One of the Biggest At-Home DNA Testing Companies Is Working with the FBI - <AUTHOR> https://www.buzzfeednews.com/article/salvadorhernandez/family-tree-dna-fbi-investigative-genealogy-privacy <comment><USER2> Few people taking theses tests understand or care about the privacy-destroying effect of what they're doing to themselves and their families.

For example, this is from the AncestryDNA (different company) terms of service:

 _By submitting User Provided Content to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a perpetual, royalty-free, worldwide, sublicensable, transferable license to host, transfer, process, analyze, distribute, communicate, and display your submission for the purposes of providing Ancestry 's products and services, conducting Ancestry's research and product development, enhancing Ancestry's user experience, and making and offering personalized products and services._

[https://www.ancestry.com/cs/legal/dnaterms_2017_09_22_us?hid...](https://www.ancestry.com/cs/legal/dnaterms_2017_09_22_us?hideHeader=1#Term3)

There's a feel-good statement elsewhere in the document about how the company won't disclose your info to third parties, but this grant of rights pretty much covers anything you'd want to do with a DNA sequence.

Privacy policies change, but grants of rights like this to a service like Ancestry are forever.

I imagine a future in which every casual DNA company has been hoovered into a single powerful corporation. All those rights granted by users will transfer to that new company. That company will be just as mean as Facebook (or Microsoft in its heyday), but 10x more powerful.

<comment><USER3> >what they're doing to themselves and their families.

This only encourages me. My DNA is on record in various places, and if any relative of mine commits a crime I want the honor of being the person who fucked them and sent them to prison. I would tout the event as an esteemed accomplishment.

Everyone seems to be worried about a sci-fi movie where clones are made from cheek swabs or corporations use DNA to deny certain services.

The former is a pipe dream and the latter is already (partially) illegal in the US via the Genetic Information Nondiscrimination Act of 2008.

If evilmegacorp is going to break the law today then they'll break it tomorrow as well.

Every conceivable scenario in which DNA can be used to harm an individual can be answered with "well a bad actor can already do that today using different methods".

As far as I'm concerned a database of DNA is no different than a database of mugshots or fingerprints.

Mugshots and fingerprints have both led to false-positives being reported.

"Oh but DNA might lead to a false-positive so it must never be used" differs little from "eyewitness testimony, mugshots, fingerprint analysis, confessions, and every single investigative technique ever used in the history of humanity has unassailably led to false positives therefore they should all be banned".

<comment><USER4> As a German, I see many problems with this point of view. What is a crime can change fast, and it can also mean just being of the wrong group. Don't think it can't and won't happen again.

<comment><USER5> Exactly. People who proudly tell you that they have nothing to hide never seem to understand that _they_ aren't the ones who decide whether or not they have something to hide.

</comment></comment></comment></comment><comment><USER6> The term "At Home" is very disingenuous. Spitting in a tube at home and then mailing your DNA to a lab is not At Home. A proper at-home test would be a kit that allows you to decode your DNA at home without a single strand DNA or byte of data landing on a system that does not belong to you.

<comment><USER7> How long until this is feasible? I've heard of DNA sequencing machines for $2k, but are not easy or reliable.

<comment><USER6> I would gladly pay $2k to keep my data at home. To me, that is much cheaper than what it would cost to remove genetic data from multiple corporations and governments, if that is even feasible.

<comment><USER8> a genome is useless without a huge set of algorithms and datasets to analyse the genome

<comment><USER6> Agreed. That needs to be open source code, checked into a public repo with instructions that the average person can follow.

After a few years, I would expect that code to run on the device that enumerates the DNA.

Perhaps a RasPi with a daughter card or USB device that reads the DNA, similar to blood sugar testers.

</comment></comment></comment></comment></comment><comment><USER9> I am torn on this, as on the one hand it does violate privacy to a very large degree and provide massive power to the government. Things I am very much against.

On the other hand, essentially all this does is provide law enforcement a means to potentially quickly identify violent criminals via physical traits as opposed to the contents of their mind such as forcing someone to unlock a phone which I am very against.

Assuming DNA technology is advanced enough to provide few false positives (which I am not sure it is) and prosecution is based on additional concrete evidence as well I think I am fine with this. I am not ok with this being accepted as all that is needed to bring charges but as a means to narrow the suspect pool.

If the company did not disclose this in massive font to potential customers ahead of time, then I do think this company should very quickly go out of business.

The slippery slope though is a near Gattaca situation where now law enforcement and government can screen people for genetics flaws and make hiring decisions etc. based on them. Private companies should absolutely have no access to this data unless it is for scientific research and highly anonymized and customers have agreed to allow it.

<comment><USER10> `law enforcement a means to potentially quickly identify violent criminals`

Go ahead and replace "law enforcement" with political group you don't like, and "violent criminals" for a group you do.

<comment><USER11> With regards to political groups, what would DNA tell you that their Facebook profile and network wouldn't?

<comment><USER12> Who their relatives are. One tool of political assassination is to out the <some bad thing> sibling of the { conservative | liberal } party candidate.

<comment><USER11> I would think that if they had any connection with them, there would be a Facebook link. If there is not even a Facebook connection, I doubt that the fact that a politician has <some bad thing> sibling that they don't really keep in touch with is going to be a big deal.

<comment><USER13> Oh, what a blissful #fakenews-less reality that would be.

</comment></comment></comment></comment></comment></comment><comment><USER14> All of the at-home DNA testing companies include this in their license agreements, including the ability to use your DNA in case any of your _relatives_ might be accused of a crime.

This is one case in which you definitely want to read the license before you sign up... then throw that test tube in the trash!

<comment><USER15> I know I'm not a serial rapist &/or murderer.

I hope my family members are not. The question is: what do I value more? A society without serial rapist killers or my family? I guess I prefer a society without that sort of nonsense, so even if my DNA is used to ensnare a relative, and they were doing horrible stuff, I'd be heartbroken that a family member had gone so astray but grateful they were unable to hurt anybody else.

See the investigative work using shirttail relative DNA to isolate the Golden State Killer.

That said, do I want law enforcement to have willy nilly access to DNA to, for example, chase down littering? No, IMO that is an inappropriate level of intrusion for the societal problem. Do I trust government to exercise good sense with these tools? I fear not so much. But I guess we will get used to the intrusions just as we have become accustom to the gov hoovering up all our communications metadata to find terrorists.

<comment><USER16> > _The question is: what do I value more? A society without serial rapist > killers or my family?_

I would got for option three, a society without false positives, and especially not a false positive because someone's naive uncle involuntarily submitted the entire family for testing.

</comment></comment></comment><comment><USER17> Of all "dystopian future" things that are now becoming a reality, this is IMHO the most disturbing.

There is nothing you can do about it as a privacy conscious person. Some random relative will give their DNA up at some point or another. Then you're fucked forever.

</comment><comment><USER18> Better yet, all 50 US states have government-run newborn heel prick programs, and they keep the blood. [https://www.cbsnews.com/news/california-biobank-dna- babies-w...](https://www.cbsnews.com/news/california-biobank-dna-babies-who- has-access/)

It's cartoonishly evil. The government literally takes and stores the blood of all newborn infants.

There's a good thing they do with it, which is screening for genetic diseases, and some epidemiology. But there's nothing preventing them doing all that without tying it to each newborn's identity.

The doctors are stupid about it, but very few are going to forcibly take a blood sample from an infant while you protest and film it with your phone. And they'll give you horror stories and guilt trips about all the awful diseases your infant might have if you skip the test.

But fortunately the Mayo Clinic Labs have a test they can mail to your doctor that you can use instead: [https://www.mayocliniclabs.com/test- info/newborn/index.html](https://www.mayocliniclabs.com/test- info/newborn/index.html)

Better plan it in advance though, and don't let the doctors put you off. Because once baby arrives, you'll be tired and the doctors will use all kinds of time pressure on you.

</comment><comment><USER19> Whole genome sequencing is now available for well under $1000 and prices continue to drop.

[https://us.dantelabs.com/blogs/news/whole-genome- sequencing-...](https://us.dantelabs.com/blogs/news/whole-genome-sequencing- cost)

I understand that forensic DNA comparisons are currently simpler and more error-prone, but it seems like whole-genome comparison is already cheap enough that it _could_ be used for comparing suspect DNA with crime scene DNA in important cases. At some point I expect it to become the new standard.

The "what about flawed DNA matches?" arguments against using this technology in law enforcement raise valid concerns, but I think that these specific objections may be obsolete in a few more years.

</comment><comment><USER20> To my knowledge, in California, a genetic sample has to be recovered and stored of every baby born? The archive is run by the state government. So why do they not use this registry that they already have full control over, but the data from the DNA company?

<comment><USER21> I don't believe that test does the same level of sequencing that 23andMe does.

It basically tests for a few dozen genetic diseases. Diseases where if it's caught early, the child has a chance at curtailing the negative consequences of the disease (they don't test for diseases with no treatments).

<comment><USER20> Indeed it doesn't do the same level of sequencing. But the specimen is not being thrown away after the test, but kept in an archive. In some states like California you can revoke consent at least.

See the list of states with how long they store the specimens here: [https://www.cchfreedom.org/files/files/Newborn%20Retention%2...](https://www.cchfreedom.org/files/files/Newborn%20Retention%20All%2050%20States%202018.pdf)

Governments might use this archive to sequence the DNAs down the road and then use it similarly to how they are already using those private services. Prices of sequencing are sinking as we speak.

<comment><USER21> Fair point about keeping the samples!

</comment></comment></comment></comment><comment><USER22> If this bothers you, consider fighting back. Submit as many DNA samples to as many firms as you can find. Send each sample from a different [consenting] donor, and ask that they do the same and include you among their donors. This action at scale dirties the data sets of all the companies involved.

<comment><USER23> I don't think that plan follows awfully well, why on earth would you pay money for services for the sole intent to game their database into inefficiency? A spotted chance of that even working, at best you've given them money for nothing back. No, it's best to just spread the word amongst your friends, and avoid all this muck.

<comment><USER24> noise in the system?

<comment><USER23> I'm just advocating for the simpler and less costlier solution, speak with your wallet and remove yourself as data from the system, and encourage others.

Definitely don't send any money to these companies, as that's a lost game already.

</comment></comment></comment></comment><comment><USER25> A user in /r/conspiracy posted the other day their school is offering free dna tests:

[https://www.reddit.com/r/conspiracy/comments/alwd5r/my_high_...](https://www.reddit.com/r/conspiracy/comments/alwd5r/my_high_school_offers_ancestory_dna_testing_for/)

</comment><comment><USER26> It seems inevitable that nearly everyone's DNA will eventually be disclosed or available to sufficiently interested parties. You literally leave a trail of DNA behind you, the cost of collecting it has steadily fallen, and you can't change your DNA so a single security breech in your entire life is irrevocable.

</comment><comment><USER27> I remember attending a bioinformatics conference years ago when Nanopore presented one of their first devices. For those who are not in the field, Nanopore offers a palm sized device that can sequence DNA in real-time as the strand moves through a small pore. They are still far from offering a device that is accurate enough to identify people.

During the presentation, images of public places vacuuming up biological material and sequencing whatever DNA material found came to my mind. The privacy implications of this is potentially very scary.

</comment><comment><USER28> It's bad but not unexpected, overreach is what these people do. Day to do though everyone should be far more scared of Insurance companies getting hold of their DNA test results.

<comment><USER29> In the US GINA bans health insurance companies from using genetic data for determining premiums or eligibility.

If it were legal you wouldn't have to worry about insurance companies mining genetic databases, it wouldn't matter, they'd simply demand a DNA sample in order to be insured.

<comment><USER30> GINA's effective -- now. But what if it goes the way of the endangered preexisting condition exclusion? Parties are already chopping pieces of that latter protection away under the guise of short term policies.

<comment><USER29> GINA was voted into law 509-1 (Ron Paul being the sole dissenter), it was hardly controversial.

>what if it goes the way of the endangered preexisting condition exclusion?

Then insurance companies will simply demand DNA to be insured. Same way car insurance companies demand financial information (through credit bureaus) in order to insure you in places where it's legal to do so (which is the vast majority of the US save 1-2 states).

So either way you don't have to worry about insurance companies mining private databases, if GINA exists they can't legally and if GINA doesn't exist they'll just do the data collection themselves.

<comment><USER30> Legally of course you're right, and I suspect you already know about the Medical Information Bureau's repository of adverse health info used right now.

Where we'd part company I guess is in seeing an equivalency of consequences in the lack of car as compared to the lack of health insurance.

</comment></comment></comment></comment></comment><comment><USER31> I almost did one of this test because I was curious about the results. Ultimately I decided that giving my DNA to a some random company on the internet is just a bad idea, even if (a big if at that) the results are accurate and interesting.

Stories like these are why I'm glad I decided not to.

</comment><comment><USER32> A bit hyperbolic, but not completely inconceivable: Long lost twins separated at birth, one twin murders somebody, the other twin gets his DNA tested, FBI says "we found him", guy goes to jail for crime he never committed. Oops

<comment><USER33> Replace murder with art heist: [http://content.time.com/time/world/article/0,8599,1887111,00...](http://content.time.com/time/world/article/0,8599,1887111,00.html) With a "happier" ending.

</comment></comment><comment><USER34> Are there any similar reports regarding 23andme? I know quite a few people who have used their service.

<comment><USER35> We do not do this at 23andMe: [https://www.23andme.com/transparency- report/](https://www.23andme.com/transparency-report/)

</comment></comment><comment><USER36> I'm of two minds on this. On the one hand, catching the golden state killer is awesome.

On the other, DNA matching is a stochastic process. False positive matches are possible, and likely if used to identify suspects at scale with no other evidence or links to the crime.

We're probably still in the infancy of DNA-based law, I suspect.

</comment><comment><USER37> I bet if there was an option to voluntarily enable this, many people would say yes! eg. "Do you want us to use your data to help catch criminals / rescue those wrongly accused?"

Same way as asking "Do you want to be an organ donor?".

</comment><comment><USER38> The NSA collects the records of everyone two connections away from a terrorism suspect.

This will allow the FBI to profile the families of criminals. I have a cousin who joined a white supremecist group. Does that mean my life ahould be put under a microscope in case I'm committing crimes too? Should I have to submit to body cavity searches at airports because of her drug convictions?

Our prison system is not designed to punish or rehabilitate. It's designed to isolate society's undesireables and put them in a cage away from the rest of us. The Powers That Be would like nothing more than to extend that to entire families.

</comment><comment><USER39> I would gladly donate my DNA to be tested to find criminals. I signed up to 23andMe years ago just for fun, but if that data can be used to help someone who was hurt by someone genetically related to me, I am all for it.

Reading the reactions here makes me feel crazy, as if their intention is to make me feel manipulated or otherwise bad. It is really interesting to me how many people are fearful of dystopian futures that could play out instead of excited to actually potentially help identify a serial killer.

<comment><USER40> The intent is to encourage you to consider the relative incidence rates of various misfortunes. Police ineptitude and the prosecutor's fallacy are vastly more common in this world than serial killers are. You seem eager to screw over your cousin, but it could just as well be you who is screwed over.

<comment><USER41> Serial killing is the extreme example, but is police ineptitude and prosecutor's fallacy more common in this world than rape, murder, assault and battery, burglary, etc?

<comment><USER40> How could this question really be answered? You'd have to trust those whose unworthiness to that trust forms the question's very premise. Police and prosecutors couldn't be all that effective, since their ultimate argument seen here amounts to little more than an extortion threat: _If we aren 't all- powerful, someone might get raped!_ Those who wish to avoid crimes equip themselves to stop criminals, rather than afflicting the rest of us with counterproductive attempts to further empower those in authority.

Crime is a quality of society. All human societies will see some level of crime, but there is a great deal of variation. A sick society in which the police are powerful will simply see more crimes committed by police. A healthy society will see fewer crimes, no matter how many police quit for more productive occupations.

</comment></comment></comment></comment><comment><USER42> Wait a second, I though these companies didn't sequence DNA. I thought most of them just ran your DNA against known patterns to see if they patch to give you a probably/percentage of ancestry, with all the original samples being destroyed:

[https://www.youtube.com/watch?v=U3EEmVfbKNs](https://www.youtube.com/watch?v=U3EEmVfbKNs)

Does ancestry actually sample and save entire DNA sequences (I guess they have to in order to do family tree matching)?

Crazy.

</comment><comment><USER43> I just submitted my DNA for testing, and was more than happy to do so. I believe, that for me knowing MY genetic predispositions about certain diseases AND do something about it (even paying a premium for insurance) far outweighs the privacy concerns while you slowly die without targeted medical/lifestyle interventions.

<comment><USER43> Also, I would be glad if an insurance existed that was based on keeping certain metabolic/blood markers in a healthy range. which translates to a decrease of 30-75-ish % of chance of death by cardiovascular/neurodegenerative/cancer.

an insurance like this would certainly cost less

</comment></comment><comment><USER44> Speaking of which. I sent two samples to 23andme and both times they rejected my sample saying that there was not enough DNA to recover. Hopefully that is in fact what happened......

They did send me a refund though.

I really really dont like the idea of someone potentially having my DNA while I didn't even get my end of the bargain (dietary recommendations, possibly knowing what will likely kill me, etc)

</comment><comment><USER45> Article from a year ago about this: [https://www.buzzfeednews.com/article/danvergano/serial- kille...](https://www.buzzfeednews.com/article/danvergano/serial-killer-dna- testing?bfsource=relatedmanual)

Edit: nevermind, this is a different company

<comment> Paul-ish The article you linked is about GEDmatch and the golden state killer. This one is about Family tree DNA.

</comment></comment><comment><USER46> These issues usually have a benign beginning. "We only do this for violent crimes" seems reasonable but it will never stay benign. Cops are lazy. Give them a tool and they will eventually use it to catch shoplifters and graffiti artists or to inquire about the heredity of their girlfriends.

</comment><comment><USER47> > a private firm has agreed to voluntarily allow law enforcement access to its > database.

I mean, nothing says that it was voluntary. In any case this should not be surprising. Everyone who uses these services knows that they ll be fingerprinted. Hopefully, one day we'll have private, home sequencers.

</comment><comment><USER48> It is interesting how the crowd - as in relatives - are helping solve violent crime cases, from DNA at the scene.

I think a lot of people have been taking advantage of this system for a long time. Like they know they get a free pass on assaulting people because they haven't been arrested yet.

</comment><comment><USER49> This is a major violation of trust.

</comment><comment><USER50> I disagree with this. Over time GEDMatch will get enough samples for forensic purposes. I'd rather have an incentive program to get people to upload their data onto GEDMatch than to have the government work with the commercial companies.

</comment><comment><USER51> Haha. I'd never send my DNA away. But then I have to hope that one of my cousins and distant half-siblings does. Well, in the EU privacy laws might hold up a few more year but we're all doomed.

</comment><comment><USER52> What problems can arise when law enforcement agencies are able to match DNA to catch criminals such as rapists and murderers? Wouldn't that bring benefits to society and make it safer.

</comment><comment><USER53> I'm interested in sequencing my own DNA, but only if the information never leaves my possession. I'd like to do it once the cost goes below $1k. Any idea when that will be realistic?

</comment><comment><USER54> I suspect some of the strained objections to this is from MRA types who are aghast that women will use this to track down unknown fathers for child support.

</comment><comment><USER55> I figured that's why the ads encourage people to have their grandparents tested. One grandparent, and you've got a whole family group.

</comment><comment><USER56> Whenever you see the governments touting this 'public private partnership' this is exactly what it is.

</comment><comment><USER57> I think that government agencies should have everyones DNA.

Esp rape I'm really surprised police can't just look at the semen and look up who it belonged to. The government already knows everyone's photos and basic biometrics from drivers licenses and passports, surely this is just one more field in the database.

</comment><comment><USER58> How does an at-home dna testing company get any of your infoemation?

<comment><USER59> Only the sample collection is "at home" using a kit mailed to the customer with instructions on how to collect the sample. The analysis is done in a (hopefully good and clean) lab where the sample gets mailed to by the customer.

</comment></comment><comment><USER60> in a few years every phone will have a DNA sequencer included

<comment><USER61> and you need to spit saliva to unlock?

</comment></comment><comment><USER62> "We value your privacy. Please let us track you."

No

</comment><comment><USER63> How many people here complain about authoritarian governments and yet support this mass surveillance via DNA?

</comment><comment><USER64> This is why I would want to send in other people's DNA to be tested and they send in mine (like a bitcoin mixer).

</comment><comment><USER65> Fewer than 10 cases apparently

</comment><comment><USER66> Anyone know if there is a way to remove yourself from being shared with 3rd parties?

<comment><USER47> fbi seems a third party that's hard to remove

<comment><USER66> Thanks for your input.

</comment></comment></comment><comment><USER67> George Orwell is saying: DA FUQ?

</comment><comment> Iwan-Zotow Jesus, unDNA me!

</comment><comment><USER68> I really can't tell if we are headed towards a "1984" dystopia, a "Brave New World" dystopia, a Black Mirror "Nosedive" dystopia, or now a "GATTACA" dystopia.

It seems like we're headed to a horrible hybrid combination of all of the above.

<comment><USER69> I don't mean this in a seriously snarky tone, but: What you're saying has been said by every generation which experienced great leaps in technology.

Why is _this_ wave of technology, one less transformative than the invention of the printing press or transistor or nuclear bombs (none of which lead to ruin), going to be the one that leads to a dystopia?

<comment><USER70> I think you bring up an interesting point. For those of us who are employed in the darling industry of our time, in the most liberal societies, who manage our money well, and are not related to anyone undesirable, this will not be a dystopia, it'll be paradise!

<comment><USER71> It would be beneficial to your friends and family, and probably your own quality of life, to start considering whether those who do not meet the above criteria should be subject to oppression, while those privileged by birth and wealth live in paradise.

</comment></comment></comment></comment><comment><USER72> One step closer to Gattaca every day.

</comment><comment><USER73> Shocker /s

Anyone who thinks that the data at these testing companies isn't going to the FBI/NSA (directly or indirectly) is just plain naive.</comment>


The current state of kernel page-table isolation - <AUTHOR> https://lwn.net/SubscriberLink/741878/eb6c9d3913d7cb2b/ <comment><USER2> TLDR "all existing x86 processors are seemingly affected by information- disclosure vulnerabilities" plus arm64 too. This appears to be severe enough for Linus to accept a 5% slowdown in user code (which in previous security cases he would not have), although future processors may have this disabled again.

<comment><USER3> Why is mere information disclosure about kernel layout severe enough to warrant a slowdown and patch like this? I suppose it's gated behind a feature flag? I'm wondering because I thought just knowing the layout isn't enough to attack the kernel. Don't you need other vulnerabilities too, that let you actually access the memory?

Address randomization is nice, but if an attacker can write to arbitrary pages, potentially including the kernel, isn't it game over no matter what? I'm not an expert on this and would be interested to know more.

Also, do these activities imply that there may be significant known but embargoed vulnerabilities? In particular, Linux accepting a patch like this so late into the release cycle.

<comment><USER4> > I'm wondering because I thought just knowing the layout isn't enough to > attack the kernel. Don't you need other vulnerabilities too, that let you > actually access the memory?

NB: My understanding of this is purely arm's-length. I've never actually done exploit development.

Short version: you need to know the layout of the code in order to actually exploit those other vulnerabilities.

Longer version:

Attackers: We can inject machine code into the stack and execute it [1].

Developers: Not anymore; stack pages aren't executable [2].

Attackers: We can turn your own code against you by manipulating the stack to "return" to an arbitrary sequence of pre-existing functions with arguments of our choosing [3].

Developers: Not anymore; we randomize the address space every time we load the code, so now you don't know where those functions are. You could guess, but you're going to be wrong and just crash the system almost all of the time [4].

Attackers: For the kernel on x86/amd64 systems, we have a way of reading the page table from an exploited user process, which we can then parse to discover where you located those functions. <\---- you are here

[1] [https://en.wikipedia.org/wiki/Stack_buffer_overflow#Exploiti...](https://en.wikipedia.org/wiki/Stack_buffer_overflow#Exploiting_stack_buffer_overflows)

[2] [https://en.wikipedia.org/wiki/NX_bit](https://en.wikipedia.org/wiki/NX_bit)

[3] [https://en.wikipedia.org/wiki/Return- oriented_programming](https://en.wikipedia.org/wiki/Return- oriented_programming)

[4] [https://en.wikipedia.org/wiki/Address_space_layout_randomiza...](https://en.wikipedia.org/wiki/Address_space_layout_randomization)

<comment><USER3> Thanks. That was a very helpful explanation!

</comment></comment></comment></comment><comment><USER5> I wonder what else is in x86/arm64/common processors we don't know but would care about.

In situations like these it really pays of to have at least some parts of the system developed as free software. In a dystopian alternative reality where free software never happenend, people would hardly ever hear about these issues, even though issues like these would still be there, and maybe even worse.

Waiting for affordable open/free hardware single board computers like for example lowRISC is aiming to offer is becoming harder and harder. I'm already sitting on my hands (and pocket).

<comment><USER6> Speaking of lowRISC, does RISC-V also suffer from this? Apparently SPARC and s390 are immune, since they already have separated user and kernel address spaces, maybe somehow enforced at the ISA level.

Having the benefit of hindsight, I hope they have avoided this issue.

<comment><USER6> Replying to myself, it seems they haven't avoided it, and here is a recent proposal to fix it: [https://groups.google.com/a/groups.riscv.org/d/msg/isa- dev/J...](https://groups.google.com/a/groups.riscv.org/d/msg/isa- dev/JU0M_vug4R0/YELX92fIBwAJ)

</comment></comment></comment><comment><USER7> I'd like to hear more about the processor bugs in question. Are these purposefully introduced flaws? If the bug(s) in question extend across all x86 processors that begs the question, was it intentional. Why would the flaw have not been fixed in subsequent generations.

<comment><USER8> Well this can happen when you keep a very old architecture for a long time and only add new features while keeping backwards compatibility forever. Even then switch to 64-bit involved several missed opportunities to clean things up properly.

<comment><USER9> It would be interesting to know whether any Itanium processors ever suffered from these (now disclosed) bugs.

</comment></comment></comment><comment><USER10> Waiting for spender to show up and break it :-)</comment>


On the Origin of Foods - <AUTHOR> http://www.chewonthis.org/site/?p=1048

<comment><USER2> It's an interesting map, but I would've preferred some alternate weighting scheme, such as by calories consumed or tonnage produced. While I like olives and dates, do they get produced in significantly greater quantities than barley and wheat (which appear much smaller)?

As it is, this seems to put an undue weight on the Old World staples.</comment>


The purpose of a CS degree in the 2020s? - G-delta My experience is that non-CS engineers and scientists can write their own code, the talent that was supposed to keep the degree alive for decades. Consequently the subset of jobs unique to CS is rapidly converging to a handful of positions in computer systems, where electrical engineers are just as desirable. Will we still tell people that we need more CS majors in 2030, or will it be the next undergraduate business degree? <comment><USER2> If the entirety of Computer Science == write code to you .. then nothing, I guess.

<comment> G-delta My original point was that the jobs _unique_ to the CS major are converging rapidly to several in computer systems; do these other topics (e.g. theory of computation and esoteric algorithm D&A) lend themselves to employment outside of academia better than the domain-specific knowledge a chemical engineer has, for instance?

I agree with you that CS is more than coding, but the educational establishment does not. The CS curriculum in most American universities comprises architecture, networks, operating systems, software engineering, some algorithm D&A, and Java/Python/C++, at maximum. The fundamental issue is that a proper study of the other components of CS you bring up demands mathematical maturity. Consequently a 3 year course of study in algebra, analysis, and topology is likely much better preparation for advanced study in CS than a 4 year course of study in software engineering, which is what most American CS degrees are. It is one thing to debate how useful CS is as a _field_ beyond programming, but a completely different problem to determine how useful the training offered in a CS _degree_ is.

<comment><USER2> Lots of discussion about degrees as signaling and such around. I didn't realize this was where we ere going.

If you walk out of a university only knowing how to code, you've wasted an opportunity. (and a lot of somebody's money)

</comment></comment></comment><comment><USER3> One of the largest problems in the industry is that they are looking (job ads) for CS, hiring programmers, but actually often need software engineers. And the second problem is that they often don't understand the first sentence.

CS was never meant to be a programming degree. There are universities that don't have programming in their CS curriculum at all (well, except for pseudo- code or the like). It's a scientific degree. It's an education that teaches you how to solve problems in the Computing in a reliable, mathematical, scientific way. They solve abstract problems.

Software engineers, on the other hand, solve concrete problems, but also without much code. They design a solution with respect to the requirements, technical constraints, price, available resources etc. They shape the development process.

Programmers write code. Ideally they do know the infrastructure they're working with (compilers, libraries, frameworks, hardware, ...) and write the most optimal code in the frame, defined by an engineer, and using solutions developed by a scientist.

At least this is how it should be. And there are some companies that really working like this - usually the ones that have to have really good software working for decades. Other (nowadays the majority) hire physicists or the like for everything. I had the chance to work for some of these companies too - <AUTHOR> of them hired basically everyone with some mathematical background to do coding - and they coded. They created one of the largest code bases on the planet (larger than e.g. Microsoft's at that time). They never learned how to get requirements from the customers, so their software was an absolute desaster in terms of usability. It is also extremely slow - jokes about its start-up times were pretty widespread a couple of years ago. And it was absolutely unmaintainable, to a degree that the company was on the verge of bankruptcy because they were basically not able to react to customer requests. They survived. But they are not hiring physicists to do software development anymore.

</comment><comment><USER4> > non-CS engineers and scientists can write their own code

Having seen plenty of code written by non-CS engineers and scientists, my experience is that formally trained programmers have excellent job security.

Have you ever tried maintaining that kind of code base?

<comment> G-delta >Have you ever tried maintaining that kind of code base?

I've never tried to maintain a code base written by non-CS people. In what context have you seen code by non-CS scientists?

>Having seen plenty of code written by non-CS engineers and scientists

There is a trade off between domain knowledge and programming style. Is it better to teach a BSCS 2 years of chemistry to work on your molecular modeling library, or hire somebody with chemistry experience who writes less maintainable code? Coding has become easier over the last 20 years, but the domain-specific knowledge has become harder. This trend favors the chemist over the BSCS.

<comment><USER4> > non-CS engineers and scientists can write their own code

> I've never tried to maintain a code base written by non-CS people

...

<comment> G-delta You do not need to actively work on a code base to know who does. The educational backgrounds of developers who work on software in non-CS fields are very easy to find online. There is no contradiction in these quotes. If your point is that non-CS people write bad code (and that at some point I have argued the opposite, which I have not), you still haven't explained why the market won't value the domain-specific knowledge of a non-CS person over a BSCS's programming knack.</comment></comment></comment></comment>


Living in World of Fantasies - <AUTHOR> https://medium.com/@jonathanmartell/living-in-a-world-of-fantasies-2bfe98a43fb9 <comment><AUTHOR> ¿What is the 'correct' way to live?</comment>


An Ingress Player's Story - <AUTHOR> https://plus.google.com/u/0/101412482791457669319/posts/14UicNg8hgg

<comment><USER3> I liked the preview stuff I read about it. But the game was rather boring, seems like a grinder with a little bit running around :\

hack - cooldown - hack - cooldown - hack - cooldown - hack - cooldown - hack - cooldown - hack - cooldown - hack - <USER2>

meh...</comment>


Guardian quotes 10x programmers and warns Twitter to keep the best - <AUTHOR> http://www.theguardian.com/technology/2015/oct/14/twitter-better-remember-who-monetises-its-tweets <comment><USER2> Please do not editorialize the titles of stories you submit HN.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><AUTHOR> noted</comment></comment>


Hey Facebook, WTF? Stay Away From TechCrunchers - <AUTHOR> http://www.techcrunch.com/2007/12/06/hey-facebook-wtf-stay-away-from-techcrunchers/ <comment><USER2> Hard to tell how serious he is. I personally think that TC is boring and I'm not a regular reader. But as a reviewer their impartiality is a strength. If people think that negative FB press is sour grapes then the reviews become worthless. Again, not sure if he's kidding but he's treading on dangerous ground.

<comment><USER3> To the extent that he is not kidding, this is a really bad idea. Facebook obviously have a lot of allure as an employer, get over it. If TC is losing talent to them, that is their problem, not Facebook's. The idea that Facebook should refrain from hiring away any other TC staffers ("or else!") is ridiculous, and doesn't reflect well on Arrington at all.

(TC jumped the shark 9 months ago, anyway...)

<comment><USER4> Why shouldn't he be allowed to be annoyed by it? Consider somebody enticing away your spouse, would you be annoyed?

</comment></comment></comment><comment><USER5> This is interesting?

<comment><USER6> if you have employees to loose, maybe?

<comment><USER7> lose

<comment><USER8> Loose also means "to unleash". The intern is probably a mole.</comment></comment></comment></comment>


Journalists perceive stories published in local news outlets to be less worthy - <AUTHOR> https://www.niemanlab.org/2020/09/journalists-perceive-stories-published-in-local-news-outlets-to-be-less-newsworthy/ <comment><USER3> In my experience, if you want to learn about things in your neck of the woods, local news outlets are _much_ more reliable than national news.

I wrote a few days ago about an event I had personal knowledge about:

> The local newspapers were the best. They didn't report false facts - <USER2> > verified them. They had the most detail (continual coverage over months > rather than random sensational headlines).

[https://news.ycombinator.com/item?id=24366381](https://news.ycombinator.com/item?id=24366381)

<comment><USER4> > They didn't report false facts - they verified them.

Unless they're directly copying from press releases or, worse, police reports. Too many local (and for that matter, even national) papers don't have the money left to do actual boots-on-the-ground journalism.

<comment><USER3> In the case I was referring to, the local news outlets were usually the only ones who dug deeper and questioned the police/FBI/prosecution statements. National outlets rarely did it - it was big enough to be national news, but amongst national news it was a smaller item.

Of course, this was a _big_ case in the region. For small cases, I find that both the local and national news outlets simply suck.

<comment><USER5> This reminds me of the Richard Jewell case I saw on the news as a kid. I remember how the news went on about him having _nails_ in his garage and I was like "WTF? That's the best evidence they have?" even as a kid.

He was, of course, not merely acquitted but proven innocent later. I think they made a movie about that this year, but due to Covid it's been a long while since I've seen anything.

</comment></comment></comment></comment><comment><USER6> Local news tend to be more fact driven and less opinion drivel in my experience. In a lot of big stories the local news can often be way better than any national coverage.

<comment><USER7> When I think of "local news", I think of this [0] video.

[0]: [https://www.youtube.com/watch?v=ZggCipbiHwE](https://www.youtube.com/watch?v=ZggCipbiHwE)

<comment><USER8> I don't know why someone would downvote this. There has indeed been massive consolidation of local media, and that is a good example.

</comment></comment></comment><comment><USER9> Well, it's kind of understandable isn't it? Everyone in pretty much every field has a notion that making it to a national stage/level of your work means something more meritorious than just being #1 in your little town, don't they? You don't just get to cover the Secretary of State's trade visit to Southeast Asia after graduating high school and working for the local paper, do you?

That is not to say that there's not absolutely good journalism done at the local level. And important journalism at that.

But to say that the average local journalism happening (at 5,000 local news outlets, say) will generally equal the level of national quality, is probably just not true. So the bias is not without foundation.

You get to the big leagues by doing a good job in your local level.

But it does not have to follow that there is not good work being done at the local level. Some people take that equally valid and societally important path, and it's important to point it out.

<comment><USER10> Perhaps on the flip side, real journalism is more valuable locally while sensationalism is more valuable nationally. People might care about facts at home, but they seem to prefer entertainment—e.g., some tantalizing story about some group they hate—on national news. Seems like it could go either way.

<comment><USER11> Do they prefer it, or does it simply work better because they can't check whether it's true? You could do sensationalist news locally as well, but everybody drives by the house you wrote "exploded" every day and they can see that it wasn't more than a burning trash can. That's different on the national level: almost all of the audience isn't where the story is, so they can't verify personally. That allows for much more sensationalism without being regarded fake. And more sensationalism = more viewers = more money, so there's an incentive to go there.

<comment><USER10> That seems plausible, but there have been lots of news stories where every major outlet published an absurd sensationalist story which was objectively refuted by the story's own sources. Even here on HN years later people subscribe to (and will die on the hill for) the trivially debunked sensationalist interpretation. Two examples that come to mind are the [Covington Catholic fiasco][0] and the [Google "Diversity Screed" memo][1].

Besides, it's my perception that the news has become _more_ sensational, and I certainly don't think it's accurate to say that the jobs of fact checkers have become more difficult (except in the sense that their superiors hamper them in some manner on account of the profitability of sensationalism, which is essentially my point).

I personally think there's some merit in the notion that we live in a post- truth world. Both the media and the POTUS feel comfortable lying quite overtly as though they understand that the value of credibility is at an all-time low. Academics in critical theory fields deride objectivity as fundamentally racist and talk about "other ways of knowing". Maybe I'm wrong, but it feels like there's a sea-change in our values, especially as they relate to truth and integrity.

[0]: [https://reason.com/2019/01/20/covington-catholic-nathan- phil...](https://reason.com/2019/01/20/covington-catholic-nathan-phillips- video/) [1]: [https://www.theatlantic.com/politics/archive/2017/08/the- mos...](https://www.theatlantic.com/politics/archive/2017/08/the-most-common- error-in-coverage-of-the-google-memo/536181/)

</comment></comment></comment></comment><comment><USER12> Local news seems to be inherently hard to do well. Small towns tend to have fewer resources and "everyone knows everyone," so you don't want to be controversial because if you are, you are stepping on the toes of people you actually know and/or people who can directly impact your life in some way.

People with a lot of talent tend to work for bigger publications because they pay better, so local organizations are often left with people who aren't all that good (edit: implicitly: This fact probably undermines credibility/reputation for local papers).

This is a problem for small towns for any serious profession, not just journalism. Small towns have trouble attracting good talent for any kind of job requiring "professional" skills because those same people can got to a larger city, apply to the same kind of job and get a better paycheck while living someplace most people typically feel is more desirable than a small town.

I sometimes wonder how to address such problems because I think this overall trend causes other problems that I think are very serious, but I don't know where to begin.

</comment><comment><USER13> This article is not corroborated by my real-world media experience at _all_.

Local stories are simple. That makes them more reliable. If it's newsworthy, then national, followed by international journalists will pick up on it and it becomes something big.

I don't want to give unnecessary details but I've been the subject of news stories multiple times, which always started in my humble local media. One time it led to a massive career opportunity that benefited me for ten years. The other time, I got significant international media attention which hugely boosted a charitable donation drive.

Each time, journalists at the national level picked up my local story and landed me attention at that level. So, yeah...something's wrong with this study or at least how it's been communicated by NeimenLab.

Also, local journalism is important. Let's not undermine that bastion of independence, free speech, and resistance to political censorship, fake news, or media corruption, shall we?

</comment><comment><USER14> If you find this frustrating I recommend finding a local news source that you trust and supporting it. Your money goes a lot further and will be more appreciated with local events. Be aware it's not always a paper per se. In San Diego the best local news is Voice of San Diego.[1] Which is afaik just a website and podcast.

[1] [https://www.voiceofsandiego.org/](https://www.voiceofsandiego.org/)

</comment><comment><USER15> For _journalism_ , they absolutely are. Do you know where national news outlets typically recruit their journalists? From local news outlets. The nationals pick up the folks doing the best work. By definition this means the people left over aren't quite at the same level. I distinctly remember we had a local guy who was active in the Twitter meet-up group in my area around the same time I was (many years ago). He was just starting out as a journalist for a local paper. He was great - his articles were well written, easy to understand, and he was prolific in his writing. He was picked up by the NYT within a year or two while the people who were less of all the above stayed behind.

<comment><USER16> I'm a former news editor who went from a national, NYC-based publication to a metro newspaper in a small state.

It wasn't because my skills were lacking -- I was being recruited by other national publications in NYC -- but because my wife and I wanted to be closer to family, so our children would have an opportunity to see their grandparents regularly.

I found out that this sort of decision is common, and as a result, local papers tend to have a mix of:

\- Talented up-and-comers, some of whom will end up at bigger-name publications. And that's great for people who want those illustrious jobs and also want the lifestyle that goes along with them.

\- Wash-outs, who either tried and failed at bigger-name news outlets or knew their limits well enough to not even try.

\- Downshifters, who previously worked at a bigger-name publication but decided that they didn't like the location or the lifestyle.

\- People with deep roots, who could easily do well at bigger-name publications, but who love their local communities and have no desire to go anywhere else.

</comment></comment><comment><USER17> Yet if those same Journalists saw that same story they dismissed, suddenly trending upon social media - they would be all over it.

So in many ways, social media attention has become a sudo voting system for news items. Though equally, the news feeds into social media - so the potential for feed-back loops is not zero.

However, those who do social media are perhaps not the clearest insight into the public as a whole and how much weight upon that the various news outlets use will vary.

</comment><comment><USER18> Sometimes that means their own paper. The Washington Post has at times seemed to want to be the Journal of Foreign Affairs, and to have scanted local coverage.

</comment><comment><USER19> Charlie Reese was our county commissioner (lifetimes ago) and afterward he wrote a local column for years (eventually syndicated by King).

That man went after everyone with equal ferocity; no favorites. He often tore apart pols I supported & when he did, I paid attention.

I've never instinctively trusted another journalist, like I did him.

</comment><comment><USER20> I for one, perceive stories published in mainstream media outlets to be less trustworthy

</comment><comment><USER21> That's because the goal of most journalists is to become close to the powerful.

<comment><USER22> Cover local kitten stories or wine and dine with celebrities?</comment></comment>


N64 Zelda patent expired today - <AUTHOR> https://patents.google.com/patent/US6626760 <comment><AUTHOR> I happened to be looking through some N64 technical documents including a list of patents[1] and noticed that many of them seemed to have expired today!

including ones related to:

Z-buffering[2]

Starfox 64[3]

and Mario 64[4]

[1]: [https://forums.cen64.com/viewtopic.php?f=16&t=7](https://forums.cen64.com/viewtopic.php?f=16&t=7)

[2]: [https://patents.google.com/patent/US6414678](https://patents.google.com/patent/US6414678)

[3]: [https://patents.google.com/patent/US6540612](https://patents.google.com/patent/US6540612)

[4]: [https://patents.google.com/patent/US6331146](https://patents.google.com/patent/US6331146)</comment>


Swift, definition of version 1.0 and ABI stability - <AUTHOR> I don't have any opinions on Swift itself, just their versioning. Why would you release 1.0 without a stable ABI? We just had a choice of Swift or Obj-C in our project and Obj-C won by a landslide because its stable. Swift just seems like a toy language that Apple screwed up a long time ago by releasing it way too early. It is basically useless if you need to do anything else than source based integration. I am baffled and confused. <comment><USER2> Wrong choice.

[https://h4labs.wordpress.com/2016/02/09/should-i-use- objecti...](https://h4labs.wordpress.com/2016/02/09/should-i-use-objective-c- or-swift-for-writing-ios-apps/)

You are placing too much emphasis on compatibility. You'll do less work writing in Swift and fixing any changes than writing all that Objective C code.

</comment><comment><USER3> Parts of El Capitan are written in Swift. See :

[http://daringfireball.net/thetalkshow/139/federighi- gruber-t...](http://daringfireball.net/thetalkshow/139/federighi-gruber- transcript) From the Link :

"FEDERIGHI: We have all types here within Apple. They start out with the "I love Objective-C. I don't want to change" to "OK, maybe there's something to this Swift thing" to "Let me give it a try" to "I love it." We've gone through all the phases internally. You know, we've had some really great adoption by teams like … the team that does the Dock and the window management on OS X, implemented all their new features for El Capitan in Swift and started mass- converting all of their code, and say that they couldn't imagine going back and that they're more productive with it. Part of what our internal teams need to deal with, though, is that they're working on, let's say, the current version of Swift 2.0 while it's not done yet. I mean, while it's not even WWDC-level done yet, right? And they're working on the interfaces in terms of our internal frameworks that haven't been modernized for Swift. And so, they've got it rough. They've got to really love it to make that leap because they're working on a very, very bleeding-edge environment when we use it internally. Thankfully, with Swift 2.0 now well out the door, that's stabilized things a good bit and they're really open to it.

But there's been just lot of feedback. And a lot of it has helped with the impedance, making sure the impedance between Objective-C and Swift is absolutely minimized because of course we have and will continue to have and continue to write more Objective-C code, and so the ability of Swift and Objective-C code to work together completely naturally is a huge focus. A bunch of things like generic collection, support for lightweight generics in Objective-C, were big pain points internally and something we fixed in the language, and is now great for all of our app developers externally. So, it's been a not dissimilar road for us internally to what you see outside. But in terms of Swift and writing big apps, it's certainly the case that when Swift 1.0 came out — heck, we didn't support incremental compilation in the very first update. And so that was going to be a limiting factor for productivity for people who had big apps. A lot of that stuff has changed. And then in 2.0 having a good error-handling model, having the availability check so you could span API versions — these sorts of things. I think it really addressed the vast majority of pain points that we were experiencing, that I think the community was experiencing about writing larger apps. And so much about Swift is actually inherently better for building big apps because it handles modules and namespaces in a way more naturally than in Objective-C. It makes the API contracts a little more clear, the code more obtainable. So, we're very comfortable."</comment>


Everyone Is Falling for This Frighteningly Effective Gmail Scam - <AUTHOR> http://fortune.com/2017/01/18/google-gmail-scam-phishing/ <comment><USER2> So I'm assuming that the image is a hyperlink, and that this link contains the "data:text/html" webpage designed to trick users.

So couldn't Google flag emails which have links to "data:text/html" as suspicious?

Even if it came from a known contact, I can't imagine normal people emailing around links with "data:text/html" as the link target.

<comment><USER3> Could be a redirect from a regular URL: Gmail -> Attacker's website -> data:text/html

The attacker's website would only be visible for half a second, and users are used to the dance of redirects before a login page, so this makes it not suspicious

<comment><USER2> > Could be a redirect from a regular URL: Gmail -> Attacker's website -> > data:text/html

Sure, I agree it's a game of cat and mouse. But GMail's spam filter in my experience is pretty good, so if Google started flagging these messages as spam based on the link contents/website it would help reduce the success rate.

</comment></comment></comment><comment><USER4> Previous discussions from when this was first highlighted:

[https://news.ycombinator.com/item?id=13372985](https://news.ycombinator.com/item?id=13372985)

[https://news.ycombinator.com/item?id=13408078](https://news.ycombinator.com/item?id=13408078)

</comment><comment><USER5> How is this different from just copying the Google login page to a website you control, with a URL that includes the right words?

<comment><AUTHOR> It is not that different, but the art is in the attention to details (the sender can be posed as your colleague) and subtlety in execution.

</comment></comment><comment><USER6> Clickbait title

<comment><AUTHOR> The title is not bait. It describes the post correctly and does not mislead you. Just pointing it out; I did not change the title.

<comment><USER6> Sure it is. 'This' is a terrible way describe an article. In fact it leaves to the imagination what the scam is about, it might as well be another run of the mill phishing email for all I know. The point here is to make me click to find out what it refers to, therefore, clickbait. To increase this effect they start off with 'everyone is falling for', which signals urgency but again doesn't convey anything about the scam's nature. If you abstract away the clickbait you end up with 'effective gmail scam'.

This is on fortune.com by the way, I'm not calling you out. The submission title is the same as the article's, but that one is trash.

<comment><AUTHOR> I'd like to know more. I feel in this case the title should convey the urgency with enough context. Which it does in my opinion. Just "Effective GMail Scam" would not make me care enough to click through to the post. It is the fact that "Everyone is Falling" that alerted me to the importance of the post.

<comment><USER6> The purpose for a title is to both communicate the content and attract the viewer. I'd use something a bit more descriptive, along the lines of "new Gmail phishing technique hijacks sign-on page".

<comment><AUTHOR> We can agree to disagree on this.</comment></comment></comment></comment></comment></comment>


Simple solution to the password reuse problem - <AUTHOR> http://grisha.org/blog/2013/05/31/simple-solution-to-password-reuse/ <comment><USER2> This is a prime example why you should leave crypto to the experts. This method in no way should be used.

Imagine one of your hashes leaks. A cracker can notice your password was a hash of something and just run their normal attacks on it for leaked password + salt hashes. They don't know the salt exactly, but it will likely be part of the leaking site's url.

Now the cracker can generate your password for any account you have. Great.

Please use Keepass or another password safe to generate pseudo-random hashes. These were designed by experts.

<comment><USER3> But a cracker can't "notice" that your password was a hash of "something" without knowing exactly what that "something" was, because the output of the hash is pseudorandom and isn't distinguishable from a random string.

Sure, they could assume every random-looking cracked password is a hash and try to crack each one, and conceivably discover your master password that way, but depending on your master password's entropy, that can be as unlikely as you need it to be. And the whole point of something like this is that you can use all your memory remembering an extremely high-entropy master password, rather than a large number of medium-entropy single-use passwords.

<comment><USER2> When we do an analysis on something like this we assume the method of encryption is fully known. Otherwise it's called 'security through obscurity'[1]. If this method got popular at all crackers would automatically start checking all hash-like passwords.

I'm also completely ignoring what would happen if that site were compromised. A little javascript snippet could just forward all passwords to the hacker's server. Even a browser extension could be compromised if it auto-updates. These are implementation details though that could be fixed/worked around.

[1]<https://en.wikipedia.org/wiki/Security_through_obscurity>

<comment><USER4> That is why the pass phrase is required to have a lot of entropy. Even if you know the algorithm used, you're going to have to guess the pass phrase to verify that. And the pass phrase is harder to guess than most people's passwords are.

Aside from the implementation details that you've raised, I'm not finding as many flaws as I expected in it.

<comment><USER2> So put that high entropy pass phrase in Keepass and don't worry about a cracker getting access to all your accounts through a misplaced hash. With all these sites getting attacked you have to assume anything you put in a website is public knowledge.

I mean, using a password safe is no more inconvenient than having to go to a website. When set up, the safe can even be a one click auto-fill deal. I don't see any reason to take the added risk.

<comment><USER4> I'm not recommending this approach. I'm merely saying that it isn't as trivially broken as one would think.

</comment></comment></comment></comment></comment></comment><comment><USER5> From the comments:

> I do something similar via a shell

> echo "masterpassword gmail" | md5

Please do not do this, md5 is not a cryptographic hash and is relatively trivial to reverse. Ie; is possible for someone to discover your 'masterpassword' given any one of your passwords generated via this method.

If one of your passwords is leaked then it is possible for an attacker to brute-force this to find out a list of possible 'masterpassword foo' combinations (although not knowing the length increases the search space).

If one of those foos is 'gmail' for your gmail password then it is game over.

Even if your foo is not similar to the service, if the attacker is able to get 2 of your passwords then the search-space is much smaller (looking only at the overlap of the reverse of both md5 functions).

This may not be relevant if you only take a 'random' sub-sequence from the generated md5, thus only disclosing part of the hash to the attacker.

<comment><USER6> People might not share my sentiment but I think doing this is fine. Yes, all your points are true, but they require the attacker to single you out specifically, and try and figure out your process. Frankly, unless you're a very important person to warrant someone singling you out, an attacker is going to go after the countless easier targets that do not require personal attention.

<comment><USER5> One assumption in security / cryptography is that the process is always known, otherwise it is security by obscurity.

This is still better than password reuse as the plaintext doesn't disclose your other identified without further effort, however the users should be under no illusion of bullet-proof security.

</comment></comment></comment><comment><USER7> Considering this requires you to go back to a single source to retrieve your passwords, I fail to see what this offers over tools such as 1password. I am aware that passwords are not actually being stored anywhere, but ultimately you are doing the same thing: copy and pasting. 1password with a sufficiently strong passphrase to protect the keychain (is it even called that?) is just as realistically impossible to crack.

<comment><USER8> It does occur to me though, that it could be turned into a browser plugin. I'd have no idea whether that would be an improvement over anything, though.

Either way, it is an interesting thing.

And just to play devil's advocate, there _is_ the possibility that someone hosting this code theoretically could add an event handler to surreptitiously send them the content of the text fields by ajax, so there is the issue of implicitly trusting the host even if the passwords aren't stored anywhere.

<comment><USER9> So, host a known-safe copy of the code somewhere in the cloud with https access (e.g., one of your appspot apps). Then you'll know where to find it whenever you need to regenerate a password.

Of course, you'll still need to trust that the machine you are using isn't logging your keystrokes. You face that problem in any case, but it's worse if all your passwords are exposed instead of only one or two.

You probably should have two or three pass-phrases. E.g, one for banking and brokerage, one for other business use, and a third for fora, social networking, etc.

</comment></comment></comment><comment><USER10> This is a great, straightforward idea. But the main problem with these kinds of approaches is that the system breaks down if you ever need to change any of your passwords. There's also the problem of sites with password restrictions like alphanum-only, or maximum of 8 chars, which are unfortunately things a practical password scheme would need to deal with. I think KeePass (or one of the alternatives) paired with a browser extension is still the best solution out there right now.

<comment><AUTHOR> That's easy to work around - use google2, google3, etc as the keyword. A more "industrial" implementation might actually store secure hashes of past/void passwords and increment a nonce until we get a "new" one. The underlying crypto is still sound.

</comment></comment><comment><USER11> Passwords produced are only ten or eleven characters long - pretty good, but they could be longer.

Edit: A recent Ars Technica article[1] suggests an 11-character minimum. Ending with 0 or ! like this doesn't really add a whole character to the search space.

[1] [http://arstechnica.com/security/2013/05/how-crackers-make- mi...](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat- out-of-your-passwords/3/)

<comment><AUTHOR> So make it 11? A SHA-512 in Base-64 encoding is 42 characters long, use all of them if you'd like. Chain them, and get infinite length passwords. My post is a just a demonstration of the technique which requires no disk storage or network transfer :)

</comment></comment><comment><USER12> If we're using master passwords, why not go all the way and use a password file program like KeePass?

I can instantly generate passwords of arbitrary length and complexity and I do so for each new account I create.

<comment><USER13> I suppose the difference here is that there is no password file, like with KeePass. You are re-generating all your passwords with the knowledge in your head.

<comment><USER12> So instead of generating the passwords once, I do it over and over? I'm not sure that's a win.

Because realistically, I'm still going to copy and paste the end result.

</comment></comment></comment><comment><USER14> Just use LastPass (or one of the alternatives, like 1password). Sure it takes a few minutes to set up and learn to use, but once that's done, it will be far easier and less error-prone than something like this. Plugins for all major browsers, as well as a couple of top mobile ones, apps for the major mobile platforms... password reuse is a solved problem.

Sure, it sends data over the internet, but data is 256-bit AES encrypted on your local machine, and then is sent via SSL on top of that. So even if someone could get a hold of the data you're sending, they couldn't do anything with it.

I finally started using LP a few months back after having it on my to-do list for a year, and I only wish I'd made the leap sooner.

</comment><comment><USER3> So, I built something almost identical for myself[1] but lately I've been switching to 1Password. Why? Essentially, it's difficult/impossible to create passwords for all the weird/stupid requirements people think up (no more than X characters, no symbols, require at least 2 symbols, etc.) without storing information about the passwords themselves somewhere. And once you have infrastructure for storing information about passwords, well, you might as well just encrypt the password itself and store that.

In the end, it was fun to build and a cool proof of concept, but the problem it solves is solved more robustly and just as securely by existing solutions.

[1] <http://mawud.com>

<comment><USER15> The requirements could be integrated into the generation scheme. As long as it is reproducible, you are fine. Essentially something like a pipe:

"pretty long passphrase I use for everything" + "bank" | bcrypt | only numbers | length 4

</comment></comment><comment><USER16> This is pretty cool. One improvement that would be nice to see is strength checking on weak "spatial" passwords: I was able to eventually get it to say my password was strong just by walking down the keyboard (e.g., "qwertyioup..." or "qazxswedc...").

<comment><USER17> Same here. I typed in a word and kept typing without numbers until it registered from very weak to strong. But a simple brute force would make short work of such a "source" password.

<comment><USER18> 'I like to eat boogers' is strong. Not against a dictionary attack, I don't think.

<comment><AUTHOR> It may actually be pretty strong - you have 5 words out of, let's say 2000 "frequently used English words" (totally picked the 2K number out of the air, and "boogers" is probably not as common) - you have 31,840,279,800,048,000 possibilities (according to wolfram-alpha "2000 choose permutations of 5").

</comment></comment></comment></comment><comment><USER19> I've been using <http://passwordmaker.org/> for years to do the same thing.

<comment><USER20> I was too. The only reason I stopped using it is because I stared needing to enter my password in things other than Firefox. Not to mention I got tired of having to remember which websites needed which character limitations. I never could get it setup to do this automatically.

</comment></comment><comment><USER21> <http://crypto.stanford.edu/PwdHash/>

<https://www.pwdhash.com/>

<comment><USER22> This! Also <http://wijjo.com/passhash/>

There are (Cross) Browser Extensions running the algo on your computer so can log in directly with your passphrase. You can have the JS code offline or in a Dropbox. There are apps using the algorithm on iPhone and Android. No need to rely on a single website. No need to type/copy'n'paste cryptic passwords. No need to rely on the Browser's password storage. So much better.

</comment></comment><comment><USER23> I made something similar for myself that I've been using:

<https://c-cr.it/new/>

(The "new" version is a few in-browser algorithms instead of my original PHP backend) It's a pretty decent scheme, I think, for most people who are unlikely to be the specific, individual target of some crafty password thief. The technical details of my implementation are described on the about page:

<https://c-cr.it/new/what.html>

</comment><comment><USER24> I think it would be simpler and easier to remember one password to your non- cloud based password program such as Keepass. That way, you can create not only random passwords, but random usernames (since usernames are one key to unlocking your account).

The disadvantage of this approach is that your more restricted on where you can login to services (since you'll need your password manager there, and a trusted computer to run it on).

<comment><USER25> Unfortunately, usernames are very often reused, especially when a site simplifies matters and asks for your email address. This is an especially attractive bit of info because an email address and an easy-to-remember password can net you their email account (so you can delay discovery of your escapades) as well as every ecommerce site where they have an account. Gift cards for everyone.

</comment></comment><comment><USER26> SuperGenPass does something similar as a bookmarklet (<http://supergenpass.com/>) There is a convenience vs security trade-off (an attacker could find the master password with javascript), which the author discusses in the FAQ.

<comment><USER27> Wouldn't this problem be solved by making an extension that runs in a sandbox instead of a bookmarklet that runs on the same page?

</comment></comment><comment><USER28> This is actually pretty clever, simple, and seems pretty secure. I'm not sure about attack vectors if someone has many of your passwords, but this seems good enough for most people.

<comment><USER29> I don't think we should consider the "good enough" case when security is involved. (some) password vaults are secure and yet have a straightforward interface.

</comment></comment><comment><USER30> Having seen the first implementation of this idea years (5+) ago, I never understood why not simply use a password manager? Now you can have them synced with your mobile.

</comment><comment><USER31> I introduced something to HN a while ago, but received almost no feed back. okay.jpeg: <http://www.longpw.com>

</comment><comment><USER32> This is exactly what SuperGenPass is, only the latter is much more convenient.

</comment><comment><USER8> eh.. zxcvbn-async.js is returning content-type text/plain instead of application/javascript (chrome gives me an error about this, firefox doesn't) and sha.js is returning a 404.

<comment><AUTHOR> oops... not sure what to do about the chrome error, but sha.js thing should be fixed, thanks!

<comment><AUTHOR> both fixed now. i was hoping to not have to host those locally, oh well...

<comment><USER8> It works fine for me now.

Condolences to your server though...</comment></comment></comment></comment>


To all JavaScript users, what is an event loop? - <AUTHOR> https://blog.phuaxueyong.com/post/2020-07-08-what-is-event-loop-javascript/ <comment><AUTHOR> What other interesting aspects of JavaScript do you know? We've got to understand our tools better (:</comment>


SQLBoiler 2.0.0 MySQL Support – Generate an ORM (Go) - <AUTHOR> We got some feature requests and a lot of asks from outside of Github as well for MySQL support so we decided to bite the bullet and add it despite it not being 100% beneficial to us (since we <3 postgres). Hopefully others will find this support useful and it can help SQLBoiler grow.
We're sad to rev a major version so short a time after initial release, but we solved quite a few pain points with the way our packaging was structured and how simple it is when you're using the auto-complete that we think is so valuable, and the mysql support did necessitate some of this as well. We also take semver seriously, we broke the API and therefore a 2.0.0 was necessary.
Have fun boiling your databases!
Repo: https://github.com/vattle/sqlboiler
2.0.0 Release Notes: https://github.com/vattle/sqlboiler/releases/tag/v2.0.0 <comment><USER2> Project homepage: [https://github.com/vattle/sqlboiler](https://github.com/vattle/sqlboiler)</comment>


Building Beautiful Command Line Interfaces with Python - <AUTHOR> https://codeburst.io/building-beautiful-command-line-interfaces-with-python-26c7e1bb54df <comment><USER2> I personally stick with plain old argparse for 90% of my command line python apps, but when I need something with more utility/higher abstractions I reach for Click as the author mentions. Click is in a sweet spot in my opinion.

A new package that is interesting is Nubia, by Facebook. You can create interactive shells or use it as a traditional CLI. However, it currently supports only python 3.6/7, I believe, and getting started with it could be challenging as there currently aren't complete docs. The source code is fairly easy to read, however, and it's intuitive after a point.

<comment><AUTHOR> I'm going to have to look into Click then, I've stumbled on this article while doing some research (actually, I did some research about 2 days before and then Google Now or whatever it's called recommended it to me in my feed, but same diff) and will be giving it a try, but I'll try Click as well.

As far as Nubia, I have to say I'm probably a bit biased but I will refuse to use any tools built by Facebook. I would want to do a full source audit beforehand because I trust them not to put some analytics in there about as far as I could throw one of their datacenters.

</comment></comment><comment><USER3> Click is like really smooth. It just clicked for me.</comment>


Tencent facial recognition algorithm finds a missing child after 19 years - <AUTHOR> http://szdaily.sznews.com/MB/content/201906/20/content_674731.html <comment><AUTHOR> More in Chinese [http://in.sznews.com/content/mb/2019-06/19/content_22185256....](http://in.sznews.com/content/mb/2019-06/19/content_22185256.htm)

</comment><comment><USER2> It's amazing what they're able to fabricate to try and paint surveillance in a positive light.</comment>


Introducing Facebook, Messenger, and Instagram Windows Apps - <AUTHOR> http://newsroom.fb.com/news/2016/04/introducing-facebook-messenger-and-instagram-windows-apps/ <comment><USER3> The real story here is that now we know what Osmeta, the stealth startup Facebook acquired a few years ago, has been up to. Look inside the installation directory for the Messenger app, and you'll find that it's using an iOS compatibility layer. Unfortunately, that's bad news in terms of accessibility for blind users, at least in its current form; this thing isn't firing any focus events. But I'm sure that can be fixed.

Edit: I referred to the Messenger app, but the same applies to the Facebook app. The Messenger app was just the one I looked at first.

<comment><USER4> It it doing binary compatibility with iOS apps or just some cross-compilation approach?

Don't have access to a Windows machine and if this is the mentality behind getting apps on the platform, not sure there's any reason to change that.

<comment><USER3> The iOS APIs were reimplemented on Windows. The binaries are DLLs, with a few small EXEs as entry points, but the filenames make it obvious what's going on.

<comment><USER5> I did that for running iOS apps on Android; just recompile with another dll and the app works. It's not perfect but allows fast delivery for those clients who start with iOS and then don't really want to invest in Android (at that time) which, at least here, most of them.

</comment></comment></comment></comment><comment><USER6> Remember when all the major IM platforms supported xmpp and you could just use pidgin/adium/trillian/your client of choice for everything at once?

That was a fantastic time...

<comment><USER7> I remember it as a bunch of applications that supported half of the standards, were buggy, and had clunky fits-none-well UX

<comment><USER8> I feel that way about every windows and linux app, though. Adium on OS X was brilliantly designed. And if you didn't like the design, there were tons of skins for it.

<comment><USER9> Skinning support != user experience.

That said, Adium is one of the best designed OSS apps I've used.

<comment><USER10> Adium OTR on the other-hand had a really bad UX. So I'm happy TextSecure/Signal figured that out.

</comment></comment></comment></comment></comment><comment><USER11> This is exactly what I needed. Now I have a Telegram, HipChat, Slack, Skype, and now FB apps. I think my computer is complete.

<comment><USER12> Time for the next Trilian/Adium/Pidgin.

<comment><USER13> I was a Miranda fan myself. Simple, clean native windows UI. Alternately, Winphone 7 had great twitter/fb integration for contacts, feed, and IM. I'd love to see somebody make that happen again.

<comment><USER14> Oh I remember miranda. Good old times.

</comment></comment></comment></comment><comment><USER15> Shame they're rolling out separate Windows 10 desktop and Windows 10 phone Facebook apps. One would think this would have been a great opportunity for a high profile example of how to do a Universal Windows Platform app.

</comment><comment><USER16> Curious if these were built with the recently revealed React Native for UWP: [https://blogs.windows.com/buildingapps/2016/04/13/react- nati...](https://blogs.windows.com/buildingapps/2016/04/13/react-native-on- the-universal-windows-platform/)

</comment><comment><USER17> What does a Facebook app offer over just giving the website notification permissions in Chrome or Firefox?

<comment><USER18> Personally, I like being able to Cmd+tab to commonly-used chat apps. Really hard to have a conversation (while doing other stuff) when you have to Cmd+tab to Chrome, and then find the tab.

<comment><USER13> In general is there a good browser extension or something for a "browser chat tab" that you keep open and don't want to manage as a normal browser tab/window? With a pulse-on-change feature?

<comment><USER19> Chrome->File->Create Application shortcut does this. Or is that not what you're looking for?

</comment></comment></comment></comment><comment><USER20> Unfortunately they chose to make Instagram a phone-only app. I don't understand why Instagram ignores non-phone devices.

<comment><USER21> This looks like a trend for certain types of services that focus on users active predominantly on a tablet and/or smartphone. I am assuming that these services usually turn a profit via monetisation of advertising 'eyeballs' or user data acquisition and sales, and that losing a small percentage of users who want to use their service with a browser are less profitable.

WhatsApp seems similar in that regard.

I am not particularly interested in these apps, but I am starting to see a disturbing pattern where parts of the internet are being segregated by operating system and the willingness to install and run software (apps) instead of accessing on-line services with a web browser or via open protocols (e.g., IMAP or XMPP).

</comment></comment><comment><USER22> Putting my highly pessimistic privacy hat on, this gives (and has the potential to give) Facebook a lot more information than a web browser would:

* The ability to serve ads without being blocked by a browser based ad-blocker.

* The ability to use its own web view to open web pages and have more tracking of the user's activities.

* Read through all the browser histories and caches that exist on the system to get a good picture of what the user does online.

* Read email files (if not encrypted) on the system to get more information about who the user corresponds with, subjects, etc.

* Read the entire filesystem and probably upload interesting looking file metadata on to their servers for analysis.

* Read what other applications are in use, at what times, for how long they retain focus, etc., building a (somewhat) complete profile of how the user spends time while one of the FB apps _is not_ in focus.

* Get to know all the locations the user uses the computer at and also get more information about the networks (wired or wireless) that the user uses.

* Is a key logger possible with an application on Windows 10???

* Perhaps many more things I've missed...

The above points are slightly similar to what the smartphone apps already have (although the privileges vary across smartphone OSes and versions - <USER2> everything applies to all of them).

It would seem strange for anyone who cares about privacy but needs to use Facebook (yes, that sounds like an oxymoron) to use an official app from a privacy breaking company instead of a browser with extensions to thwart tracking and to block ads.

In the interest of all of humankind, I can only hope these apps get neglected by the users, get abandoned and die a quick death!

P.S.: All the points above apply to any program you run on your computer, but these points become more disturbing when it's related to a company like Facebook.

<comment><USER23> These new apps are UWP based so a lot of things, such as access to the whole file system, running processes, etc. is not possible as the app is sandboxed.

<comment><USER22> Thanks for pointing that out. I wasn't aware of this. This makes things better on several points I listed.</comment></comment></comment>


Ask HN: Crowdsourced headhunting? - <AUTHOR>

As a person growing a company: Would you value a service that has resumes rated by industry professionals over a headhunter? (i.e. a bunch of ranked resumes with feedback by other people in the same industry vs. a headhunting agency that has deemed qualified candidates and forwards them) <comment><USER2> As a person growing a company, what I look for in an employee might be different than what an industry professional working at a larger firm looks for. Depending on how early stage my company is, I might favor someone who has more startup experience, is more passionate about our goal, is capable of doing more than just the job description, has the proper culture fit, and is willing to work more than 9-5. I'd be looking for employee #1 or 2, which is very different than employee #50. Headhunters, although I've never tried them either, might not be a whole lot better/worse.

You also run the risk of misaligned incentives. Ideally, you'd want to have industry professionals who know your industry and can evaluate employees properly, but aren't your competitors. Otherwise, they might try to poach your best candidates or recommend subpar ones.

There's also the misaligned financial incentive for headhunters in general. If they get paid every time you hire someone they recommend, it's in their best interest that you hire sooner rather than later to maximize their revenue/time spent.

How you brand or productize this service can bypass some of these risks. Just some concerns to think about.

An interesting thought: If you have a marketplace with resumes and ratings, the top-rated candidates will be approached much more frequently. This'll make them harder to hire and give them the power to negotiate better terms. Not a whole lot different than the rockstars who get job offers everywhere they apply, but a little more transparent.

<comment><AUTHOR> The misaligned incentives are the hardest problems to solve in this case. An example use case could be a weekly email sent to you with 5 anonymous resumes/bios, of which you pick the best two. You would probably be able to passively collect income as the service could pay ~$100 for each "review" and then pay a bonus if one of your reviewed bios gets hired. Still, there's the incentive to sign off on two random resumes and collect $100. At that point, the question is whether it is worth your time as an industry professional to spend a bit of time and earn side cash. This is completely meant to disrupt recruiting agencies by the way, not to source co-founder level team members.</comment></comment>


JS lib inspired by Prelude (haskell) - <AUTHOR> https://github.com/nicolasbrugneaux/functional-javascript

<comment><AUTHOR> There isn't doc yet, I'm working on it, just to get a taste if people would like it, and/or if there's big flaws to fix</comment>


How to use Amazon S3 like you use CloudApp - <AUTHOR> http://aaronjgreenberg.com/s3_uploader.html

<comment><USER2> Nothing new here, I already wrote about this using node.js, Automator and osx [http://explorejs.com/posts/using-two-nodejs-applications- to-...](http://explorejs.com/posts/using-two-nodejs-applications-to-mimic- cloudapp-on-osx) and the code is open sourced on GitHub

</comment><comment><USER3> I really like the idea. Maybe you could also add a prefix to the file and have it automatically upload into that folder. Lets say st_background.png and it will automatically upload to your static files folder and app_img_filename.png will upload to app/img/</comment>


Examples of errors detected in various open-source projects  - <AUTHOR> http://www.codeproject.com/KB/cpp/errors-in-open-source.aspx#xx4067556xx

<comment><USER3> The mandatory Google Cache link: [http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...](http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fwww.codeproject.com%2FKB%2Fcpp%2Ferrors- in-open-source.aspx%23xx4067556xx&ie=UTF-8&oe=UTF-8)

...cause the article is marked as `deleted' now :-(

<comment><USER4> <http://www.viva64.com/en/a/0077/> seems to have been the original article anyway.

</comment></comment><comment><USER5> I worked for static analysis company.

I am happy to see this kind of analyses popping up here and there. As computers become more powerful, you can do more sophisticated checks.

One of the biggest problems in static analysis is false positives - <USER2> about potential problems which are not relevant for one reason or another, and false positive rate has huge impact on ROI.

Unfortunately, aside from an interface element for triage, article does not mention or link to the article that describes how they are handling false- positives problem in the analysis.

<comment><USER3> The article does not mention whether the bugs have been reported and rectified in subsequent releases, either.

Since at least some of the bugs found are segfault/data-corruption/wrong- query-results level ones[†], one would assume they'd get found out quite soon.

For me, when picking software for a new project, an important metric is how fast bugs get fixed upstream.

\--

[†] I just love how `ones' is a perfectly reasonable expression in english. `Would that it were so in our programming languages', with apologies to Alan Perlis ;-)

</comment></comment><comment><USER6> ...and thanks to the fact those are Open Source projects they can be now easily fixed.

<comment><USER7> Yes, but not necessarily easily integrated into the next release. You can fix it for yourself, but if the project isn't very well maintained, or if the maintainer rejects your patch, etc., etc...

<comment><USER3> That's why some distros roll packages with bugfix patches applied even before upstream maintainers include those in official releases.

Even better, if a particular bug is a show-stopper at your organization, you can build fixed package and deploy it to your local package repository on a short notice; machines can then obtain the update automagically.

</comment></comment></comment><comment><USER8> Also mirrored at: [http://software.intel.com/en-us/articles/90-errors-in- open-s...](http://software.intel.com/en-us/articles/90-errors-in-open-source- projects/)

</comment><comment><USER9> Reminds me of this article on how hard it is to convince companies to use static analysis:

[http://cacm.acm.org/magazines/2010/2/69354-a-few-billion- lin...](http://cacm.acm.org/magazines/2010/2/69354-a-few-billion-lines-of- code-later/fulltext)

</comment><comment><USER10> Article deleted? Here's the Google cache: [http://webcache.googleusercontent.com/search?q=cache:www.cod...](http://webcache.googleusercontent.com/search?q=cache:www.codeproject.com/KB/cpp/errors- in-open-source.aspx)

<comment><USER11> Link: <http://www.viva64.com/en/a/0077/>

</comment></comment><comment><USER12> Article seems to be a rip-off from an Intel article. Original here: [http://software.intel.com/en-us/articles/90-errors-in- open-s...](http://software.intel.com/en-us/articles/90-errors-in-open-source- projects/)

<comment><USER13> Nah, it's was the same guy that posted that. It's an infomercial, not a real article, perhaps codeproject took it down when they realised.

Though kinda interesting anyway if a little blandly written.

</comment></comment><comment><USER11> Article deleted. New link: <http://www.viva64.com/en/a/0077/>

</comment><comment><USER14> Fascinating...on one hand, it's disheartening to see the vast array of errors that can go undetected and how easy they are missed even in retrospect. On the other, it's nice to know I'm not the only one :)</comment>