How To Price Software Without Just Rolling The Dice - <AUTHOR> http://onstartups.com/tabid/3339/bid/11097/How-To-Price-Software-Without-Just-Rolling-The-Dice.aspx <comment><USER2> You probably get 80% of the value of all these posts with just two bits of pricing advice:

* Don't charge cost-based prices; what you pay to build something has nothing whatsoever _at all_ to do with your price. All arguments of the form "that's just a (wiki|blog|bug tracker|reddit clone) with a * attached" are themselves a subtle form of cost-based pricing.

* Charge more.

I liked the book though.

<comment><USER3> Additionally, if you do b2b:

* Charge more.

<comment><USER2> Also, at rev 2.0:

* Charge more.

<comment><USER4> In a recent Stack Overflow podcast (73?) Joel said that he would helped the world a lot better if he made a robot that you could ask about software pricing, and it spat out the answer "Raise your price by $200"

<comment><USER5> It was the This Week In Startups podcast with Matt Mullenweg as a guest.

<comment><USER4> That's it - too many podcasts to keep straight. Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER6> I think there's a better way if you're doing webapps. Since you can change the price for each customer in the backend code you can actually start doing statistics and find out at which pricepoint you maximise your profit.

More info here: [http://www.maximise.dk/blog/2009/01/getting-product- pricing-...](http://www.maximise.dk/blog/2009/01/getting-product-pricing- right.html)

(Full disclosure: it's my own rarely updated blog)

<comment><USER7> It might be a better way in theory, but do you know of anyone who's actually employed the technique without severely alienating customers? You mention Amazon as a general A/B tester, but Amazon's price testing is the most prominent example I can think of and it ended with a public apology. Price discrimination (even if it's only a testing phase) only seems to fly if it's not obvious, and it'd be obvious for most webapps.

<comment><USER8> As I understand it, airlines can get down to a per-seat pricing structure. Look how much we love them for it.

There is a reason why Farecast did so well...

<comment><USER7> True. I didn't mean that some markets don't support price discrimination, just that customers' perception of it -- if they know it's going on -- is terrible. With airline tickets, people see prices fluctuating over time: lots of bumps but also some apparent connection between the time/effort involved with buying early and a generally better price. Customers seem to be more infuriated if they can easily tell that someone else is getting a better price on the same exact seat at the same exact time. Given the fluctuations and the _expectation_ of fluctuations in airline pricing, there's not much direct comparison going on among airline ticket consumers.</comment></comment></comment></comment>


Enigma: Decentralized Computation Platform with Guaranteed Privacy [pdf] - <AUTHOR> http://enigma.media.mit.edu/enigma_full.pdf <comment><USER2> Sometimes I wonder what kind of operations would actually be useful to do on such data in the real world.

I mean, the way the web currently works is that I trust some server to host my data. I can have this service auth an external consumer site and display data in an iframe, say, which the consumer site can't get at. This is good enough for displaying people their personalized info (name, friends) on various services (eg directions to their house in an iframe, for a user authenticated with my chosen provider).

But to go further, what if I don't want to trust any provider? Then I could simply encrypt the data and store encrypted data with the provider (or providers for redundancy). The authentication could be replaced with visitors holding a key to decrypt the data (because I gave it to them) and I can switch to using some other key and effectively "unfriend" those who don't get my updated key.

But all this is good enough for displaying data and files I upload. Now, why would I want to do operations on those files "in the cloud" without trusting a provider? I am already trusting my friends with the data, since they can reshare it once it's displayed to them. So why not trust a provider? One of my friends can run the provider.

I guess the only scenario I see it being useful is if all my friends can only have limited access to the data and all manipulations on the data are collaborative, and that's where the homeomorphism comes in. Perhaps no one will be able to see the whole data and it's not really about data at all, but views of some Enigmatic process running on some network (like an autonomous corporation.) is that the use case?

<comment><USER3> Maybe this could be used for something like clinical quality analytics. There is an industry of data-driven optimization on dimensions like diagnoses, treatments, outcomes, populations/demographics. A big challenge with this is that the useful data is HIPAA-regulated.

Something like SETI@home, but for finding better clinical care options instead of finding aliens.

</comment></comment><comment><USER4> Phenomenal stuff. Can't wait to see this play out IRL.

</comment><comment><USER5> Discussed at [https://news.ycombinator.com/item?id=9805385](https://news.ycombinator.com/item?id=9805385), but perhaps a link to the paper will receive more substantive discussion.

<comment><AUTHOR> Agreed.

Honestly both the article you linked and the website [1] were unsatisfying to me, so I read the paper to better understand the implications.

BTW thank you for linking the previous discussion, I missed it!

[1]: enigma.media.mit.edu

</comment></comment><comment><USER6> Go Oz!

<comment><USER7> Thanks Tal!</comment></comment>


What's the Best Programming Language to Learn in 2015? - <AUTHOR> http://www.sitepoint.com/whats-best-programming-language-learn-2015/ <comment><USER2> 2015 is over. Language is just a tool, focus on solving the problem.

<comment><USER3> And also OP should not take advice from a list that includes "CSS" as a programming language.</comment></comment>


Ask HN: Recommend a great book on Ruby on Rails for a Beginner - <AUTHOR>

I have a great desire to learn building stuff with ruby on Rails. Let's just say I am a beginner although I have built (and currently building) simple GUI apps with C# on .Net (WinForm). I remained a newbie with C#. I want to revive my quest for programming.
I was searching the net for info about good book to start with.
Would you recommend any book for beginning Ruby on Rails?
I was about to purchase "Agile Web Development with Rails" by Pragmatic Programmers from Amazon but I was discouraged by the many negative reviews.
Any similar book recommendation to get me up to speed with ruby on Rails? <comment><AUTHOR> @Aqua_Geek & @tfitzgerald yes, I already have that in my Chrome's bookmark. I also bookmarked the following:

BOOKS \+ Why's (Poignant) Guide To Ruby (<http://mislav.uniqpath.com/poignant- guide/>)

\+ Learn To Program (<http://pine.fm/LearnToProgram/>)

\+ The Book Of Ruby by Sapphire Steel Software (<http://www.sapphiresteel.com/The-Book-Of-Ruby>)

\+ The Bastards Book of Ruby (<http://ruby.bastardsbook.com/toc/>)

BLOG TIPS ON RUBY

\+ I'm basically following tips listed here: "5 Resources to Get Started with Ruby on Rails" ([http://quickleft.com/blog/5-resources-to-get-started-with- ru...](http://quickleft.com/blog/5-resources-to-get-started-with-ruby-on- rails)) And,

\+ "Best way to learn Ruby & Rails" (<http://astonj.com/tech/best-way-to- learn-ruby-rails/>)

WEBCASTS/VIDEOS

\+ I'll be watching "Rails for Zombies" (<http://railsforzombies.org/>)

\+ Screencasts at rubyonrails.org

And on the side, I am also re-reading "OOP Demystified" to get a better grasp on OOP.

Is there any other particular book that is a must-book for a beginner? Or my list on top pretty much covered all a beginner should know about getting up to speed with Ruby on Rails?

</comment><comment><USER2> I would highly recommend Ruby on Rails Tutorial by Michael Hartl (<http://ruby.railstutorial.org>). It's free to browse online or $26 for the PDF. There are also screencasts, if you're into that.

The tutorial does a great job of introducing the various pieces of the Rails framework and how to get started.

</comment><comment><USER3> Hartl's Ruby On Rails 3 Tutorial book is great, and available for free online: <http://ruby.railstutorial.org/></comment>


Innovative Anti-Seismic Mechanical Watch - <AUTHOR> https://www.red-dot.org/project/the-innovative-anti-seismic-mechanical-watch-10740 <comment><USER2> It's stunning to me how this mechanical watch borrows its outside design from the Apple Watch. It's got a round mechanism, and yet it's still using a black square case with rounded corners [1].

I don't really know what to make of it, other than be impressed by the design impact Apple manages to have even in neighboring markets.

[1] Flashback to the infamous design patent [https://www.theverge.com/2012/11/7/3614506/apple-patents- rec...](https://www.theverge.com/2012/11/7/3614506/apple-patents-rectangle- with-rounded-corners)

<comment><USER3> This is not entirely uncommon when it comes to tank watch cases. Indeed, here is an image of the movement from the trope namer, a Cartier Tank:

[https://smhttp-ssl-39255.nexcesscdn.net/wp- content/uploads/2...](https://smhttp-ssl-39255.nexcesscdn.net/wp- content/uploads/2015/12/Clear-Image-of-the-JLC-Movement-in-a- Cartier-1500x995.jpg)

</comment></comment><comment><USER4> Having been to Basel world before, even $2k and $6k is considered cheap for a watch.

I wonder if the exposed mechanics are real or just for show (with a simply quartz mechanism really doing the work)? I remember some phone manufacturing getting criticized because the phone guts they were claiming to show in their design was actually just a fancy sticker.

<comment><USER5> Looks very real (and cool !) in this unboxing: [https://youtu.be/nd9Srch9IeM?t=267](https://youtu.be/nd9Srch9IeM?t=267)

</comment></comment><comment><USER6> Bremont already has a shock-protected rubber movement mount with a floating movement. And of course all mechanical watch movements (except some cheap Chinese ones) have Incabloc shock protection (or some derivative).

Edit: It looks like some Breguet watches use a super-old-school mechanism invented by Breguet in 1790.

</comment><comment><USER7> For those interested, it's a Xiaomi Youpin CIGA Automatic.

<comment><USER8> Researching Xiaomi phones I was blown away by the sheer number of other unrelated products they sell.

Someone at the top has a big push towards diversification.

</comment></comment><comment><USER9> Is red dot an actual award-award or an pay-and-get-one-award?

<comment><USER10> More of the latter: in 2018, more than a quarter of the submissions got one. [https://www.red-dot.org/about-red-dot/news/product-design- re...](https://www.red-dot.org/about-red-dot/news/product-design- results-2018/)

</comment></comment><comment><USER11> Why did this website require two entire seconds to load a single picture and a paragraph, even with umatrix enabled?

</comment><comment><USER12> Why would anyone want a mechanical watch? If you want an accurate timepiece, use a quartz oscillator. If you desire more accuracy, get something that sets itself by radio transmissions, or uses Bluetooth to synch with your smartphone that in turn uses NTP to set its internal clock.

AFAICT the only reason that people want a mechanical watch is to show how much money they have to waste.

<comment><USER3> There was a post on HN a couple years ago that I should probably have dug up instead of vaguely gesturing at, but here we are.

Anyway, it described the transition to digital technology as moving towards "magical rocks". They are amazing, perfect, and betray no hint as to their mechanism. They are excellent tools, in many ways better than their predecessors, but they don't tickle the brain the same way as a machine that wears its heart on its sleeve.

Everyone can have an intuition about how a mechanical watch works. You can see it right there, watching as the gears spin, the balance swings, the mainspring uncoils. It's alive. Like watching a steam engine. It takes a lot more knowledge, and a lot more trust in things unseen, to build intuition around how electronics work. And I'm not sure it's ever quite as evocative, even while being perhaps more amazing.

There are a million other arguments either way, but that's the one that's compelled me the most. And granted, I'm pretty biased, typing this with a mechanical watch on my wrist.

<comment><USER13> > There are a million other arguments either way, but that's the one that's > compelled me the most. And granted, I'm pretty biased, typing this with a > mechanical watch on my wrist.

Me too, except the bit about wearing a watch. I haven't worn one since my Seiko 5 died at about the same time that the magical rock telephones took off about 20 years ago.

Thanks for the 'magical rocks' phrase!

</comment></comment></comment><comment><USER14> We generally don't like to spread anti-seismetism here on hacker news.</comment>


Time Cube is gone - <AUTHOR> http://www.theverge.com/2015/9/2/9247913/time-cube-is-gone <comment><USER2> This is the kind of worldview you get when you optimize on too few parameters.

<comment><USER2> ohh seems I touched a nerve..

<comment><USER3> Please don't post unsubstantive comments to Hacker News.

<comment><USER2> Then what is the point of posting a link about TimeCube? Your own comment does not explain what its significance to the hacker community is, while mine at least hints at it. The correlations should interest serious minded people. I think it is more than a freak show exhibit. We are all free thinkers, aren't we, bro?</comment></comment></comment></comment>


Competitive lockpicking growing in US popularity - <AUTHOR> http://www.boston.com/business/articles/2010/07/28/competitive_lockpicking_growing_in_us_popularity/?page=full <comment><USER2> One of the more striking points of this article (for me) was not so much about lockpicking. It was this statement:

"Some lockpickers observe a code of responsible disclosure by providing manufacturers information on weaknesses they discover in locks they defeat -- _just like responsible computer hackers do when they detect security flaws in software_."

I'm thrilled to see a statement like this coming from the mainstream media.

<comment><USER3> Yeah, and both types of responsible whistleblowers probably end up getting arrested.

</comment></comment><comment><USER4> I'm surprised there are not more digitally controlled locks on the market - something that has an embedded microcontroller that releases a solenoid if the right code is entered.

What's a locksmith hacker to do with such a lock? There's no keyhole to use a diamond pick and so its basically a metal brick. I don't see too many ways to open it without destroying it physically.

Maybe I'm missing the big picture, but a traditional keyed lock seems about as high-tech as an ancient model-T car. It's completely out of place given the latest technology available today.

<comment><USER5> The big problem with digital and electronic locks in general is maintaining the power source. Mechanical locks have extremely low maintenance requirements, and could be left unattended for months or years without issue. Even if they then stick, a quick shot of WD40 will usually allow entry.

Electronics, on hte other hand, rely either on external power, or some sort of internal battery. A battery is ill-suited to heavy duty-cycling when the lock will be opened/closed regularly, and an external source is potentially subject to tampering.

There do exist many electronic locks, typically for fairly low-security shared access doors, or where various additional requirements make them more suited (such as easily rekeyable card-locks for hotel rooms)

There's an interesting article at [http://www.wired.com/threatlevel/2009/08/electronic-locks- de...](http://www.wired.com/threatlevel/2009/08/electronic-locks-defeated/) regarding some work by Marc Weber Tobias and others in defeating hybrid electro-mechanical locks and their built-in audit logs.

Electronic locks on the whole don't magically ensure security, and open up a whole new set of attack surfaces, whereas mechanical locks have been around for centuries, and have well-defined failure/exploitation modes.

<comment><USER6> Problem, yes. Engineering problem to solve. The real issue is that these companies don't feel they need to innovate much, and so we're still stuck with technologies invented in the 19th century.

<comment><USER7> Handwaving at a problem and declaring it's just an "engineering problem" doesn't actually do anything to solve it... hey, wait, are you my manager?

The power problem is actually a big deal and shouldn't be minimized. Take the hotel situation; what happens when the hotel loses power? You _can't_ have the locks fail closed, you end up with people trapped away from their stuff. Failing open is of course a bit of a problem, too. Locks by their nature tend to congregate around things that are actually important so you actually have some serious problems with a lock that is "down" even five minutes a year.

<comment><USER6> I'm hand-waving at it because this industry has had 40-50 years of high technology at its beck and call and has done little or nothing with it. This _is_ an engineering problem, and making excuses for them ("Failing open is of course a bit of a problem, too") does not change the reality. They have failed to innovate, and the world is going to pay for that. The power problem? So don't use traditional power: experiment with something else. Try. They've had half a century, at least. If that industry had tried at all, it would've come up with more than this.

<comment><USER7> You deny my point, then just go on to reinforce it. The lock industry should just create a new magical power source? You just moved around the "mere engineering problem" label but if anything you've made your problem worse by being more clear about what you want to have magicked into existence, not better.

</comment></comment></comment></comment></comment></comment><comment><USER8> Non-destructive lockpicking is a sport these days; burglars would use bumping or other destructive technique like crowbar (with a much shorter path to success) since they won't care about the clean result. Maybe only relevant for spies/intelligence/other areas where you need to hide the fact that the lock has been picked.

And the fact that weak lock mechanisms are publicized encourages manufacturers to invent, it's all good.

<comment><USER9> I'm sorry, but this isn't completely true. (The part about burglars not using lock picks).

I am an amatuer locksmith, and I can open Masterlock No. 3 or No. 5 (which are used _everywhere_ ) incredibly quickly (less than 10 seconds, typically [especially on No. 5, which are horrible).

A half diamond pick and a torsion wrench are tiny, I can keep them in my pocket and nobody will ever notice... I can't do this with a huge bolt cutter.

Now, do I steal things? Absolutely not. Has getting into picking caused me to be much much more careful about what I lock up, where, and with what? _definitely_.

I'm all for locksports, I think the fact that people are getting into picking is awesome, but the idea that using a bolt cutter against a padlock is faster and more conveinient than using a pick is just plain wrong.

<comment><USER10> I remember first seeing the MIT guide and it sparked my interest, however I didn't want to make homemade picks. Can you recommend a good lock pick set?

<comment><USER11> I have this set [1]. Though mine has a plastic handle so it was about half the price listed there. It's a nice set, quite small and very pocketable.

There's something deeply satisfying about picking locks, hearing each pin tick and feeling the barrel give just _a little_ bit more than the last time you torqued it. I love it.

[1] [http://www.southord.com/Lock-Picking-Tools/Jackknife- Pocket-...](http://www.southord.com/Lock-Picking-Tools/Jackknife-Pocket-Lock- Pick-Sets.html)

<comment><USER9> Ha! YES! That little snapping feeling. I still remember getting my first lock, :). I was on the phone with a friend and just raking the crap out of it until finally _POP_.

She did not understand my excitement.</comment></comment></comment></comment></comment>


Critique of 2018 Turing Award for Drs. Bengio and Hinton and LeCun - <AUTHOR> http://people.idsia.ch/~juergen/critique-turing-award-bengio-hinton-lecun.html <comment> P-NP Schmidhuber's critique has over 200 references. I have spent several hours on verifying them. It helped that I already knew many of his papers and earlier posts i.e. "Deep Learning: Our Miraculous Year 1990-1991" [http://people.idsia.ch/~juergen/deep-learning-miraculous- yea...](http://people.idsia.ch/~juergen/deep-learning-miraculous- year-1990-1991.html) and "Critique of Honda Prize for Dr. Hinton" [http://people.idsia.ch/~juergen/critique-honda-prize- hinton....](http://people.idsia.ch/~juergen/critique-honda-prize-hinton.html)

As far as I can tell, all of Schmidhuber's claims are correct. Apparently the post even went through some sort of peer review. He is thanking "several expert reviewers for useful comments."

Have a look at the astonishing Sec. XVII which lists eight of his direct priority disputes with Bengio and Hinton.

This is not a glorious chapter in the annals of the Turing award.</comment>


What if the CrunchPad blowout is a marketing ploy? - <AUTHOR>

A star attorney turned investigative reporter doesn't lock down his contracts? Irresponsible.
Mystery investors popping out from nowhere killing a deal with the most influential tech publication in the world? Ridiculous.
This thing reads like Shakespeare.
TechCrunch would lose a huge amount of credibility which would damage their $100m brand, which would be insane. Arrington is not insane.
BUT - what if the guys on the other end are doing it?
The story is being covered EVERYWHERE and at the press conference they plan to show off the tablet - this story will likely be covered by all major news papers.
I'm saying this all with half seriousness, but it's amazing the frequency of reporting on the drama, vs. the previous frequency on the CrunchPad.
It's worth considering for those of us in the start-up world how dynamic this story has become, and how mainstream, when the drama entered the picture. <comment><USER2> It shows how amateur they are. Not good when doing business with retailers and the public dirty laundering will hurt relationships with possible future *crunch hardware partners.

I don't think a "Hey, we've reached an agreement" post from Techcrunch in the future will fix this damage.

But yeah, it shows how optimism and making deals on trust can blind even those who apparently should know better.

Business, friends, and family. Try not to mix them.

</comment><comment><USER3> Never ascribe to conspiracy what you can ascribe to stupidity.

People really _are_ that stupid.</comment>


Leadership - <AUTHOR> http://regardingwork.com/2011/07/01/leadership/

<comment><USER2> Leadership, innovation and great sex are hard to talk about - the guys do a great job reminding us that an action we might complacently think of as leadership might in fact just be being a dick.</comment>


Startup Tip: Save bandwidth with Gzip (Eg: YC News can save upto 80% per page) - <AUTHOR> http://www.whatsmyip.org/mod_gzip_test/?url=aHR0cDovL25ld3MueWNvbWJpbmF0b3IuY29tL25ld3M= The Gzip module compresses the HTML as it sends it out. It is compatible with all major web servers and all web browsers. Using Gzip can save HUGE amounts of bandwidth, and increase the overall performance of the webserver. <comment><USER2> I'm a big advocate of gzipping the web. People should be aware that enabling gzip can cause some differences with page rendering due to the extra decompression step. It also increases CPU load on the server. There can be other minor issues too. No show-stoppers though.

Also, the percentage of compression savings should not be confused with the savings in load time. An 80% reduction in the size of the response does not mean an automatic 80% reduction in page load time.

<comment><USER3> Load on the CPU isn't that big of deal, when compared to the benefits.

1\. By sending lesser data over the wire, you save on the number of round trips, thereby the page renders faster on the browser

2\. the other one is the savings in bandwidth

</comment></comment><comment><USER3> good point.

PG: any particular reason you have not turned on compression? Is to get benefits of chunking?

<comment><USER4> How do you propose I turn on compression?

<comment><AUTHOR> What web server do you run? (Apache on *nix Or IIS on Windows)

<comment><USER4> this one:

     (def serve ((o port 8080))
       (nil! quitsrv*)
       (ensure-dir logdir*)
       (let s (open-socket port)
         (prn "ready to serve port " port) (flushout)
         (= currsock* s)
         (after (while (no quitsrv*)
                  (if breaksrv*
                      (handle-request s)
                      (errsafe (handle-request s))))
                (close s)
                (prn "quit server"))))

<comment><AUTHOR> ycombinator.com seems to be running Apache/2.2.4 on FreeBSD ( <http://uptime.netcraft.com/up/graph?site=www.ycombinator.com> ), in which case your best option is using the mod_gzip module: <http://www.schroepl.net/projekte/mod_gzip/>

<comment><USER5> What part of "this one" don't you understand? :)

www.ycombinator.com is not necessarily news.ycombinator.com.

</comment></comment></comment></comment></comment></comment><comment><USER6> Does anyone know if Hunchentoot can be made to do compression?

</comment><comment><USER7> currently this page is scoring an 82 on YSlow. Needs to make use of a CDN. Needs to add expires headers to external resources, and Needs to Configure ETags.

<comment><USER8> Really, what does YC need a CDN _for_? Just because YSlow says it doesn't mean it's actually a sane idea. They also say to turn off ETags, when what's actually good advice is to set up ETags in such a way that it works.</comment></comment>


EFF: Google Should Not Help the U.S. Military Build Unaccountable AI Systems - <AUTHOR> https://www.eff.org/deeplinks/2018/04/should-google-really-be-helping-us-military-build-ai-systems <comment><USER2> If it's not safe for Google to be building stuff for the military, then it's just as not safe for them to be building stuff for themselves.

Also, these kinds of things can't be looked at in a vacuum. There are are other, much more belligerent, countries in the world that are investigating the use of AI.

What should the US do in response? Nothing doesn't seem to be a very good answer.

<comment><USER3> We did think about those issues before writing the piece.

It's safer to figure out how to get AI systems to be robust, reliable and safe in civilian contexts before rushing to weaponize them. We need to understand how to avoid technical problems like adversarial examples, and how to recognize and avoid accidental action-reaction-escalation pathways, before militaries start deploying this stuff.

Objectively speaking, the US is one of the planet's more belligerent nations. But if there was evidence that other belligerent countries were already deploying AI weapons systems, there might be an argument for the US keeping pace. If there isn't such evidence, the US should think more carefully about whether to move first, and how to move first, or whether certain kinds of restraint in this space might be in its long term strategic interest.</comment></comment>


How to Work with JavaScript Math Object - <AUTHOR> http://mrbool.com/how-to-work-with-javascript-math-object/26168

<comment><USER2> Is HN the place to post a link to a beginners JavaScript post?

And - oh joy - a blocking pop up with a fiddly exit on the page as well.</comment>


Reddit launches harassment crackdown - <AUTHOR> http://www.bbc.com/news/technology-32749408 <comment><USER2> Given Reddit's already unequal application of the site rules (some people can shamelessly vote manipulate, others receive hellbans for merely following links), and the propensities for specific groups to treat mild disagreement as "harassment", this does not bode well.

It gets really blatant if you've been on the site for any length of time. I really hope this doesn't kill the site, but it looks bad.

<comment><USER3> I mean, rules are applied by the mods of each different subreddit, right? I don't doubt some subreddits have huge problems, but IMO the majority don't, and the site itself works just fine.

<comment><USER4> A moderator can't shadowban you. But someone criticizing Ellen Pao got a shadowban recently, which means the actual administrators (Reddit employees) did it. I don't know if it was for criticizing her or for something else.

<comment><USER5> I am not a habitual Reddit user and know little about the controversy with Pao, but I am interested in the subject of Internet site moderation so I have been looking into what has been posted in this thread. I found this. Pao linked to this post by a non-reddit admin recently as an example of how she thinks shadowbanning should be done: [https://www.reddit.com/r/blog/comments/35ym8t/promote_ideas_...](https://www.reddit.com/r/blog/comments/35ym8t/promote_ideas_protect_people/cr91z7r)

Selected quotes:

>You will never be told exactly what will earn a shadowban, because telling you means telling the sociopaths, and then they will figure out a way to get around it, or worse, they will file shitty, frivolous lawsuits in bad faith for being shadowbanned while "not having done anything wrong"[...]Shadowbans are intentionally a grey area, an unknown, a nebulous and unrestricted tool that the administrators will use at their sole discretion in order to keep reddit running[.]

The first thoughts that come to my mind are "this isn't compatible with a culture of transparency" and "there has to be a better way" but I can appreciate how hard it must be to keep a site the size of Reddit running.

<comment><USER6> I don't know how you can be interested in Internet moderation and think that "transparency" is anything other than a road direct to concern troll / rule- lawyering hell.

It maybe worked for meatball wiki but they were i) small and ii) disciplined.

I doubt their approach would work anywhere else.

<comment><USER5> Because I've done it. It is not necessary to put up with people rule-lawyering and concern trolling just because you're very clear on why people were banned.

</comment></comment></comment></comment></comment></comment><comment><USER7> This is a topic I'm legitimately curious about. 4chan existed in a form for a very long time such that (aside from any stated rules) harassment was ubiquitous (at least in /b). That being said, that same domain formed a basis for massive swaths of the internet community and culture we see today.

In any place I've seen these sorts of gestures of "safe-ification", they seem to serve only to 1. be ineffective; for whatever moderation you have it's going to have edge cases and a time delay for enforcement. 2. Split the community, create _more_ (and often more subtler, now that it has to conform to some rulebook) harassment/drama between the split. 3. Drive away productive parts of the community, for any variety of reasons. (for me it's a mix of "I've seen this pattern before and don't like where it goes" and "I don't agree that trying to dictate social standards is the proper way.")

Caveat, and I'm somewhat frustrated that I feel like I need to say this (whether that's at myself or the fear that I'll be jumped on if I don't), I was _VERY_ heavily bullied/harrassed for much of my childhood.

I caveat as such to try and say that I don't hold this stance from a position of ignorance, but that if I hadn't interacted with bad actors in places that are frankly more insulated from real life (the internet) I would have never come to (yes, painful, but still VERY useful in hindsight) realizations about human interaction and my role in it.

This rambled a bit, so tl;dr, Dealing with bad actors is how we learn to deal with bad actors, which is a _critical_ life skill. This even aside from that the strategy being applied does not have a successful history, from what I've seen. (I'm trying to avoid the slippery slope argument, although that's kinda implicit in my second conclusion, I'd rather hear what other people think on this concept of growth through pain, or if it's all in my head)

<comment><USER8> About 2. One thing i have seen more and more as rules come into play on various sites is baiting. In particular when the rules are automatically enforced.

</comment></comment><comment><USER9> I don't like it, but Reddit can do whatever it wants with it's platform. Reddit is not a "free speech platform", it is whatever it wants to be at any moment.

In Portugal we have a saying that translates to something like this: "Who is not well/happy, should move to another place". And that's whats going to happen. Some users will go to another platforms.

And, in the end, we'll always have the chans...

<comment><USER2> That is _exactly_ what it is, by their own reckoning[1]:

        Create a safe space to encourage participation.
        Embrace diversity of viewpoints.
        Allow freedom of expression.
        Be stewards, not dictators. The community owns itself.

As long as they claim to be holding themselves to that standard, people are _fully_ within their rights to call them out on hypocrisy.

[1]:[https://www.reddit.com/about/values](https://www.reddit.com/about/values)

<comment><USER10> I'd be curious about their exact definition of "safe space". That term on college campuses is rapidly evolving exactly into ensuring that a diversity of viewpoints is not even seen or heard, let alone embraced.

I mean this straight; I'd honestly be interested in hearing an elaboration from them, not as snark about how they can't possibly mean it or something. Again, no sarcasm or snark, high principles are _hard_.

<comment><USER11> Safe space is just code for coddling the first person to claim offense.

A safe space for you, if we are at odds, is an unsafe space for me. The concept of a universal "safe space" is an impossibility in that regard.

<comment><USER3> _A safe space for you, if we are at odds, is an unsafe space for me._

Only if you are determined to be at odds. It's quite possible for an atheist and a die-hard Christian to get dinner together, if they both commit to focusing on the topics they share rather than the ones they disagree on.

 _Safe space is just code for coddling the first person to claim offense._

seems like a willful misrepresentation of the aims behind the concept.

<comment><USER11> >Only if you are determined to be at odds. It's quite possible for an atheist and a die-hard Christian to get dinner together, if they both commit to focusing on the topics they share rather than the ones they disagree on.

That's not honest debate.

>seems like a willful misrepresentation of the aims behind the concept.

As a white male I am often told that I'm not allowed to participate in discussions because of my race and gender due to the discussion taking place in "safe space." No matter what the original aims are behind the concept, it is easily corruptible and almost never used in the "best case scenario." It's usually used to set up echo-chambers where individuals can feel safe from criticism or debate. It has no place in a healthy society, IMO.

<comment><USER3> _That 's not honest debate._

Who says they have to have an honest debate? Why can't they just have a conversation with each other? That's the problem with battling attitudes - there isn't any reason why the two of them _must_ come to blows about their opposing beliefs. They can simply respect each other and move beyond it.

 _As a white male I am often told that I 'm not allowed to participate in discussions because of my race and gender due to the discussion taking place in "safe space."_

Interesting, because as a white male myself I have never been told that. I have been told that my opinion in a conversation is not an important one, which is often (not always!) a valid point. But I have never been told I am cannot participate in a discussion _solely_ because it is a "safe space". Where are you having these conversations?

<comment><USER2> Is there a meaningful and substantial difference between those two things? Both amount to "your input is not welcome here", both amount to classifying one's identity more important than the content of their speech, and the entire concept of a "safe space" is one in which mere disagreement is _explicitly_ disallowed.

<comment><USER3> Absolutely there is a difference. If a group of women are talking about their experiences of sexism in the workplace they ought to be able to do without a man coming in and "actually"-ing them.

<comment><USER2> This set of questions is going to sound a lot more flippant than the tone it's intended to be in, but I am curious as to the answers:

Why is that?

Why is someone's identity more important than the content of their speech in this particular case?

Is it impossible for anyone/a man to be against sexism and yet disagree with someone's characterization of an event?

Are all ideas sacred and above criticism now, or only some ideas?

Which ones?

Who gets to decide that?

Why them?

Why does the right of people to be free from criticism take priority over the right of people to have a discussion?

Why does mere disagreement necessarily need to be classed as a negative thing (as you just did?)

How can such an environment foster any kind of healthy discussion, as opposed to me-too echo-chambering?

<comment><USER12> Attempt at an honest answer:

If a group has been marginalized, belittled, and excluded for long enough, it can damage the people in that group. They can need a safe place to heal, to realize that they matter, that they are as worthwhile as anyone else, and that they don't have to be what their oppressors said they were. A safe place can be very important in that process.

Or a safe place can be a place where a bunch that feels oppressed because somebody looked at them funny, and feels more oppressed because nobody else thinks they're oppressed, can get together and rehash their sense of victimhood and exclude anyone who disagrees.

Human nature being what it is, the second is perhaps more likely than the first. But that does not make the first invalid (when genuinely needed).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> On the surface it seems like a good thing. Taking a stance against the worst "systematic and continuing harassment" should help the most vitrolic cases. Some might argue that Reddit should be an " _extreme_ free speech platform" and this obviously goes against it, but I'm not sure reddit sees itself that way.

I think most people are afraid of the slippery slope and censorship if taken too far. Making Reddit "too political correct" would transform the current culture into something else. Many (or a loud minority) currently doesn't seem to trust Reddit to not do that. What makes things worse is people assume this is a "Monetization of a service"-story they've seen played out many times before with catastrophic results.

In the end I guess it comes down to the execution and agenda.

</comment><comment><AUTHOR> Is this Reddit's Digg 4.0 moment?

<comment><USER14> Not quite by my reckoning - but I think the tinder box is close to being lit, large parts of the community already takes a poor view of its CEO.

<comment><USER15> I agree.

Starting something like this isn't necessarily the death knell, but the inevitable unequal application of it will be.

</comment></comment></comment><comment><USER16> "Think of the children" justifications for normalizing private sector censorship seem to be a contemporary ruling class focus. Pao's contribution is a smart career move.

<comment><USER17> Just like how intelligence organizations wraps their methods with "hunting pedophiles and terrorists".

</comment></comment><comment><USER18> Isn't reddit feeding off the entire nation of self-professed internet activists who are out to solve the world's injustices? These people are going to lose their sense of purpose if nobody is attacking them. Don't bite the hand that indirectly feeds you, reddit.

</comment><comment><USER19> Reddit is a propaganda site and has been for a while now. Many years ago, it was predominantly run by the users ( commenting and voting ). Now it's just a tool for admins and mods to push their agenda/views.

They might as well get rid of the voting system. Reddit is a joke and the sooner it goes away the better.

</comment><comment><USER20> So, what's the driving force behind this?

They're not doing it out of the good of their hearts, so I see three obvious possibilities: making the website a more attractive place to advertize, external pressure hurting their image (like that time they banned some subreddits only after being featured on CNN) or trying to appeal to more women. Did I miss anything?

I assume it's some combination of the above leaning heavily towards advertizement. Considering the number of house ads I see them running, and the anecdotal things I've heard about advertizement sales on 4chan or other uncouth websites.

</comment><comment><USER21> > Censorship should be the subreddit's decision.

It's fun to watch parallels develop between reddit site operators versus subreddit moderators, and federal government versus state's rights. (For anyone not familiar with this long-running American political theme: [http://en.wikipedia.org/wiki/States%27_rights](http://en.wikipedia.org/wiki/States%27_rights))

</comment><comment><USER22> I said it in another thread, I visit a subreddit with very strict moderation. Very strict. The place is wonderful for regulars and newcomers. It is healty and strong. One of the rules is:

>If we find that you are active in any subreddits that promote hatred toward any particular group of individuals, your participation rights in this sub will be revoked.

And another:

"Mod abuse will not be tolerated"

Those rules have worked for years.

<comment><USER23> I'm really interested in knowing what subreddit that is.

<comment><USER24> [http://www.reddit.com/r/redditgetsdrawn](http://www.reddit.com/r/redditgetsdrawn)

</comment></comment></comment><comment><USER25> _> It added that it defines harassment as "systematic and/or continued actions to torment or demean someone in a way that would make a reasonable person (1) conclude that reddit is not a safe platform to express their ideas or participate in the conversation, or (2) fear for their safety or the safety of those around them"._

In point (1) she basically just described how SRS operates...I doubt they'll be willing to use this to punish them, though.

Speaing of SRS, maybe it's time the community starts asking A) how many reddit employees are involved with SRS and B) how many other subs the anonymous* SRS mods also moderate.

*mostly anonymous. It's public knowledge one of their mods used to be a site admin.

</comment><comment><USER17> Has anyone heard of something called "ignore"? It is possible to do online.

<comment><USER6> Less possible when you're getting hundreds of messages per day on all your online accounts with eg pictures of your children leaving school or your workplace.

<comment><USER24> No that actually sounds like a really good time to start ignoring things. You don't feed the trolls, real life or internet.

What's more inflammatory, ignoring a troll after he happens to find a picture of your children, or aggressively attacking their actions on their medium of choice? Don't feed the trolls.

</comment></comment></comment><comment><USER26> Well, at least they are doing _something_. It seems like Reddit has tripled staff and VC money but has been doing exactly zero, nada, zilch. The site is the same, as are the ads, the downtimes, the loading problems, the ...

<comment><USER27> Hint: it's an ad revenue based cash-out. They don't actually need more servers or features, they need more curators and ways to channel money.

Sell off the valuable real estate and make the site cleaner for advertisers so that there's less bad PR when one of the uglier subreddits gets critical mass and finds public attention.

</comment></comment><comment><USER28> I'd just like to point out the Pao and Reddit can do anything they want on their property and it __is not censorship __. Private parties cannot censor, only the government can censor which why the recent nationalization of the US Internet by the FCC is so dangerous for Free Speech. When the FCC comes out with their "Internet Anti-Harassment and Diversity Guidelines" that must be followed at the threat of shutting down your blog, that is true censorship and should not be tolerated.

<comment><USER29> Actually, the everyday meaning of censorship quite clearly includes the private suppression of speech. Them having the right to engage in it is independent of that.

<comment><USER28> Well, if that's the case we'd better be careful with our definition and use of concepts or we will lose our freedoms.

</comment></comment></comment><comment><USER30> I can't agree with many of the comments here. I have a 7 year old reddit account, go there daily, am still subbed to many defaults, and I just haven't seen many of the accusations of terribleness and the inevitable downfall that have been professed here. In my experience, the growth of the site hasn't changed it much at all.. maybe more reposts to the front page but that's not a big surprise.

It is what you make of it.

</comment><comment><USER31> It would be nice if they would have a spam/self-promotion crackdown.

<comment><USER32> /r/iama/ one of their main revenue sources, is all about self-promotion.

<comment><USER31> And that's not a problem since it's the point of that subreddit, but the behavior is sitewide.

</comment></comment></comment><comment><USER20> I see the submission title has been edited so that it's no longer the title the BBC used. I get what the social pressures are around here, but c'mon son.</comment>


Lessons learned from cracking 2 million LinkedIn passwords - <AUTHOR> https://community.qualys.com/blogs/securitylabs/2012/06/08/lessons-learned-from-cracking-2-million-linkedin-passwords <comment><USER3> Here's a useful one-liner to create a strong password in Linux:

        cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4

This uses the dictionary _/usr/share/dict/words_ and skips all the words containing characters like é, å, ø and all those ending in _'s_. The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen. This gives a password with about 65 bits of entropy.

By adding another word, thus creating a 5-word passphrase, a botnet capable of checking 1,000 trillion passwords per second would spend, on average, 1600 years cracking away before it would find the correct passphrase.

Here are some example 4-word passphrases produced using this method:

        poetically archaisms accept constrictors
        leukemia shuttlecocked checkout benevolently
        climactic gyrate dynamical predominates
        massage beef Concords recliners

These are surprisingly easy to remember. I use a 7-word passphrase for the most important things and it didn't take me more than a day or two to learn it.

<comment><USER4> That's only 4 tokens and you should assume at least some of the combinations are already in rainbow tables. I don't know how long it would take to create a rainbow table for the whole space, which is this big:

      72940^4 = 2.8304992 × 10^19

To put it in perspective, a 14-character password using _only_ lower case English alphabet letters as individual tokens already beats this:

      26^14 = 6.45099747 × 10^19

<comment><USER5> Then again, a random string of 14-characters is nearly impossible to remember.

The key takeaway here is that every word adds another 16.15 bits (assuming good random source and no non-random decisions by the user), whereas another character adds only 4.7 bits. I'd argue that the effort to remember another 4 random characters (to reach those 16 bits) is far more than the one to remember another random word. We're quite good with words, you know :)

</comment></comment></comment><comment><USER6> _no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked_

So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language.

Would the passphrase "My first car was a 1972 Monte Carlo" really be harder to crack (once the cracking tools are adapted) than a random 8 character password?

<comment><USER7> Well, calculating the "true" strength is difficult to do, because even though sophisticated tools are available to aid the process, the attackers are still human, and can input their own guesses that may or may not be more accurate. If the attacker knows (or can closely guess) the password rules used to generate your password, he or she has a better chance of getting a hit.

Let's look at a password like "My first car was a 1972 Monte Carlo". The password is 35 chars, 3 upper case, 6 special (spaces), and 4 numbers. The key space is all upper and lowercase english letters, all numbers, and all special characters. That's a key space of 95 characters, over 35 places. Objectively, there are 1.66 x 10^69 possible combinations. Given that the LinkedIn password crackers are slowed down at about 9 chars it seems like you're incredibly secure. But let's assume the attacker knows something about your password structure. Let's say they know that you use words (many people do, so it's a reasonable guess). Let's also assume that for numbers the attacker knows that years are popular for password numbers. Now instead of 35 chars, your password has 7 words and a date. We've changed the key space from 95 to about 100,000. (The exact number of words there are is a tricky number to pin down, but crackers have some good data on what the most popular ones are.) As for the date, there are really only a couple hundred interesting numbers, including all dates from this and last century, as well as common patterns.

Password strength is (key depth) ^ (key length). An uninformed attacker has 1.66 x 10^69 possible combinations (95^35), while an informed attacker has roughly 1.0 x 10^40 possible combinations (100,000^8). Obviously, the less an attacker knows (or can guess) about your password structure, the better chances your password has against being cracked.

Now, you asked about your password versus a random 8 char password. Let's take a "strong" password like "1~qQ%57h" This password also has upper and lowercase letters, numbers, and symbols. We can assume that there is nothing predictable about this password for this exercise. The password strength is 95^8, or 6.6 x 10^15, obviously much lower than the longer sentence, even if the attacker knows the sentence is 7 words and a date.

Now remember, our passwords are being matched against human crackers attempting to guess the ways our passwords are most likely put together. For now, most passwords are 6-12 characters. In fact, most websites only allow passwords of these kinds, so it makes the most sense for crackers to go after these passwords. But it's still an arms race. If we assume that webmasters see the light and allow (or enforce) long, sentence-like passwords, the crackers will adjust. It's plausible I think that 5-10 years from now, we'll see articles like this one that use sentence structure syntax as an attack method.

Until we discover and implement a better system that obsoletes passwords, the best we can really do is have long, complex, and unique passwords for everywhere we go, and have a system to manage them for us. I believe that something like LastPass or KeePass are the way to go for now.

*Disclaimer: This was written on a groggy Sunday morning. Do not rely on my calculations. Do not use any of the examples as passwords. Do please check my work.

<comment><USER8> One improvement: for most people, the risk is not that someone tries to crack your password, it is that someone uses rainbow tables to crack many passwords, one of which may be yours.

Rainbow tables have a degree of freedom: the function that maps hashes back to passwords. You should try and pick a password that that function will never generate. To get that, do something unique. Good options, I think, are including a foreign language word (neither English nor your native language, nor the site's language), reversing a word or a syllable inside it, and made up words that have Hamming distance greater than two to any other 'obvious' word.

Short (<= 8 characters) passwords, I think, are bad choices for that reason, even if they consist of ASCII gibberish.

Disclaimer: I have never looked what kind of code commonly used rainbow tables use.

<comment><USER9> I thought GPUs killed rainbow tables? (the storage space alone makes them impractical compared to cracking realtime)

<comment><USER8> Not that that says much, but I am not aware of that. More importantly, googling for "GPU vs rainbow table" leads me to phrases such as "a fully GPU accelerated set of rainbow table tools". Or has the term changed meaning?

<comment><USER9> These links are good:

<http://news.ycombinator.com/item?id=3140614>

<http://news.ycombinator.com/item?id=4073597>

<comment><USER8> Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> So here's an idea:

Pretty much every site with a login facility has an "I forgot my password" option where you put in your username or email address, and it sends you a link to reset your password. This is effectively a second form of authentication - the ability to receive email at that address implies the ability to log in to that account.

So what about an authentication mechanism that works as follows:

1\. You type in your username

2\. The site emails you a one-time authentication token (as part of a link)

3\. You click on that link and then you're logged into the site

Of course, there are a few obvious problems with this: it's a bit cumbersome to have to do for every login, email is unencrypted, and message reception uses a pull-based mechanism.

So I could envisage a standard, incorporated into browsers, as follows:

1\. When you first launch your browser, you log into an authentication server S, supplying your password (either manually, or automatically via a saved password)

2\. When you want to log in to a site, you type in your username, and the site sends an authentication token to the server S

3\. S sends a push notification to your browser with the authentication token

4\. Your browser passes this token to the site, and you're logged in

This way, your (hashed + salted) password need only be stored on server S (in the first example, this corresponds to your email server). This means that apart from S, none of the sites you use need to store any password information at all.

I'm sure this basic idea has been implemented previously in other contexts. Why are we not using for all our web logins?

<comment><USER11> I don't want to let server S know which sites I have an account to. Also, I don't trust server S.

And as if that wasn't bad enough ( _which it is_ ) it is a single point of failure both in terms of security and availability.

<comment><USER10> The role of server S would be analogous to that of your email server, which you already trust. Just like email, it would be a decentralised system - <USER2> numerous public providers, as well as servers that organisations and individuals have set up themselves.

You could also have multiple accounts with different S servers, e.g. one for work and another personal use.

I agree with the single point of failure regarding availability - if your authentication server is down, you won't be able to log into _anything_. Though we already have the single point of failure with the existing system, in that once someone has your email password, they can obtain password reset messages from any site that you've registered on with that account.

<comment><USER11> So you gladly replace that single point of failure with two points of complete failure? You can't conceive of any problem with that reasoning?

 _You could also have multiple accounts with different S servers, e.g. one for work and another personal use._

If I was forced to use such a service I'd make a service that made it easy to automatically create one "S-server account" for each "real" account and continue to use passwords for those accounts as if nothing had happened.

In practice, BrowserID doesn't solve anything for me - at the cost of reduced security, availability and integrity - as well as forcing me put trust in a third party.

There is a huge difference between my mail server and the S server. If someone uses my mail to reset passwords I will notice, since my credentials won't work anymore. Also there are different levels of security, I value my mail account more than say my account on hacker news. Which I haven't even entrusted with my mail-address - love that you don't have to supply even a fake one and considering that I don't forget my password (or allow anyone to hijack my session) I can't possibly gain anything from supplying it.

Which is the key point, rather than me not trusting ycombinator there is just no incentive for me to supply it - so why should I? Maybe ycombinator gets hacked and my mail gets leaked, I might thus end up with spam - no need to take that miniscule risk when there is nothing to gain. Just as I see _no_ reason to link independent accounts together with a service such as BrowserID.

</comment></comment></comment></comment><comment><USER12> _Thus, it is highly recommended to use a strong random password generator that is known to be actually random._

The whole point of a password is that you can remember it. The moment you need software to store and retrieve passwords, you're better off using asymmetric cryptography. That said, I really dislike the idea that it's the only way to achieve security. I would really like to see more discussions and propositions for solving this problem.

<comment><USER13> It will get to the point that we need biometric scanners or implanted RFID chips with private keys to do authentication, since brute forcing even unrememberable passwords will be trivial eventually.

<comment><USER14> Why? There are plenty of ways to make brute force hard or damn near impossible, it's just a little harder to implement. It has been discussed a lot of times here at HN and other places.

Also, do you really think that storing private keys on RFID would be a wise choice? I would put that in the "stupid as fuck"-category, just above storing your keys on a USB-stick, as they are both easy to copy and duplicate, and with RFID I could do it remotely.

A real solution to all of these problems would be for people to stop reusing passwords. You don't really need the account passwords when you basically have access to all the data there anyway.

<comment><USER12> That's the problem, though. If people didn't reuse passwords, if people didn't use words and personal information in passwords and if people had no problem changing them every day then a lot of problems with security would be solved. But those are not realistic expectations, and blaming users for not being computers does not solve the problem.

Slow hash function certainly help, but I think we also need something that goes beyond straightforward cryptography to address authentication issues. Something that redefines the rules of the game to be more human-friendly and less computer-friendly.

But then again, I never even heard the question being phrase this way: what do we want from "program-less" authentication and what we can use to achieve it.

</comment></comment></comment></comment><comment><USER15> Well it's to the point now where I can't remember my passwords they are so long and complex plus I have so many accounts I need a password manager to manage all of that.

With a password manager why bother restricting any password to anything less than the maximum? Gmail's password limit is 100 characters so I did that and any other account they are maxed out. Add to that extra authentication and also change them at least once every six month at minimum.

The problem is my most valuable account, my bank, is stuck 15 years in the past.

<comment><USER16> I've done the same, though I tend to limit it at about 24 characters, simply because if I come across a situation where I have to type it on a foreign computer while reading the password from the password manager on my phone, I don't want to be there all week..

</comment></comment><comment><USER17> I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials.

Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database..

It's pathetic that a major company like LinkedIn is simply storing credentials with a SHA1 hash. At LEAST use a really good salt...

<comment><USER18> _> Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database.._

I like this idea. Like a Surgeon General's Warning for the web. I wouldn't want the government making specific laws about hashing, but requiring transparency and disclosure about how data is stored would be useful in a variety of ways.

<comment><USER19> The concern I have with this is that it provides a bit too much information to potential crackers. Security through obscurity is nothing to rely in, but it doesn't hurt to have a little. It's why disabling the reporting of http server version information is a common practice in hardening a server.

OTOH, it may be worth it. It's shocking that LinkedIn could be so negligent, especially after high-profile screwups like gawker.

<comment><USER18> >The concern I have with this is that it provides a bit too much information to potential crackers.

Only the script kiddies. The ones you have to worry about have bots and automated scans that can figure that stuff out in an instant.

Yeah, unbelievably shocking that such an advanced web company as LinkedIn could be so negligent. Amateur bitcoin sites, social media sites, venerable Web 1.0 ones like Last.fm don't surprise me much, but LinkedIn? WTF.

</comment></comment></comment></comment><comment><USER20> I always use site specific, but also site derived passwords. I think it's time to reevaluate that practice. I remember seeing that three of the top password fragments for LinkedIn were link, job, and work. My password was all three... oops.

<comment><USER21> You might want to look at a browser extension like PwdHash [1]. It uses a client-side script to generate a cryptographic hash from your common password and the domain name. I've been using it for about four years now and have been generally very happy. It means that if my password ever gets leaked the attackers are not only unlikely to find my password of "ngjO3uBJrvt", but if they get it they do not have any information about other sites, even if I reuse the password elsewhere.

There are some newer password management/hashing tools. I've stuck with this one both because it works for me and I know and trust the authors, a group at Stanford.

1\. <https://www.pwdhash.com/>

<comment><USER20> I don't use that because of (unfounded) concerns that I will someday need to enter my password into some device where it's not available, or the domain will change, or some other scenario where bad things will happen because I do not actually know the password I told the site.

<comment><USER22> I call this 'primary authentication' which means you're in an environment where you can't execute code (staring at your xfce4 desktop log on prompt for example). Password managers and generators are only useful _after_ you've logged on. Form there, you can execute code and use a password manager for 'secondary authentication' (websites, email, etc.).

</comment></comment></comment></comment><comment><USER22> Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength:

print math.log(62) / math.log(2) * 6

35.72 bits

That's easy to crack. Also, keep in mind that humans don't select chars randomly. So the bit-strength of these passwords was probably closer to 20 bits. I cracked 2.5 million with an old cpu and JtR within a few hours.

<comment><USER23> This is the advice I give to my family members. The solution is to create a one-time-pad in excel(!) that contains all of your passwords. Store it on an encrypted thumb drive and carry it with your keys. There is the possiblity that your OTP may contain a character set that is not congruent with a web- service's password system, but these circumstances are rare.

<comment><USER24> Just use keepass. If you're already carrying around a password file, you can carry around portable binaries of the program that reads your passwords.

www.keepass.info

<comment><USER25> sadly, Keepass is not very Mac/Linux friendly, because it's built on .NET, so it's only an option for pure Windows users.

<comment><USER26> I don't know about Linux, but I've been using KeePassX for Mac for about a year now. It only supports the older KeePass file format, and it's ugly, but it works great. There are also a few iOS apps you can use, my favorite of which is KyPass.

</comment></comment></comment></comment></comment><comment><USER27> This week has finally got me off my ass, and I generated a truly random password for all 260 sites I have built-up in Lastpass over the past few years... as well strong Lastpass password (most likely going to be hardened with a two-factor via Yubikey in the near future).

I must say, just finding the password reset function on some of these forums and less popular sites is a beast. Also, I was shocked by the number of 10 and 12 char limitations I hit.

</comment><comment><USER22> How to calculate real-world password bit-strength: <http://16s.us/word_machine/bits/>

</comment><comment><USER28> With all this talk about security I am still wondering why everyone isn't up in arms about the fact that Chrome makes all of your stored passwords plainly visible at the click of a button or two. This has been the case for years and many complaints have been recorded, but Google, for some strange reasons, seems to refuse to even attempt to put forth any effort to secure their browser.

<comment><USER29> There are going to be much better discussions about this in Chromium discussion archives but I'll cover one of the main reasons why Chrome and Firefox (by default) do not have a master password. If someone has physical or remote access to your computer it is an endgame scenario and it does not matter if you have a master password enabled or not. The most basic attack is just to install a keylogger and steal the master password. They could also just copy the password database remotely and brute force it.

<comment><USER28> I understand this very well. Here's one scenario: Busy office. Hundreds of computers. Open environment (no doors, just a bunch of desks/tables). Everyone using Chrome.

The current version of Chrome would allow someone to, within a few clicks, grab a pile of passwords.

Here's another scenario: Your mother takes her laptop to be repaired/updated. She uses Chrome. The entire repair shop has easy, unencumbered access to all of her passwords and logins.

Similar scenario: Computer goes to IT guy where you work for repairs/updates. He now has any and all of your passwords and logins with no effort.

My point is that for all this talk about security it seems really dumb for a prominent player (any prominent player) to not take extra steps to ensure that our valuable data is secure within reason. With LinkedIn the problem is, at the very least, the lack of anything beyond SHA-1 to protect passwords. Bad idea. In the browser case, it seems to me that, unless the intent is to provide a browser used only by those like us who understand and are very aware of security issues, it might just be a good idea to put in a few things that will make it harder for curious eyes or the 16 year old at the repair shop to grab all of your login data.

I don't propose nor do I expect perfection or absolute security, but what Chrome does today is, in my opinion, at the very least irresponsible. The uninformed user has NO IDEA WHATSOEVER that a huge security hole exists in their browser. Maybe we need to stop thinking in our terms and focus on mom, dad, uncle or grandma. When you first install Chrome you should, at the very least, see a screen telling you about security and the options you might have. I think that a master passwords would most-definitely serve a purpose in the case of "innocent" peeking. Yes, with pro's all bets are off. It's only a matter of time until someone tracks identity theft to the lack of browser security and they sue the fuck out of the browser publisher.

<comment><USER29> > The current version of Chrome would allow someone to, within a few clicks, > grab a pile of passwords

With a USB stick and one click anyone can install malware that would give complete control of the computer to the user remotely.

> Computer goes to IT guy where you work for repairs/updates.

IT repair guys generally need admin access to the computer and will have all the time in the world to install any number of malware for remote access.

> but what Chrome does today is, in my opinion, at the very least > irresponsible

For Chrome to add a master password would be irresponsible because it would give users the illusion of security they don't have. All OSes already have password protection against innocent peeking with user accounts and the ability to lock your computer when you walk away.

</comment></comment></comment></comment><comment><USER30> 20 years ago we called this crackerjack.

<http://web.textfiles.com/computers/jack14.txt>

</comment><comment><USER31> Well heres an idea i use . If you know how to touch type just offset your fingers on the keyboard in a special way so you can turn a memorable password into slightly more random gibberish . Eg : I Love you o ;pbr upi

</comment><comment><USER32> Were these just password hashes or did the leak include usernames and/or email addresses?

<comment><USER33> The file that got leaked to the public is only containing the hashes. The hackers behind the file probably has usernames or emails.

</comment></comment><comment><USER34> head -c x /dev/random | uuencode -

where x is the length of the password you want.

<comment><USER35> How do you remember it ? What do you do if you need to login from another computer ? This doesn't work on my windows computer. If we store this random password in a local pasword storage, how much different is that from using asymetric keys (rsa,...) ?</comment></comment>


What fasting taught me about energy management - <AUTHOR> http://krmmalik.posterous.com/what-fasting-taught-me-about-energy-managemen

<comment><USER2> Short version: He went through a lot of prep, but in the end what mattered most was the quality of his sleep. (As opposed to quantity of sleep and eating habits.)

I'm not quite sure I believe it matters more than eating well enough, but good sleep can make a huge difference in your life.</comment>


Digitising public domain images creates a new copyright, rules German court - <AUTHOR> http://arstechnica.co.uk/tech-policy/2016/06/digitising-public-domain-images-creates-a-new-copyright-germany/ <comment><USER2> Tragic and nonsensical decision. Just one more avenue for our cultural heritage to be locked away for eternity, when technology is on the cusp of allowing us to share that heritage with everyone worldwide for the first time in history.

How would this affect things like gutenberg.spiegel.de? Would a German digital transcriber of a PD work then hold the German copyright for that digital version, until 70 years after the transcriber's death? Ridiculous!

<comment><USER3> Important to note: the argument in this case is not "the museum owns the original artwork, thus it can stop people from freely licensing their photos of it", but "the museum owns the rights on the photo, and can decide if it releases it to the public domain or not". It's not about the rights of the owner of the artwork, but about the rights of the owner of the photo.

Photographs have a slightly elevated standing in German law, with lower demands on creativity to get protection, and I'll assume that's the way the court got to this decision. We'll see if it survives in front of higher courts. I wouldn't be surprised if it doesn't.

In your transcriber example (assuming transcriptions and photographs would follow the same rules, which they don't), the transcriber would have the rights to his/her transcription, but couldn't stop anybody else to transcribe the same PD work and release their transcription.

I agree with wikipedia that this question shouldn't have come up, because I'd prefer if public museums were required to release such photos under some kind of free license, although I'd be fine with restrictions for commercial use.

<comment><USER4> Does this mean if I create a 3D model of a physical object, I know hold the copyright to that objects digital representation? And if so, does anything prevent me from registering said copyright and providing it to the public domain?

<comment><USER5> Registering a copyright? Is that something you can do in Germany? I thought that was something that existed only in the United States, and only a long time ago.

<comment><USER4> Forgive me, in the US copyright exists immediately when a work is created (I'm unfamiliar with German law, I'm a US citizen residing in the US). You can still register your copyright to make it known with the US Copyright Office: [http://www.copyright.gov/fls/sl35.pdf](http://www.copyright.gov/fls/sl35.pdf)

</comment></comment></comment></comment></comment><comment><USER6> Sigh ... as much of a supporter I am of the public domain, I'm really thinking we just need to end the charade that a "public domain" even exists anymore. Because, increasingly, it doesn't.

Let's face it ... I'll never see a single work made within my lifetime make it the public domain. And copyrights are just going to keep getting extended and extended. Mickey Mouse is never making it to the public domain. And as if having to go back to pre-World War II to find public domain works wasn't enough, now they're trying to undermine even that!

If I thought there were any chance we could change the laws toward our favor, I wouldn't advocate this. But I just don't see any hope at all anymore. So let's just call a spade a spade, and state that the public domain doesn't exist: everyone owns everything, forever.

We'll reclassify historians and preservationists as unquestionably being "pirates". Most of us already are. But the few left that are trying to play within the confines of the law, only to continually have the rug pulled out from under them, can get to work with the rest of us on the wrong side of the law. Civil disobedience is the only recourse we have left. It's that, or we give up our very history to corporate interests.

<comment><USER7> > _I 'll never see a single work made within my lifetime make it the public > domain._

Plenty of work makes it to the public domain; it just need to be noted as such by the creator, and creators do do that from time to time.

On Mickey Mouse specifically, I don't really have a problem with that one. Mickey Mouse isn't something created by someone who is riding on their past successes and whose descendants are riding on the coattails of. It's an actively developed and organised bit of intellectual property, which is responsible for literally thousands of jobs. They are actively working their IP, rather than merely sitting back and demanding a cut if other people want to work it. As such, I think protection for that is reasonable, as it is a going business concern.

I have far more problem with IP not making it to public domain if it's not actively worked. An example from Australia: there was an iconic song "Land Down Under" in the 80s, in which a 12-note melody was in the bridge. That melody was "Kookaburra sits in the old gum tree", a very recognisable Australiana kids/folk tune. The original owners didn't pursue damages, but nearly 20 years after the pop song made it, a business group bought the rights to Kookaburra and sued the creators of the pop song. This business group didn't 'value add' to the IP - they didn't actively work it. The case turned out with a relatively sensible ending - the judge gave some minor royalties to the rights holders because while the melody was clearly in use (it was the point of using that melody, after all), it wasn't the main theme of the song.

So I think copyright should be a bit more complex - if you're actually actively working the IP to a reasonable (yes, 'define reasonable...') amount, you should be able to extend it. Otherwise, expiry as it used to be. Some protection would need to be figured out to prevent trivial token 'working', of course.

<comment><USER6> > Plenty of work makes it to the public domain; it just need to be noted as > such by the creator, and creators do do that from time to time.

Every time I try and release my source code to the public domain, I invariably get people telling me it's not possible to do this due to laws in various countries, and that I should use the ISC/MIT license instead.

I've taken to releasing a lot of my work as "public domain where applicable; ISC where not."

> So I think copyright should be a bit more complex

My general idea of copyright would be that it's 14 years from the date of creation, with a one-time possible extension to 28-years that is not automatic (basically, what copyright used to be.)

The problem is abandoned works. If you produce a game on some volatile medium like a CD-R, then use DRM to protect it, it's quite possible that in 28 years, not a single working copy will exist. The only way it can enter the public domain is thus through breaking the law initially. And let's not even get into things like online servers required to use software =(

Ideally, there'd be a forfeiture of copyright for "abandoned works" (works the author will no longer sell to anyone); but I recognize that a legal framework for such a concept would be damn near impossible to create (you'd get artists saying, "sure I'll sell you a copy still ... for $100,000,000")

</comment></comment></comment><comment><USER8> > The General-Director of the Reiss Engelhorn Museum, Prof. Dr. Alfried > Wieczorek, told Ars why the museum had decided to take legal action: "As far > as we are concerned this case is not about harming Wikipedia, or of us > fundamentally disagreeing with this project. On the contrary: we have great > sympathy for the Wikipedia project, and share with Wikipedia the object of > spreading knowledge. But in this case, the question for us is who should > decide whether and especially how our holdings should be made available. > Even if one supports the free public accessibility of cultural items on > Wikipedia, it is difficult for us to comprehend that a single Wikipedia > author claims the right to decide on their own to release to everybody the > results of work created with public funds on Wikipedia for free and thus > also for commercial use."

So, while it might be ok for wikipedia to publish images of public-domain work, it is unconscionable for wikipedia to publish images of public-domain work that someone else subsequently makes commercial use of. (And it's important that the museum get a veto over whether the public should be allowed to see certain works at all.)

<comment><USER9> The stupid part about this is that this ruling will only affect stuff hosted on German servers, so only dewiki will be affected. Even then, someone will likely go in and sneak a few pictures that are "good enough" for Wikipedia purposes. All they've accomplished here is further restricting the public domain in Germany while not stopping Wikipedia from using their images. (We call that "cutting off the nose to spite the face") Now Germans will need intimate physical access to a work in the public domain to be able to get their own copyright to share it. Very disappointing for a museum, especially one which takes pride in receiving public funds. (Though of course the court shares more blame for making such a decision)

<comment><USER10> I though all the Wikipedia servers were hosted in the US, regardless of language. de.wikipedia.org has address 126.96.36.199, which seems to be in the US. That would make it easy to ignore German court rulings if desired.

<comment><USER9> Whoops, you're right. Looks like I misread the relevant passage:

> The German court dismissed the case against Wikimedia Deutschland on the > grounds that it was not legally responsible for the files in question, which > were held by Wikimedia Commons in the US, which in turn are managed by the > Wikimedia Foundation.

</comment></comment></comment></comment><comment><USER11> It will be interesting to see how this plays out in German law. US and UK courts have already established that in those countries, copying an image does _not_ establish a new copyright. In the US, this is a Constitutional limitation: "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries." The key US rulings are Feist vs. Rural Telephone (telephone directories cannot be copyrighted because they're just collection of facts, not creative works) and Bridgeman vs. Corel (photos of public domain images cannot be copyrighted because they are not creative works.) There's also Meshwerks vs. Toyota, which reaffirms Bridgeman at the circuit court level and extends it to 3D scans. (scans of 3D objects create no new rights.)

In the US, databases of facts are not copyrightable. The European Union, though, has a 15 year copyright-like right for databases.

</comment><comment><USER12> There's an infinite number of ways to digitize a painting. What if you invented, say, a new algorithm to calculate colors from bayer pattern? Or an entirely new sensor (as, e.g. Foveon, did)? Or, maybe, a new lighting scheme that produces more accurate colors? Should you be denied the copyright on your work because you "sought to reproduce the paintings as exactly as possible"? I don't think so. In this respect the court decision makes sense to me.

On the other hand, I agree that preventing sharing of public domain works runs counter to the mission of public museum and, while legally entitled to, they probably shouldn't exercise their copyright in this way.

<comment><USER13> Your work is the sensor, algorithm or lighting scheme and you should own the relevant patents and/or copyright to those. The exact copy of an image in the public domain that you take using those should not be copyrighted.

</comment></comment><comment><USER14> This is kind of similar to how thing are in Poland, so maybe other countries in EU work the same way?

In short, digitalising creates new "pole eksploatacji" (~field of exploitation/utilisation) for image, and by the law each such field needs to be explicitly named in agreement with the author. And no, you CAN NOT give rights to all of them, either known or invented in the future. All of them have to be explicitly named, and the law itself does not contain any list of them, just some examples. For example even if tablet, PC and console all are just a computer for the purpose of distributing video they could be counted as something different even if video is streamed from the same source. Other circumstances like if consumers are buying the copy or just renting it, or if it can be viewed at restricted or any time etc. may also be important. By default author is entitled to payment even if agreement doesn't mention it. Finally apart for the above part (called "autorskie prawa majątkowe") there are also "autorskie prawa osobiste" ( [https://en.wikipedia.org/wiki/Moral_rights](https://en.wikipedia.org/wiki/Moral_rights) ) which can not be licensed away, and at least from my point of view seem to be less popular in US.

I've heard this law (mostly explicitly naming fields of utilisation) creates some issues with digitalisation of old archives here in Poland, but I don't remember the details.

I'm not a lawyer, it's couple of years after I learned it so there might be mistakes, if someone could correct me I would be grateful.

EDIT: better example

</comment><comment><USER15> I'm confused.

Does this merely mean that if I take a photo of something in the public domain, I hold the copyright on that particular reproduction?

Or that if a museum takes a photo of something in the public domain, they can restrict others from offering/using their own photos of that work?

<comment><USER16> To clarify, because the original article doesn't really mention this: the photos that were uploaded to Wikimedia Commons were taken by a photographer hired by the museum, not Commons users. The museum is claiming that they hold copyright over the photos because even though the original artwork is in the public domain, the photo taken of it has its own copyright, held by the museum's photographer (and thus the museum).

<comment><USER15> That seems completely reasonable to me.

</comment></comment></comment><comment><USER17> Very curious given that the UK, which has always taken a maximalist view on this, quietly rowed back last year and said that maybe it doesn't create a new copyright after all.

</comment><comment><USER18> This decision only binds these parties with relation to these pictures in these circumstances. No one else. Other courts, even this Berlin trial/appeals court or an inferior Berlin court, need not pay any attention to this legal reasoning in other cases.

<comment><USER19> They don't _need_ to but more often than not they do if the legal argument holds any merit at all. And this is not the first time a court has argued that way creating a substantial risk that the next time the decision will be similiar.

</comment></comment><comment><USER20> I think there's nothing wrong with mechanical rights for the digitization. Each person shooting their own picture gets their own mechanical copyright. (This is the same as difference between the specific recording, and the written song, in music)

<comment><USER10> How would you even distinguish one from another, once they've been processed a bit in graphics software and copied all over the web?

<comment><USER19> You can usually tell the images apart if you have some resolution to play with. Taking such pictures in sufficient quality takes some skill (e.g. with regards to lighting) that two different photographers usually end up with two different picture of the same painting.

And even if you can't tell those two images apart you can often trace the image back to its origin.

</comment></comment></comment><comment><USER21> So germans should be running to their local library, in order to digitize everything and claim new copyright?

Better the citizenry do it than corporations.

<comment><USER10> They'd only have copyright over their own photo (and it's not clear a scan would count). Anybody else could still make another photo with a separate copyright.

<comment><USER21> why wouldn't a scan count? Every tax agency I've ever heard of accepts scans _in lieu of paper_.

<comment><USER10> Because the German ruling applied specifically to photographs, if I understand correctly.</comment></comment></comment></comment>


Open-source selenium helper library - <AUTHOR> https://github.com/selenium-webdriver-software-testing/kspl-selenium-helper <comment><AUTHOR> This library is intended to make job of selenium webdriver user easy. This can be used for

Reporting Cross browser testing TestNG parallel execution Data Driven Testing Easy integration with Jenkins HTML report / Excel reporting Reading data from Excel file or CSV file TestNG FAQ: [http://mayurshah.in/tag/selenium- webdriver?utm_source=hn&utm...](http://mayurshah.in/tag/selenium- webdriver?utm_source=hn&utm_campaign=kspl-selenium- helper&utm_medium=readme_file)

Ask us a technical question: [http://mayurshah.in/ask?utm_source=hn&utm_campaign=kspl- sele...](http://mayurshah.in/ask?utm_source=hn&utm_campaign=kspl-selenium- helper&utm_medium=readme_file).</comment>


Passé présomptif: on Vercingetorix - <AUTHOR> https://www.the-tls.co.uk/articles/public/passe-presomptif-vercingetorix/ <comment><USER2> One of the most interesting materials I was exposed to in a college french course was actually an 8th-grade level French history book. It was beautifully illustrated, not all that difficult to read, and it spanned an impressive amount of time and material (at least compared to the US history books I had been exposed to before)

I was really surprised to see a whole chapter dedicated to Ancient Gaul, a place I had never even heard of until then. Brits may begin their history with Rome, but us Americans seem to start our tale in England (with perhaps a very small nod to the native cultures that predated English colonization). Anyhow, it's fascinating from the American perspective how relatively "young" we really are as a national identity.

<comment><USER3> So you've never read Asterix. You're in for a treat.

<comment><USER4> Although I wonder how they translate the never ending puns in English.

<comment><USER5> Very effectively. The English versions are celebrated almost as much for the translations by Anthea Bell and Derek Hockridge as for everything else. Puns are translated quite freely; in many places they make up new ones. See e.g. [https://auntymuriel.com/2012/12/23/asterix-in-translation- th...](https://auntymuriel.com/2012/12/23/asterix-in-translation-the-genius- of-anthea-bell-and-derek-hockridge/)

<comment><USER6> Wow. The translations are impressive indeed, I didn't expect that.

That reminds me of the French traduction of Discworld, an amazing work by Patrick Couton.

<comment> barry-cotter Traduction is translation in English, one of the three faux amies with -ion at end.

<comment><USER6> That was me not paying attention. Though if you look closely, I got it right the first time ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> A good read outlining the different kinds of historical writing, including 'passé présomptif' where an author makes statements that their subjuct _may have_ done something or _would have been familiar_ with something else. It ends, essentially, as a review of Jean-Louis Brunaux's _Vercingétorix_.

<comment><USER8> I agree. It's a great article.

Incidentally, the "passé présomptif" is also much used for writing about Shakespeare: a similar phenomenon. Now I know what to call it.

<comment><USER9> When I was younger I read a really good book about Homer that was kind of framed as a 'biography' of Odysseus that was written in that way, but it was open from the start that it was an artifice used to elucidate what we know about the Greek Dark Ages.

</comment></comment></comment><comment><USER10> It's a lively and interesting piece IMO.

>"In schools, Our Island Story starts with Roman Britain, [...]" //

I'd have thought that was because Britain wasn't a thing until the Roman conquest. AFAICT prior to Roman occupation there wasn't a Britain, there were different tribes, but they weren't united in to a nation, they weren't even a loose affiliation.

When it notes that some Iceni tried to revolt, that tells you exactly why British history is started there. Otherwise it would be "some Britons tried to revolt".

What's he doing in the imagined prose when he gives French words in parentheticals, I don't get it. And shouldn't it be "knows [ _savait_ ]" rather than _connaisait_?

<comment><USER11> The same was true for the Gauls, pre-Roman conquest.

> And shouldn't it be "knows [savait]" rather than connaisait?

No, connaître is the right word. If you took French class, you probably learned that you "savoir" a thing or skill and you "connaître" a person, but that's not the correct dichotomy. Instead, "savoir" is more for knowing concrete, particular facts, while "connaître" is a weaker, vaguer familiarity, almost more like "to know about" or "to know of" rather than "to know". In this usage, Vercingetorix isn't implied to have had these skills themselves but rather to know of them.

<comment><USER12> Both senses of 'to know' from Latin's cognoscere and sapere similarly flow through to other Romance languages including Portuguese (conhecer/saber) Italian (conoscere/sapere) and Spanish (conocer/saber).

</comment></comment></comment><comment><USER13> >> Just try to think of a famous saying by Boudicca.

Well, there is that thing she used to say as she went into Warp Spasm just before ploughing into the Romans; "grrraaaaAAARRRGGGGHHH!!".

Historical fact.

<comment><USER14> I see that you have garnered a few down-votes for this - for not putting it in the passé présomptif, I would guess.

<comment><USER13> I know. My apologies to the readers who find jokes are not acceptable on HN. My feeling is that sometimes it's worth burning a little karma to lighten the mood just a bit.

</comment></comment></comment><comment><USER15> > In France, things are different. Ever since the Revolution, the idea of a > deep and mystical connection with "our ancestors the Gauls" has been central > to French national identity.

This is not true anymore. I was in primary school in the 80' (when you usually learn these things, usually twice) and indeed, the Gaulois mentality was strong.

My children now go to school (the same one btw) and they are repeatibly taught about how good the relationship between the Gaulois and the Romans was. The Gallo-Romains is all the rage now and they supposedly mixed extremely well, each taking from the other three good parts of their culture.

The trade aspect of the Gaulois' work is also highlighted a lot (so they are not shown anymore as warring tribes).

I think my children had a passing info about Vercingétorix but it was very minor.

</comment><comment><USER16> In Germany it's basically

[https://en.wikipedia.org/wiki/Arminius](https://en.wikipedia.org/wiki/Arminius)

and it isn't used in Asterix either for obvious reasons.

<comment><USER17> I wonder what the translation for Astérix and the Goths is like in German.

</comment></comment><comment><USER18> Great color on Vercingetorix in Dan Carlin's podcast: [https://www.dancarlin.com/product/hardcore-history-60-the- ce...](https://www.dancarlin.com/product/hardcore-history-60-the-celtic- holocaust/)

<comment><USER19> I agree. This episode is called The Celtic Holocaust. Great alternate read of the Gallic Wars by Caesar.

</comment></comment><comment><USER20> That was a well informed piece, worth reading, but the final complaint is weak - so the book was just about its subject life and times and not piled on with later centuries' consequential factoids ... [https://en.wikipedia.org/wiki/Anxiety_of_influence](https://en.wikipedia.org/wiki/Anxiety_of_influence) strikes again.</comment>