just showing a video).

I don't mean to suggest that interactive tutorials can't ever work, but they were a huge failure for me. The only upside was that several people contacted us specifically to mention how awesome they thought the tutorial was. However, most of those people seemed to be other software developers that were interested in doing something similar. They didn't seem to actually be any more likely to subscribe.

</comment></comment></comment><comment><AUTHOR> Crumble is a jquery plugin that makes it easy to create tours to introduce new users or new features. It is built on top of grumble.js by James Cryer to generate the bubbles themselves.

The library also uses a standard ordered list to store the tour information, making it accessible.

Thoughts welcome!

<comment><USER3> I think it would help to have a more obvious method for dismissing the bubble, like an X button, or a button that explicitly says OK on it, to give a better visual clue for users that are using a touch device or don't think to try hovering over the bubble to see if it's clickable or not.

<comment><AUTHOR> Hey, good feedback for sure - in all there is no button so as to keep the aesthetic simple - the entire bubble is always the button.

The first step in the tour tells the user they can click to continue, I would definitely recommend that you do this if using the library. You can also hit ESC to exit the tour.

</comment></comment></comment><comment><USER4> Folks who've used tour things like this: how do you detect if it's the first time your users are using your app? Do you make a db query every time they log in? Do you use cookies? Cookies seem unreliable and a flag in the database seems a waste of resources.

Thoughts?

<comment><AUTHOR> We store a flag on the user that the tour has been seen. The user is always loaded with the page anyway so it's no extra DB calls to get this information.

<comment><USER4> Ah. Fair enough. Thanks for the tip.

</comment></comment></comment><comment> johnx123-up Similar jQuery plugins:

1\. <http://sorich87.github.com/bootstrap-tour/>

2\. <http://tracelytics.github.com/pageguide/>

3\. <http://tympanus.net/Development/WebsiteTour/>

4\. <http://alvaroveliz.github.com/aSimpleTour/>

5\. [http://www.zurb.com/playground/jquery-joyride-feature- tour-p...](http://www.zurb.com/playground/jquery-joyride-feature-tour-plugin)

</comment><comment><USER5> Initial thoughts: 1\. A circle is not a very effective content area at this size, particularly for instructions or steps.

2\. Why an image instead of CSS?

</comment><comment><USER6> This is good. I remember seeing a couple of other walk-through plug-ins recently on HN, except they both wanted a monthly subscription. Unless they're also offering (and you require) heavy duty analytics, something like this with perhaps a few tweaks should be fine for a basic introduction.

</comment><comment><USER7> This is great and I'll probably use it! However, I think I might fork because I don't like that the bubble is an image. If it were just css it would be much easier to style. Is there a specific reason why it is an image? I guess it would be fairly easy to replace the sprites with others.

<comment><AUTHOR> Hey, using images allows compatibility back to IE6. You can read up on the original grumble post here which crumble depends on:

<http://jamescryer.github.com/grumble.js/>

</comment></comment><comment><USER8> This is exactly what I've been considering using on <http://debugmap.com> It's a site that needs a little explaining but I hadn't been able to come up with something usable myself. I'm going to try it out soon, thanks!

</comment><comment><USER9> Nicely done. One thing: I think you need to be careful it doesn't get frustrating for users - perhaps have the messages dismiss when you click on website elements, and try to place the bubble so it doesn't hide the wrong part of the app?

<comment><AUTHOR> I could definitely include this as an option

</comment></comment><comment><USER10> Seems very similar to <https://taurus.io/>

<comment><AUTHOR> There are a few different solutions for providing this kind of functionality, if you need different buttons, deeper explanations or have more than a 4-5 points to make then this library probably isn't appropriate!

<comment> mck- And Crumble is open-source! Which is awesome!

Great job, I was looking for something exactly like this - simple. Will try tomorrow

</comment></comment></comment><comment><USER11> Look's great. I'm going to give it a try to guide first time users of my app.

</comment><comment><USER12> Fun? How?

<comment><AUTHOR> Who doesn't love bubbles?</comment></comment>


The FBI's Massive Facial Recognition Database Raises Concern - <AUTHOR> http://singularityhub.com/2014/04/27/the-fbi-has-a-massive-facial-recognition-database-but-is-it-ready-for-primetime/ <comment><USER2> I feel this is the least worrying database around, because of a the simple check on its accuracy and the biometric used.

Facial recognition is what we humans are all about - we have surprisingly strong taboos about covering up this very useful and universal biometric already and any flaws in the algorithm or software are much much easier to challenge than DNA tests (I can stand up to a jury all day and say it was not me, and they will most likely believe a DNA expert. show them a picture of someone who just looked like me and they will all use millions of years of evolution to set me free)

Yes it is worrying that any mass databases are being compiled, and yes we must debate as a civilisation how we are going to mitigate the downsides and promote the upsides, but this is not a disaster. not like PRISM.

<comment><USER3> If the only thing you're worried about concerning mass surveillance is that it could be inaccurate, I can see why you aren't worried.

<comment><USER2> That's a little disingenuous no?

There are many things to be concerned about, but it is worth having a fuller discussion about the problem.

I think we are all talking about passive surveillance - My views are that mass passive surveillance has always been with us. We are surveilled by our neighbours and strangers all day everyday. Until recently that was entirely based on the facial biometric recogniser "Human Eyeball v1.0".

Generally our neighbours do/did nothing with their metadata collections - maybe some salacious gossip, occassionally criminal behaviour.

Privacy has till now been the politeness of our neighbours.

However on the Internet everyone is now a neighbour. A Good Thing mostly but it has implications for that metadata store. PRISM shows what a meta-metadata store looks like, and history shows us what will be done with it.

It is worth noting that what in civilian circles is called "private" most governments see as "secret". They are going to freak when we really start handling Big Data. Even now I would be surprised if the Chinese / Russian intelligence services have not hoovered up all Facebook and LinkedIn.

Those PhD Students from MIT 10 years ago will be doing some interesting work for the government now, and thier connections will map the halls of weapons researchers and government quite well. OpenMapping, satellitte and UAVs, a flood of data will pierce everyone's privacy.

Anyway, people now are able to monitor others not physically close to them. Some like NSA are going for total knowledge, others like Tesco or Walmart have a more narrow focus but deeper focus (I am pretty sure the NSA will not know my wife is pregnant before I do. Or that Gen. Alexander is really in for it!)

But we have no framework for dealing with this, no laws or even ideas of laws we want. The idea of Big Data will give us such benefits that "stop progress" is not a viable response. But what is? Data cannot be labelled. So ...

</comment></comment></comment><comment><USER4> "may include as many as 52 million face images by 2015"

Huh? If you've had a drivers license or passport photo taken then it's in a federal database. Maybe they aren't shared well across all federal organizations yet but that's only a brief matter of time.

</comment><comment><USER5> What about Facebook's massive facial recognition database? Any concern for that, especially since we voluntarily contribute to it?

<comment><USER6> Oh, it's far worse, and there's nothing voluntary about it (just as there's nothing voluntary about GMail). And even if it were voluntary, Facebook (and Google, which is far, far worse, IMO) tries not at all to make it clear to the public how they pay for Facebook's services. The massive spying and data collection by Google and Facebook is probably the largest , and possibly most dangerous, surveillance campaign in history. Worst of all, unlike the FBI (or the NSA), Facebook and Google constantly analyze and use any piece of personal data they can get their hands on.

<comment><USER7> I don't necessarily disagree, but intent plays a role here too. Google's intentions and the FBI or NSA's intentions differ quite strongly when they have your personal information in their system.

<comment><USER6> Well, the FBI's intentions are to catch criminals with the information, while Google's and Facebook's are to sell it for profit.

<comment><USER8> And the FBI NEVER would abuse their power or use their access for other purposes. Same as the NSA.

<comment><USER6> _Of course_ they might. But so would Google and Facebook. And in either case it doesn't even have to be an order from above, but an action by a single employee. At least I'd like to hope that the FBI performs more thorough background checks on its employees than Google or Facebook.</comment></comment></comment></comment></comment></comment>


OpenStreetMap redaction underway - <AUTHOR> http://blog.osmfoundation.org/2012/07/09/licence-redaction-ready/ Contributions from individuals unwilling to accept the project's move from CC-BY-SA 2.0 to Open Database License (OdbL) 1.0 are being removed. OSM reports that less than 1% of data will be removed. @harry_wood has created a progress map for the progress: http://harrywood.dev.openstreetmap.org/license-change/botprocessing2.php <comment><AUTHOR> Contributions from individuals unwilling to accept the project's move from CC- BY-SA 2.0 to Open Database License (OdbL) 1.0 are being redacted. OSM reports that less than 1% of data will be removed. <http://twitter.com/harry_wood> has created a live map of the bot's progress: [http://harrywood.dev.openstreetmap.org/license- change/botpro...](http://harrywood.dev.openstreetmap.org/license- change/botprocessing2.php)</comment>


Towards verified compilation of CakeML into WebAssembly [pdf] - <AUTHOR> https://lorenz.leutgeb.xyz/paper/cakeml-wasm-viennajs-beam.pdf <comment><AUTHOR> video from the talk at the JavaScript meetup in Vienna: [https://m.youtube.com/watch?v=qRkxbWRJQyc](https://m.youtube.com/watch?v=qRkxbWRJQyc)</comment>


What's wrong with Flash Cookies? - <AUTHOR> http://blog.jgc.org/2010/06/whats-wrong-with-flash-cookies.html

<comment><USER2> As a side note:

"This means that if, for example, you use the private mode to browse pornography..."

I like that private browsing is recognized for it's primary purpose without the usual hypocrisy (like: "private browsing is useful when you browse for presents for your family and don't want to spoil the surprise"). We all know why private browsing is there.

What I also find quite funny is that Apple was the first one to introduce private browsing. The same Apple that now wants to "free people from porn" (quote from a Steve Jobs email).

<comment><USER3> I've actually found it immensely useful for being able to log into a different Gmail account without signing out of my primary.

<comment><USER4> That's what other browsers are for ;p

</comment></comment></comment><comment><USER5> The Firefox "Better Privacy" extension can delete these when you close the browser, or better yet on a timer, every few minutes. This allows you to use Flash sites that rely on them without most of the privacy issues.

(Note: don't play any long-term Flash games with Flash cookies disabled).

<comment><USER6> I also use this. Here is the link: <https://addons.mozilla.org/en- US/firefox/addon/6623/>

</comment></comment><comment><USER7> I found the Adobe page to manage these settings[1] to be somewhat funny.

The notice underneath the Flash content says:

 _Note: The Settings Manager that you see above is not an image; it is the actual Settings Manager. Click the tabs to see different panels, and click the options in the panels to change your Adobe Flash Player settings_

What's that say for the UI usability?

1: [http://www.macromedia.com/support/documentation/en/flashplay...](http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager05.html)

<comment><USER8> What I find odd about that page is how it reloads when you switch to different tabs.

I thought... it was Flash? And it could just change to the new tab without the whole HTML wrapper page reloading?

<comment><USER9> It might be so that any settings changes are in effect when you switch to the next panel, which can't happen without reloading the .swf.

<comment><USER8> I'm sure they have a good reason, too.

</comment></comment></comment></comment><comment><USER10> I don't use any flash applications that I want to store anything. In the past (in linux) I did:

      rm -Rf ~/.macromedia && touch ~/.macromedia

which stopped flash creating the ~/.macromedia directory and being able to store anything on disk. This caused problems with the odd rare site that insisted on storing things, and the BBC iplayer would become unresponsive. Now I call my browser from a shell script which deletes ~/.macromedia whenever I close it.

<comment><USER11> My experience with trying to disable cookies was that the (Flash) web became unusable. All sites with Flash content would just keep nagging and nagging.

<comment><USER12> somewhere on this site I posted my aliases for dealing with this problem ( <http://news.ycombinator.com/item?id=1401118> )

</comment></comment></comment><comment><USER13> Flash Cookies are also quite often used for "stuffing" by unscrupulous affiliates for all of the reasons mentioned in the article.

</comment><comment><USER14> If you disable 3rd party flash cookies, that should eliminate all unwanted tracking.

Meanwhile, flash cookies are useful for other things: Pandora uses them to keep you logged in forever, even if your session on the server dies (unless you log out), on our site we use it to store copious amounts of user data (such as music libraries) so that it doesn't need to be loaded from the server every time you visit.

Flash cookies are also a win over regular cookies because they aren't sent along to the server with every single http request.

</comment><comment><USER15> Interesting question: Can HTML5 localStorage be used to circumvent cookie controls in lieu of using Flash cookies?

<comment><USER16> It would be pretty intrusive/noticeable, since the user has to opt in to allow the site to use it. So it's probably only a risk on sites that also make legitimate use of Web Storage.

localStorage is subject to same-origin restrictions (so advertisers can't easily use it to track you across sites). And localStorage is handled like cookies when you use the private browsing mode in browsers like Firefox and Chrome, e.g.:

 _"When the browser goes into private browsing mode, a new, temporary database is created to store local storage data; this database is empied, and is thrown away when private browsing mode is turned off."_

<https://developer.mozilla.org/en/dom/storage#localStorage>

(This is true of Flash 10.1 also, but wasn't true for older versions.)

</comment></comment><comment><USER17> I use Flush by machacks to delete my Flash cookies. I think it's for Mac OS X only. [http://machacks.tv/2009/01/27/flushapp-flash-cookie- removal-...](http://machacks.tv/2009/01/27/flushapp-flash-cookie-removal-tool- for-os-x/)

</comment><comment><USER18> If you've got 5 mins (make a cup of tea) there's a quick talk and live demo about this here, from Oxford Geek Night 17 (<http://oxford.geeknights.net/2010/feb-17th/>): <http://ogn.s3.amazonaws.com/16-DavidSheldon.mp4>

</comment><comment><USER19> I suspect the use of Flash cookies will decline gradually as the use of HTML 5 increases, since a great many of them are just used to store volume settings for commonly-used Flash-based video players.

That's not to say the use of Flash cookies by certain ad networks isn't completely obnoxious.

</comment><comment><USER12> This has been around for a very long time (2005 or so). They were originally called Persistent Identification Elements.

Have a browse: [http://duckduckgo.com?q=persistent+identification+elements&#...</a>

</comment><comment><USER20> It seems like all these problems could be solved by tighter integration with browsers: add hooks for browser privacy features to NPAPI and support them in Flash. Adobe seems to already be heading that way with the new private- browsing support.

</comment><comment><USER21> This particular issue seems to pop up every year or so and there is vast online info available on the topic already. But Flash-bashing seems to be de rigueur these days...

Yes, Adobe is aware of some of the issues mentioned (we Flash pros cringe at the old Macromedia settings windows _still_ in use) but some of his bugs are in fact features (such as being browser agnostic) that behave differently because it's simply different tech (like Mac vs Win).

In all fairness, Adobe has their hands very busy these days with AIR, the new Flash player, and porting Flash to multiple platforms. If the old stuff works, they're not messing with it.

<comment><USER22> That's because adobe are assholes. Don't think that avoiding/subverting user intent with respect to cookie management is anything but an intentional feature and selling point.

<comment><USER21> Wow. He actually scores more karma for saying Adobe are assholes.

HN hits a new low.

</comment></comment></comment><comment><USER8> Sure, that's why I have a cron job to delete /home/<user>/.macromedia/* every night.

</comment><comment><USER23> I think point 2 is no longer true if you're running Flash 10.1 and Firefox, Chrome or IE.

</comment><comment><USER24> I don't understand point 4. Why restore the redundant HTTP cookie?

<comment><AUTHOR> So that you can track the user for as long as possible. Very useful if you are running an ad network.

<comment><USER24> But it's unnecessary since you already set the Flash cookie.

<comment><USER25> In case user deletes that flash cookie, but forgets to clean the http one!

<comment><USER26> And also the convenience of having the user/session info in HTTP headers where all sorts of other code/frameworks expect it -- instead of only where Flash in-page objects can see it.

</comment></comment></comment></comment></comment><comment><USER27> Does the FF extension click-to-flash mitigate this?

</comment><comment><USER28> how to disable flash cookies

<http://www.google.com/search?q=disable+flash+cookies></comment>


Why is linux(Debian) 4PC becoming mess again?? - <AUTHOR> I have been using same hardware since Debian 7 and as far as i remember, with Debian Wheezy 100% of my hardware (even nvidia and 3G module) worked out of box, only with some non-free libs.
Now, i stuck with Wayland, nvidia drivers almost impossible to compile and install, some apps having problems with Wayland.. etc...
Also, i'm wondering why so many popular apps are still using 32bit libs.. Viber/Skype/Eagle CAD etc..
I understand some changes are necessary and some things will be improved but i don't get the point why such changes are moved from upstream to release if it is going to crash so much in my system??? <comment><USER2> Eventually, it will get sorted out via bug filing and coding.

</comment><comment><USER3> CADT...</comment>