Who is running the Pandemic Survival fear-mongering spam campaign - <AUTHOR> https://osint.fans/coronavirus-spam-selling-pandemic-survival-ebook <comment><USER2> A one post fake blog about absolutely nothing[0], knocked-up five minutes ago, on a garbage domain extension registered a few weeks ago, exploiting the clickiest topic of the day and posted to HN. Who's the coronavirus spammer here, exactly?

[0] The only issue after wasting my time reading most of the post is that it was, according to the author, spam (UCE). Otherwise it's no more remarkable than any other affiliate marketed ebook trash that aren't worthy of blog posts.

To fill the article the author complains that the book simply gives "trivial" tips; but if the tips are good advice ("proper handwashing techniques") or at least not harmful, so what? Maybe there are people who don't trust the Federal Government or UN or WHO or CNN but take advice from the kind of thing you might find advertised on alexjones.com.

The rest of the article is just about the ways companies hide who they are and use fake office addresses. Again, so what? It's not something I particularly support or agree with but it's commonplace, not a secret and seemingly not illegal.

I was struggling to see why this was written, other than it's related to the topic of the century, until I noticed it was a fake site with only one post and that _is_ the only reason it was written.

<comment><USER3> I suspect the idea was to expose them, hurt their business, and maybe turn the eyes of the law in their direction. I don't see anything that would bring about the level of anger you express unless you're tied to their profits. Are you?

<comment><USER2> Are you selling a potentially illegal pandemic ebook and hoping to profit from a competitor being taken down?

Baseless paranoid accusations are easy, and completely missing the point of a post - annoyance at low-effort junk posted to HN by site owners for the purpose of leeching page rank - isn't an excuse for resorting to them.

</comment></comment></comment><comment><USER4> Quackery is often described as "health fraud" with the salient characteristic of aggressive promotion."

In the medieval times this was done by shouting in the public markets, today using affiliate marketing networks targeting millions of emails. Surely they don't target people that can reason and ignore/ delete their messages but the ones that click and follow the dodgy trail.

Here is an interesting podcast about Scams - You Are Not So Smart Podcast 097 [https://m.youtube.com/watch?v=8mbW18RcO8Y](https://m.youtube.com/watch?v=8mbW18RcO8Y)

Ref: [https://en.m.wikipedia.org/wiki/Quackery](https://en.m.wikipedia.org/wiki/Quackery)

</comment><comment><USER5> I misread the title. I was really hoping this was a link to house-rules on playing the Pandemic cooperative boardgame with the COVID-19 coronavirus as the disease.

<comment><USER6> Using a mix of Legacy and Expansion Pack rules: Sharpie the name COVID-19 onto the game board for your least favorite color. Every outbreak of that color is now doubled (as if it had been drawn twice from your deck). It's up to your group if you want that to also effect overall difficulty (if those double outbreaks count as double towards the game's lose condition counter).

</comment></comment><comment><USER7> Kind of ironic that halfway through reading an article about spam, they have a popup on screen begging me to sign up for their mailing list.

</comment><comment><USER8> Title doesn't match source.

"Coronavirus spam selling the 'Pandemic Survival' ebook"

</comment><comment><USER9> I read the article to the end and was half expecting the answer to be "Alex Jones". Hopefully he doesn't reappear so easily after being banned from so many platforms!

<comment><USER3> I know ... could have easily been something he was selling. (Looks like a few Alex Jones fans here. Hi to you too.)

<comment><USER9> I'm not here to gain karma ... and I'm willing to have a discussion with Alex Jones fans too so long as they stick to facts and avoid hyperbole, mis-truths, etc.

</comment></comment></comment><comment><USER10> The article mentions yomali out of Malta. Yomali's just an ecommerce, billing and hosting site doing payment processing for the people selling these guides. Much as Google and AWS host services for numerous questionable companies.

Malta has some weird tax advantage apparently because a lot of ecommerce goes out of there. Also Cyprus.

Yomali's owned by an Israel guy who says his name is Mike Peters. ( [https://www.entrepreneur.com/article/326673](https://www.entrepreneur.com/article/326673) )

It's likely he and his company have little to do with these ebooks other than handling payment processing for them along with many other small companies.

<comment><USER11> Malta appears to be somewhere you can get an EU banking license without quite so much scrutiny and oversight as some of the larger places. Coincidentally quite a few cryptocurrency-related organisations have moved their HQ there...</comment></comment>


DéjàVu: a map of code duplicates on GitHub - <AUTHOR> https://blog.acolyer.org/2017/11/20/dejavu-a-map-of-code-duplicates-on-github/ <comment><USER2> I always like to see how some API is used in real projects. Sadly GitHub search is mostly useless for this, because of the number of duplicates. Google code search was great. It even supported regexps. Then the was koders.com, now there's also something from ohloh and it's better than GitHub AFAIR.

EDIT: ohloh became openhub and now the code search is discontinued. So there is the nonfunctional GitHub search and an open niche for other projects...

<comment><USER3> Disclaimer: I'm the founder of GitSense ([https://gitsense.com](https://gitsense.com)) that indexes code and Git history.

Indexing and retrieving code at scale is actually a really challenging problem due to the fact that there is a lot of code, on a lot of branches, in a lot forked repos. With GitSense, it doesn't even try to determine the authoritative source (repo/branch), since I personally think this is a lost cause, given current AI technology.

With GitSense, everything is context driven, which is how you can reasonably remove duplication. To search, you have to define what branches/repositories to consider, which can a be a few to a few thousand. Note, once a search context has been defined, it can be reused, so this isn't something you have to create every time, if you want to search.

I sort of envision a Yahoo type (the first incarnation) approach to searching for code. The basic idea is provide a curated search experience, where domain experts can share what they believe to be relevant branches to consider, for a given problem.

Without some human intervention, I think duplication is a given and as you point out, can lead to useless results.

</comment></comment><comment><USER4> What really sucks is people committing node_modules, that's just plain wrong.

<comment><USER5> ... until LeftPad 2.0 [1] happens, then everyone will be mocking those who _didn 't_ commit node_modules.

1\. [http://blog.npmjs.org/post/141577284765/kik-left-pad-and- npm](http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm)

<comment><USER6> What's wrong is that the package manager and repo manager aren't talking to one another. "Keeping a copy of the dependency with your code" and "copy and pasting the code" should not be the same thing.

<comment><USER5> I agree, ideally artifacts should be stored and cached, e.g. in a stored container or as a tarball.

Other than a local npm mirror, what do you think is the best way to store artifacts for new builds? Vendoring code is not a bad solution if it permits new builds to occur even in the event of a package manager outage. I see vendoring code as the simplest solution for small companies who don't want the management overhead of running a local mirror of package managers.

That said, I'm very much open to learning a new technique for handling this problem.

</comment></comment></comment></comment><comment><USER7> Wow, GitHub could save a lot of storage space if they dedup'd across projects/files explicitly, rather than storing Git repos, which is what I'm assuming they do.

Even with a good deduping/compressing filesystem, the way git history is stored means that they're probably missing out on a ton of savings here. Eh, it's probably not worth the complexity/deviation from standard Git tooling.

<comment><USER8> Github uses their own storage backend which I believe shares objects across all of projects regardless of whether they are explicit forks or not.

<comment><USER7> That's really neat. Is there any documentation/discussion available on that technology? It sounds like something that would be fascinating to learn about.

<comment><USER9> I am not sure if the parent's claim is true, ie that Github is storing objects and sharing them across forked repos.

If they are, then it likely just a direct implementation of git the technology. you can see how git stores data here: [https://git- scm.com/book/en/v2/Git-Internals-Git-Objects](https://git- scm.com/book/en/v2/Git-Internals-Git-Objects)

<comment><USER10> Not an expert, but that would only work if there was a single repo, right?

<comment><USER9> Not an expert either :)

There is the concept of submodules which allows for multiple repos while maintaining the checksum mechanics that allows sharing the same bit of information between branches and across commits: [https://git- scm.com/book/en/v2/Git-Tools-Submodules](https://git-scm.com/book/en/v2/Git- Tools-Submodules)

The trick is that git maintains an abstract file system (ie a graph) across commits. The graph consist of pointers to content without having to create a clone of the actual content for every new version of said graph....it gets a little dizzy to explain but it is really not too complicated :)

</comment></comment></comment></comment></comment></comment><comment><USER11> This is very interesting. I would have liked to see the results for JavaScript when you ignore the node_modules folder. If that's going to count for code duplication then pip dependencies should be included as well.

This should definitely be taken as a lesson though: JS needs a better deployment solution. That, or better education on the current solution(s).

<comment><USER12> Do people check in their node_modules?!

<comment><USER11> Apparently some people do. They really shouldn't. I can only imagine this is in some places ignorance and others out of fear for another left-pad scenario.

<comment><USER12> Then shouldn't that article account for it?

I would have thought that JS has fewer dupes because of NPM

<comment><USER11> That's exactly what I'm saying. The author even states that the node_modules folder makes up 70% of the files in the JS section. Seems like a poor way to measure.

</comment></comment></comment></comment></comment><comment><USER13> Would love to see a follow up where we would see how much duplication existed if we controlled for common dependencies and autogenerated code in conjunction with data on how many repositories are fully cloned (i.e. all code is near identical to another repository).

</comment><comment><USER14> Very interesting from a security perspective. So much potentially dangerous code copy-pasted and most of it is probably never updated too. I've personally found some C vulnerabilities in code that I easily found used in many projects by Googling the vulnerable line... Usually not so much to do about it too.

<comment><USER15> Trying to frame this as a security problem is a stretch, IMO.

My impression is that most public projects on GitHub are only of interest to the author, and maybe a small handful of people. I, for example, have over 100 non-forked public repos and, except for 3 or 4 projects, nobody even looks at most of them, much less clones them and uses them. Even the ~4 that do get attention, it's usually not because they're using the code itself - it's because they're doing something similar and want to see how I did it.

On the other hand, I only have anecdotal evidence to back up that claim, so who knows.

</comment></comment><comment><USER16> Would be more interesting to see an analysis of almost equal files - to detect reimplementations of the same thing

</comment><comment><USER17> Now predicting automatic software that looks at duplicated code, flags it for violating license agreements, and sues for money.

Welcome to the future of copyright trolls.

<comment><USER18> Burden of proof would hopefully save the day here.

<comment><USER17> ...tell that to existing copyright / piracy trolls

</comment></comment></comment><comment><USER19> In order to prevent code duplication on a global scale, we need more frameworks, like leftpad. :sarc:

<comment><USER20> You're being sacastic, but sitting down and looking at what subject areas appear most frequently and talking about _why_ would be useful for any language.

Are they even getting it right or do they all have the same bugs? Are there no existing libraries? Are the downsides worse? Can we fix that? Should this functionality live in the core language (did we miss a feature).</comment></comment>


Show HN: Industry – Professional Network for the service and hospitality industry - <AUTHOR> https://www.industry.co <comment><AUTHOR> We are here trying to empower individuals that work in the service and hospitality industry. Right now we help you get hired, but more in the pipeline to come. Thanks for checking us out!</comment>


Keep Your Frineds in Your Circle Close - <AUTHOR> http://socialcircle.cf <comment><USER2> For one, your 日本語 doesn't even work. Just leads to 404. And why does this look suspiciously like some PHP based social site that I've seen before.</comment>


Add a "contrib" directory to your projects - <AUTHOR> https://drewdevault.com/2020/06/06/Add-a-contrib-directory.html <comment><USER2> _The contrib directory is used as an unorganized (or, at best, lightly organized) bin of various useful things contributed by the community around the software, but which is not necessarily a good candidate for being a proper part of the software_

I think this only works with the caveat that the core code is so well-designed that the user is capable of mixing contrib APIs with core APIs without requiring action on part of core developers.

For instance, TensorFlow v1 had a contrib directory that encouraged a lot of internal contributions and features to be added. This was initially quite nice due to the "batteries included" argument. However, the success of TF quickly resulted in a lot of bloat being added. There were competing ways to do the same thing within the default TF installation, and the worst part was that users expected contrib features to be interoperable with all other contrib features and core TF.

</comment><comment><USER3> Would recommend using a dedicated repository. Can then give eager people commit access easily, and let them (help) manage contributions of more drive- by nature.

For this to work, contrib must be possible out-of-build/tree, which is a good thing, because it means there can be other "contrib" repositories as well - not just the single special directory in the mainline repo.

</comment><comment><USER4> At the company where I work, if a team runs a widely depended on project, there's a better than even chance they'll host a contrib directory for exactly this purpose. A solid idea.</comment>


The Ridiculous Copyright Situation Faced By Academics - <AUTHOR> http://techdirt.com/articles/20090625/0342445360.shtml <comment><USER2> If academics will just insist on not assigning copyright, they may get further; publications need authors, and to demand copyright assignment will become a competitive disadvantage.

"The ACM copyright form now explicitly says that authors can post a copy on their personal websites" --scott_s

Actually, ACM can be pushed further than that. When ACM solicited an article from me for their Communications magazine, I (nicely) refused to execute their copyright assignment, even with the personal website permission. So ACM proposed instead a simple licence to publish (royalty-free, worldwide, non- expiring, any medium, non-exclusive) which I was happy to sign while preserving my copyright ownership, and which gave them everything they need. But recently IEEE has refused a similar licence arrangement, insisting on a copyright assignment or no publication (which was what I chose). I expect ACM to prosper over IEEE.

<comment><USER3> Right now, I need the ACM more than the ACM needs me.

</comment></comment><comment><USER4> I really don't think the journal model works well anymore.

It used to be that distributing papers was burdensome, so they compiled them into journals and professionals paid for a subscription. Built into the cost was peer review -- they couldn't just publish ALL the articles, because there was limited space, so they had to have professional reviewers filter out all but the "best."

So now that distribution has been solved, the only value-add that a journal can claim is that filtering process, which ostensibly is costly.

It all hinges on the question of whether peer review can happen without compensation. I think it's pretty well-established now that peer review without compensation happens constantly. Welcome to the internet, right?

So the correct new model is something like a digg/HN system that aggregates articles from various fields, and allows peers to review, respond to, and upvote important papers. I think it'd need to be more complex because of voter credibility concerns, but it seems workable. I can't say the same for the current journal model.

<comment><USER5> _I think it's pretty well-established now that peer review without compensation happens constantly. Welcome to the internet, right?_

As far as I know, even before the internet era, you never got paid for referee reports. I've certainly never been paid for one, though I've only been writing them since 2006.

<comment><USER6> That is correct. Academic journal article peer review has always been unpaid.

</comment></comment></comment><comment><USER3> The ACM copyright form now explicitly says that authors can post a copy on their personal websites: <http://www.acm.org/publications/copyright_form/>

</comment><comment><USER5> Creative commons and the arxiv give you a very simple solution.

1\. Upload to the arxiv under a creative commons license.

2\. Submit, and post to your webpage.

3\. If the journal ever demands you take the paper down, do so. Then download the creative commons version from the arxiv and post that (or just link to it).

<comment><USER7> Many journals will not consider an article if it has been previously published.

Publishing to your own web page may not count but it will surely not make the journal happy, especially if you hope to get published in the same journal again.

<comment><USER5> As far as I know, submitting to the arxiv does not qualify as publication.

</comment></comment></comment><comment><USER8> Simple solution: a requirement of receiving public funds should be that authors are required to make their work available for free online (possibly via a community license).

This way the journals don't get a choice as to what copyright scheme they'd like to use.</comment>


Copyright Office Adds DMCA Exemption for 'Abandoned' Online Games - <AUTHOR> https://torrentfreak.com/copyright-office-adds-dmca-exemption-for-abandoned-online-games-181026/ <comment><USER2> Sadly the ruling directly forbids reverse-engineered protocols and custom made servers that emulate the original server. The ruling also states that these abandoned online games could only legally run at a museum/library and that it's against the law to distribute them to the internet or host them publicly.

> and the video game is not distributed or made available outside of the > physical premises of the eligible library, archives, or museum.

<comment><USER3> What does it take to get your basement classified as a "private museum"? A sign?

<comment><USER4> You have to convince a human that your basement is a museum in order to make this work rather than a simple robot. A sign won't be nearly enough.

<comment><USER5> Obviously. But that doesn't help figure out where the boundary is between "collection" and "museum".

</comment></comment></comment></comment><comment><USER6> This covers legally obtained server code, but what about reverse engineered third party servers which allow the use of abandoned game clients?

As an example, a popular 'Blizzlike' Vanilla WoW server (ie. authentic to the original, pre-expansion game) has been built without using the official server software. Recent announcements from Blizzrd aside, it's hard to argue that the original game is not abandoned, as it's been unplayable since 2006.

<comment><USER7> I do get your point but I wonder if it's really that hard to argue?

I don't think Blizzard will have a hard time defending the stance of "we haven't abandoned WOW".

and if you enter the world where we consider WOW legally abandoned, publishers will start re-evaluating their expansion models, possibly for worse?

<comment><USER8> The original game is radically different in major ways to the current version.

Maps are different, class mechanics are different, races are different, models are different, enemies and bosses are different, classes are different, etc.

It's a completely different game now under the same banner. Theseus' Ship comes to mind; yes, there's been a continuous migration process in place, but you cannot play World of Warcraft v1 any more.

A more reasonable comparison would be Windows 95 vs Windows XP or something. Yes, XP is backwards compatible, but it's obviously a completely different OS in most ways aside from the name.

<comment><USER9> Where does one draw the line that it's markedly different? Expansions? Major patches? When 8.1 is released are we allowed to emulate 8.0? 8.2 means 8.0 is fair game? Or the day after Wrath of the Lich King and the Burning Crusade?

<comment><USER10> Perhaps draw the line where client compatibility stops without extra payment?

I've never played WoW nor do I know anyone who still does, so I'm out of touch. At what point (if any) were users forced to pay extra (a paid for update and/or increased subs) to continue to play the game? Can those without the expansions still play? That certainly seems to be a fair place to draw a line.

Having to accept changed game mechanics via free-but-compulsory patches is a much harder to define distinction as the matter is very subjective: what to some is a wonderful improvement may to others be a game breaking change.

<comment><USER11> > I've never played WoW nor do I know anyone who still does, so I'm out of > touch. At what point (if any) were users forced to pay extra (a paid for > update and/or increased subs) to continue to play the game? Can those > without the expansions still play? That certainly seems to be a fair place > to draw a line.

It doesn't quite work out the way you're imagining. A WoW expansion does one thing that require you to buy the expansion: the level cap goes up (e.g. in Cataclysm the level cap was 80 if you were paid up through Wrath of the Lich King, but 85 if you had bought Cataclysm). An expansion may or may not also prevent accounts that haven't bought it from entering new zones.

But it also makes a bunch of other changes that you get whether you want them or not. Content may be removed from the game, like original Naxxramas. Game mechanics will shift around. Every raid below the level cap goes out of support -- it isn't possible to play supported raids without being at the most recent level cap, and it also isn't possible to play old raids the way they were when they were current, as mechanics changes are not evaluated for impact on unsupported raids.

There were so many conceptual problems with having multiple different expansions that weren't current that Blizzard has moved to the model of "you've either bought the current expansion, or you haven't" \-- when one expansion releases, the previous one is now automatically rolled into everyone's account.

</comment></comment></comment></comment></comment></comment><comment><USER12> Just recently there was the Right to Repair change, and now this. Looks like things are going in the right direction.

<comment><USER13> If they forget to re-exempt it in three years, it becomes a felony again.

<comment><USER14> The process doesn't work like this anymore; now the copyright industry has to argue that the exemption should be removed and there are a narrow number of reasons why this could be done.

</comment></comment></comment><comment><USER15> This exception is so limited that I don't even get how it is potentially considered circumventing DRM to begin with. Once you have legally acquired the source wouldn't you normally also have the right to modify it to remove the DRM?

</comment><comment><USER16> Does this open the door to future debate surrounding variations of game versioning as time continues forward?

Let's say Blizzard does implement WoW Classic, but they choose a specific permutation of classic that makes some people happy and others angry. Do those who wish for variant A of WoW classic but get a drastically different variant B have any legal leg to stand on for their version of the game being abandoned?

</comment><comment><USER17> Maybe this will create small arcade like "museums" where people go to legally play old games with each other.

That would be neat.

</comment><comment><USER18> Wow this is really great. It's now a use it or lose it sort of copyright protection for online games.

I have an idea of supporting an online game that is long forgotten, one day. Now it'll be totally legal for me to work on it :)

<comment><USER19> The exemption is very limited:

>Permitting access to the video game to allow copying and modification of the computer program to restore access to the game on a personal computer or video game console when necessary to allow preservation of the game in a playable form by an eligible library, archives, or museum, where such activities are carried out without any purpose of direct or indirect commercial advantage and the video game is not distributed or made available outside of the physical premises of the eligible library, archives, or museum.

This is only for non-profit museums etc. so third party servers are still not legally allowed. It's a big step in the right direction and I think it's a good sign that one day we might get an exemption that allows third party servers for home play but it's not there quite yet. It also requires a statement saying the owner is abandoning support and it remains to be seen if the standard "we're shutting down all the servers required to play this game" will count legally or not.

[0] [https://s3.amazonaws.com/public- inspection.federalregister.g...](https://s3.amazonaws.com/public- inspection.federalregister.gov/2018-23241.pdf) pg 59

<comment><USER18> Ah that sucks. I'll have to read through it.

</comment></comment></comment><comment><USER20> I don't know how it looks technically, but it's often highlighted that many digital sales are actually in form of a lease (or right to use), and not an actual purchase of a product. How would this work then?</comment>


The Untold Story of Otto Warmbier, American Hostage - <AUTHOR> https://www.gq.com/story/otto-warmbier-north-korea-american-hostage-true-story <comment><USER2> I had always thought that he was beaten, I guess because I'd never really looked into it. From the article it seems like it's most likely that he either attempted suicide or lost blood flow to his brain in some other way, and then was discovered by his guards unconscious and taken to the hospital in North Korea.

<comment><USER3> Yeah the article mentioned all the North Korean medical paper work showed Otto went into the Hospital already in a coma the day after he was sentenced. Furthermore, the article suggest he was well taken care of the entire time while in his coma (i.e., no bedsores, healthy coma weight, healthy skin etc.). And it said the original brain scans showed equal distribution of brain damage on both signs (i.e., he died from lack of oxygen rather than blows to the head).

I don't think I'd be strong enough to stay in it after being sentenced to a lifetime of jail in a North Korean prison camp.

The "beatings" and "torture" talk all seems to be false propaganda that wasn't backed up by any evidence with several officials noting no signs of beatings or torture, which is disgusting.

<comment><USER4> and north korea has never been known to lie, so must be true

<comment><USER5> For most of the detail cited in the comment you replied to, we're not relying on North Korea's representations, so your reply is largely nonresponsive.

</comment></comment></comment></comment><comment><USER6> The author dedicates a full section to a possible attempt at suicide. However, he doesn't even try to correlate that with the physical examinations.

How does one go braindead in a suicide attempt while locked up, without leaving physical evidence of other injuries?

Certainly, none of the other suicide attempts the author listed would qualify.

Later in the article: "Upon learning that this article did not support claims that Otto was beaten, and included the theory that he may have attempted suicide—a possibility that the family, through their lawyer, dismissed categorically—the Warmbiers withdrew a statement that they had previously provided."

The "theory" that he attempted suicide is definitely on shakier ground than the "theories" his injuries were intentionally inflicted on him by the North Koreans.

<comment><USER5> I think the implication that he tried to hang or strangle himself is pretty clear; it's consistent with his injury (symmetric brain damage consistent with oxygen starvation, no other external signs of injury).

It is certainly possible that, rather than hanging or strangling himself, he was strangled by someone in the DPRK. The DPRK hasn't done that to any other US prisoner, but it's the DPRK, so who knows?

The problem is that the narrative in the media doesn't have that uncertainty. Rather, it's reported (somewhat widely, though less so after the coroner's report) that there was evidence of physical abuse: scars on his legs, "rearranged" lower teeth, etc.

It is worth adding that the article doesn't say Warmbier tried to kill himself; it just adds that to the stack of plausible causes. It is indeed a very plausible cause.

<comment><USER7> There's a point where the hairsplitting becomes a little unseemly, maybe, even with the most pigheaded interlocutors? The guy is dead, there's a recording of him abjectly begging for mercy. Nobody does that other than under duress even when it turns out the duress was probably not physical and was misrepresented as such.

<comment><USER5> I don't know what to say to this. The DPRK is evil almost beyond comprehension. If Warmbier harmed himself, surely he did so under the most intense psychological stress you could imagine him being under. He was imprisoned for tampering with a poster. Surely we can all agree that was a terrible human rights abuse. Nobody is (or should be) trying to immunize the DPRK here. Certainly I don't intend to put any of the responsibility for this tragedy on Otto Warmbier; what he did is something I might have done myself were I there at his age!

My point is, as it was downthread, that there's a special recent history to reports of abuses by enemies of the US. If the prevailing narrative about Warmbier's treatment by the DPRK is false, and is exploited by the administration as _casus belli_ , that's not hairsplitting.

Like I said earlier: whatever the US accused the Iraqi Baathist regime of doing, their actual abuses were similarly awful. But in the question of how the US relates to other countries, the distinction matters.

Candidly, I think the debate about US/DPRK relations is (on HN) less important than the debate about what it means to report on these stories and to challenge a popular narrative. If I've been triggered to respond by anything in this thread, it's the subtext (in many comments here) that the reporting in this GQ piece is slapdash or done in bad faith.

<comment><USER7> _Nobody is (or should be) trying to immunize the DPRK here._

I didn't say that, if it sounded like I did, sorry!

 _is exploited by the administration as casus belli_

That's a different argument with a higher bar - you can't meet it debating the state of Otto Warmbier's teeth.

 _it 's the subtext (in many comments here) that the reporting in this GQ piece is slapdash or done in bad faith._

For what little it's worth, that gets my goat every single time as well.

</comment></comment></comment></comment></comment><comment><USER6> Nearing the summation, the author uncritically quotes a "senior-level American official." \--"The North Koreans have never tortured a white guy physically. Never." Earlier in the article, "The 82 American sailors captured on the Pueblo were beaten and starved for 11 months before finally being released."

Conclusion: either none of the 82 American sailors were white guys, or "beaten and starved for 11 months" doesn't constitute torture.

<comment><USER8> It's a men's fashion magazine. I don't expect high quality work on this topic from them. I just skim to get a salient point here and there.

<comment><USER5> That's not how this works at all. GQ and Esquire run serious long-form journalism all the time. For that matter, Vanity Fair is Michael Lewis and William Langewiesche's home after leaving The Atlantic.

</comment></comment></comment><comment><USER9> tl;dr: I'm like, way, smarter than the president, who is a big ugly stupid- head and everything he does is wrong.

If you want to be taken seriously as a journalist, don't tie the story back to your opinion on Trump. It was an interesting story until he reveals the political motivations behind it. Have the courage to present the facts and let people come to their own conclusions.

<comment><USER10> It seemed factual to me. In fact, the Trump administration are given a lot of credit for the eventual release. It's the _spin_ factor thats being called into question.

<comment><USER9> Well, it is factual up to a point, which is great, and then he starts speculating, which is okay, and then he turns it into some indictment of Trump for tweeting that he was tortured, and then another indictment for not attacking more on the same issue. This brings all the weak sources into question. But really the problem is that I don't care about his politics. Not do I care about Trump. I care about the fact that an entire nation full of people is living in some kind of perverse socialist utopian hell, and this tragic case is but one glimpse into it.

His name was Otto Warmbier. I will not forget.

<comment><USER5> You won't forget _what_? The point of the article is that you don't know what happened to Warmbier, and if your only source of information about him was the media stories that ran prior to this article, what you might think you know about him is almost certainly false.

</comment></comment></comment></comment><comment><USER11> Based on the source, I went in to this article assuming it would somehow paint North Korea in a more forgiving light, and attack the Trump administration. I was not wrong.

The whole thing left a bad taste in my mouth. Maybe Otto was physically beaten, maybe he wasn't. Maybe his incarceration conditions were "good" or maybe they weren't. Maybe he did try and commit suicide, maybe he didn't. The author certainly didn't have any more hard, objective facts than anyone before them. He just had an axe to grind.

<comment><USER12> As a non-American, I did not feel it was highly critical of the Trump administration

> Now, that's not to fault the Trump administration for applying maximum > pressure on North Korea for an American citizen ending up brain-damaged in > its custody: Such behavior warrants punishment. Nor is it to imply that the > senior government official lied to The New York Times about the intelligence > reports, as some analysts suggested to me; that person seems to have > correctly described them. But if the maverick boldness that the > administration displayed in rescuing Otto represents the best of Trumpism, > what followed once it was clear the reports were flawed encapsulates its > troubling disregard for facts when a dubious narrative supports its > interests.

You could say that the last sentence is critical but, Trump or no Trump, any government is using sometimes dubious arguments for its own interest. Never let go a crisis go to waste.

<comment><USER11> The author implies that the Otto story was simply a lever for Trump to start a war with NK. And that when moods change, the Otto story is no longer "useful" to Trump and so is forgotten. This is more an indictment of the 24 hours news cycle I think.

He also spends a great deal of time defending the NK hospital procedures and "likely" incarceration facilities.

I mean, personally I'm repulsed by NK. I'm repulsed that Trump treated their leader with dignity. I'm repulsed that this story implies that the north koreans didn't get a fair shake in the press.

<comment><USER5> The story doesn't imply that DPRK didn't "get a fair shake"; it simply says that the story spread in the press was _false_. We don't believe falsehoods simply because we think they should be true.

<comment><USER13> > We don't believe falsehoods simply because we think they should be true.

That sounds like something you believe because you think it should be true :-)

</comment></comment></comment></comment></comment><comment><USER14> The author is claiming that the Trump administration "encouraged the narrative" that Otto Warmbier was beaten but it does not really explain why very precisely except to imply that Trump may have used Otto's parents to look better himself. There isn't any evidence he did this, it is just speculation by the author. I can't find any quote from the Trump administration saying this except for "intelligence reports" from before Otto's return that even officials state the reports about beatings were from third or fourth hand sources. Further, North Korea's official explanation of Otto's brain trauma, botulism and a sleeping pill reaction, are dubious medical claims and can therefore be rightly doubted. 6 days after Otto's return, a press conference was held from Otto's doctor about his condition and reports about torture could not be confirmed or denied except to state that North Korea's explanation was unlikely. This would make it very hard to perpetuate a narrative that Warmbier was, without a doubt, beaten. I think it is an extremely tedious point to suggest that Trump was deliberately misleading the public about Otto's treatment in order to make himself look better.</comment>


The NSA wants to call time on its phone-tapping hobby - <AUTHOR> https://www.theinquirer.net/inquirer/news/3074656/the-nsa-wants-to-call-time-on-its-phone-tapping-hobby <comment><USER2> To be honest I wasn't surprised when it was revealed they done this. The phone system is SIGINT-Enabled and always was from the outset. What _did_ surprise me was how they went after the weak crypto and weak ciphersuites used to secure webpages. Matt Green goes into this in more detail: [https://www.youtube.com/watch?v=CKncw6mIMJQ](https://www.youtube.com/watch?v=CKncw6mIMJQ)</comment>


Ask HN: IP marketplace for startups? - <AUTHOR> I know IP is controversial within HN to begin with, but the recent "terminator of Startup" post got me thinking...
I've previously been able to liquidate IP (a method of automatically calculating legal fees).  Before I get the label "troll", I brought the IP to market, engaged in discussions with near unicorns Avvo and Legalzoom.
The terminator post has me reconsidering other IP including a method for practicing medication therapy management.  In this case the World's largest company green lit us for a pilot after just a 15 minute teleconference, but abdandoned the same due to a cofounder conflict of interest.  That was simultaneously heartbreaking while validating.  Even now we are talking with another top 10 Pharmacy to pilot, an independent pharmacy, and a local University Pharmacy School. I know ideas are easy it's execution that matters but the reality is I can't just start a Pharmacy to implement my own MTM software to demonstrate how it will facilitate Medicartion Therapy Management more effectively than the 2 existing Medicare MTM software vendors.  There is no doubt many parties that could effectively bring my IP to market, but is there a way to effectively get my IP in front of their eyes?
Is this one of the moments where I have a problem and I should build my own solution (an auction website for IP, including trademarks, patents and copyrights)? Anticipating the HN concern about facilitating IP trolls, acquisitions/assignments through the system could include anti-troll clauses curbing the buyers enforcement rights in the event they are not actively in the stream of commerce. <comment><USER2> Markets require liquidity so that buyers stand a reasonable chance of finding what they are seeking and sellers stand a reasonable chance of selling what they want to sell. Typically, this is achieved at least initially with market makers -- super buyers and super sellers (who can be the same entity).

Now if I think about the intersection of an IP marketplace with super-buyers and super-sellers, the obvious candidates would be businesses in the patent portfolios business. That's probably the place to begin research into existing markets and values and players.

<comment><AUTHOR> I think Universities likely qualify as super sellers/licensors of IP, but obviously the ability/capacity for them to liquidate valuable IP at scale and/or bring IP to commercial markets is a real problem. Perhaps with the right "market" we might see more innovations/IP make it into market.

I think you're right with where to begin and I have secured meetings with the market incumbents for my IP, but it's been done via cold LinkedIn connects over the course of 6 months and to date I have not secured the type of deal that would make me forgo everything else (law practice, opportunity costs, etc...).

</comment></comment><comment><USER3> It sounds like your trying to develop a market to sell ideas. As much as I wish this were possible, the reality is you can't give away ideas for free let alone sell them.

The basic problem is people are more attached to their own crappy ideas than someone else's brilliant idea.

<comment><AUTHOR> Brilliant ideas often lose to crappy ideas because of market incumbents, and even when brilliant ideas win it can take patents and fortunes to do so, Tesla:AC::Edison:DC.

IP on its own is more than a crappy or brilliant idea.

Take any startup they might have a trademarked name, logo, a domain, or patent...We know the vast majority of startups will fail" and it isn't because they all have crappy Ideas, some might have both crap ideas and valuable IP, but even crappy IP can still be valuable.

Alternatively, As I mentioned above Universities have patents but are often unable to bring them to market, isn't it unfair to assume unused University patents are crappy ideas since they aren't competing in the market?

I think if the market had easy access to these patents (to buy or license) we would find there is a lot of value in unused IP (both brilliant and crappy) not unlike UBER/AirBNB created found a lot of value in assets being underutilized by owners.</comment></comment>


Ask YC: What has happened to Zenter? - <AUTHOR>

Does anyone know what has happened to zenter, post google purchase? I didn't get to see it & I'm curious about the editor design choices. Any images (or descriptions) aside form this one? ~ http://www.tonicstudios.com/sliderocket/Zenter_screenshot.jpg <comment><USER2> Google added the presentations tool to its online 'office suite' not too long ago. The tool might have Zenter at its core ([http://googleblog.blogspot.com/2007/09/our-feature- presentat...](http://googleblog.blogspot.com/2007/09/our-feature- presentation.html))

<comment><AUTHOR> _"... Google added the presentations tool to its online 'office suite' not too long ago. ..."_

Thanks. The link gave me some pointers. Pity there are no writeups on how the app worked. Seems google uses these companies for core technology spare parts and discard the product. [0]

[0] <http://googleblog.blogspot.com/2007/06/more-sharing.html></comment></comment>


Good Talks about Developing - <AUTHOR>

I'm looking for good developer talks; any language, any system, as long as you like it and think people should listen to it <comment><USER2> Whenever I remember, I add ones I enjoyed to a YouTube playlist, so check it out, it's about 35 talks I've enjoyed in the last year or so: [https://www.youtube.com/playlist?list=PLGt3gNR- AoFmYmai5cx0p...](https://www.youtube.com/playlist?list=PLGt3gNR- AoFmYmai5cx0p5PRoIzurXlVP&feature=mh_lolz)

<comment><AUTHOR> This is awesome! Nothing but videos today! :D</comment></comment>


Passphrases You Can Memorize That Even the NSA Can't Guess - <AUTHOR> https://firstlook.org/theintercept/2015/03/26/passphrases-can-memorize-attackers-cant-guess/ <comment><USER2> This doesn't stop the biggest threat against a government-sponsored entity: if they really want to break into your data, they'll just install a key logger into your bios or some other crazy shit like that.

All these nice pass-phrases do is protect you against people that get big user dumps of hashes like we saw with the recent Slack security breach.

The NSA doesn't need to guess your passphrase. The Chinese equivalent doesn't need to either. They'll just literally watch you type it in. Or use existing vulnerabilities to capture the traffic at your border router. And if you're REALLY a person of interest, they'll just use their CIA equivalent to capture you and torture the information out of you.

</comment><comment><USER3> FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember.

      % ./passphrase.pl 10
      coppice-topped
      belly-naked
      bastard locust tree
      diamond bort
      middle-aged
      self-mapped
      air level
      field gun
      machine rifle
      chock stone
      % ./passphrase.pl 10
      self-knowing
      soul-killing
      Magna charta
      fly-killing
      spring chicken
      blotting book
      finger-cone
      gauge glass
      Fort union
      assistant examiner
      % ./passphrase.pl 10
      soya-bean oil
      foxtail pine
      island-dotted
      four-way cock
      side-bar rule
      benzoyl hydride
      straight-fibered
      steel town
      stone bramble
      rag-boiling

<comment><USER4> Not that odd. All the words from Webster's are in web2, all the compound entries (not strictly "words") are in web2a.

That said, "straight-fibered four-way cock" is my new favorite passphrase.

<comment><USER3> So that explains where they were sourced from. Thanks!

</comment></comment></comment><comment><USER5> I've tested the passphrase:

        password password password password

and most of the online entropy checkers[1] says it's really safe to use such .. is this true?

1\. [http://rumkin.com/tools/password/passchk.php](http://rumkin.com/tools/password/passchk.php)

<comment><USER6> The entropy checker doesn't know about externalities like how common a word is or how likely it is to appear following some other word or how frequently it's used in passwords specifically. It's just measuring the length of the string, and probably the class from which its characters are drawn (in your case lowercase letters and spaces).

Relevant Dilbert:

[http://dilbert.com/strip/2001-10-25](http://dilbert.com/strip/2001-10-25)

<comment><USER5> my point was using some common word on purpose, expecting it to produce a low entropy result

My thinking was that "Correct Horse Battery Staple" had more entropy than: "go go go go go go go go go go go go go"

.. which, apparently, is not

<comment><USER7> An online entropy checker is going to assume all the decisions that went into making the password, beyond the ones it's been programmed to understand, were die rolls. This is a false assumption unless, of course, those decisions actually _were_ die rolls. It's generally going to tell you passwords are stronger than they are -- sometimes a LOT stronger.

A password from the space of "things users think up while staring at a dialog box for 5 seconds" has a much different probability distribution than "random strings". There are common passwords, and that's an exploitable pattern, but recognizing those patterns is difficult. All the typical entropy checker is going to tell you is how strong the password _would_ be if it _were_ a random string.

Any pattern is, in principle, exploitable. If I use ten digits of pi as a password, a programmed entropy checker isn't going to know that's easier to guess than ten random digits unless it has been told that, and including all possible exploitable patterns would require rather better software than can currently be written.

So don't trust the results too much.

What you really want to know with passwords is, "Is there outside information that would make this easy to guess?" Does it conform to some external, independent pattern, or are all the patterns in it things you made up after seeing the password itself?

That is why I am a big advocate of random generation as the only safe way to make passwords. Knowing the strength of a password is the same thing as knowing the size of the class of live probabilities from which it's drawn, and to do that you have to characterize the method used for generating it.

</comment></comment></comment></comment><comment><USER8> This is actually pretty cool.

From the article: Not too bad for a passphrase like "bolt vat frisky fob land hazy rigid," which is entirely possible for most people to memorize. Compare that to "d07;oj7MgLz'%v," a random password that contains slightly less entropy than the seven-word Diceware passphrase but is significantly more difficult to memorize.

At one trillion guesses per second — per Edward Snowden's January 2013 warning — it would take an average of 27 million years to guess this passphrase.

<comment><USER9> The other advantage? It's generally faster /easier for someone to type something like "bolt vat frisky fob land hazy rigid" than "d07;oj7MgLz`%v,". At least it is for me.

<comment><USER10> It's easier on keyboards (since we spend most of our time typing lowercase letters as part of text) and also on mobile (since you don't need to do annoying and error-prone context switching for capital letters or symbols).

I think this is one of the greatest unspoken benefits of Diceware-style passphrases!

</comment></comment></comment><comment><USER11> I used this concept a while back to generate 7-word passphrases with 84 bits of entropy. I picked a list of popular words and filtered it down to 4270 that are reasonably short and memorable:

[https://raw.githubusercontent.com/dbasch/clj- brainwallet/mas...](https://raw.githubusercontent.com/dbasch/clj- brainwallet/master/words.txt)

Here's a browser implementation. I wouldn't use it (do you trust your browser's prng? Do you trust my code?) but it's fun to see the passphrases it generates, and how easy it is to create a story to remember them.

[http://diegobasch.com/passgen/](http://diegobasch.com/passgen/)

Same thing applied to generating bitcoin brainwallets. Once again, don't use this. It was just a fun experiment to see if I could keep money in my brain.

[http://diegobasch.com/brainwallet/](http://diegobasch.com/brainwallet/)

</comment><comment><USER12> A mechanism to implement XKCD's password recommendation: [http://xkcd.com/936/](http://xkcd.com/936/)

</comment><comment><USER13> Sadly doesn't work ever because of internet enforced password length and character pattern requirements.

<comment><USER14> So much this.

You can think of a great passwords scheme for yourself, and then find yourself in a pool of shit where hotmail asks you to have maximum 12 characters in a password, facebook requires you use a number, but it can be up to 40 characters, amazon wants you to use a special character like an @ or a # and but has a max length of 15 so on and so on.

Passwords. Suck. Use a password manager that autogenerates and autostores it like lastpass.

</comment></comment><comment><USER15> A hat-tip to Arnold Reinhold, the guy behind Diceware, would have been nice. (I know the article links to the Diceware site, which gives Mr Reinhold's name at the bottom, but still ....)

</comment><comment><USER16> Reading this, I just thought of another way to make passphrases that might be a bit more memorable. The idea is to come up with a sentence which will be grammatically correct, so it'll be easier to remember.

First, write down 36 words. Roll two dice, take six times the number on the first minus the number on the second plus one. That is the position in the list of the first word in the sentence.

Next, write a new list of 36 words, but only include words that make sense given what is already there. Roll again as before and pick as before. Reusing words between lists is fine, but don't include the same word in the same list multiple times.

Rinse and repeat until you have the desired amount of entropy. Each die thrown adds log_2 6 bits.

Edit, just tried this, 36 is a lot of words to come up with. Much easier to write down 6 at the cost of making it twice as long. Unless you have access to lists of nouns, verbs, etc.

Bored now, but came up with "Countries can slowly sit at my feet", 24 bits of entropy (some lists had 36 words others had 6. It's very low, but, if you did that 2 or 3 times, you'd be getting somewhere). Couldn't be easier to remember.

</comment><comment><USER17> In practice this would take longer than the 27 million years stated assuming 2 things: that the computer doing the guessing doesn't try passphrases it has tried in the past and that the user changes their password at least 1 time (more likely multiple times) within the 27 million years. This is contingent upon somehow not changing your passphrase to a passphrase much much higher up on the list of what the computer will try to guess. What are the chances of this occurring and what are the chances of the opposite occurring where the user's correct passphrase is somehow next on the list yet at that time the user randomly changes it to the passphrase at the very end of the list? Would this then mean it is better to keep the same passphrase forever or to change it?

</comment><comment><USER18> From a UDS password framework the Dicey password generator is pretty formidable.For one things its extremley user friendly: you can memorize it easily, and there are infrequent errors attached to its usage. Deployment wise it's non-propietary software which is a plus. Lastly for security, it's easy to see that there is a big resistance to machine guessing. I liken this in intensity with an grID password, while although has a big cognitive exertion to be able to input your password within a set of grids which change, the security is high not only for machine guessing but also from internal observation since malware would be able to deduce the hash based off a new random event each time and resilient to physical observation!

</comment><comment><USER19> The diceware word list has a lot of words that aren't very memorable.

Here's my attempt at memorable password generation: [http://rmmh.github.io/abbrase/](http://rmmh.github.io/abbrase/)

</comment><comment><USER20> How many easy-to-remember words are there in English, does anyone happen to know? Does Diceware's list include almost all of them?

By 'easy-to-remember', I mean for 99% of the world's English speaking population (i.e., for a widely used application).

I'm trying to estimate the entropy of random, easy-to-remember words. I'm not trying to generate a list (which would vary by region and country).

</comment><comment><USER21> I can't imagine doing this for the hundreds of passwords in my list, especially when I change some of them regularly.

It could be useful for a master password, though - such as the one that secures my password list. Isn't just remembering a line from a song a little easier? Then you get a password recovery mechanism too, as long as you remember the song, or at least the artist!

<comment><USER12> A line from a song is far weaker entropy-wise due to grammar. I wonder by how much. Common songs/writings would be vulnerable to a dictionary type attack.

As for the hundreds of passwords in your list, I'm convinced a password manager with a master password/3rd party auth/dongle is the way to go. Otherwise it's impossible to have unique passwords for all sites, rotate them, and remember them. Of course the risk is of losing the dongle.

<comment><USER22> > A line from a song is far weaker entropy-wise due to grammar.

Interesting observation, the usual objection is due to the reduced Kolmogorov complexity which is difficult to quantify. Let's look at a modified diceware scheme of the form:

Article adjective noun adverb verb adjective noun

A (non-random) example might be: _The young boy really likes video games._

I'm not going to go through the diceware word list and classify each word, but assuming it is (or could be made) 50% nouns, 25% adjectives, 14% verbs, 11% adverbs and four articles you'd get roughly: 2 bits + 11 bits + 12 bits + 10 bits + 10 bits + 11 bits + 12 bits = 68 bits, which is the equivalent to a 5.2 word normal diceware password. Most of that reduction comes from the article.

Here's a random example made with a diceware generator:

 _an straw scrim ne adorn drab sybil_

I'm not sure that's any easier to memorize.

<comment><USER12> Interesting, I really like your approach to this.

If we go back to the original 'song verse' idea, the space of all valid/written phrases is much smaller than the space of all possible word combinations. It's vulnerable to dictionary attacks based on commonly chosen phrases and frequency of phrase use in language/culture.

Wikipedia only has 2.4 billion words, out of an estimated billion English words [1]. Perhaps we could add project Gutenberg with it's 50,000 works, and all the song lyrics we could find on the internet. We may hit 5 billion words. Let's estimate we also get 5 billion 6-word phrases out of that set. We've lost a ton of entropy.

Ultimately, we suck at passwords. Machine capability will exceed what we can reliably, efficiently memorize.

[1] [http://www.languagemonitor.com/number-of-words/number-of- wor...](http://www.languagemonitor.com/number-of-words/number-of-words-in-the- english-language-1008879/)

<comment><USER22> This is the more usual objection that I was referring to with Kolmogorov complexity. Forty random digits has very decent entropy, 40 digits of PI, though they look very random, has much less. From that you can see how it's really hard to quantify exactly how much entropy there is an song verse that exists somewhere on the internet.

If you wanted an absolute ranking of password strength, you'd first want to construct a universal brute force dictionary of passwords. Clearly the password 'password' is going to be near the beginning of the list and a password consisting of 48 randomly picked characters from [a-zA-Z0-9!@#$%^&*()] is likely to be somewhere out beyond the number of particles in the universe. But where exactly is "When you ain't got nothing, you got nothing to lose" going to appear? The first 10 million? billion? 10 billion? trillion? I really have no idea.

<comment><USER12> We should be able to at least estimate an upper bound.

If wikipedia has 2.5B words, let's generously assume 10B words. Let's allow phrase lengths of 1-10 words and arrive at 100B combinations.

Optimistically we're at 37 bits, not even a 7 character [a-zA-Z0-9!@#$%^& __()].

And unlike the [a-zA-Z0-9!@#$%^&*()], we could madly cut that down based on frequency and popularity.

Therefore existing phrase passwords are security through minority. If they are adopted, they provide at best an order of magnitude or two over simple dictionary words.

But we're kidding ourselves, most people still use 'password'.

</comment></comment></comment></comment></comment></comment><comment><USER23> The official website of Diceware does not have a certificate [http://world.std.com/~reinhold/diceware.html](http://world.std.com/~reinhold/diceware.html) Is it intentional ?

The word list is signed but for someone unfamiliar with crypto an electronic signature is useless while a lock in the address bar is reassuring.

<comment><USER24> while true, the nice thing about the diceware wordlists is you can scan them. The only thing that would lower the entropy is if there were duplicated words. The lists are in alphabetic and numeric order.

</comment></comment><comment><USER25> (shameless plug) [https://github.com/leshow/rust_mnemonic](https://github.com/leshow/rust_mnemonic)

BIP0039 has been around for a while and generates passphrases strong enough to be the seed of every private key you will ever deterministically generate in a wallet.

</comment><comment><USER26> Here's something I wrote a little while ago - an xkcd-style passgen script in ruby. Usage is just `./passgen.rb [number of words]`. Default word count is 5.

[https://github.com/kurotetsuka/passgen](https://github.com/kurotetsuka/passgen)

</comment><comment><USER27> You can create your own dice word list by selecting 7776 words and indexing them with a base-6 ID.

</comment><comment><USER6> From the article:

"Unfortunately there doesn't appear to be user-friendly software available to help people generate Diceware passphrases"

This is silly. There are popular applications for every major phone OS that implement Diceware. Does anyone feel that they're untrustworthy?

</comment><comment><USER28> These kinds of passwords remind me of gfycat URLs.

</comment><comment><USER8> Interesting rewrite of the actual title :P

<comment><USER29> We're at the point where we're more worried about NSA then a _random_ attacker, as we should be.

<comment><USER4> Really? You think the NSA is more interested in your bank password than random criminals in [country over there]?

</comment></comment></comment><comment><USER30> Their are two levels of security, Mossad and non-Mossad. Worrying about evading the NSA is premature optimization at best and a form of mental illness at worst.

<comment><USER31> Other than it not being tinfoil after the past 2-15 years of evidence that citizens are targeted, it's not unreasonable to assume that the public is "only" 10-20 years behind the NSA when it comes to technology. So unless you have lifecycle management on all your encrypted files, and plan on regular password rotation on everything on your hard drive that you keep encrypted, perhaps it's not unreasonable to use something secure and memorable NOW.</comment></comment>


Show HN: A cross-platform JWT Debugger - <AUTHOR> https://jwtdebugger.app/ <comment><AUTHOR> Hi HN, We have created a cross-platform interactive JWT Debugger App with JWT token validation support using JWKS Endpoint and PEM/Secret Keys. Use the web version as a progressive web app or install desktop apps for Mac, Window, and Linux.

Love to hear your feedback. App itself is open-source and if you find any issues or like to add a feature just open a Github request ([https://github.com/axioms-io/axioms-jwt-debugger](https://github.com/axioms- io/axioms-jwt-debugger)). We will love to help.

The app is built on top Quasar Framework which is why it is cross-platform. It took about a day to pull this off. So current codebase is probably not completely clean yet but the app itself is fully functional.</comment>


Bill Gates Announces Toilet That Converts Waste into Fertilizer - <AUTHOR> http://boomvibes.com/bill-gates-announces-toilet-that-converts-waste-into-fertilizer/ <comment><USER2> I'm still trying to see if I can see a diagramatic representation of the toilet.</comment>


Source code level analysis and exploitation of recent Firefox/Tor zero-day - <AUTHOR> https://community.rapid7.com/community/metasploit/blog/2016/12/29/a-friendly-fireside-foray-into-a-firefox-fracas <comment><USER2> Interesting... and complex:

Trigger a race condition to enter into an infinite loop. Use a service worker to make javascript running into the background... ... to find a way to get code into the host.

Honestly, I already thought web browsers were _incredibly_ complex beasts... but looking at the exploit, they are far more complex that I tought :-)</comment>


Collection of Intel 8080 microprocessors - <AUTHOR> http://demin.ws/blog/english/2012/12/24/my-i8080-collection/

<comment><USER2> You do not include the 8085, Intel's response to the Z80, with some new instructions some of which were not documented. There was, I believe, a period of several months shortly after the 8085 introduction when the 8080 parts shipped by Intel were actually made by Texas Instrument since Intel had lost the 8080 process.

</comment><comment><USER3> Having very little knowledge about processors and chips, I particularly enjoyed the last bit where you say

 _This is how I took pictures of all these chips in a quite technological way using one iPhone and two Raspberry Pi_

very funny

<comment><AUTHOR> Well, I was experimenting for while with light to avoid shadows, and that setup was the best I could build that dark night ;-)

</comment></comment><comment><USER4> I'm surprised there are no Zilog (Z80) chips in this collection. They were an 8080 clone, massively popular, with a very useful set of extended instructions including block copies and an extended register set.

<comment><AUTHOR> Zilog is a different story. I love them as well, but i8080 is quite exceptional to me personally. Somehow it still remember almost all machine codes of this CPU and can program even without the assembler ;-). I know, Z80 is a derivative from i8080 compatible in most of instructions, so maybe another collection.

<comment><USER4> It's a great collection.

What I really liked about the Z80 was the sane and regular assembler syntax. I know that's not a feature of the Z80 per-se, but when Zilog had copyright problems with the Intel assembler, I think they went one better.

        ld a,(hl)

load accumulator from the address pointed to by the hl register pair

The equivalent 8080 was:

        mov a,m

where you had to know that 'm' was really the h & l registers paired plus indirected. The Intel syntax was very irregular, eg. "mvi" was move an immediate value into a register, "stax" was store (something? I forget exactly). "lxi" was load immediate(?) into a register pair?

The Zilog syntax used "ld" for all of them.

The only better assembler I've used was the 68000.

Edit: Found a good Intel<->Zilog translation here: [http://nemesis.lonestar.org/computers/tandy/software/apps/m4...](http://nemesis.lonestar.org/computers/tandy/software/apps/m4/qd/opcodes.txt) Wow, Intel _really_ was ugly.

</comment></comment></comment><comment><USER5> I love seeing how other people express and communicate the things they are passionate about. I fully support people geeking out about whatever they please, as long as it makes them happy :)

</comment><comment><USER6> do any of you have the real story on AMD's 8080 clone?

<comment><USER7> also really interested in this ^^.

<comment><AUTHOR> The link above is exactly what I read. Very interesting.

</comment></comment></comment><comment><USER8> I love that you staged the photos by propping a phone on top of two Pibows, I'm one of the guys who makes those in Sheffield, UK :)

</comment><comment><USER9> That was a particularly uninteresting collection of identical-looking things.

<comment><USER10> Perhaps if you find it uninteresting you should refrain from commenting? Just a friendly suggestion. I mean, what value are you adding by saying you find it uninteresting?

What makes your comment particularly annoying is that it is obvious you haven't even read the short article that accompany the pictures. It states two things:

"Testing revealed that all processors are identical according to the CPU Exerciser except clones from AMD."

"Interestingly, AMD i8080-compatible chips were reverse-engineered from schematics literally stolen from Intel."

In other words, they are identical, which is why they look identical. DUH!

<comment><USER9> Now now, I'm surprised my light-hearted post caused such a backlash.

>Perhaps if you find it uninteresting you should refrain from commenting? Just a friendly suggestion. I mean, what value are you adding by saying you find it uninteresting?

For one, I can't downvote, so this is the only way I could express my disapproval. And different opinions are valuable in themselves, as you can't have rational, democratic discourse without them.

>In other words, they are identical, which is why they look identical. DUH!

That doesn't even disprove what I said, rather affirms it. It's like saying "The emperor is nude, that's why he seems to have no clothes. DUH!".

<comment><USER11> > And different opinions are valuable in themselves, as you can't have > rational, democratic discourse without them.

No one minds different opinions. But people do want a bit more substance in those opinions so that there can be some kind of discussion.

> I can't downvote, so this is the only way I could express my disapproval.

Not upvoting this article, but upvoting other articles, would have been one way to express disapproval.

<comment><USER9> Well, didn't my previous post have substance? It's like everything I say nowadays gets buried. I'm going to guess it's power users trying to silence the small fry.

<comment><USER11> Your first post in this thread was empty. Unfortunately there is a kind of "pile on" effect, where all your posts in this thread get downvoted even if those posts don't deserve a downvote.

Hopefully that will correct after a few hours - other people will upvote any incorrectly downvoted comments.</comment></comment></comment></comment></comment></comment>


Show HN: Saka – A tab search Chrome extension inspired by Spotlight - <AUTHOR> https://saka.io <comment><USER2> Very cool!

<comment><AUTHOR> Thanks! I was very surprised a half-decent in-window tab search extension didn't already exist. They all opened in the popup or a new window. So I made one myself.

My goal is to make a complete Omnibar/tabs replacement so I can browse in full-screen mode by default.

This extension complements my other keybinding extension ([https://github.com/lusakasa/saka-key](https://github.com/lusakasa/saka- key)).</comment></comment>


Military Reaper Drone Documents Leaked on the Dark Web - <AUTHOR> https://www.recordedfuture.com/reaper-drone-documents-leaked/ <comment><AUTHOR> The original tile was supposed to be:

"Military Documents Stolen Because Someone Forgot to Update the Router Password"</comment>


Microsoft Is Why Samsung, Dell And Others Didn't Invent The iPad - <AUTHOR> http://www.fastcompany.com/3002441/below-surface-microsoft-why-samsung-dell-and-others-didnt-invent-ipad?partner=newsletter

<comment><USER3> Without Microsoft, Dell would not exist as a major hardware provider (Samsung and others, are left as an exercise for the reader).

It was Microsoft's business innovation of separating the operating system from the hardware that formed the foundation upon which Dell was built, and which sent companies like DEC, Wang, and Commodore to extinction. IBM and Apple only survived by reinventing themselves as something different.

<comment><USER4> I think you're rewriting history here.

CP/M was there long before Microsoft's dominance took off, powering machines from multiple companies (including the ones you listed). In fact, MS DOS 1.0 was a re-branded QDOS, which was highly inspired by (as in, an incompatible but extremely similar to) CP/M.

It was Microsoft's execution, NOT innovation, that gave them the lead. And IBM's lack of foresight, giving Microsoft control of the PC market.

<comment><USER5> IBM lacked foresight only in retrospect and we can laugh and point fingers only because we know the outcome. In any given year the company of that size probably has access to a hundred various technologies that have not been market-tested. No company has a record of picking winners and losers perfectly, most companies need to concentrate, and hence the whole market for mergers & acquisitions exists.

IBM actually rode the PC market quite nicely and exited it via sale to Lenovo quite timely as well.

<comment><USER4> Indeed. I was not implying that they were stupid or that anyone else would have seen it better; just stating the fact that they did not anticipate what ceding control of the OS market to Microsoft would mean.

From what I've read, IBM didn't pay much attention to this decision - <USER2> considered MS-DOS 1.0 a "stop-gap" measure to make the PC-g useful (original IBM-PC model, later followed by XT, jr and AT) while they were getting a real operating system (CP/M 86) ready.

In fact, IBM's original PC-g seems like it was almost an afterthought ("oh, Apple implies there actually is a market for a personal business computer? let's put a leg in this market, just in case"). The original design had very little IBM in it - it was very close to Intel reference designs for the 8088, using available off-the-shelf components (the main non-intel parts were a Motorolla CRT controller, a NEC floppy disk controller which was backward compatible with an older Intel floppy disk controller; unlike Apple's Woz- designed Video adapters and disk controllers).

<comment><USER6> IBM mounted a major marketing campaign for the PC when it was introduced, and it made a big splash. It sure didn't look like an afterthought.

When I bought my IBM PC, there was CP/M-86 (in an IBM box) on the shelf right along side PC-DOS (IBM branded MS-DOS). PC-DOS was $40, and CP/M-86 was (I don't recall exactly) $180. Everyone bought PC-DOS because of the price.

The company I worked for at the time did buy a copy of CP/M-86, so I had a chance to work with it for a while. I saw nothing at all to recommend it over PC-DOS. It was not a "real" operating system any more than PC-DOS was.

CP/M-86 failed because it was way, way overpriced. There was no conspiracy against it, and it was not technically superior.

<comment><USER4> > It sure didn't look like an afterthought.

I don't remember the marketing around it; I believe you they made a splash. But technically, it didn't look like IBM spent a lot designing it.

> there was CP/M-86 (in an IBM box) on the shelf right along side PC-DOS (IBM > branded MS-DOS)

That was after IBM PC was already a hit. When it was introduced, and for quite a while after, only PC DOS was available.

> I saw nothing at all to recommend it over PC-DOS. It was not a "real" > operating system any more than PC-DOS was.

That is correct. Also, when CP/M-86 was finally introduced, it had no software (all CP/M software at the time was 8080 or more commonly Z-80), whereas PC- DOS=MS-DOS had already amassed a nontrivial software catalog.

> There was no conspiracy against it, and it was not technically superior.

I totally agree, never said it was. But I do remember reading that the IBM thought process was that CP/M-86 was the "serious" operating system, since CP/M had business software already (wordprocessors, payroll software - don't remember if VisiCalc was already ported to CP/M at the time), whereas PC-DOS was a newcomer, and therefore cannot be taken seriously (except as a stopgap measure).

<comment><USER6> There was a selection of CP/M-86 software for a while from companies that hedged their bets and developed for both systems. This ended when they noticed nobody bought those versions.

I'm not sure just when CP/M-86 was released by IBM, but it was there when the IBM PC with the 64K mobo and 180K floppy appeared, which is when I bought mine.

Many CP/M people did buy CP/M-86 at first, but they threw it under the bus shortly thereafter. Some of them tried to extoll its virtues to me at the time, but they were clearly disappointed by it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Dell didn't invent the iPad because they were comfortable with sitting on their asses while other companies did the heavy lifting for them (MS, Intel). From the article, Dell's SVP says,

"The reason we didn't come up with [the iPad] is because there wasn't an OS provider that could work with a tablet."

That didn't stop Google.

Not to mention, Dell still makes enough cash that they could venture out and do something on their own instead of relying on other companies to innovate for them. What do they chose to do? Blame MS for their lack of innovation and whine that they will now be competing against MS in the hardware arena.

<comment><USER8> For an innovative software company like Google to step out of their is an order of magnitude more feasible than a low-margin commodity hardware provider like Dell deciding to make software.

<comment><USER9> +1 "lest we forget" the laws of margin/commodity in all this innovation back slapping :)

</comment></comment></comment><comment><USER10> You could say that Dell is the reason why Microsoft didnt invent the iPad.

Tablets have been a gleam in the eye of the software industry for a long time. My wife worked for a professor who wanted to make an Apple Newton app for turfgrass professionals in the 90's and I remember playing Game Boy games in emulation and knocking off handwritten complaints during bad sales meetings with a palm pilot in the early 00's.

Microsoft has been fascinated with tablets and pen computing and has made multiple efforts in that direction over a very long time.

Look at one specific thing.

Back in the early 00's none of that suspend, sleep and restore stuff worked right on Windows laptops. It just didn't. I was a linux fanatic at the time and I was always laughing at the business people who had to remove the battery from their laptop 3 or 4 times a day to get it running again.

Back then, Windows was a real mess and when anything went wrong there was endless finger pointing. Microsoft seemed to believe that Windows never crashed on its own, that the fault was always bad hardware, bad drivers, cosmic rays, whatever.

Vendors of premium hardware, like Apple and Sun, controlled the OS and the drivers and the hardware. Sun systems were legendary for reliability (even though they were losing the performance war even in 1992) and Apple laptops could reliably wake up from sleep 4 or 5 years before Windows laptops could.

By the time Microsoft and the hardware vendors got sleep figured out, there was the invasion of the "crapplets". Turns out that Dell and HP get kickbacks from 3rd part software vendors when they pre-install annoying nagware on a computer you buy. So you've got a brand new Windows machine and it performs like it's 6 years old because of the junk pre-installed with it.

So it's fair to say that Microsoft has been held back by PC vendors as much as PC vendors have been held back by Microsoft.

<comment><USER11> > Back in the early 00's none of that suspend, sleep and restore stuff worked > right on Windows laptops.

Bullshit. It worked fine. But only if you bought a proper laptop (mid-high end IBM + HP etc). If you bought a crapfest machine cobbled together by the lowest bidder, you got what you paid for...

Hell we had internal Windows NT machines up for 3-5 years at one point. Windows doesn't go wrong unless you throw crappy hardware at it.

The bad rep by shoddy hardware vendors is why they invested heavily in WHQL and testing and qualification.

And as for laughing at the business folk when their machines won't hibernate, that stinks of typical Linux smugness which in this area is certainly not justified. Linux's ACPI implementation is shitty and has never worked properly. I've have well over 50 Linux based laptops pass through my hands in the last 15 years and like hell hibernate/suspend works on any of them.

<comment><USER12> You take his statement (power management works in Linux / doesn't in Windows) and says it's false because it works in certain contexts (IBM + HP).

Then you hold his argument to a higher standard by applying it to all PCs and providing anecdotal evidence.

Have you tried suspend / hibernation with Linux on a ThinkPad?

<comment><USER11> Yes I have a T61 which reliably doesn't hibernate or sleep properly in either Debian or Ubuntu...

</comment></comment></comment></comment><comment><USER13> It's worth noting that PC manufacturers had a variety of 'palmtops' and 'subnotebooks' based on low-power RISC chips & Windows CE, going back to the 1990s.

IMO, this segment was largely a casualty of Microsoft's disinterest in web browser development. If they had something approaching a working browser, these devices might have found their niche. MS also lost interest in CE, which should have been the place to define 'industry standards' for 'managing the power architecture'.

When Windows CE was released, it inspired a lot of talk about "Only the paranoid survive" and "MS doesn't want someone to do to them what they did to IBM". Somewhere along the way that was all forgotten.

<comment><USER7> The segment was a casualty of the fact that very different elements of design were forced to co-exist in a space where nothing worked in a reasonable, enjoyable or productive manner.

Desktop UI on a tiny device? They were always impossible to use and had vastly more tradeoffs than bonuses in actual use.

A functional web browser was the last item on a very long list of shortcomings these devices had.

<comment><USER14> That makes it sound worse than it was: it wasn't a desktop is with e.g. floating windows. It did have trappings of windows 95 that didn't belong: start menu, task bar, systray

But, apps were full screen. The biggest impediment was internet explorer couldn't render standard webpages that the desktop version could. That and resistive touch sucked.

<comment><USER15> I had one. It was a fun toy. Did about as much as a Palm Pilot.

And that's probably why it failed.

</comment></comment></comment></comment><comment><USER16> But that doesn't explain phone and home electronics manufacturers like Nokia, Palm, Motorola, RIM, Samsung, Sony and Creative who weren't as invested in the MS stack as the PC OEMs.

I suspect a major reason was the reaction to the Palm Foleo, a lightweight instant-on Linux-powered ARM subnotebook designed for web and email. Palm were widely mocked and berated in the press for developing a non-Windows non-x86 computer and ultimately canceled the device. Is it any wonder other companies were reluctant to follow in their footsteps?

<comment><USER17> Of course, and the Foleo was followed almost immediately with the x86-based netbooks. These devices seem to have grown out of the OLPC and intel's long time goal of shrinking their chips for mobile devices.

But why was there so much opposition to the Foleo? The software seemed quite useful, it had WiFi so even the lack cellular wasn't that much of a limitation. Netbooks may have run Windows desktop software but were largely used for web browsing and Microsoft Office.

I've heard the argument from some on the Palm team that the Foleo had to die, that it was more important to focus on the new webOS platform. But what software was used in the Foleo? A custom system built around Docs-To-Go. A menu which married keyboard-driven interfaces and full screen applications. The concern was that the Foleo wouldn't run the same software as the new hardware devices and also wouldn't run PalmOS software that the Palm developers were relying on, though they all knew that those revenue streams were already drying up. Of course, the new devices barely ran PalmOS software anyway with a required additional download of a trial of an emulator. That wasn't the death of the new platform though, Android and iOS were.

I'm aware that the Foleo was underpowered, but it was the first generation of a new device. It was the first netbook, and it is very similar in a lof of important ways to the new Microsoft Surface going on the size of the display and use of ARM processor.

</comment></comment><comment><USER18> This is remarkably short-sighted and myopic.

Microsoft certainly held a lot of things back by sticking to a status-quo for as long as possible. But how can you blame them? It was a profitable status- quo.

Apple just foresaw the needs and wants of the consumer and created a product that matched them. They innovated on all fronts, without giving excuses or accepting limitations. I'm not saying they're perfect, but their achievement is one that could have been done by any company _if_ they understood the whole picture; including usability, industrial design, aesthetics, software engineering, functionality, customer service, price point, and marketing.

Apple didn't invent the iPad. The iPad isn't what made them successful. Apple invented itself, and the iPad came out of it. It was the natural product of a company designed to create innovative products by taking all aspects of the experience into account.

Samsung, Dell, and others didn't invent the iPad because they weren't good enough companies. They didn't exude quality from every pore, and they didn't understand every aspect required to create true innovation. They can blame Microsoft all they want, but it won't get them anywhere. They won't be inventing iPads anytime soon, and they have to look inside their own culture to see why. But they won't.

<comment><USER19> _"Microsoft certainly held a lot of things back by sticking to a status-quo for as long as possible. But how can you blame them? It was a profitable status-quo."_

That is _exactly_ the Innovator's Dilemma. That is why, IBM, for example didn't pursue the home PC market with more vigor. The status quo is enormously profitable. The emerging market is quite a bit less profitable. However, by the time you recognize that the emerging market has greater growth potential than the status quo, all of the first mover advantages are taken by companies who had no choice _but_ to go into the emerging market. Going back to the IBM PC analogy, Microsoft and Compaq had no choice but to go into personal computers, because the mini-computer and mainframe markets were dominated by companies like Unisys, IBM, DEC, and Digital.

In the same way, Apple saw that the personal computer market was dominated by Microsoft. When Steve Jobs returned to Apple, the company's marketshare had declined precipitously and it had ceded all but a few specialized niches to Microsoft. A lesser CEO would have waged a costly and futile battle to take back the personal computer market from Microsoft. But Steve Jobs saw that the battle was already lost. Instead, he focused on consolidating Apple's hold on the niches that it did retain (high-end, well designed, hardware sold at a premium price) while expanding out into emerging markets like MP3 players, phones, and tablets; markets that Microsoft did not take seriously precisely because its dominance of the desktop/laptop market was so complete. And now Microsoft finds itself in the same position that IBM found itself in when Microsoft dominated personal computers.

</comment></comment><comment><USER20> Two key points from the article:

 _"In order to come out with a tablet, you had to have the ability at that time to influence and manage the power architecture, as well as a software layer" - David Johnson, Dell's SVP of corporate strategy_ [1]

 _Peter Hortensius, president of Lenovo's global product group, says, "I think the global view is that everyone got a little bit surprised by touch [technology]. We had touch devices, but the industry just didn't connect the dots like [Apple]."_

In short, the iPad sips power by tightly integrating hardware/software. And touch was slick and integrated all the way up the stack.

I think the only question now is how many other companies can move fast enough? It took Apple the better part of the last decade to develop the hardware + software to where they are today. It makes Samsung's alleged copying make a lot of sense considering how far ahead Apple is.

Personally I'd really like to see more competition. Hopefully hi-res LCDs, good UI design, good industrial design, and rapid innovation become common. Also, if everyone is doing "rounded corners" or whatever it is next year, Apple won't have all the patents and will be forced to cross-license. I admit it's not all going to be as rosy as this. But this is better than what happened in the 90's.

[1] [http://www.fastcompany.com/3002272/top-dell-exec-why-his- com...](http://www.fastcompany.com/3002272/top-dell-exec-why-his-company- didnt-invent-ipad)

<comment><USER21> But Samsung _didn't_ copy. The UK courts have ruled so, and they've made it clear that they consider it libel to say otherwise.

In fact, I question the article's premise. Samsung _did_ invent the iPad, as well as the iPhone - except that theirs are called Galaxy S and Galaxy Tab. And they were able to do so while being a hardware manufacturer whose OS is provided by a third party, which calls the entire "blame Microsoft" theory into question.

The fact that Samsung's offerings arrived after Apple's means nothing: it is clear that they were developed independently, and the fact that they shipped later must have been due to the additional development time required to make their products less expensive, and thus technically superior. The timing was entirely accidental, a mere side effect of the fact that Apple had access to a mass of brainwashed fanbois that will buy anything with an Apple logo, which provided them with both the funding and the opportunity to target the deep- pocketed early-adopter market.

But in a world where Apple didn't exist, Samsung would have shipped the Galaxy family of products around the same time as they eventually did - and they would have looked just as they do, too. Any resemblance in design between Sammy's products and Apple's is due to convergent evolution: it is simply less efficient, if not thoroughly impossible, to make a smartphone or a tablet that doesn't feature that shape, that button, that grid of icons in those specific colors - or even one that doesn't ship in that type of box. Apple's claims to have "invented" any of that are tantamount to claiming ownership of a law of nature.

In the end, articles such as this are a waste of time. There is no secret to Apple's perceived success, no lesson to learn. Their headstart is doomed to evaporate against Android's irresistible growth, and they will be recorded as a mere curiosity (to avoid calling it a "fad" as it really deserves) in the books of history.

Hacker News has limited formatting capabilities, but, while reading the above, please imagine that there is a banner saying "This is what Android fanatics actually believe" at the bottom of your screen.

<comment><USER22> Brilliant. You actually had me spitting mad until I got to the last paragraph.

The real question I would like to see answered, either here, or in the Fast Company - is what will the _next_ major advance be, that everyone is (presumably) hard at work on right now?

I'm very, very impressed with Google Voice on my iPhone. Much more so than Siri (in terms of speed. Integration with the phone is obviously better with Siri).

I would like to suggest that high-resolution stylus input, equal to or better than what you can do with a pen-to-paper in terms of resolution and responsiveness, will launch the next round of advances.

<comment><USER23> _"I would like to suggest that high-resolution stylus input, equal to or better than what you can do with a pen-to-paper in terms of resolution and responsiveness, will launch the next round of advances."_

What would be the point? Using touch is faster and more direct for operating a UI. As for text input, I can type a lot faster on the iPad's onscreen keyboard than I can write with pen and paper.

Granted, I rarely write anymore, mostly signatures. But I also don't print documents and I don't keep a paper archive. I think those are all going the way of the dodo.

<comment><USER22> I'm just reflecting on the fact that when I get together with a group of people, and we start _sketching_ out an idea, none of us would ever consider using our iPads (and all of us have them) to do it - iPads are crappy for that sort of quick, on the fly diagraming. We always end up with napkins, notebooks, and pens. If we're in the office, we always go to a whiteboard. Nobody ever uses computers/tablets to sketch out a concept - too slow, too low resolution.

A good high resolution, highly responsive tablet/drawing interface would be a revolution.

<comment><USER24> Oddly I've found that since I've got my iPad I've switched to using Paper over, well, paper.

Note, my basic diagrams and workflows and other concept sketches would make most people cringe in horror, so high fidelity is not a big sell for me.

<comment><USER23> Try OmniGraffle for iPad, it's awesome. I use it extensively, and its interface allows me to make diagrams faster than I could on a desktop computer.

At $50, it's not the cheapest iOS app, but it's worth every penny.

<http://www.omnigroup.com/products/omnigraffle-ipad/>

<comment><USER22> I use omnigraffle on my ipad extensively - I've got about 20 different diagrams, some of which have turned into real-physical things ( a brick walkway pattern, is one example).

It's still about 5x slower for me than a whiteboard or paper napkin + pen, albeit much easier to edit once you've created something.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> The final quote is telling:

"If I knew [why we weren't first to market with a touch tablet] I might be retired in a tiki hut on a beach somewhere." (paraphrased)

Steve Jobs _was_ first to market, and he made all those hundreds of billions of dollars and he was still working on the next thing until his last week on this earth.

</comment><comment><USER26> Software is why. Apple is really the only company with lots of experience in both hardware and software.

<comment><USER27> Palm and RIM both straddled that divide.

<comment><USER28> Kinda. So did Nokia. I don't really know that much about Palm's historical skill at software, but I _do_ know Nokia was not very good at it, especially the usability part, and RIM had reached a place where they were content to remain (keyboard phones for enterprise markets, even though their phones were more popular with texting teens in europe) static until "somebody" got a bullet in each of their knees.

<comment><USER29> The Palm software was OK but it really succeeded because of the app store. Third party apps were huge in the Palm heyday.

</comment></comment></comment></comment><comment><USER30> The enterprise is why Microsoft didn't invent the iPad.

There is so much baggage that Microsoft has to support to make huge amounts of money with enterprise companies that they can't just drop everything and reinvent like Apple could.

That's why there is a split in Windows 8 - they can't drop the desktop and bolt.</comment>