The logic behind treating "sexting" teens as child pornographers - <AUTHOR> http://reason.com/archives/2010/01/25/ruining-kids-in-order-to-save <comment><USER2> What I find particularly disturbing is the normal emotional and sexual relationships from my own teenage years (just so we're clear: dating people my own age when I was a teen) is now seen as a crime. If the clock was turned back and I was suddenly 16 years old in 2010, i'd be scared just to have a girlfriend. What if her parents charged me with a sex crime because they caught us making out? I feel pretty bad for kids today for having to grow up in a culture of fear, confusion and repression.

<comment><USER3> Where I am. the law on the age of consent contains a strong exemption for cases where the age difference is small. The age of consent is 15, but if a 15yo and a 14yo have sex and are fine with it, their parents can scream their lungs out, the police will immediately dismiss it. Because our lawmakers remembered the purpose of the law: To stop adults from having sex with children, not to stop teenagers from having sex with each other.

This is also something I've wondered about the US legal system, how much extra information is written into law? Where I am, in Sweden, which uses a different legal system, most laws come with instructions for how to interpret it. Does this exist in the US? Or is this built up by judges?

<comment><USER4> When I was in high school I was informed (and I remember because it was relevant at the time) that our councilors were legally obligated to report sexual activity only if any participant was 15 or under or if one was a minor and another was not.

It was rather silly that a lot of students had a window of a few months during their senior year when their relationship could result in criminal charges, but before or after that it was fine.

<comment><USER5> It's even better when you consider, for example, a senior dating a junior starting from when they were both 15 <-> 18\. Today, happy couple. Tomorrow, criminal sex offender. All that changed was a few hours went by.

</comment></comment></comment></comment><comment><USER6> The best line "The message to minors: These photos can ruin your lives, kids. And just to prove it, we're going to ruin your lives."

<comment><USER7> Similar approach to teens and drugs appears periodically.

</comment></comment><comment><USER8> This is just stupid; essentially they are making a judgement on child sexuality and trying to force kids into a chaste society.

As someone who struggled with intimacy and other issues in my teens (aka the kind of environment these people are trying to foster) and I can tell you now: _it's incredibly damaging_

This is just knee-jerk reaction to a few people's distaste at overt sexuality in minors. It's damaging to the campaign against those who really _are_ abusing minors.

<comment><USER9> My theory is that the people with "distaste at overt sexuality in minors" are actually just uncomfortable with their own sexuality.

For example, this Skumanick guy sees young girls at the beach in bikinis and is uncomfortable with the fact that he's sexually attracted to them. To me this is just part of our biology and it's not a big deal. But this guy is so insecure that he goes on a mission to make it be known that he does not approve of this behavior because to him the thoughts he's having about the girls at the beach are impure. He even goes so far as to say he's able to prosecute minors in bikinis at the beach.

It's the same sort of situation with the article's reference to Mark Foley.

<comment><USER10> In other words, he is the kind of pervert he is trying to stop.

<comment><USER9> It's funny to think that, but I think it's more that the guy is just insecure.

</comment></comment></comment></comment><comment><USER11> Do kids prosecuted and convicted under these laws have to register as sex offenders? If so... that is just awful. I mean, official reprimands, even going to court over something racy is not cool, but a lifelong stigma over something mostly harmless?

Also wouldn't that reduce the meaningfulness of the sex offender registry when a large portion of the people are 'just on it cuz I got caught having sex when I was 17'.

<comment><USER12> Yes, they generally have to register.

We need to just do away with sex offender registries entirely. Not only are they unjust, but they're impractical: they're mostly made up of innocent people who upset their SO's parents as teenagers.

<comment><USER13> I'm not sure that that's true. There's plenty of rapists, child molesters, etc on them. We shouldn't put people on there for sexting or having sex with their signifcant other who is only a year or so younger, but we shouldn't prosecute them at all.

Though the registries do have the issue of leading to discrimination against the sex offenders and not giving people much of a 2nd chance.

<comment><USER14> If someone, as a mother of a child, has the right to know that a sex offender lives in her neighborhood, then I, as the owner of some expensive things, have the right to know that a burglar lives in my neighborhood.

<comment><USER13> Well yeah, at the end I admitted that there are other reasons to do away with the registries.

But the premise that we should get rid of the registries because they're mostly stupid teens that were victims of these stupid laws is just wrong. The solution to that is to stop prosecuting kids with laws never meant to be used on them.

<comment><USER14> You're right, there are a lot of better reasons to ban those registries.

</comment></comment></comment></comment></comment></comment><comment><USER15> What baffles me about these cases is the hypocrisy of the position the courts are taking on it. They say that minors aren't able to consent to creating indecent images of themselves; that's a fairly decent position in and of itself. However, they then say that they're committing an adult crime by doing so. You can't have it both ways -- either they're minors or they're adults. If they're minors, they can't legally create these images but they can't be tried as adults for it either; if they're adults, they could be tried for it but there's no crime there. Pick a side and stick with it.

</comment><comment><USER10> I guess it's indeed true that the definition of "indecent" is "whatever arouses a judge"... Or a District Attorney in the cases pointed by the article.

</comment><comment><USER16> If isn't about protecting children any more, what is it about? My 2 cents: It's just a witch-hunt, you know, like in the middle ages.

<comment><USER17> Or like the Red Scare in the 1950s.

Or like the Satanic ritual abuse witch-hunt in the 1980s.

Or like any number of other moral panics:

<http://en.wikipedia.org/wiki/Moral_panic>

<comment><USER18> Yup, that's basically it. Moral panic + DAs striving for reelection = mob justice

</comment></comment></comment><comment><USER19> Apart from the question of photographs of teen nudity, how can they be prosecuted for being photographed in a bra? Is there really a law against that kind of thing? Or for appearing "coy" - soon the only way to be save is to only go outside hidden behind a veil?

<comment><USER8> That's difficult - because it depends on the classification of "indecent". Which is subjective.

There are usually a few levels of "indecent image". Here in the UK we use the Copine scale which has 5 levels. Level 1 _includes_ non/semi nudes but in an overtly sexual pose OR nudes but in a non-sexual pose.

Im not sure of the exact classification system used in the states but I think they do it similarly. The difference here is that if you only have a few level 1 images then you wont get prosecuted - i.e. these people wouldn't be prosecuted here. (based on that I am assuming that the US system is a bit more lenient about what is classed as indecent)

<comment><USER20> > _based on that I am assuming that the US system is a bit more lenient about > what is classed as indecent_

It's basically up to however draconian a judge, jury or prosecutor wants it to be. If a girl baking cookies in a short skirt is 'indecent' to someone in that list, then you might just get successfully prosecuted for it. It's really insane.

[EDIT] The system was _supposedly_ designed with its original intent being to protect victims (child abusers, and to a lesser extent child porn consumers in a bid to choke off demand for child porn). Now it's basically become a vehicle whose aim is to punish you if your get off on something that they don't like, or do something that they don't like (where 'they' is someone in that list above). If a judge has a stick up his ass about teens being 'immoral' then he may just throw the book at teens that are brought to his court for 'sexting' just to satisfy his urge to punish someone for it.

<comment><USER8> Hmm that is insane. It _is_ a subjective thing - but here it is considered expert testimony. Therefore it is up to an expert to grade the images and present the findings to the court (of course the jury can judge the images for themselves).

I know it is similar in some parts of the US - but I guess not everywhere :(

</comment></comment></comment></comment><comment><USER21> Might I recommend a title change? s/logic/boneheaded logic/

Currently reads as if the article is advocating treating them as sex offenders.

(wording taken from article's deck)

<comment><USER22> The terms _tongue-in-cheek_ and _irony_ come to mind...

<comment><USER23> The terms 'intonation' and 'non-verbal cues' also come to mind. Specifically the lack there'of ;)

<comment><USER22> Oh, come on! Do we have to be so deliberate?

<comment><USER23> I wasn't sure, so I erred on the safe side of caution.

</comment></comment></comment></comment></comment><comment><USER16> Does anyone have an opposing point of view? Granted it's difficult, given how the article presents the points, but I'd be interested to hear from people satisfied with how the law—or maybe just parts of it—is behaving in these cases.

<comment><USER24> You should re-calibrate your sense of "in other words". You had an interesting question until you lumped a broad category of people, including many minors, into the loaded word "pedophile". Your last question is not a re-statement of the previous question. It adds assumptions and associations that overwhelm the reasonableness of the first question.

<comment><USER16> I'm at a loss to rephrase the problem part in an appropriate way so I removed it. Ask the second question yourself if you can and wish to.

</comment></comment></comment><comment><USER5> "They've been introduced to the criminal justice system merely for appearing in them."

Thank god the legal system has finally figured that out! The true criminals that need punishment are none other than the victims. Fingers crossed this will set a precedent, and murder victims will finally get the punishment they deserve.

That'll teach 'em not to get exploited.

</comment><comment><USER25> Alright, own up - who left the stupid tap on? We're knee-deep in stupid!

</comment><comment><USER26> I hate to be That Guy... but this really isn't Hacker News.

Why don't you discuss it over on reddit: [http://www.reddit.com/r/reddit.com/comments/au2vm/these_sext...](http://www.reddit.com/r/reddit.com/comments/au2vm/these_sexting_photos_can_ruin_your_lives_kids_and/)

<comment><USER27> It's Hacker News if your cloud app is suddenly carrying what courts would consider child porn because your under-17 demographic is upping nude pics of themselves to it.

<comment><USER28> Apparently nudity is not even required anymore for images to be considered child porn, so you're not even safe if you aggressively remove all images that most people would consider inappropriate. From what I can tell, there really is no unambiguous line, and that's disturbing, because there's no way to keep a site "sanitized" against this sort of thing.

The upside is that I don't think there have yet been child porn charges brought against web service owners for things that their users have uploaded, since it's usually against the terms of service to upload such things and courts realize that owners of a web service can't be expected to police every piece of user-uploaded content.

And FWIW, I find this very appropriate for Hacker News: it is a disturbing legal trend specifically caused by people's reactions to new technologies, and you can bet that the people responsible for this push would love nothing more than to spread this type of thing to the Internet. I don't think we should be too concerned that they'll succeed, because most normal people see the lunacy in all of this, but it's still worth keeping an eye on.</comment></comment></comment>


API for Get Scientists? - <AUTHOR> I tried to search for more than 2 hours some API where I can get the list of the most recognizable scientists throughout history, but I only found breeds of cats, comics and anime, do you know any API that does that? I find it weird that I can't easily find this API <comment><USER2> [https://pantheon.world/explore/rankings?show=people&occupati...](https://pantheon.world/explore/rankings?show=people&occupation=MATHEMATICIAN,BIOLOGIST,PHYSICIST,PHYSICIAN,INVENTOR,ASTRONOMER,CHEMIST,ECONOMIST,ENGINEER,COMPUTER%20SCIENTIST,PSYCHOLOGIST,ARCHAEOLOGIST,ANTHROPOLOGIST,GEOGRAPHER,GEOLOGIST,SOCIOLOGIST,POLITICAL%20SCIENTIST,STATISTICIAN)

<comment><AUTHOR> Ohhhhhhhhh, thanks!!! I going to spread this API

</comment></comment><comment><USER3> Wikidata has a query service, which you may find useful:

[https://wikidata.org/wiki/Special:MyLanguage/Wikidata:SPARQL...](https://wikidata.org/wiki/Special:MyLanguage/Wikidata:SPARQL_query_service/queries/examples)</comment>


Show HN: web app to create flippable brochures/magazines - <AUTHOR>

It's an editor that lets you create something like this: http://papermine.com/samples/julskitchen/
The publications look stunning on tablets, but pretty cool on PCs as well :-)
http://papermine.com/
What do you guys think? <comment><USER2> The only proven, lucrative market for "flippable brochures as a service" is in hosting weekly circulars for large retail chains. And that market is already locked up by ShopLocal [1]. Walmart, Best Buy, Target, Maycs, Toys R Us, Sears, Staples, CVS and over 100 other top retailers pay ShopLocal to put their circulars online; the ones hosted on their "own" sites are typically on a subdomain which is just a cobranded portal hosted by SL. Their core offering isn't just "page flipping tech" but top-notch print-to-digital conversion.

1: [http://www.shoplocal.com/](http://www.shoplocal.com/) [http://aboutshoplocal.com/](http://aboutshoplocal.com/)

<comment><AUTHOR> Hi, Dan!

Papermine isn't for brochures, only, though. You can create pretty much whatever you want with it.

For instance (and this was actually a problem I had after I got married), wedding albums to send to family and friends via email. I actually think photographers could use this a lot in general.

It's just a nicer format than a PDF (10 times nicer on a tablet, I'd say), and more interactive.

Compared to similar products, Papermine actually lets you create the content, and it's not merely an aggregator.

:-)

<comment><USER2> "Who could use this" and "who will pay enough for this to build a sustainable business" are two different questions. I was addressing the more important one.

<comment><AUTHOR> Oh, I got you.

I don't take care of the financial aspect, but I do see your point.

I'll take a look at ShopLocal, to be honest I'm not familiar with it. Is it used by most big companies, etc.?

</comment></comment></comment></comment><comment><USER3> The example looks very clean.

Reminds me a bit of treesaverjs.com, which created automatic magazine-like page layouts for any size screen, but unfortunately seems to have run out of steam.

Do you plan on offering a complete solution for publishers including CMS integrations?

<comment><AUTHOR> Hi, dkoch, thanks!

Compared to other platforms we're more about the user using a editor to create the content himself, rather than doing that automatically (like—for instance—Paperly). There is an import tool, but normally you'd want to use Papermine as a content creation tool, rather than an aggregator.

As for CMS integrations, right now we're focusing on getting the basics right. However, we do want to make it easy to create great publications: if integrating with any CMSes people use will help with that, we will certainly do it :-)</comment></comment>


Let's talk about PAKE - <AUTHOR> https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/ <comment><USER3> I'm really excited about PAKEs! But for a totally different reason.

PAKEs are great for low-entropy secrets, but they don't have to be static: you can generate them on the fly too. Every time you have a human-mediated channel that eventually needs to agree on a strong secret, PAKEs are good. So, if you have a device that you want to pair with an existing device with an untrusted third party PAKEs are super great. You can use this to safely send a file across the ether by just sharing a short string like "2-bonobo-magic; see magic-wormhole.

I therefore disagree with the notion that a PAKE being symmetric is a downside: I just think that they're different tools for different tasks, and we should talk about sPAKEs and aPAKEs specifically. Symmetric PAKEs are worse for password auth: I just think PAKEs are not a high priority for password auth. There are two problems with passwords: cred stuffing and phishing (fundamentally the same attack: an attacker gets a password "out of band" and then replays it) and PAKEs solve neither.

[magic-wormhole]: [https://github.com/warner/magic- wormhole](https://github.com/warner/magic-wormhole)

</comment><comment><USER4> Unfortunately this won't help while we continue to trust JS sent to us by the server.

Their threat model is "server is compromised by an attacker, who then vacuums up all the cleartext passwords". Assuming that under normal operations there's some fancy UI that takes the password and handles the PAKE stuff (which it will have to be, until browsers support it), there's nothing stopping that attacker from simply adding malicious code that fire off your cleartext password.

If you want user authentication security, use client side TLS certs. 1) the UI is built into all major browsers, and can't be faked, and 2) the server doesn't require the CA's private key, only the server generating new certs needs it. In the above threat model, the worst that can happen if an attacker compromises the server is he can MITM the traffic at the time... but the attacker will never capture user credentials that can be used in the future, or be used to decrypt past communications.

<comment><USER5> The problem that exists with TLS certs, and not with PAKE, is usability.

Client certs suffer from questions like "as a user, how do I handle multiple devices? Logging in from my phone? Logging in from the biz center at some hotel / my friend's phone / etc?

The UX for client certs in browsers makes it a pain to use even as a tech- savvy person; if we want it to actually become popular as a web auth method, it has to start with better UX.

<comment><USER4> To be fair the UX for client side certs is pretty idiotproof once you have the cert installed. You get a "X site is requesting an identity certificate" box. Installing certs is pretty painless too -- you navigate to a certain page and get a "this site is attempting to install a security identification certificate in your browser" box. Securely getting to that page is a different matter.

As for logging in on untrusted devices (biz center, friend's PC, etc)... you shouldn't be doing that under any circumstances in a high security situation.

<comment><USER6> The problem with certificates is that A) it requires the user to install them on every device B) they are required to be installed on every device C) they are a bitch to manage and distribute and D) protection around certificates is fairly weak and any client compromise will lead to the exposure of all credentials.

You also end up delegating the authentication to your transport layer which is never that good of an idea.

<comment><USER7> I think most linux distro's protection of certificate private keys is pretty weak (just storing a .pem file somewhere) and I can't say anything about OSX but on Windows you can prevent the private key from being disclosed even if the user wants to export it and enforce entering a password or PIN each time the certificate is used. Getting access to the physical hardware is about the only way to bypass the CryptoAPI, which is pretty far from 'any' client compromise.

<comment><USER8> You can't actually "prevent the private key from being disclosed even if the user wants to export it" out of box on Windows [if you have an HSM this may be an option although it may also make the keys unsuitable for some purposes]. You can make it _annoying_ which is a stock in trade for Microsoft designs, but attackers don't care about it being annoying. The reason is that the CryptoAPI hands over the keys to an application for it to use (it does not function only as a proxy like say ssh-agent), and so application can export the keys. People even make ready-to-use apps to do this, because, as described above, the CryptoAPI behaviour is annoying.

You can require a password, but that's true for text files on a Linux system too. So why don't most people use a secret password to protect a file with a secret key inside it? Because it's yet more pointless busy work, again a stock in trade of Microsoft environments.

Also, because this is so very annoying you don't need physical access but only console access, which you can of course get remotely, as otherwise administrators of the mountains of Windows servers set up this way couldn't type in all the passwords needed over RDP every day. (If you're lucky they are using an encrypted RDP session to do this...)

<comment><USER7> I agree that CryptoAPI is nasty, but if your key doesn't have the CRYPT_EXPORTABLE flag set when it was created then it can not be exported by CryptoAPI, and can only be accessed maliciously by breaking the CryptoAPI (by patching it in memory, which requires full admin access to a running system) or accessing the OS disk offline.

CryptoAPI does not hand over the key and delegate signing and encryption to the application. Instead, it provides APIs for signing and encryption and does not disclose the private key.

<comment><USER8> > CryptoAPI does not hand over the key and delegate signing and encryption to > the application. Instead, it provides APIs for signing and encryption and > does not disclose the private key.

There is no proxy, they keys live in your process. Because Windows is proprietary they can do the moral equivalent of:

      if (key->flags & CRYPT_EXPORTABLE) {
        export(key)
      } else {
        error_not_exportable
      }

If you did this in OpenSSH, everybody would laugh because they could see it in the source code. "This doesn't make the key unexportable Beavis, you idiot". But in Windows they can solemnly announce that the key isn't exportable and as you've demonstrated, people believe them even though some introspection tells us this can't be true (Where is the key? Like, really, where - it isn't in a proxy because there isn't one... when we load it _our_ process gets bigger and in a debugger we can see it's in our memory, just CryptoAPI tells us we're not supposed to export it...)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Usually this blog is very practical and easy to understand. This post, though, just talks about how great PAKE is and what this new proposal achieves, but not the how of it. It sounds better than client side hashing, but it doesn't explain how (or whether) that's achieved. Actually looking into PAKE is left as an exercise for the reader (other than one screenshot full of math at the bottom).

Wikipedia is actually more clear in this case:

> an eavesdropper or man in the middle cannot obtain enough information to be > able to brute force guess a password without further interactions with the > parties for each (few) guesses. This means that strong security can be > obtained using weak passwords.

Looking into SRP, it seems that a server can still brute force a stored login. While cool, TLS achieves the same goal in popular login systems: eavesdroppers cannot learn anything (in fact, they cannot even make a single attempt at the password, unlike with PAKE). The other advantage of PAKE, the server never receiving the password, can be done with client side hashing (for which I've been advocating for years, as it would have prevented many issues).

<comment><USER10> Client side hashing solves only one aspect of the problem. Effectively, this means a password breach of your service will give the attacker a "password equivalent" that they can subsequently use to log into the service without further cracking. This may or may not be a problem, depending on whether you're willing to lock all user accounts.

Whereas a proper asymmetric PAKE means that even if your password file is breached, the attacker can't use the leaked hashes to log into the service without first cracking each password.

The problem you point out: that password hashes can be brute-force cracked, is unfortunately not a problem we can solve. Consider that a server can always "attempt a login to itself", so given a password database you can always run a dictionary attack. The only thing truly protecting you in that case is the combination of strong passwords and a hard password hashing algorithm. Passwords are fundamentally a drag.

<comment><USER11> [Orthogonally to client-side hashing]

Using a hardware one-way function you can ensure that even if your database is breached or disclosed, attackers cannot brute-force outside of your environment (e.g. the hashed are "anchored" to your systems).

You can construct such a function using something like CloudHSM (pity that KMS cannot be coaxed to be deterministic or you could use that). All you need is an encrypt operation with no corresponding decrypt or way to extract the key.

I'm surprised that more large online services don't use anchoring.

</comment></comment></comment><comment><USER12> I'll shamelessly plug this for Kerberos since SPAKE is a variant of PAKE...

Kerberos has a draft for adding SPAKE to Kerberos: [https://tools.ietf.org/html/draft-ietf-kitten-krb-spake- prea...](https://tools.ietf.org/html/draft-ietf-kitten-krb-spake-preauth-06)

This was implemented sometime around March in MIT Kerberos: [https://github.com/krb5/krb5/pull/741](https://github.com/krb5/krb5/pull/741)

One of the interesting use cases would be to add 2FA support to the Kerberos protocol, but that support is still pending last I checked.

A second draft that is useful for SPAKE would be improved Channel Binding (CBs) support: [https://tools.ietf.org/html/draft-ietf-kitten-channel- bound-...](https://tools.ietf.org/html/draft-ietf-kitten-channel-bound- flag-01)

CBs are still WIP upstream: [https://github.com/krb5/krb5/pull/685](https://github.com/krb5/krb5/pull/685)

Channel bindings allow Kerberos to piggy back on top of an existing encrypted channel (e.g., TLS). When doing 2FA with SPAKE in a browser, this means that we can take advantage of the security guarantees of the TLS protocol by ensuring the value of the final handshake is the same. This is most helpful for SSO-type scenarios.

If anyone wants to comment on either RFC, I'm sure the Kitten WG would be happy to take feedback: [https://tools.ietf.org/wg/kitten/](https://tools.ietf.org/wg/kitten/)

Disclosure: I work closely with several of these folks and worked on the CBs PR.

<comment><USER3> Is there a particular reason to use a symmetric PAKE in this case? Is it somehow not a long-held password?

</comment></comment><comment><USER13> The reason it's not used more often is only because it's _incrementally_ better than salted and memory-hard hashed passwords. It has obvious and important benefits, but still only incrementally better.

It's more important that bad implementations are removed immediately. Personally I'd rather get rid of all of my passwords and use FIDO2 or perhaps even something through touch-id on my iOS/Mac. At this point every password I have is unique thanks to great password managers.

<comment><USER14> >Personally I'd rather get rid of all of my passwords and use FIDO2

FIDO2 should be implemented in many more areas but it shouldn't be exclusively relied on for authentication. Authentication should require proof of person/entity (something you have, a FIDO2 key) and proof of volition (using a password stored in their brain that their will decides to produce/disclose)

<comment><USER15> > their will decides to produce/disclose

Or someone else's will decides to shoulder-surf / keylog the password :)

</comment></comment></comment><comment><USER16> Without digging into this post too much ... is the problem that we don't know the solution, that servers aren't implementing it, that clients (browsers) are limited, or more than one of the above?

To the degree that it's the browsers' limitations, couldn't the browser makers make a standard authentication client (or at least an API) with whatever tech and features are needed? A sandboxed mini-application, hardened, that passes a 'yes', 'no', or 'timeout' to the browser? Not every website would utilize it, but certainly the well-resourced ones could at first (FAANG, banks, etc.) and web server engines, frameworks, content management systems, etc. could incorporate the server side over time. It doesn't seem expensive, and the ROI would seem to enormous - safe authentication over the Internet. But maybe I'm solving the wrong problem?

<comment><USER17> There is such an API. It's called HTTP authentication. No one uses it.

</comment></comment><comment><USER18> For a more technical references check out Dan Boneh and Victor Shoup's cryptography book (pg 789). [0]

For the Gophers out there, I wrote a Go library for doing PAKE [1], which I use for a data transfer utility [2].

[0]: [https://crypto.stanford.edu/~dabo/cryptobook/BonehShoup_0_4....](https://crypto.stanford.edu/~dabo/cryptobook/BonehShoup_0_4.pdf)

[1]: [https://github.com/schollz/pake](https://github.com/schollz/pake)

[2]: [https://github.com/schollz/croc](https://github.com/schollz/croc)

</comment><comment><USER19> I wonder if "Don't do password-authenticated key exchange." is still "Cryptographic right answer"; does OPAQUE address the reservations that tptacek had back in the day

[https://news.ycombinator.com/item?id=9593916#9594731](https://news.ycombinator.com/item?id=9593916#9594731)

<comment><USER20> No, not at all. OPAQUE addresses problems Green has with SRP, not the problems I have.

<comment><USER21> WPA-3 is using a PAKE, ignoring the fact that there are some concerns about the specific PAKE used, do you think a PAKE buys anything in that use case?

<comment><USER3> It's pretty decent for the WiFi use case, but you could actually do something cooler with a symmetric PAKE if your WiFi device had a display. Pick a short random password, copy it over to the client, do SPAKE2. You now have a unique, high entropy secret -- and you have strong guarantees no-one else has that secret (an attacker can guess, but there's a tiny time window for them to do so, and the honest participants are immediately convinced foul play occurred).

As it stands, the PAKE is better than what they had, but not ridiculously better in the way U2F is over TOTP for example.

</comment></comment></comment></comment><comment><USER22> One place where PAKEs are widely deployed is in enterprise wifi networks that use PEAP/MSChapV2 password auth. MSChapV2 is really terrible and basically requires you to store passwords with weak hashes (or in cleartext).

Its nice to hear that there are PAKEs that are not tied to specific password hashing functions.

<comment><USER20> The WPA2 4-way handshake isn't great, but a PAKE actually doesn't do too much --- besides breaking the (slow) dictionary attack --- to operationally improve its security. PAKEs are a good fit for wifi handshakes, if you're starting from zero.

</comment></comment><comment><USER23> Something I've never understood is why we don't hash the password on the client before sending it to the server, and again on the server. This prevents the server from knowing your password (assuming it's a good one) with no real drawbacks that I can see.

<comment><USER24> Because then the hash of the password becomes equivalent to a password - <USER2> malicious actor that learns the hash of the password can just use that to log in to the service (since they can just choose to send it to the server).

<comment><USER23> You're absolutely right. But it means that they can't use the password to build a dictionary, to log in to other services, etc. (Assuming the password is complex enough that the hash isn't reversible)

</comment></comment></comment><comment><USER25> Related and maybe more accessible: [https://00f.net/2018/10/18/on-user- authentication/](https://00f.net/2018/10/18/on-user-authentication/)

<comment><USER26> We have been looking at something very similar (using scrypt and Ed25519) at work for LDAP (SASL) authentication. The primary motivation for us is to move costly password hashing off the LDAP servers.

Our current design is basically the same, but we generate and store a random salt server-side and present that to the client along with the challenge. Using a deterministic salt based on the username and domain is a nice idea - we actually do something similar if the client presents an incorrect username to avoid leaking whether the account exists (we send salt = HMAC(secret, username) in that case).

</comment></comment><comment><USER27> This bit I didn't get:

> The earliest key exchange protocols — like classical Diffie-Hellman — were > unauthenticated, which made them vulnerable to man-in-the-middle attacks.

From Wikipedia ([https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange)):

> The Diffie–Hellman key exchange method allows two parties that have no prior > knowledge of each other to jointly establish a shared secret key over an > insecure channel.

Maybe there's something I'm not understanding, but I thought the point of DH was you could exchange something even when other people are listening. You can see in the example in the article that it does't matter what Eve can see.

<comment> mike-cardwell Without auth, you know you're doing DH, you just don't know who you're doing it with.

If somebody is passively observing/recording the traffic, they wont know what the negotiated shared secret was. However, if they actively insert themselves in the middle, they can negotiate a shared key with you, and another one with the final destination. Then they can decrypt messages from you with the shared secret they negotiated with you, re-encrypt with the shared secret they negotiated with the other party and forward them on.

</comment></comment><comment><USER28> Shout out to SCRAM (RFC 5802) which enables hashed password storage on both the client and the server.

<comment><USER20> Aren't you shouting out to a protocol that is in every material sense worse than a PAKE?</comment></comment>


Australian opposition vows to implement Internet filter by default - <AUTHOR> http://www.zdnet.com/au/australian-opposition-vows-to-implement-internet-filter-by-default-7000020270/ <comment><USER3> As a citizen, this is impossible to fight.

This issue is regularly floated by both "sides" of politics, usually to much criticism (on both technical and moral grounds). It is like the Hydra - <USER2> off one head and it will simply grow two more. This time the policy announcement is especially reprehensible, coming 48 hours before an election which is all but decided in advance and buried in fine-print.

No doubt the new government will announce that it has "a clear mandate" to implement the filter as it was tucked away in their last-minute policy announcements.

<comment><USER4> > As a citizen, this is impossible to fight.

There are several ways you can fight it.

1\. Voting. If you live in New South Wales, Queensland, Victoria or Tasmania, you can vote for the Pirate Party in the Senate on Saturday. If you live in NSW, Victoria or Western Australia, you can vote for the Wikileaks Party. Live anywhere, and you can vote for the Sex Party or the Greens.

2\. Activism. Join one or more of these parties.

3\. Software. Write software that circumvents the censorship.

> This issue is regularly floated by both "sides" of politics

People who think there are only two sides are wrong.

<comment><USER5> There will always be only 2 relevant sides in politics.

If there were 3 or more, then it means that one sides vote is split, and so will not get a majority.

Unless of course you have some wacky proportional representation system.

<comment><USER6> In Australia we have a wacky proportional representation system.

<comment><USER7> Handing seats over to the greens and independents is pretty much why we had a minority government though. The system works on a seat by seat basis, but it doesn't seem to work when forming a government.

Though this election is going to be a landslide for the Libs, and split votes aren't going to have much impact.

<comment><USER8> The system has almost always worked as intended: the Government is formed in the House, which has the monopoly on questions of supply. Because the House is single-member electorates, there has been a clear majority in every election except for 2, including this outgoing Parliament.

The Senate doesn't form the government and cannot originate supply bills, but otherwise has coequal legislative powers. It is elected on a proportional basis.

The system works well because a government can normally form quickly and govern stably, but in order to pass legislation it must give consideration to minority parties in the Senate. You get an Executive that can execute but which must nevertheless be prepared to compromise.

<comment><USER7> Good points, thanks for that. I guess I have thought about the minority government a little too much when it is an anomaly.

I have no problems with the senate. I vote for minority parties (Sex Party last election and this one) because I want protection from the government when required.

<comment><USER8> I basically miss the Democrats. It's a pity that Stott-Despoja killed them by zagging left.

<comment><USER6> "The Democrats died because they zagging left" narrative is one I've heard before, but it doesn't match the facts.

The fall of the Democrat vote mirrors the rise of the Greens vote, and the Greens are _way_ more left leaning than the Democrats ever were.

I think their demise had more to do with internal infighting and the Andrew Bartlett drunk in the senate debacle.

But yes, I miss them too - they were basically a sensible party who wouldn't do stupid things.

<comment><USER8> When she took the party left, the Greens were already outflanking them.

Zagging left cost them the votes they got from Liberal voters.

And that was that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Snuck in less than 48 hours before the federal election, in the media blackout[1] period that immediately precedes it. Disgusting.

1\. [http://www.aec.gov.au/faqs/election_advertising.htm#blackout](http://www.aec.gov.au/faqs/election_advertising.htm#blackout)

<comment><USER10> That is absolutely reprehensible. This is precisely why blackouts are such a bad idea. It turns out they are extraordinarily easy to game.

<comment><USER11> Blackouts don't make much sense in our always-connected world, but I think they should be swapped for "all policy must be announced 7 days out".

If you have no economic policy announced the Saturday before the election then you're going in to the election with NO policy and you're not allowed to talk about what you'll be doing in regard to the economy in that last week.

<comment><USER4> > all policy must be announced 7 days out

What if an event happens 6 days before the election and politicians are asked to comment on it?

<comment><USER11> Sorry, I take my policy queues from Abbott and Turnbull. I haven't really thought it that far through. But if you vote for me I can probably muddle through.

</comment></comment></comment></comment></comment><comment><USER12> Malcolm Turnbull (@TurnbullMalcolm) tweeted at 7:43 PM on Thu, Sep 05, 2013: Policy released today wrongly indicated we supported an opt out system of internet filtering. That is not our policy and never has been. ([https://twitter.com/TurnbullMalcolm/status/37555476615306854...](https://twitter.com/TurnbullMalcolm/status/375554766153068544))

</comment><comment><USER13> And as the article notes, this pledge has been snuck into a document that will be read by few, and released after an "advertising blackout" point has been passed which prevents TV advertising (and thus critical ads) for the final couple of days before the election.

Can anyone explain to me how this isn't a really low move?

<comment><USER14> Oh it's nothing but a low move, introduced by a vile bunch who would prefer Rupert Murdoch controlled all media.

</comment></comment><comment><USER15> [http://www.abc.net.au/news/2013-09-05/no-internet-filter- say...](http://www.abc.net.au/news/2013-09-05/no-internet-filter-says- turnbull/4939156)

They've now backed out on it. No mandatory filter. The report was "poorly worded".

</comment><comment><USER16> According to a radio interview I just heard with the opposition shadow minister Malcolm Turnbull on TripleJ, this is a "software filter" that ISPs will install and enable on "home broadband routers and smartphones" by default, and there will be "no server-side filter".

While this of course sounds terribly stupid, pointless, costly and technically infeasible, it also sounds fairly innocuous as far as these types of proposals go.

It sounds like users would be able to enable/disable it whenever they like, without adding their name to a central database at the Ministry for Censorship (unlike the UK proposal?). He declared that the point was to enable this kind of filtering for people who aren't technical enough to set it up for themselves, and that ultimately the decision and responsibility lies with parents.

In fact, it sounds a lot better than the system the current government (who is of course already criticising this policy) tried to ram down our throats recently.

(Disclosure: I just heard about this policy on the way home from voting early, and the intent of my vote was to benefit the current governing party more than the opposition proposing this system, after my preferred minor candidates are eliminated...I like Malcolm Turnbull a lot, but I don't like his party's policies any more than I suspect he does, at the moment.)

</comment><comment><USER17> Breaking news: on ABC News 24 right now Abbott just said he doesn't support a filter and got the policy wrong.

<comment><USER18> [http://www.abc.net.au/news/2013-09-05/no-internet-filter- say...](http://www.abc.net.au/news/2013-09-05/no-internet-filter-says- turnbull/4939156)

"The correct position is that the Coalition will encourage mobile phone and internet service providers to make available software which parents can choose to install on their own devices to protect their children from inappropriate material."

=== Sounds more reasonable if accurate.

<comment><USER17> It's indeed VERY different to "opt-out" as they had stated. What a mistake!

<comment><USER9> "Mistake". It was likely just testing the waters.

</comment></comment></comment></comment><comment><USER19> The Australian election just keeps on getting better and better. I cannot believe Tony Abbott is actually going to win if the polls are to be believed... I get Kevin Rudd messed up, but I think he was honestly trying his best to right his wrongs after recently becoming leader again. The NBN and the fact Labor aren't for a mandatory Internet filter are two good reasons alone to vote for Labor.

I believe this is Abbott letting his Catholic views get in the way of policy. Much like his opinions on gay marriage and abortion align with that of other Catholics, he's a puppet. And even if Kevin was a puppet, at least he went about hiding it a bit better.

In six months or so people will realise they made a mistake voting for LNP but it'll be too late. Filtering will not only be used to filter adult content, it'll be used to block whatever content Abbott and church/parent groups of Australia want banned. It'll also block legitimate content as the test run of a filter a little while ago actually showed.

This is just the beginning. A filter is nothing compared to what Abbott will be capable of doing in his position of power. He is hell-bent on proving a point by rescuing the economy by taking dirty lobbyist money in exchange for a few lax laws and blocked sites here and there.

</comment><comment><USER20> Danger will robinson! This is internet censorship. Going down the slippery slope of restricting free speech on the Internet.

Is it that the politicians themselves who can't stop surfing to those adult sites and want to stop it by censoring it for everybody?

</comment><comment> ryan-allen Wait nope! They're backtracking [http://www.abc.net.au/news/2013-09-05/no- internet-filter-say...](http://www.abc.net.au/news/2013-09-05/no-internet- filter-says-turnbull/4939156)

</comment><comment><USER21> There is already a filter in place. It was utilised most recently earlier this year. ASIC maintains a database of fraud/scam websites, and blocks them so as to minimise the impact on unsuspecting victims.

"The Federal Government has confirmed its financial regulator has started requiring Australian Internet service providers to block websites suspected of providing fraudulent financial opportunities, in a move which appears to also open the door for other government agencies to unilaterally block sites they deem questionable in their own portfolios." ([http://delimiter.com.au/2013/05/15/interpol-filter-scope- cre...](http://delimiter.com.au/2013/05/15/interpol-filter-scope-creep-asic- ordering-unilateral-website-blocks/))

And direct press release from ASIC: "ASIC has already blocked access to these websites."

[http://www.asic.gov.au/asic/asic.nsf/byheadline/13-061MR+ASI...](http://www.asic.gov.au/asic/asic.nsf/byheadline/13-061MR+ASIC+warns+consumers+about+Global+Capital+Wealth?openDocument)

</comment><comment><USER22> Will they cut with the porn bullshit we all know this is all about power and controlling what people can see. Once a filter is set up it's very easy to block any website they want. Porn/sex shouldn't be taboo to begin with it's how we all got on this planet. I grew up on the internet without filters and I'm happy to report I'm just fine stop filtering my shit.

<comment><USER23> Once the filter is setup its free political muck to ask a politician if their home connection is "opted in to pornography".

</comment></comment><comment><USER24> Looks like they've just posted a correction:

[http://www.liberal.org.au/latest- news/2013/09/05/coalitions-...](http://www.liberal.org.au/latest- news/2013/09/05/coalitions-policy-enhance-online-safety-children)

Sweet Jesus....playing it fast and loose with freedom of expression just hours before an election.

</comment><comment><USER15> "The Coalition said it would work with mobile phone operators to install the filters onto handsets."

Yeah, that's going to happen.

</comment><comment><USER25> It's so easy to convince someone who understands nothing about how computers and the Internet works that "filtering out (child) pornography" is a good thing, easy to do and won't cause any collateral damage.

I wonder if all these spying scandals and the rise of censorship in the West will lead to an noticeable increase in the size of tor/i2p/...

<comment><USER26> What is needed is a simple "throwing the baby out with the bathwater" analogy that effectively communicates how it's a) impossible to effectively filter out such things and b) how easy it is to abuse said filters once they're in place.

Maybe something using cars? =P

<comment><USER25> Unfortunately, for the vast majority of voters (or people in general), counter arguments don't really matter if they liked what they heard in the first place. Then they just think "what you're saying makes things more difficult, I'd rather not hear it".

<comment><USER26> Don't forget the studies implying that, when presented with evidence to the contrary, people will hold their original beliefs _stronger_. The more I learn about everything, the less certain I am about anything; I wish more people were the same.

The idea is to come up with a metaphor that is as short and sweet as it is compelling. As much as the idea of "selling" truth disgusts me, we need to "market" the unpleasant realities of a filter as effectively as politicians have sold the lie of it being "for the children" in order to have a fighting chance of preventing it.

<comment><USER25> I hadn't heard that before, can you provide any reference or source for this? I think I'll need it in future discussions :)

<comment><USER26> > when presented with evidence to the contrary, people will hold their > original beliefs _stronger_

Actually Googling my phrase seems to give pretty good results -- descriptive powers FTW! :D

The name for it appears to be "the Backfire Effect", classed as a type of cognitive bias:

[https://en.wikipedia.org/wiki/Confirmation_bias#Backfire_eff...](https://en.wikipedia.org/wiki/Confirmation_bias#Backfire_effect)

[http://www.skepdic.com/backfireeffect.html](http://www.skepdic.com/backfireeffect.html)

<comment><USER25> Thank you!

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> And now the would-be communications minister, Malcolm Turnbull, has said it's all a big misunderstanding: [https://twitter.com/TurnbullMalcolm/status/37555476615306854...](https://twitter.com/TurnbullMalcolm/status/375554766153068544).

<comment><USER26> "Oops, turns out people were actually paying attention... and they really didn't like it... quick! Backpedal!" Classic.

</comment></comment><comment><USER27> I've lost count of the number of times various parties have tried to implement Internet filtering in Australia. It almost seems to be a seasonal cycle, whereby some legislation gets proposed/approved, the IT industry and civil liberties advocates explain why it's both wrong and can't work, and then it sort of fades away from view.

Both sides have said everything they have to say on the issue. I'm of the belief that it's only for point scoring with various conservative groups that the idea even continues to be floated. I think even Tony Abbott (the opposition candidate and almost-certain victor) probably understands how it can't possibly be made to work but is just going along to placate certain segments of the electorate.

<comment><USER26> A cycle! Seriously! I recall when I used to browse Slashdot a few years ago, all you would ever see tagged "Australia" was censorship and filter proposals. Not a good look for Australia.

Let's hope that you're right and they're not actually ever taking it seriously.

</comment></comment><comment><USER14> Well they snuck this in at the last minute hoping no one would notice and their supporters would be too dumb to care... Based on current opinion polls sadly good assumptions. Add this to killing the NBN as another stake in the heart of our digital future...

</comment><comment><USER28> "The filter will be contained in software installed in either people's smartphones or modems ... which can be disabled at their option." \- Malcolm Turnbull (Liberal party shadow communications minister) on Hack[1] tonight.

Fucking scumbags.

48 hours before we go to the polls.

And apparently they plan on _hacking our devices_ in order to implement it? They have no clue.

[1] 27:05 at [http://mpegmedia.abc.net.au/triplej/hack/daily/hack_thurs_20...](http://mpegmedia.abc.net.au/triplej/hack/daily/hack_thurs_2013_9_5.mp3)

<comment><USER26> To be fair that was probably just an ad-libbed statement by a politician who has absolutely no clue how software and filters work.

Politician: "It'll be like an iPhone app, only somehow mandatory, right?" IT Consultant: "Uh... kinda sorta..."

</comment></comment><comment><USER29> Someone needs to start doing version control systems for legislative bills and documents in governments everywhere. Most lawmakers are ugly sneaks and we will need to watch their every move.

<comment><USER26> I don't know if this would really fix anything, but it sure would be awesome to see the one-line pork additions to a bill tied directly to a Senator's name.

<comment><USER30> If only we had "git blame" for legislation.

</comment></comment></comment><comment><USER24> To anyone not familiar with the Australian Constitution, we do not have a bill of rights and no explicit guarantee of freedom of expression. (AFAIK freedom of expression is an implied right [http://en.wikipedia.org/wiki/Australian_constitutional_law#F...](http://en.wikipedia.org/wiki/Australian_constitutional_law#Freedom_of_political_communication)).

<comment><USER26> This blew me away when I first heard about it. My favorite WTF example of the AU government trampling on freedom of expression? The banning of a TV ad arguing for the legalization of voluntary euthanasia[1], and, even more alarmingly, the "crime" of using a "a telephone, fax, email or the internet to discuss or research assisted suicide."[2]

[1]: [http://www.theage.com.au/national/proeuthanasia-tv-ad- ban-a-...](http://www.theage.com.au/national/proeuthanasia-tv-ad-ban-a- violation-of-free-speech-20100912-1570f.html)

[2]: [http://www.theaustralian.com.au/news/suicide-drug-of- choice-...](http://www.theaustralian.com.au/news/suicide-drug-of-choice-in- mail/story-e6frg6no-1111119129660)

</comment></comment><comment><USER26> The Australian government is always threatening to implement draconian filter, censorship, or data-logging plans; luckily, in true government form, they never carry through on it.

It's a pity that such things are the only exposure the tech crowd has to Australia, instead of more compelling things like the massive and ambitious National Broadband Network fiber-to-the-home infrastructure project.

<comment><USER31> > fiber-to-the-home

Or, as it will be known on Saturday evening: copper to the "good luck with that".

<comment><USER32> That's the thing that puzzles me. Fast internet benefits businesses more than residents, and it's the 'business party' that's against it.

A colleague says that there are Murdoch's hands in the till on this one, given that fast internet threatens his TV offerings.

<comment><USER7> WE NEED TO CONTROL THE SPENDING!!!!!!!!!

That's basically all it comes down to. Not enough people care about what a fast network can do for the country, and they've been brainwashed to think that the economic management of the last few years has been appalling.

It's really really strange. People all of a sudden seem to give a shit about how much we are spending and think it's a bad thing, when every economic commenter has said it's been managed brilliantly. It looks like a lot of people are trying to be smart and are failing hugely.

<comment><USER26> Well it doesn't help that all those pits have asbestos in them -- but that's not the project's fault. That would have to have been cleaned up eventually anyway.

It's the same problem the US has IMO: no one wants to support grand, forward- looking projects that are going to take longer than a term in office. That's why poor NASA has its funding yoyo-ed around a 4-year presidential election cycle, and can't ever follow through on the bigger projects anymore.

</comment></comment></comment></comment></comment><comment><USER33> As a human being I am angered by these rapid advancements of Internet censorship in the developed world.

As someone in the business of circumventing said censorship I am excited to have the solvent westerners as my clients in additional to generally poor third-world folk we are currently serving.

</comment><comment><USER34> Looks like someone started a petition! [https://www.change.org/petitions/liberal-party-of- australia-...](https://www.change.org/petitions/liberal-party-of-australia- stop-the-internet-filter)

</comment><comment><USER35> Who is next: Canada, New Zealand, USA ?

Make sense, this 5 Countries work really close together, as we know it from PRISM.

</comment><comment><USER36> Ugh... we're stuffed.

</comment><comment><USER37> That was quick. Looks like they've backflipped on it already.

</comment><comment><USER38> Clearly, vote Wikileaks.

<comment><USER39> Wikileaks preferenced One Nation ahead of the Greens, Labor and Liberals in the senate. Since the final senate seat will likely come down to One Nation / Greens in 1 or more states, the only effective outcome of voting for them is a vote for One Nation.

<comment><USER40> Only if you vote above the line. I prefer to nominate all my own preferences, thanks. It's not hard.

<comment><USER39> Only 3.8% of voters vote below the line. At least 95% of Wikileak's votes will go to One Nation.

And then there's the question of why the hell you would support a party that does this sort of shit. The only thing they will ever do is appear on a ballot and distribute their preferences, and they can't even do that well (I mean assuming you wouldn't want to vote for One Nation... if you do, then go ahead).

Edit: I got mixed up. Replace One Nation with the "Australia First" party (even worse IMO... look them up) and the shooters and fishers party.

</comment></comment></comment></comment><comment><USER41> I point my finger at you and laugh, Australia.</comment>


Building a Hacker Space (2007) [pdf] - <AUTHOR> https://events.ccc.de/congress/2007/Fahrplan/attachments/1003_Building%20a%20Hacker%20Space.pdf <comment><USER2> We've been building Tampa Hackerspace for the past four years and much of this is similar to advice I give.

The "ten people" to start is close. I tell people you need at least 100 in your broader community and at least 10 committed to the point that they'd put money into it. More is better though.

We probably would have started a year later if we hadn't had a firm "just do it" person on the board.

We got lucky with our initial landlord and very lucky with our current landlord. Everyone we talked to would tell us how easy it would be to find space but it was a huge hassle finding someone that would rent to an unproven organization without much cash on hand.

Using recurring billing via Paypal (now considering Stripe) was a huge help.

Of course we meet on Tuesdays. It's been painful but we meet every single Tuesday. There's never any confusion about whether we meet this week or next week. Every Tuesday.

The "Sine Curve" pattern worries me and I can definitely see some of our shops / areas becoming cyclical.

</comment><comment><USER3> Don't be everything to everyone, it's unsustainable. Have a clear mission and stick to it. Know what a hacker space is: it's not a startup incubator, even though it's easy to confuse the two.

I dropped out of a hacker space when they took on too many financial commitments. They thought they needed to expand because they were operating as a pseudo startup incubator for 1/4th the price. The problem was once they started to grow, they needed to meet ADA requirements. Dues that were fine for a hacker space just didn't pay the bills when suddenly the new crop of members were showing up everyday and had high impact needs.

It would have been fine to run a real incubator in the same building with a different membership fee structure so that things like ADA and conference rooms would be there for those who needed them.

The problem was ultimately that the organization ran itself in an everything for everybody mode. No one really put on the brakes when an expansion didn't make sense for what the organization did.

</comment><comment><USER4> I think I found a link that works:

[https://wiki.hackerspaces.org/images/8/8e/Hacker-Space- Desig...](https://wiki.hackerspaces.org/images/8/8e/Hacker-Space-Design- Patterns.pdf)

<comment><USER5> The OP's link is from Dec 27, 2007, while this link is from Aug 2007.

The actual presentation from 24C3 is available at [https://www.youtube.com/watch?v=8lywXCZogsg](https://www.youtube.com/watch?v=8lywXCZogsg)

</comment></comment><comment><USER6> I would add a recommendation for Peter Hook's book, "How Not To Run A Club" as a cautionary tale. In it, he's talking about how to run a dance club, but the things he mentioned impacting his club were the same as those that I saw impacting my local hacker space. The biggest one is the cash-flow. People open a club because they want to be with their friends, and friends get friend- prices. Before you know it, everybody's your friend and nobody's paying for anything.

My club had fees for things like project storage and certain consumables, but they were _terrible_ at collecting these fees. ja27's recommendation to outsource that billing to Paypal or Stripe is a very good idea, in my opinion. Certainly the "totalitarian treasurer" in the presentation seems like a hard requirement in my mind.

[https://www.amazon.com/Hacienda-How-Not-Run- Club/dp/00623079...](https://www.amazon.com/Hacienda-How-Not-Run- Club/dp/0062307959/)

</comment><comment><USER7> Getting an expired certificate error.

<comment><USER8> Ditto.

"This server could not prove that it is events.ccc.de; its security certificate expired 42 days ago. This may be caused by a misconfiguration or an attacker intercepting your connection. Your computer's clock is currently set to Monday, December 25, 2017. Does that look right? If not, you should correct your system's clock and then refresh this page"

</comment></comment><comment><USER9> I think it's really cool when people build anything, there's a small odd change in reality forever. Anyone else find themselves scanning the PDF looking through just the photos?

Thanks for sharing this.

</comment><comment><AUTHOR> I like the Tuesday Pattern a lot!

<comment><USER10> All the spaces I'm familiar with follow the Tuesday pattern. It's sort of funny.</comment></comment>


On Goldman - <AUTHOR> http://www.fivethirtyeight.com/2010/04/on-goldman.html <comment><USER2> Here's a point I haven't seen made elsewhere:

 _Sixth -- how will Goldman defend themselves? The standard defense when two parties to securities litigation are "sophisticated investors" is to argue the parties were essentially big boys and knew the risks. That defense isn't possible in this case, largely because of the statute employed. This case comes down to whether or not Goldman lied -- period. Either they did or didn't misrepresent facts. The financial standing of the purchaser of the security is irrelevant. Goldman's only defense is to somehow demonstrate they did not lie about the transaction. Given the complaint filed, I don't see how that argument is possible._

Since the "big boys" argument has been frequently cited -- it's basically the "caveat emptor" defense running through most threads about the case including this one -- it's worth noting that if this guy is right, it's irrelevant.

</comment><comment><USER3> [http://crookery.blogspot.com/2010/04/nasty-derivatives- tale....](http://crookery.blogspot.com/2010/04/nasty-derivatives-tale.html)

This is an example of committing the same crime Goldman has allegedly committed. You'll notice that if you're an accredited investor, you can call your broker up right now and do this. In act, if you do much options trading, you may have already more or less done it.

<comment><USER4> At what point in that story did the bank lie about who specifically had assembled the reference portfolio? In other words, where's the parallel with Goldman using ACA as a marketing tool and shield?

</comment></comment><comment><USER5> The crux of the complaint is weather GS lied or not. But what are they supposed to have lied about? If they were selling this fund/instrument/collection of bonds to third parties, by definition there must be a short on the other side - someone has sold the instruments into the fund. So what?

<comment><AUTHOR> The heart of the case is that they were selling a product as being composed of a high-quality mix of mortgages likely to produce positive returns while simultaneously working to engineer the actual content of the CDO to be almost exclusively bad debt unlikely to avoid default.

It's like a real estate agent knowingly selling you a house with a mold problem. Or maybe more like a developer selling houses that had been constructed with substandard materials.

<comment><USER5> at the risk of soliciting downticks, caveat emptor surely? It's not like the underlying instruments were not known.

Edit: I can't believe Goldman really said - here's a basket of triple A's, when in fact they were junk. Expressing an opinion on whether they were likely to go up/down is a different matter. Of course a salesdesk is going to promote the investment in positive terms.

<comment><USER4> Your incredulity aside, they absolutely did say that, or at least they convinced the ratings agencies to say that. That wasn't the lie, though - according to the (horribly broken) models, they were AAA (or whatever rating is in question).

The lie was that the package of underlying mortgage bonds was selected solely and independently by a 3rd party who had an interest in putting together a quality instrument, when in fact Paulson played the major role in the selection.

<comment><USER6> He played a role only to the degree ACA allowed him to and failed in it's fiduciary duty.

<comment><USER4> Okay, fine, ACA sucks. But Goldman still knowingly lied about who was involved in selecting the reference portfolio.

</comment></comment></comment></comment></comment></comment><comment><USER7> Does a same law exist for lying about massive destruction arms ?</comment>


Vermont utility says it will be the first to install Tesla powerwalls in the US - <AUTHOR> http://arstechnica.co.uk/business/2015/12/vermont-utility-says-it-will-be-the-first-to-install-tesla-powerwalls-in-the-us/ <comment><USER2> This seems to be the most important bit, but Ars skip over it:

 _Or, a GMP customer can buy a Powerwall outright for $6,500 and share access with GMP, receiving a $31.76 monthly credit, which a GMP press release says "represents the value of leveraging the battery to help lower peak energy costs."_

So this utility (which is generally progressive compared with their peers) is acknowledging that people having energy storage in their home is a benefit to the utility, and are even prepared to put a price on that.

There's a parallel battle going on with rooftop solar, with some utilities paying money for the value they recieve from this which is above the consumer cost of electricity in many cases, and other utilities trying to shut down users by imposing fees to cover the costs they claim they are incurring.

<comment><USER3> More likely they just want to be seen as hip and serving their customers as a single unit isn't going to going to let you run your house fully during an outage and buying multiple units to support a power user typical wattage need and who else besides those types are buying into this?

It might be good for time shifting expensive electrical rates but where in America is that going to happen?

I don't think they see value in home storage of power, first off the amount stored is way way WAY too minuscule if you look at it from a grid perspective. If you wanted efficient, safe, and reliable, battery storage the utility or an independent would be better off setting up a dedicated facility for it. Even if just a series of boxes at the front of a subdivision/apartment complex the manageability goes up a lot.

tl;dr utility company just riding the cool wave as it really doesn't benefit their consumers. far better options than relying on small storage spread across private homes

<comment><USER4> It happens all over the place. The problem with electricity is that the marginal cost of adding capacity to the grid is very expensive, and you only hit peak capacity a few days a year.

For a decade or more New York has paid commercial and industrial customers something like $50M to shut down capacity on demand in exchange for lower electric rates.

Doing that delays or avoids $500M investments in power plants. Time shifting and solar build on this idea.

If you live in the boonies where power interruption is routine, partial power preservation means your fridge, well pump and heat continue to work. You don't need to worry about frozen pipes in the winter when your on vacation or lost groceries after a thunderstorm in the summer.

<comment><USER5> This is called "Demand Response".

[https://en.wikipedia.org/wiki/Demand_response](https://en.wikipedia.org/wiki/Demand_response)

[http://energy.gov/oe/technology-development/smart- grid/deman...](http://energy.gov/oe/technology-development/smart-grid/demand- response)

[http://www.enernoc.com/our-resources/term-pages/what-is- dema...](http://www.enernoc.com/our-resources/term-pages/what-is-demand- response)

</comment></comment></comment></comment><comment><USER6> That is an interesting article in many ways:

1\. Elon Musk announces the PowerWall in April with delivery end of 2015 (still on the site).

2\. SunEdision announces end of September to deliver the first PowerWalls in Australia by November: [http://cleantechnica.com/2015/09/22/sunedison- australia-taki...](http://cleantechnica.com/2015/09/22/sunedison-australia- taking-delivery-tesla-powerwall/)

3\. SunEdision will partner with LGChem to deliver a competing product: [http://seekingalpha.com/instablog/14040502-tom- collins/44245...](http://seekingalpha.com/instablog/14040502-tom- collins/4424576-lg-chem-sunedison-just-leapfrogged-tesla-solarcity-in- distributed-storage-but-partner-eguana-tech-are-the-real-story)

4\. Vermont utility announces to be the first with 10 PowerWall beginning January 2016.

So, why there are no PowerWalls available? Seems that there are production issues.

<comment><USER5> > So, why there are no PowerWalls available? Seems that there are production > issues.

Because production is starting up, with equipment being moved from Fremont.

[http://cleantechnica.com/2015/11/04/tesla-gigafactory- ahead-...](http://cleantechnica.com/2015/11/04/tesla-gigafactory-ahead-of- schedule-production-beginning-in-q4/)

</comment></comment><comment><USER7> I believe the article author confuses the pricing. As presented I'm guessing the price quoted by GMP includes the inverter, while the price given by Tesla does not.

side note: original article appeared on arstechnica.com [http://arstechnica.com/business/2015/12/vermont-utility- says...](http://arstechnica.com/business/2015/12/vermont-utility-says-it-will- be-the-first-to-install-tesla-powerwalls-in-the-us/)

<comment><USER6> Which is clearly written in the article as you may have read along:

> Now, according to GMP, buying a 7kWh Powerwall outright will cost $6,500, > including the inverter and the installation fee.

</comment></comment><comment><USER8> There is lot of potential out there for retrofitting used Car battery to wall mounts. That is the approach, I would be more interested. Has Tesla reused any of its roadster batteries that have gone stale in wall mounts? Does Tesla as a company has a plan for having old roadster batteries along with Model S etc. to convert into home batteries in the future ?

<comment><USER9> 80% of the power-wall business is expected to be industrial installations, not home installations. Big installations like that are a much better home for "tired" batteries - a homeowner cares about their 7kWh, a business with a 500 kWh install might not mind if 1/3 of it was used batteries with 1/2 max capacity.

And yes, Tesla's been talking about that for more than a decade.</comment></comment>


The Language and Writing System of MS408 (Voynich) Explained - <AUTHOR> https://www.tandfonline.com/doi/full/10.1080/02639904.2019.1599566 <comment><USER2> See [https://news.ycombinator.com/item?id=19917166](https://news.ycombinator.com/item?id=19917166)

</comment><comment><AUTHOR> Another article on the subject

[https://phys.org/news/2019-05-bristol-academic-voynich- code-...](https://phys.org/news/2019-05-bristol-academic-voynich-code-century- old.html)</comment>


Ask HN: Finding a Technical Co-Founder - <AUTHOR> Hey, I'm Andrei, technical co-founder of Scrumbs and boardme.
Links:
https://www.boardme.app - Under development
https://www.scrumbs.app - Alpha launched a couple weeks ago
I was wondering where is the best place to search for technical co-founders. I'm fiddling with the idea of bringing somebody in for boardme.
Our small team is composed of 3 members: Ildiko (UI/UX), Bryan (Marketing) and I (Dev).
We started out with 4 members in January, we had a font-end guy, but he deserted a couple weeks in. Which needless to say made the past 7 months of my life a bit tricky.
Did you have any luck with finding technical co-founders? If so, where and how? <comment><USER2> What's your requirements for technical co-founder? What is boardme's stack? If i am a customer, why should i choose boardme?

<comment><AUTHOR> Hey thanks for your message, answers below.

1\. What's your requirements for technical co-founder?

Should love front-end technologies and making beautiful interfaces functional. We're really into this stuff, we're looking for somebody to share our obsession. Javascript, Typescript and SASS are the main tools they would be working with.

2\. What is boardme's stack?

Client: HTML, SASS, Typescript, Webpack etc.

Backend: Node, Typescript, Express, Mongo, etc.

Infra and automation: Ubuntu, Docker, Swarm, Jenkins

3\. If i am a customer, why should i choose boardme?

I will not sell you on the value of customer onboarding, because that just speaks for itself in 2019. If there weren't tremendous value to it, you wouldn't see every big name in the software industry implementing it. In fact, the truth is you would have to search really hard to find an example of a successful application that is not leveraging it.

It is crucial to the success of your application, but at the same time it is a feature that the users come across rarely during their lifespan as an active user. The effort and expense it takes to implement and maintain it remains the same though. Thousands of dollars or lots of manhours.

So I will instead propose this. Instead of spending a lot of time coding and debugging your onboarding solution, or spending thousands of dollars to outsource the development and maintenance, you could use boardme to set up your onboarding with a few clicks, and for a fraction of the cost.</comment></comment>


Show HN: Search engine for lectures - <AUTHOR> https://www.findlectures.com/ <comment><USER2> The idea is really good, but there is still a long way to go.

Searching for "python simulation" (a suggested search, btw) yields results such as "introduction to programming lecture 23" \- short of watching the lecture, how am I supposed to judge it's relevancy? There is no description, and the title contains neither "python" nor "simulation".

Also, the email sign up modal is enough to not make you want to return.

<comment><AUTHOR> Thanks for the feedback. The email thing should be better now.

Agree on the relevancy issue, I'm working on ways to improve that. If you do a search that matches the closed captions, it will tell you where in the video the match starts.

</comment></comment><comment><USER3> On mobile,

The email modal is over most of screen and can't be closed...

<comment><AUTHOR> Really sorry about that. I pushed a change to hide it when it doesn't fit.

That area of the screen is supposed to be an informational card, like you see in Google search results. When I have the data, it shows books a speaker has written, and I'm working on getting more in there.

</comment></comment><comment><USER4> I tried to look for some math topics, such as "harmonic analysis", "lie algebras" and "model theory" \- unfortunately none of the matches were relevant for any of the queries

<comment><AUTHOR> Thanks, I'll look at adding some math classes.

</comment></comment><comment><USER5> Hey this is pretty cool! I looked for a specific CS topic and the result was definitely better than Google's. I'll probably keep using this!

</comment><comment><USER6> Looks interesting. As someone going through all of Dr Jordan Peterson's lectures, I put him in the search and only one of his talks (with Joe Rogan) came up. Please add his stuff if you get the chance (he has a YT channel). It'd also be nice to be able to find like-minded talks.

Also, when pressing the back button through some searches, the URL changed with me but the results stayed the same.

<comment><AUTHOR> Thanks for the feedback!

</comment></comment><comment><USER7> As someone who does a lot of learning online, I can see the usefulness of this! It'd be a lot easier for me to use if the filters on the side of the screen if they matched my search queries more closely. Currently, searching for "react.js vs. angular.js" leads to Ronald Reagan and Bill Clinton being options in the "speaker"filter.

<comment><AUTHOR> Thanks! I think you'll get a better experience if you filter to "Technology" first, if you're using it that way. I'd like that to be more seamless, but haven't found a good way yet.

</comment></comment><comment><USER8> Just curious, is this using React/Searchkit/Elasticsearch under the hood?

<comment><AUTHOR> It's a custom React UI + Semantic UI + D3 + Solr. If I had found Searchkit when I started this a year and a half ago, I would have used it!

</comment></comment><comment><USER9> It shows ApplicationError. Got a HN hug of death, or are you updating?

<comment><AUTHOR> Sorry, looks like a memory issue on the Solr server. I shut everything else down, so hopefully it holds!

</comment></comment><comment><USER10> Good initiative. Suggestion: The content could be categorized.For example - the lecture of MOOCs should be at one place.

Problem: Say, I am browsing page 5 for some query and I change the query, it shows page 5 of the current query rather than page 1 and if the content of current query is not enough to reach page 5, it shows "No results found, sorry!".

<comment><AUTHOR> Good feedback, thanks.

</comment></comment><comment><USER11> Great project Gary. Thanks for sharing (and building). I would love to see this kind of content get some love.

<comment><AUTHOR> Thanks! I'm getting a ton of good feedback and lots of speaker recommendations, so the next version should be even better!

</comment></comment><comment><USER12> Interesting project, but as op said email modal on mobile can't be navigated out of.

<comment><AUTHOR> Sorry about that, it should be fixed now.

</comment></comment><comment><USER13> Great project, thank you for your time!

(minor bug: Searching for "top 20%" results in "URIError: URI malformed /public/lecture_search.bundle.js?v=1.0.22:79346")

<comment><AUTHOR> Thanks, I will look a this!

</comment></comment><comment><USER14> Nice! That's going to be very useful when learning a new topic/technology

How are the hits ranked? I imagine just time? Do you have a list of all sources you used?

<comment><AUTHOR> There are about 20 factors right now, which I've been tuning over time. They are applied as I'm able to get the data for the talk. Here is a selection-

1\. Is the publisher of the talk good? (whitelist)

2\. Is the talk referenced in social media (e.g. HN)

3\. Safe for work (i.e. you could use in a lunch and learn)

4\. Length (15-50 minutes preferred)

5\. Is the speaker a keynote level speaker?

6\. Are there closed captions? Can the video be embedded?

7\. How often does the speaker say 'um' (or similar)

8\. Is the talk in English (there are some in Russian and Arabic, but only small collections)

9\. Are there notable audio quality issues (channel balance)

10\. If it's a historic talk, older talks get higher ranking

11\. If it's a technical talk, these get lower ranking, unless you filter to that

12\. Is the speaker influential enough to have a wikipedia article?

13\. Has the speaker written books?

14\. What is the role of the institution that sponsored the talk (conferences are neutral, think tanks, etc lose some ranking)

</comment></comment><comment><USER15> I think a language filter would still be good.

</comment><comment><USER16> Great resource but your filtering needs some serious work. I managed to filter myself into a corner with no way to get back.

<comment><AUTHOR> Thanks for the feedback - I'll look into fixing that.

</comment></comment><comment><USER17> Pagination doesn't seem to be working, I need to change the URL to go to page 2 and so on when filtering a cathegory.

<comment><USER17> e.g.: [https://www.findlectures.com/?p=1&class1=Technology&category...](https://www.findlectures.com/?p=1&class1=Technology&category_l2_Technology=-Machine%20Learning)

<comment><AUTHOR> Sorry about that, I will look into this.

<comment><USER17> Thanks! Great site!

</comment></comment></comment></comment><comment><USER18> Really interesting, are you searching through Youtube? Wonder what other sources that you are getting the source data out of

<comment><AUTHOR> I'm collecting lists of speakers/conferences and doing very targeted crawling. There are a couple essays on the site (in progress) if you're interested in more detail-

[https://www.findlectures.com/articles/2017/05/15/Building-a-...](https://www.findlectures.com/articles/2017/05/15/Building- a-Crawler-in-Node-JS/)

</comment></comment><comment><USER19> this is awesome. thanks!!

obviously a huge undertaking probably not in your wheelhouse- but finding a way to map all these topics together would be amazing.

<comment><AUTHOR> I'm not sure if this is what you mean, but looking at ways to map concepts together with word2vec. E.g. so you could search "writing NOT code" and get literature, or facets more conceptually related to search results.

<comment><USER19> interesting but i was thinking more of a Khan-style mindmap: [http://2.bp.blogspot.com/-ChwlFfoI4TE/TtEl5UA1AkI/AAAAAAAAAe...](http://2.bp.blogspot.com/-ChwlFfoI4TE/TtEl5UA1AkI/AAAAAAAAAeI/MCR3dwjo8xc/s640/Khan2.png)</comment></comment></comment>