Advice to avoid public Wi-Fi is mostly out of date - <AUTHOR> https://www.eff.org/deeplinks/2020/01/why-public-wi-fi-lot-safer-you-think <comment><USER3> Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

<comment><USER4> That's an interesting point. As an app developer, I'd assumed that would be handled automatically by the OS.

What's the best way to test for certificate validity? (In my case I'm interested in iOS, but the same concern must exist on all platforms).

<comment><USER5> In my experience, the OS _does_ handle that automatically. If the app isn't verifying it, it's because they went out of their way to disable certificate validation.

Which is alarming.

<comment><USER6> What's the odds that the corporate network the developers are on does MITM https interception, and the only way they could get their app to work was to remove certificate validation

<comment><USER7> Very slim, as you can still verify the certificate chains up to a trusted root certificate and it's trivial (and generally part of the enrollment process) to load the companies root CA on your device.

We MITM and certificate validation works correctly.

<comment><USER8> As far as I understand, this is no longer possible on modern iOS versions at least, except if the app developers explicitly disable that validation.

<comment><USER7> You can pin your certificate in your app bundle such that your app only allows certificates you specify or ones signed by CA's you specify. That clearly isn't the case here. Normal iOS operation will verify the certificate chains up to a trusted root certificate and it is indeed possible to load your own trusted root CAs on to a device for purposes of MITM. Again, some apps may pin their own certificates, but that clearly wasn't happening in this example.

I deal with this virtually every day.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Even if HTTPS is deployed, and even if the client actually verifies the certificate, untrusted networks are still risky.

There are many attacks against HTTPSs itself (e.g. DROWN [0]), bugs (like the Windows 10 crypto bug [1] from just a couple of weeks ago), irresponsible CAs (e.g. symantec [2]), and hacked CAs (e.g. DigiNotar [3]).

Are things better than they were before Let's Encrypt? Sure. But is the advice against public Wi-Fi out of date? I don't think so.

[0]: [https://en.wikipedia.org/wiki/DROWN_attack](https://en.wikipedia.org/wiki/DROWN_attack) [1]: [https://techcrunch.com/2020/01/14/microsoft-critical- certifi...](https://techcrunch.com/2020/01/14/microsoft-critical-certificates- bug/) [2]: [https://wiki.mozilla.org/CA:Symantec_Issues](https://wiki.mozilla.org/CA:Symantec_Issues) [3]: [https://en.wikipedia.org/wiki/DigiNotar](https://en.wikipedia.org/wiki/DigiNotar)

</comment><comment><USER10> > So when you visit HTTPS sites, anyone along the communication path... can > see their domain names (e.g. wikipedia.org) and when you visit them. But > these parties can't see the pages you visit on those sites (e.g. > wikipedia.org/controversial-topic), your login name, or messages you send.

I believe this is the reason Turkey blocked the entirety of Wikipedia[0], which was recently lifted[1]. They wanted to block specific pages that revealed negative information (and I believe they did at some point), but when Wikipedia went https only[2] the only avenue was to block the entire domain.

0: [https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey](https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey)

1: [https://wikimediafoundation.org/news/2020/01/15/access-to- wi...](https://wikimediafoundation.org/news/2020/01/15/access-to-wikipedia- restored-in-turkey-after-more-than-two-and-a-half-years/)

2:

<comment><USER11> Am Turkish, and not really. There is no evidence of Turkey caring about what the individual citizens visit (except in case of a crime investigation etc.) Bans in Turkey works like this: Turkey sees something they don't like on the Internet, Turkey reaches the company / individuals behind it (they can be anywhere in the world) and tells them "take it down or we will block your access to Turkish citizens and you'll lose revenue / traffic". If the site owners comply nothing happens. If site owners refuse for any reason, they block the site so it is not accessible from Turkey. In the older days, they used to do it through DNS but it was easy to circumvent. Now they use other methods so changing your DNS isn't enough, but a VPN works just fine.

This was also the case before https wasn't as common BTW. Turkey either didn't have the technical capability to block individual pages (even back then) or they were seeking to punish the site by blocking access in whole.

A site like wikipedia values integrity more so they don't take pages down without good reason. But companies seeing Turkish citizens as a revenue source generally comply. If you browse Twitter in Turkey, it is common to see tweets where it just says something like "this tweet is blocked in your country" \- Turkey reaches twitter to mark the tweet invisible and that individual tweet goes away. IIRC it also applies to entire profiles - I'm not a frequent twitter user but I remember seeing entire profiles blocked by country.

<comment><USER12> I feel like asking the site to take something down ... is effectively caring about who sees it. Otherwise you wouldn't do that.

<comment><USER11> Sorry I was not clearer. What I meant was an operation like in China where you have to be careful about what you look for on the Internet. I saw a video from China where the police was interrogating someone supposedly because of his remarks about police confiscating motorcycles in WeChat. They were actively mass monitoring, found someone they didn't like and took him in for intimidation and questioning, perhaps more. So in effect, they are monitoring what individuals are doing on the Internet to catch and punish them en masse. My point was this type of "watching citizens and snubbing those that look at things they are not supposed to see" thing is not (yet) a thing here. You can go ahead and "read" anything, they don't care (by that I mean nothing will happen to you) but they have a problem with the site being able to serve a Turkish audience here.

</comment></comment></comment></comment><comment><USER13> Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.

<comment><USER14> refresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?

<comment><USER15> correct, assuming you don't let yourself get tricked into trying without https.

<comment><USER16> Which, if my experience pentesting is any indication, most people will.

<comment><USER17> This. The question of public WiFi often isn't "can you keep your comms secure if you try", but "will my average user who just wants stuff to work While traveling be better off on their own mobile hotspot or connecting to dodgy free WiFi?" Unquestionably, they'll be better off avoiding public WiFi.

Applications like Outlook will warn you about cert problems but still let you bypass them. This could be better on app side, but it's a reality end users deal with. And when/if IT knows about it, it's because the user complains that their laptop/Outlook is broken. The avg business user doesn't think about cert chains.

</comment></comment></comment></comment></comment><comment><USER18> > But these parties can't see the pages you visit on those sites (e.g. > wikipedia.org/controversial-topic), your login name, or messages you send. > They can see the sizes of pages you visit and the sizes of files you > download or upload.

Given the pattern of sizes of data you request, one can do seemingly-amazing things such as figure out what area of Google Maps someone is looking at based on the visible map tiles or figure out what movie someone is watching on Netflix based on the MPEG fragments or guess what article someone is reading on Wikipedia based on the pattern of requested media files. Note that these are each practical attacks that people have implemented; I have also seen a strong argument for a type ahead search attack based on the sequence of search response sets but I don't know if it has been implemented and it feels harder to pull off reliably.

<comment><USER19> Sure, and if you're under a repressive regime or have reason to think that someone is targeting you, you should probably still avoid public WiFi (and take a bunch of other countermeasures as well). But for the majority of people, who just care that their banking info isn't compromised (etc.), public WiFi is fine.

<comment><USER18> And if that is what the article said, I wouldn't be annoyed; but it went out of its way to claim that people wouldn't know what pages you were visiting, and that's a naive misinterpretation of what encryption is buying you.

</comment></comment></comment><comment><USER20> What is up with these b.s posts about open or public wifi being safe this week? A few days ago there was a twitter thread by a security person at a hotel claimig their open wifi is safe.

I won't detail all the many harms you can suffer (or the threats that will readily cause you harm),but let me state just one argument related to eff's silly (and dangerously harmfull ) statement here:

1) when you type in a domain in your navigation bar, your browser attempts to connect to unencrypted http(port 80)

2) if (big if!) The site supports https it will do an http 301 redirect to the https version of the site.

3) An attacker needs to intercept just one such redirect to have an opportunity for credential theft or content injection (downloads,exploits,etc...)

3) your browser does indeed remember these redirects going forward,which is great.

4) Except if you configured your browser to forget all history. Or if you happen to remember a site you visited a while ago (perhaps on a different device) and just typed it in to navigate. Or if you typed in something to search but your browser navigates to it,or many other opportunities for pwnage!

5) you don't care about that? Well attackers are happy to setup a malicious captive portal(captive portal checks are plain http for all browsers I know of) and use that directly or to social engineer installation of an app you "need" to connect (oh,mitmproxy has a nifty captive portal like page you can customize to install a CA cert on the device for TLS interception)

I won't even begin to talk about at least half a dozen additional classes of MITM attacks that can be used, even with wpa3 and client isolation! What you have to understand is that vulns that would normally be low severity are amplified in this sort of a network, due to the sheer magnitude of threat exposure.

I can't complain about most people being ignorant to good infosec practices(we have to understand+educate) but man this stings! The eff makes one of my favorite extensions HTTPSEverywhere, how can they post this? It takes a long time to educate people about good security practices.

</comment><comment><USER21> I think jumps the gun a little.

When sharing a network, there are other attack vectors into people's unhardened laptops except browser MITM. Do you have any unprotected shared folders? Can someone brute force your login via RDP? Can you account for all the listening ports running on your device?

A NAT provides strong protection by simply firewalling you from the outside world. It's so common that the focus (rightfully) zoomed in on MITM as that is the only thing "left", but in a shared network, the adversary may reside on the inside nulling that protection. Most users have not taken precautions against this.

Oh, and shoulder surfing.

<comment><USER22> _Do you have any unprotected shared folders?_

It's surprising how many people have unprotected shared folders. And for some reason they very often are full of music.

Spend a few days on a hotel's wifi and you can slurp up thousands of other people's MP3's.

</comment></comment><comment><USER23> Passive interception is less of an issue because so many sites are using tls, but in the case of a mitm attack isn't https stripping still a problem unless the site is using hsts?

<comment><USER24> You would have to trust a root certificates from your mitm attacker, so it is not a problem.

<comment><USER23> When you first access a site, unless the site is using HSTS you are going to go to an insecure version so a mitm can proxy the request and remove tls or redirect you to another site. This is what is known as "https stripping."

<comment><USER25> You are talking about "HSTS Preload", HSTS doesn't do anything on first access.

<comment><USER26> HSTS helps unless you are always on compromised networks or the site uses short TTLs. Even without preloading most people are probably not accessing their bank for the first time ever on a malicious network.

</comment></comment></comment></comment></comment><comment><USER16> They're talking exclusively about web browsing, though. There's more to net access than the web.

Personally, I just always use a VPN (and a firewall to ensure that no traffic flows except through the VPN). Then I don't have to worry as much.

<comment><USER27> HTTPS is not limited to web browsing. It's also how the vast majority of desktop apps communicate on with web servers.

</comment></comment><comment><USER28> I remember in 2005 when you could just start up Ethereal, run it for a minute, and get many people's email passwords, email, everything...

I think Wi-Fi security is going to be a major FUD talking point for the telecoms as they try to justify high prices, 5G, and the rest of their trip.

5G as it exists now does little to compete with WiFi because (in the millimeter wave form) it doesn't pass through walls. The overwhelming majority of data consumption happens indoors, so it can't make for a revolution in the market unless you get a huge number of antennas and/or cells installed indoors.

That's immensely problematic because building managers aren't going to want to have Verizon, AT&T, T-Mobile and maybe someday Dish Network stomp through their buildings, drill holes, do damage, etc.

There has been talk of wholesale access networks, which would be a great idea (e.g. a neutral vendor installs indoor infrastructure that gets rented by the carriers...) but the carriers are dead set against it.

<comment><USER29> But 5G is not meant for in house consumption. It is meant for crowded spaces like train stations, supermarkets to offload other bands. Then you get micro cells installed indoors inside of supermarkets. (what I mean by supermarket means mall and all those kind of shopping centers)

It is meant also for all kinds of smart sensors in area, but not like home sensors but utilities. We have that with LoRa, but it is really small data amounts, where 5G would be used for sensors that need more data, like smart traffic lights? Then you won't have to connect your old traffic lights to some cable network and they would get good connection capabilities.

Right now 4G is not used everywhere, in less dense areas you only get 3G. Of course providers will install base stations for 5G in places where it is economically possible. Places that have 3G now are not getting 5G anytime soon. It is also understandable that 900MHz is better for longer range than 1800MHz.

<comment><USER28> 5G below 6GHz really requires dynamic spectrum sharing with 4G. Once that is standardized, carriers can gradually switch out 4G for 5G with modest but real benefits.

I was part of a group that installed some radio gear on the roof of the local mall and I can say that the building manager of the mall was a tough customer. It really helped that he liked our (union) electrician and was certain we wouldn't contribute any leaks to the roof.

Carriers used to use the IBEW and CWA and had some standards for the quality of work done. Today carriers tend to use non-union contractors -- some of those people are excellent to OK but some are real idiots that any property owner would want to keep far away.

So far as serious IoT goes I think the coverage problems will still dog IoT. With fiber you can get 100% coverage -- it costs money, but there is no site that can't be served.

Will cell phones carriers will tell you they cover 98% of POPs, when you investigate it might be more like they cover 89% of POPs. With wireless systems you make a rather large capital investment that rapidly erodes in value to get to that 89% coverage but then the cost explodes from there.

</comment></comment></comment><comment><USER30> Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

<comment><USER31> This only works if your mitm ca is preinstalled in the client device.

</comment></comment><comment><USER32> As other people have mentioned, HTTPS without HSTS still makes MitM a problem.

And there are still other attacks possible on public wi-fi networks which don't involve MitM-ing HTTP(s) traffic. MitM DNS traffic and you can do nasty things: [https://github.com/infobyte/evilgrade](https://github.com/infobyte/evilgrade)

</comment><comment><USER33> "So when you visit HTTPS sites, anyone along the communication path - <USER2> your ISP to the Internet backbone provider to the site's hosting provider - _can see their domain names (e.g. wikipedia.org)_ and when you visit them."

Except wikipedia.org does not require SNI.

Most HTTPS sites do not require SNI.

Not every client sends SNI by default. OpenSSL's s_client does not. There are others.

        printf "GET /wiki/MediaWiki HTTP/1.1\r\nHost: en.wikipedia.org\r\nConnection: close\r\n\r\n"|openssl s_client -showcerts -connect mediawiki.org:443 -ign_eof

Some sites "require" SNI, but then do not check it against the Host header. A client can send any SNI.

        The server certificate says *.wikipedia.org.

But there are numerous websites sharing the IP addresses for wikipedia.org, not all of them serving Wikipedia content. One example is mediawiki.org.

What if a website padded all its pages to be the same size.

</comment><comment><USER34> This seems like weird _advice_ to give out.

Sure, it's not as dangerous as it was... Or is it? All the tools are mature now. Documentation is rife. A seven year old with a Raspberry Pi can set up a hotspot and spike your DNS. This thread contains a litany of security papercuts across the whole stack. DNS, shitty apps, crappy server configs and sites that just don't care.

So yeah, it's no 1999. You're probably not getting your FTP password sniffed off a public network these days, but there are still plenty of reasons for me to use 4G or WireGuard instead of trustless networks.

Public Wi-Fi will remain firmly on my "list of things to worry about" until I can audit all traffic from my devices.

</comment><comment><USER35> Even if a WPA2 wifi point has a password, isn't the encryption key shared among all connections? I.e, if an attacker has the wifi password, it nullifies the wifi encryption? I recall that fixing this was one of WPA3's selling points.

<comment><USER36> Not exactly, you need more information than just the WiFi password in order to decrypt the traffic: [https://superuser.com/questions/156869/can-other-people- on-a...](https://superuser.com/questions/156869/can-other-people-on-an- encrypted-wi-fi-ap-see-what-youre-doing)

</comment></comment><comment><USER37> VPN companies have been using the "omg public wifi scary" meme to market their products. I agree with EFF here.

</comment><comment><USER38> Isn't domain information still in the clear? (What specific domain you're connecting to.)

<comment><USER39> The exact hostname is delivered in SNI (serverNameIndication) during connection yes. Figuring out a safe reliable way to encrypt this data is an ongoing work item for the TLS Working Group after TLS 1.3 wrapped up. If you have a recent Firefox (possibly only in Nightlies?) you can see one possible approach work with Cloudflare sites which opted in. You will also need encrypted DNS (DPRIVE e.g. DNS over HTTPS) or it's largely pointless.

</comment></comment><comment><USER40> I still http-only links on Hacker News regularly.

</comment><comment><USER41> tl:dr;

      "You would be safe in active war-zone (eg. syria) because you are civillian and do not carry any weapons with you"

No, you are not safe at all. Lets assume public wifi requires acceptance of terms and conditions.

\- Redirects all pages (from your Mac/Ip address) to their server

\- There is checkbox on the page for ToS/ToC approval and 'Continue' button

\- Behind the scenes clickjacking/framebusting happens [0]

\- You get PWNd or monetized.

\- also being fingerprinted by company. eg: amiunique.org

Given conditions, they can inject ads/cookies to track you even after you go away. (eg. at home)

[0]: [https://blog.innerht.ml/google-yolo/](https://blog.innerht.ml/google- yolo/)

</comment><comment><USER24> The EFF is awesome with Let's Encrypt! It was really a dreadful task to buy and renew certificates, especially as out infrastructure back then wasn't that automated.

I think this article is a response to all those ads from VPN companies. They do try to scare people about public WiFi's.

<comment><USER42> One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. In the case of Apache it would be one of those "mod" type of packages. Someone feel free to let me know if this is already the case though, I would love to make note of it.

Edit:

Looks like Apache has one called 'md':

[https://httpd.apache.org/docs/trunk/mod/mod_md.html](https://httpd.apache.org/docs/trunk/mod/mod_md.html)

Your move Nginx? :)

<comment><USER25> _> One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. _

This is not as useful as you think. In nginx you only need a couple of extra lines of configuration to let an external program issue and renew certificates independently from nginx, without reloads, etc. Definitely not worth developing a C nginx module that starts a helper process that does that just so that a few people who run nginx on a single server could get their certificates issued with only one line of configuration.

<comment><USER43> You still need to reload nginx for it to start using the new certificates. But you're right about issuing/renewing certificates. I have a small snippet like this in all my server blocks:

      location ^~ /.well-known/acme-challenge/ {
        allow all;
        default_type "text/plain";
        root /var/www/letsencrypt;
      }

And to issue a cert (and automatically renew in the future) all I need is:

      acme.sh --issue -w /var/www/letsencrypt/ -d example.com --reloadcmd "service nginx reload"

Although recently I've been using the Cloudflare DNS option also offered by acme.sh instead of webroot mode. It doesn't make any difference in my issue workflow because the domains are already on CF DNS anyways, but it's required for wildcard certs.

I definitely agree in not seeing added the value of a nginx module over my current solution.

<comment><USER25> Since version 1.16 certificates can be dynamic, no need for reload.</comment></comment></comment></comment></comment>


Ask HN: If you had a chance to rebuild the internet, what would you change? - <AUTHOR>

True anonymity at the lowest level of the stack? No ads? Standard runtime environment to target instead of the 'mess' of ((DOM + CSS + JS) * browsers) we have now? Built-in state? <comment><USER2> Usage, technology, resources, bottlenecks - all have been changing all along the time and further will change. The ideal solution of today will not be a good solution for tomorrow. What you call mess, is the result of an evolutionary development that will be replaced by something appropriate when the time has come. Although your question is surely mind-challenging, it assumes that a bright from-scratch design would beat the outcome of the competition of different technologies. I don't believe in that.

<comment><AUTHOR> edited the original to add quotes around 'mess' ... guess I'm just cranky from the javascript nightmares I've been having lately.

I agree with letting evolution & competition do its work, so let me rephrase: "Given the opportunity to re-arrange the basic conditions out of which the internet evolved (TCP/IP, HTTP, SMTP, HTML, ...) what would you change." The choices encoded in these standards are as much ethical/philosophical as technical. Do we value security? Openness? Speed?

I agree with IPv6 & getting rid of NAT on a technical level. What else?

<comment><USER3> Get the technical level right and the rest will come.

Mechanism, not policy.

</comment></comment></comment><comment><USER4> 1) A better mail transfer protocol. I don't view spam as inherently inevitable, but with SMTP it seems to be.

2) Internationalization from the ground up. Domain names are still effectively limited to 7 bit ASCII (even though "dots" are represented by '\0's in the DNS, which doesn't rule out UTF-8, in practice it doesn't work well). I also still get mail I can't read, even when it's in a language I can, because of encoding issues (increasingly rare, but it still happens).

<comment><USER5> Spam makes its way into anything (search engines, social networks, blogs, twitter, you name it). In essence it's just low-quality advertising at an extremely low cost. Whatever makes it possible for people to communicate cheaply also enables spam.

A "better" mail protocol would still have to be free, or very cheap. Snail mail is not free and you still get junk mail.

<comment><USER6> How does spam make its way into twitter?

<comment><USER7> Spammers set up account and then mass-follow other accounts. See also <http://mashable.com/2008/04/14/twitter-spam-out-of-control/> and <http://www.twitterspam.com/> .

I've never used Twitter, I just found those two links by Googling for "Twitter spam".

<comment><USER6> Thanks. I've been thinking about these problems recently ([http://cratuki.blogspot.com/2008/04/blogs-as-email- replaceme...](http://cratuki.blogspot.com/2008/04/blogs-as-email-replacement- mechanism.html)), and twitter is the foremost model I've had in mind as an example of a spam-proof system!

I still think the model is good. The follower spam problem described in those links (this too: <http://www.stoptwitterspam.com/blog/about/>) is indeed spam but could be could be fixed without it breaking the essence of the twitter approach.

I'm convinced that spam is a result of weaknesses in the model of the email system and not inevitable as you suggest. If we had our time again we would be able to standardise on a better model and for this reason was a bit surprised that you just accepted spam as part of life.

The blog link at the top describes some of my thoughts. Models that involve variable payments work as well because they directly price on how much you want to be paid by people who waste your time. In such a world I'd love it for people to spam me.

<comment><USER7> I think you have me confused with someone else -- my first entry into this thread was my post above providing the links to information on Twitter spam.

That said, I mentioned in another comment in another thread that I have to spend some of my time dealing with spam and all of its people effects on a pretty regular basis. I've also screwed around on the 'net since Mosaic, and dialed in to local BBSes before that (I started young :-).

In my opinion, any form of two-way communication which allows anonymous entry will be vulnerable to spam. I certainly can't think of a workaround for that, and nobody else has managed to yet, either. I agree that Twitter spam has a good chance of being eradicated once they tighten things up a little. However, in part they have that chance because Twitter isn't fully bidirectional -- there's no way that I know of for a Twitter user to send messages to someone who hasn't signed up to follow the user.

</comment></comment></comment></comment></comment></comment><comment><USER8> I would change almost nothing on the web side of things. Having no ads would seriously change the business of the internet today. Who would foot the bill for everything that we use now? End-users?

HTML is a leveler for a lot of people, and it helps designers and developers actually work together, instead of being limited (VS.NET), it also allows for quick (albeit not always concurrent) innovation, and competition. TCP/IP Is so well generalized that you can do anything with it. Redundancy is not well executed, but it doesn't have to be if the pipes get bigger.

Doing things like calling new developers "incompetent morons" stifles innovation. I certainly would have quit a long time ago, if when I started there was no room for mistakes.

HTML and Javascript were the 'gateway language' for me for all sorts of things.

<comment><USER9> "HTML is a leveler for a lot of people, and it helps designers and developers actually work together, instead of being limited . . . "

Precisely. It used to annoy me when people would ask me what language I "program in". I've since learned to just explain that I write code that can be rendered, downloaded, executed, or otherwise modified (locally and remotely) through a browser or IDE and without (necessarily) having to be connected to the Internet.

But anyway. I think if I had the chance to rebuild the Internet, I'd build in an all-inclusive productivity-meter. This productivity meter would gauge, record and reward people as both content producers and consumers/participants of media. This question reminds me. . . there's actually an interesting piece in this video:

<http://www.youtube.com/watch?v=0fUHtc37MC8>

about that concept of ripping down the barriers between producers and consumers of media.

<comment><AUTHOR> Such a productivity meter (mind if I rephrase it as 'contribution-meter'?) assumes strong identity, the lack of which I think has greatly contributed to the rise of the internet.

At the same time strong identity is at the core of the whole OpenID / OpenSocial /Social Graph debate. Are we trying to build something that should have been included in the first place?

<comment><USER9> Interesting question. I think the "lack of identity" to which you refer has greatly contributed to the rise of Telecom and Internet giants. Also has it likely played a significant part in the erosion of Net Neutrality. There are still far too many corporate-centric entities which control or wish to control and influence what is or becomes popular or noted in traditional media outlets (television, radio, cable, etc.)

Traditional media relies upon what marketing people call "push advertising" where people are encouraged to take what is being said in the commercial/infomercial as fact. The Internet, however, is literally able to generate its own "pull advertising" as it enables people to participate and research between or among alternatives. Think of the Mac VS PC VS Linux spoofs. Apple spends zillions of dollars in advertising (which is one of the reasons their products are so expensive!) and many PC manufacturers do, too ("Dude! You're getting a Dell). But Linux doesn't have any advertising, really . . . (Novell does not count), but that hasn't prevented it from gaining momentous adoption in recent years.

But anyway, before going too off-topic:

Maybe it's not that strong identity should have been "included in the first place," but that the infrastructure could have been planned better to include room for a more equitable exchange among "providers" and "producers" and "consumers". After all, it's not like the ISPs or Internet giants are actually the entities _producing_ most of what is interesting or useful on the web. Of course, those touting themselves as "providers" would like most people to equate them and pay them as "producers" and such.

</comment></comment></comment></comment><comment><USER3> Man, a lot of people here are violently opposed to allowing invalid markup. I think that the lenience web browsers afford site creators is a boon. It is one of the key factors in the democratization of the web. Low barriers to entry have been a critical factor in the success and organic growth of the web. Requiring perfect syntax and markup as a method of keeping out the plebes is the kind of self-righteous cult-of-the-machine which drives out the very people who provide content and value to the web.

Now, if you _do_ have correct markup and the browser developers still screw it up... off with their heads! Shame on you, you should know better.

<comment><USER10> Shouldn't we "democratize" other programs, then? How about making GCC or CLISP accept incorrect syntax? That would allow more people to provide content and value.

We might end up with a lot of programs that only compiled correctly on one platform (gcc quirks mode!), but it would lower the barrier-to-entry for new programmers.

</comment></comment><comment><USER11> S-expression syntax for markup, Scheme in place of JavaScript, and I'd like HTTP to have a header that sets modification times or other cache information for resources other than the one being sent in the current response.

</comment><comment><USER12> IPv6 instead of IPv4. No NAT and enough IP's for all your network devices (pda, laptop, printer, etc.)

<comment><USER13> Well, I think the IPv6 switch is finally going to have to happen anyway within a few years. So hopefully, you'll get your wish.

<comment><USER12> I'm hoping too but currently no ISP I know has IPv6 support for customers (they may have on their backbone).

</comment></comment></comment><comment><USER14> How can you have innovation if you get a standard runtime environment ?

If I would do something I wouldn't display the pages if the markup isn't correct.

</comment><comment><USER15> I agree with mark_ellul, reverse domain name resolution.

com.google.maps etc...

I'd also like to see more crypto.

</comment><comment><USER16> Strong Crypto from the ground up. Binary standards instead of HTML, so if anything is broken even the least it cannot be displayed.

JS goes out the window and is replaced by a scheme like language that can process HBML as if it was native list.

But those are minor points when you compare it to the first.

</comment><comment><USER17> DNS.

I don't know exactly what I'd change, but I'd look for a way to make it impractical for the whole domain/certificate "industry" to get where it is today. ICANN, Verisign, Network Solutions and the like are all just scams.

</comment><comment><USER18> _Standard runtime environment to target instead of the 'mess' of ((DOM + CSS + JS) x browsers) we have now?_

This is what I've always wanted. When the web first took off, I was constantly whining about how remote application UIs were going to get shoehorned into the model of _document layout_ , of all things. It seemed short-sighted and dumb.

In retrospect, I'm not sure the web could have become what it is with something more like java applets, flash, or AJAX in the forefront. Document layout isn't what we're really doing, but it's a simple starting point that everyone can get behind.

</comment><comment><USER19> I think IP and TCP/UDP work pretty well... seems like they messed up a bit on the size of the address space. That's what I would call the "internet" (along with some general services, e.g. DNS). Sounds like you are talking more about HTTP/HTML.

True anonymity seems a bit hard (when you make a request, the reply has to go somewhere).

With regards to the "standard runtime environment"... I'd add true bidirectional communication, and a built in local storage mechanism (though Google gearbox and the flash hack seem to have mitigated this).

UPDATE: (fixed some cases).

</comment><comment><USER20> Why do some people want anonymity? Bad idea IMHO

Privacy? Yes of course. Anonymity? Definitely not - just means people can do what they want without any come back.

<comment><AUTHOR> Tell that to people in some more oppressive regimes, or in places where the alignment between what is legal and what makes sense is out of sync. True anonymity is hard to implement, but it certainly has its virtues.

<comment><USER21> Interestingly though my college professors were talking about Internet2 and they seem to think the problem is _too much_ anonymity; they want the US government to be able to track down any communications, you know, to catch "teh terrists"

Edit: Not saying that's what internet2 is for, just what my CS professors were speculating it needs to do.

<comment><USER20> For me, it's more a question of responsibility. If everyone is anonymous, there is no accountability. There's no reason to be responsible. No reason to be well behaved.

On an anonymous internet, you can just attack websites you don't like, post incorrect claims, abuse people and be a complete pain in the neck.

<comment><USER3> _On an anonymous internet, you can just attack websites you don't like, post incorrect claims, abuse people and be a complete pain in the neck._

You can do that already. On the other hand, if you have anonymity you can still choose to give yourself a name and identity. With strong identity you can even prove that it's you. Or at least that it's the same person each time.

There are lots of good reasons to allow anonymity.

</comment></comment></comment></comment></comment><comment><USER22> Build in semantics from the ground up.

<comment><AUTHOR> if & when we figure out the semantics in the first place, but I agree: some mechanism for adding metadata at a low level would be great. (Ya, I know, microformats)

</comment></comment><comment><USER23> Do you mean the internet, or the web?

<comment><AUTHOR> I meant internet but most people seem to focus on web these days. For example I miss the old usenet days.

</comment></comment><comment><USER24> reverse domain name resolution... eg. org.reprap

<comment><USER25> I'm sure you're not being facetious, but I can't figure it out. What's the advantage of this?

<comment><AUTHOR> I think he points to the fact that reverse domains look a lot more like tree structures which humans are inherently very capable of understanding. With the current system the human url decoding process goes something like this:

* "Find the third forward slash in this string ..." * "Read backwards & split on dot, there ya go: the tree path of the organization giving me this information ..." * "Now, skip forward to that slash again ..." * "From here on, split on the slash & that will be the tree path leading to the data this organization wants to give me"

We're probably all conditioned to it now, but it's not exactly beautiful ...

<comment><USER25> Ok yeah, com.google.mail/inbox preserves the tree hierarchy

<comment><USER26> So, instead of the dot com bust, we would have had a com dot bust?

</comment></comment></comment></comment></comment><comment><USER27> Luckily, people smarter than any of us thought about this a lot already. Unfortunately, with that sort of brain power comes craziness.

Check out the articles and books by Ted Nelson, Douglas Engelbart and Vannevar Bush.

</comment><comment><USER28> If we were to rebuild the Internet today, we should remake it using a fully decentralized model instead of a distributed one. By turning it into a mesh network, it would make it a lot more robust.

</comment><comment><USER29> I would remove extensions from domains, e.g., "news.ycombinator.com" would just be "news.ycombinator", and "google.com" would just be "google".

</comment><comment><USER30> Would of created the Semantic Web initially.. would of solved data integration problems on the way too!

</comment><comment><USER31> if you think something is wrong with the Internet, then build a startup around the problem.

<comment><USER26> Heh, what do you suppose the intent of the question was? He's fishing for startup ideas!

</comment></comment><comment><USER32> an extra level of indirection in all protocols for redundancy. the MX records in dns for mail are a good example. it's currently rather tricky to get good redundancy (fault tolerance) in software.

</comment><comment><USER33> Persistent connections to the server from Javascript.

</comment><comment><USER34> Kill NAT!

</comment><comment><USER35> No concept of bandwidth

<comment><USER35> Why did I get down modded!

<comment><USER36> Because it doesn't make any sense? How can you possibly have internet "without the concept of bandwidth"? Do you mean you want infinite bandwidth at no cost? That's not a very mind-expanding proposition.

</comment></comment></comment><comment><USER37> (1) No ads

(2) If your markup is not syntactically correct, the browser won't display your site.

</comment><comment><USER38> Kill, maim and murder the insanity of "be liberal on what you accept and conservative on what you emit.". Instead, have a standard dtd, and if any site deviates even a bit from it, render flashing red text on the site that says "The developer of this site is an incompetent moron. You really shouldn't trust him or do business with him." Make implementing this feature required part of every web browser.</comment>


Self-Discipline Outdoes IQ in Predicting Academic Performance in Adolescents - <AUTHOR> https://camcom.ngu.edu/Science/PSYC/PSYC%202385/Dr.%20Dobson%27s%20Spring%202009%20Course/Article%20Review%20I/Biological,%20Cognitive%20and%20Social%20Development%20Articles/Self%20discipline%20and%20academic%20success.pdf <comment><USER2> I wouldn't be surprised if this held true for particular subjects that are generally thought of as "hard" as well. My favorite is mathematics. I used to have a really tough time with maths and used to hate it. Then, the smartest friend I have (who coincidentally did his PhD in financial mathematics with Freddy Delbaen back then -- for those who don't know this area, that means he was really good) once made an offhand remark along the lines of "Most people think of mathematicians as 'geniuses' -- if only. You have no idea how much you simply have to learn by heart and how much work it can be." That sort of pushed me over the edge and I started to re-learn mathematics from the ground up, starting with, yes, high-school material, working my way up with MIT OCW courses (<http://ocw.mit.edu>) and eventually being able to take PhD classes in statistics in the space of about 2-3 years (incl. periods of part- and full-time work). Not bad for a guy who couldn't tell the difference between cos and sine functions when he started. And all because I shed the notion of "math is for talented people" and started to actually work my ass off. It was surprisingly "easy" once I put in the work and I also noticed how shortcuts taken in one part would hurt me down the road later so it really was all about remaining disciplined.

<comment><USER3> I just finished a course on integral calculus...one of my classmates said he put in 20-30 hrs/week and he ended up dropping the class - he just couldn't understand the problems and he was a terrible test taker. I put in a lot of work in the first month or so then the rest of the course sort of just sailed by. I guess my only point is, YMMV...

<comment><USER4> Integral calculus is easy - it's all about calculation. Where math got hard for me was when the focus shifted from calculation to proof (abstract algebra, number theory, real analysis). I thought I could coast by with the same sort of intuitive understanding I had with calculus, but I was wrong and I didn't have the self discipline that was required to do well.

<comment><AUTHOR> With proof you have to do a whole host of them first. I remember, filling a book with proof. Eventually, a pattern will emerge and they would be easy. At first, I used to hate them but practise enough times and you would want them to show on the exams.

</comment></comment></comment></comment><comment><USER5> I'm not surprised.

For me school has always been about discipline and dedication and not about skill. The school adapts itself to a lower difficulty so that more will pass and they compensate by making it more cumbersome so that the skilled, but not so disciplined, will get bored and not perform as well.

This was also my personal experience. I was pretty good at math but I never got any challanges so I just didn't do anything, but luckily I aced the tests and the only homeworks we got where to have complete the chapters. This translated to other courses where I was good, but I got bored and not motivated so I got a lot worse grades than I could've had if I was dedicated.

I managed to motivate myself later on to get good grades, other would call them great, but I know I could've had straight A grades if I just weren't so lazy and skipped a lot of hours.

Furthermore it doesn't help (doesn't show in grades) if you know a subject really well. Often the workaholics, or a bit nicer: those with more discipline than me, would just study like hell before a test and get a great score, where I wouldn't but I knew the subject well enough so I would get a great score too. I'm a bit upset with this because I doubt that they could remember anything from those tests but I felt I could remember them for months.

<comment><USER6> >I'm a bit upset with this because I doubt that they could remember anything from those tests but I felt I could remember them for months.

On one Calculus test I had, I didn't study or do any of the homework and pulled a ~90% score. When talking to someone who got a perfect 100%, he casually informed me that he forgot how to integrate between tests. I was shocked to hear this, but apparently it's the norm.

</comment></comment><comment><USER7> And if you are here reading this after telling yourself you really would code your ass off today, you already lost.

<comment><USER8> And if you posted on this thread after telling yourself you really would code your ass off today...

Seriously, though, sometimes taking short breaks can cause you to be more productive than just slogging through. Not all trips to the internet are procrastination. Sometimes you really do need to just stop coding for a few minutes. Though I imagine there are better ways to recharge your mental batteries than HN. HN just makes you think too much sometimes.

<comment><USER7> Err, my short stops are from BC2...

</comment></comment></comment><comment><USER9> Duh. But you can get pretty far on pure IQ. Every male in my family is a useless lazy sack, but we all have science PhDs.

</comment><comment><USER10> They controlled for IQ, but they didn't control for desire. Some people want to make good grades for pride, to impress their parents, etc.. Others would rather do something other than the busy work required to be in the 94th percentile as shown in the graph. There is no difference between getting As and Bs in 8th grade. Colleges mainly look at grades in 9-12.

</comment><comment><USER11> Why do you care about academic performance? Wouldn't your time be better spent on entrepreneurial endeavors?

BTW, it appears that fast thinkers are less likely to be creative people:

[http://www.newscientist.com/article/mg20527535.500-a-slow- mi...](http://www.newscientist.com/article/mg20527535.500-a-slow-mind-may- nurture-more-creative-ideas.html)

</comment><comment><USER12> In our current world, full of colorful distractions, an education system that relies on self-discipline is obsolete.

Some students have a "discipline" trait, they'll force themselves through boring drudgery to get the A, then never look at the material again, the A is all that matters. That's a waste of time.

True "discipline" comes from having an interest in the material. That interest has to be sparked by something, the material gives you a buzz, and working on it does not feel like work. That's not something I'd call self-discipline.

</comment><comment><USER13> "compared with their more impulsive peers, highly self-disciplined eighth graders earned higher GPAs and achievement-test scores, were more likely to gain admission to a selective high school, had fewer school absences, spent more time on their homework, watched less television, and started their homework earlier in the day."

First has a lot to do with what is expected at school (wonder what the data looks for 3rd level education) and the rest is pretty obvious...

</comment><comment><USER14> <http://blog.jgc.org/2009/10/damn-torpedoes.html> (Can't find HN link for it)

[http://www.stevepavlina.com/blog/2005/12/rules-are-no- obstac...](http://www.stevepavlina.com/blog/2005/12/rules-are-no-obstacles- for-committed-people/) "Rules are no obstacles for committed people"

</comment><comment><USER15> oblig: <http://www.paulgraham.com/determination.html>

</comment><comment><USER16> I think the people that think before hearing or reading about the solution are the one best prepared for Academic Performance. A funny experiment should be to take an English native teenager to a sociology class in Chinese language and then ask him about what he has learned.

</comment><comment><USER17> So I'd buy this, but how do I as an adult with lower than average self- discipline improve this facet of myself? Is it something you are born with? It seems paradoxical to try to achieve high self discipline through determined hard work.

</comment><comment><USER18> Clicked the [scribd] link and got this (and only this): "Hello, you have an old version of Adobe Flash Player. To use iPaper (and lots of other stuff on the web) you need to get the latest Flash player."

WTF? I thought Scribd was HTML5-in' it up?

</comment><comment><USER19> Why should anyone _want_ to get high grades in eighth grade? What's the point? No one's ever going to look at them.

<comment><USER20> Selective (private/charter/magnet) high schools. Otherwise, yeah.

</comment></comment><comment><USER21> This does not surprise me at all. Anyone with average intelligence can get good grades in high school - it's just a matter of how much time you're willing to devote to getting them.

The trade-off comes in deciding whether you'd rather get good grades or spend time learning other things on your own. It comes down to how much you trust the educational system you're in to fully make use of your time and intelligence.

I think it's a bad thing that, in general, grades to not track IQ. Hard work is important, but only when the effort does work on your intelligence (similar to the physical definition of work). One can spend hours on a paper or a PowerPoint and have done nothing to further their intelligence; and yet these assignments are what students are typically graded on.

<comment><USER22> >spend time learning other things on your own

Hear Hear! And _all_ learning is done on one's own, really.

IQ is, not to put too fine a point on it, bunk.

Grades are also bunk. They can never measure _depth_ of knowledge, which is the thing that matters, intellectually speaking. Depth depends on connections formed with _other areas_ of knowledge, which are unique to each student.

<comment><USER23> There is intrinsic to the academic system a pervasive issue of trust.

Grades can indicate the depth of knowledge, but with the disclaimer that both the arbitrating grader is trusted (in a very special sense), and that the method used to decide grades be both defensible and explicable to others.

To provide a concrete example. A paper on the first book of Hume's Treatise of Human Nature attempts to bring a new argument to bear on the consequences to modern epistemology incurred by Hume's concept of abstract ideas. The paper is written as a final in a graduate level philosophy class, and the instructor is known to be knowledgeable, intelligent, fair, and honest. The paper receives a B+. It is arguable that the mark is generally reflective of the student's understanding and ability at the time the student wrote the paper. (this example is taken from personal experience - I wrote this paper, and I feel that the grade was reflective of my knowledge on the topic)

But without the trustworthy instructor, the grade would be meaningless. The problem, if I were to speculate, is one of numbers - too many students, too few professors. A basic premise of security is that the more parties involved in a pact, the lest reliable the pact is, and if grades are to be a faithfully representation of a students ability, the reliability of the academic pact is paramount.

</comment></comment></comment><comment><USER24> I reviewed Daniel Goleman's book "Emotional Intelligence" on my blog last month, and the psychological framework he uncovers does a good job of accounting for/predicting these kinds of observed results

[http://www.zacharyburt.com/2010/04/understanding-human- behav...](http://www.zacharyburt.com/2010/04/understanding-human-behavior- emotional-intelligence/)</comment>


NodeJS 5 KEY Things I Wish I Knew Earlier. - <AUTHOR> http://www.rm2kdev.net/2014/03/nodejs-5-key-things-i-wish-i-knew-earlier/

<comment><USER2> I'm not even past the introduction and the author has used the terms: NodeJS, NodeJs, and nodejs. This bothers me greatly.

Edit: he also uses the term 'node', has asp.net and ASP.NET. Stuff like this always reflects badly on the author. Makes me think he has poor attention to detail.

<comment><AUTHOR> Thank you for pointing that out, I did spend quite a while writing this article (more than a few days :P)

As i stated in another reply i am a novice writer and still looking and learning to improve, I've gone back through and fixed up those NodeJS occurrences.

Do you have any good places that i could find more about improving my writing as that would help greatly in the future!

Thanks for reading though i still hope that the core point of my article was useful and not in vein.

<comment><USER3> Check "The Elements of Style" by William Strunk Jr. It is a classic book on writing style. It's short, inexpensive and very instructive.

Disclaimer: English is not my native language.

<comment><AUTHOR> Thanks! ill take a look :)

<comment><USER2> Not sure if you'll ever see this, but it's good that you want to improve, and for this your are entirely forgiven. The only tips I can really give you are to be consistent, and try and be grammatically correct.

I don't care if you use e-mail or email, as long as you stick with the same term. I do care if you use lowercase "i"s when you should be using capital "I"s though.

That being said, everyone can improve, so just keep learning and writing. I have just bought the above book too. Everyone has space to learn. Good job on taking my criticism positively as well, even if I did sound a bit irked.

</comment></comment></comment></comment></comment><comment><USER4> These really have nothing to with Node. Point #2 isn't really all that great. You should be learning the core Node APIs if you are going to use Node. Having a fundamental understanding of Streams and EventEmitter will no doubt be useful several times.

<comment><AUTHOR> Absolutely of course these things matter, but i think the point of the article was to outline what was 'necessary' to begin writing usable decent applications with a proper workflow.

For me urgency in getting up to speed in actually writing a functioning application was of a higher necessity than learning about core node and as part of the learning experience it bummed me out going back to writing hello world examples not getting any 'results' made me want to give it up faster.

also a side note, usually as with most platforms, experience in the higher level results in experimentation lower levels.

</comment></comment><comment><USER5> Points 3, 4 and 5 don't seem particularly NodeJS specific.

For point 2, as you say, NodeJS is built around packages and has npm bundled for easy dependency management. I'm surprised you didn't bump into this information more quickly as you were researching NodeJS as a technology.

For me, point 1 is the interesting piece of this article; when working with scripting languages, I've always worked with code editors like Sublime Text 2 and Notepad++. I'd be interested to hear more about your use of an IDE; pros / cons - what areas of development you found it improved and where it get in the way.

<comment><AUTHOR> Fair point. For me points 4 and 5 were part of my nodejs learning experience while your right they are not 'node specific' they are however things that if i had a better understanding of before i began i do believe would have made my initial experience better :)

I may do a more elaborate comparison of IDE's and how they've effected my workflow regarding node in the future thank you for the inspiration there :)

And yeah, looking back i am surprised that i didn't find out about npm and packages earlier on in the game. But yeah for me the learning experience was so fragmented that it was very hard to get a good grip on 'what i needed' and 'what was available' i suppose in the beginning i spent all my time trying to learn the 'core' nodejs without knowing that later i'd spend all my time in 3rd party librarys

</comment></comment><comment><USER6> Being also an IDE guy I must admit I find also a bit painful to get back to plain text editors. I normally use Eclipse + the JavaScript plugin but mainly because I already have open Eclipse for other projects.

But anyways, I just wanted to point out what will be obvious for many and is that node-inspector is a superb tool for real-time debugging. ( [https://github.com/node-inspector/node-inspector](https://github.com/node- inspector/node-inspector) ) No need to go to a full-IDE if the only thing you're missing is that.

</comment><comment><USER7> Not using version control in a development environment would be reckless. If you hate version control, you're either a bad developer, or you're using the wrong system.

</comment><comment><USER8> This isn't even a node js article. I want my 2 minutes back please.

<comment><AUTHOR> Is there any specific points that i could improve on? this article was more or less "The things i wish i knew" when i started node.

What exactly let you down so that i can continue to edit and improve this post going forward?

Kind Regards.

</comment></comment><comment><USER9> The writing is not that great (maybe because English is not my mother tongue) but the article is an interesting read.

<comment><AUTHOR> Unfortunately, English is my native language but i spent all my time in school programming and thus now suck at writing haha :) thanks for reading though!

<comment><USER10> Writing is like any other skill. The more you practice the better you'll get. Keep writing, don't let some of the negative comments discourage you.

<comment><AUTHOR> Everything here is feedback :) nothing really negative i'll take it and improve my next post hopefully end up with a better result.</comment></comment></comment></comment>


Ask HN: Why aren't the Japanese using robots at Fukushima?  - <AUTHOR>

Many articles on the currently unfolding nuclear disaster at Fukushima describe how the crew at Fukushima is failing to get the disaster under control because they can't get close enough because of the high levels of radiation.
This seems like a perfect opportunity to use robots, since they aren't nearly as vulnerable to radiation as humans are.
For example, here's a description of why attempts to use water canons to cool fuel rods failed:
"Hopes were also raised when several police water cannons, designed for use in riots, were brought in and used to blast water towards the empty pool next to reactor number four in which spent fuel rods were in danger of melting.
Again, the high radiation readings meant the machines could not get close enough to the plant to get the water on target, and at one point the vehicles were forced to retreat, before resuming attempts that had limited success."
http://www.montrealgazette.com/news/Desperate+measures+kamikaze+mission+cool+exposed+fuel+rods/4458612/story.html
Why couldn't have a mobile robot on treads be fitted with a camera and water cannon and be remotely wheeled in to position to aim the cannon at the pool containing the spent fuel rods?
Or this:
"Jaczko, chairman of the Nuclear Regulatory Commission, said his staff in Tokyo had been told by Japanese utility officials that cooling water that normally covers spent fuel was nearly or totally gone from an uncovered concrete pool above reactor Unit 4. ...
'We can't get inside to check, but we've been carefully watching the building's environs, and there has not been any particular problem," Hajime Motojuku, a spokesman for Tokyo Electric, said'"
http://www.nytimes.com/cwire/2011/03/17/17climatewire-fukushima-crisis-worsens-as-us-warns-of-a-lar-9187.html
Why not use a little remotely operated helicopter or plane fitted with a camera, much like many hobbiests do around the world?  It could be flown in to and through the building, or at least in a very close flyover of the building, and have a look inside.
Or, even simpler, why not just use a robot mounted on wheels or treads and carrying a camera?  It could simply be remotely directed to drive in to the building and send back a video feed of what the cameras showed.
Japan is world-renown for its robotic technology.  And yet in this disaster they are not using robots to go where humans can't because of the radiation risk.  Why? <comment><USER2> Perhaps the (normal) robots are not that much less vulnerable - after all electronics have to be hardened to be usable in space precisely because of high-energy radiation and particle radiation. ECC RAM probably wouldn't be enough.

<comment><AUTHOR> I wonder just how strong the radiation has to be for it to seriously affect electronics.

I'm not sure the thresholds of radiation exposure that would cause dangers to the health of humans vs danger to electronics are at all similar.

And, anyway, electronics could be shielded with lead.

This isn't a space mission where every extra fraction of an ounce costs thousands of dollars to deploy. If the radiation at Fukushima really is a serious hazard to the electronics on a robot, then shielding should be a practical option.

<comment><USER2> Yes, I don't doubt special robots can and will be developed. But I think the normal ones can't be used since they don't have the shielding and adding it would hamper their function.

Also radiation has different ways of damaging people vs electronics. Memory chip gets hit by radiation and immediately returns random values which can cause program to crash. Human doesn't feel much - even Slotin who had a criticality accident and died a few days later, at the moment felt just a metal taste in his mouth. He would still be able to close valves and so on.

<comment><AUTHOR> But the question is whether sensitivity to radiation is really the reason robots aren't being used.

The radiation at the plant might not even be strong enough to affect electronics at all.

This is all just guesswork.

It would be nice to get some solid answers.

</comment></comment></comment></comment><comment><USER3> I don't know of any robots that are powerful enough to carry water cannons, but still able to be deployed in short order to a hazardous and unusual environment. The robot would have to be very strong: the flow rates they need to cool all that uranium are really quite huge; the hoses they would be dragging would be heavy and stiff.

But it does seem like a ground-based robot like a packbot:

<http://www.irobot.com/gi/ground/510_PackBot>

which is used to inspect IEDs, among other things, would be helpful to get video. As well as airborne drones.

<comment><AUTHOR> I think the reason they were trying to use water cannons was because of the great range they offer in shooting water.

They needed that range because humans couldn't go near the pools containing the spent fuel rods because of the radiation.

But if a robot could get very close, they might not need to use a water cannon, and could use just a regular water hose. Or they might be able to use a water cannon but with water coming out at a much lower pressure.

And I'm not sure that the hose dragging is an unsolvable engineering task either.

They could, for instance, erect a tower with a spool of hose on it. As the robot moved away from the tower and towards its destination, it could unravel the hose from the spool and have most if not all of the hose be suspended in the air behind it.

Another solution could be to have a second robot following the first, to support a portion of the hose. They could even use a third or a fourth robot behind the first two, if needed.

Those are just off-the-cuff ideas.. I'm sure professional engineers could easily think of dozens of other methods to solve the hose-dragging problem.

</comment></comment><comment><USER4> Because they are in unknown territory. Modern robots work in fixed plants with fixed programming, not in a warzone. Having said that, I would imagine future plants being purpose built for ease of access by robots. e.g. less stair cases, more special grips etc.</comment>


6 reasons why encryption isn't working - <AUTHOR> http://guardtime.com/blog/6-reasons-why-encryption-isnt-working

<comment><USER2> ...and I still have no idea what the Estonian government did.</comment>


Are you scared yet? Meet Norman, the psychopathic AI - <AUTHOR> http://www.bbc.com/news/technology-44040008 <comment><USER2> > One study showed that software trained on Google News became sexist as a > result of the data it was learning from. When asked to complete the > statement, "Man is to computer programmer as woman is to X", the software > replied 'homemaker".

> Dr Joanna Bryson, from the University of Bath's department of computer > science said that the issue of sexist AI could be down to the fact that a > lot of machines are programmed by "white, single guys from California" and > can be addressed, at least partially, by diversifying the workforce.

Just curious but wouldn't this more likely be a result of a bias in the training data rather than the diversity of the programmers?

<comment><USER3> > When asked to complete the statement, "Man is to computer programmer as > woman is to X", the software replied 'homemaker".

Seems they're putting a lot of weight on an unqualified question...the AI just fed back the easiest, most popular, stereotypical answer it came up with. A tee-ball response.

It didn't stop and think about who'd be offended, first.</comment></comment>


Is Fusion Close to Reality? Yes, Thanks to Machine Learning - <AUTHOR> https://www.forbes.com/sites/jeffmcmahon/2020/04/27/is-fusion-really-closer-to-reality-yes-thanks-to-machine-learning/#68f16580652b <comment><USER2> "TAE Technologies, formerly known as Tri-Alpha Energy, announced last year that its fusion reactor was five years from commercialization."

Fusion reactors, like flying cars and urine-powered batteries, is always just 5 years into the future! Or maybe putting a line like this into news stories about fusion is a modern day "Occult Hand Society" ([https://en.wikipedia.org/wiki/Order_of_the_Occult_Hand](https://en.wikipedia.org/wiki/Order_of_the_Occult_Hand))</comment>


New source file policy on Vimeo - <AUTHOR> http://vimeo.com/blog:215

<comment><USER2> Makes sense. It's nice that it's kept for one week after the upload and great that it's kept for plus users. Sounds like it's a well thought out decision.

</comment><comment><USER3> Vimeo has 'fired their users' in the past -- they banned/deleted all game videos last year: <http://www.vimeo.com/blog:140></comment>


Apple Takes the Spyware-Style Low Road, Pushing Safari on Windows - <AUTHOR> http://www.readwriteweb.com/archives/safari_on_windows_scam.php <comment><USER2> I don't really condone Apple's sneakiness. However...I've had a real problem with Microsoft's ability to rake in market share for IE, for years, for no good reason: IE benefits from the tech-unsavviness of most people who can't replace it, it does not compete by adding real value.

IE's shell desperately needs to be broken; and as sneaky as Apple's solution is, Apple has a real chance of cracking the shell wider than anyone else has. And this isn't replacing Crap A with Crap B...Safari is a real standards- compliant browser, convincing people to move to Safari over IE is a step forward for the industry by any measure.

Yes, it _would_ be much better if Apple opened up their magic update scheme to allow a choice of Firefox, etc., but one step at a time.

<comment><USER3> You make an interesting point, but I'm not convinced that the ends justify the means. Just because Safari is better than IE does not mean it is okay to push it on people - especially when most of the people are using iTunes only because they have an iPod and Apple pushed iTunes on them. (This is just an observation. I have absolutely no real evidence to back up this claim.)

I do tend to be an idealist though, and I think that everyone needs to take the high ground when pushing for change.</comment></comment>


Google wants to rank websites based on facts not links - <AUTHOR> http://www.newscientist.com/article/mg22530102.600-google-wants-to-rank-websites-based-on-facts-not-links.html#.VPQ66bOsX1g

<comment><USER2> Some facts are easy, like "capital of albania" or "population of shenzhen" or "age of clint eastwood".

But is consensus the right answer for more interesting facts? Does the consensus give the right answer for "minimum wage effect on economy" or "do firearms make us safer" or "crime rate of immigrants"?

Will Google localize their facts? For a question like "us supporting nazis in ukraine", will Russian residents get one answer while US residents get a different answer?

The old Microsoft Encarta encyclopedia had different facts for different countries. In the US edition, Thomas Edison invented the light bulb, while the British version said it was Sir Joseph Swan.

As Bill Gates famously wrote[1], "The facts depend on where you are coming from".

Google Maps used to show different national borders depending on where the user was located[2], maybe it still does. Chinese users saw Arunachal Pradesh as part of China, while Indian users saw it as part of India.

[1] [https://web.archive.org/web/20120629032909/http://www.btimes...](https://web.archive.org/web/20120629032909/http://www.btimes.co.za/97/0406/tech/tech6.htm)

[2] [http://qz.com/224821/see-how-borders-change-on-google- maps-d...](http://qz.com/224821/see-how-borders-change-on-google-maps- depending-on-where-you-view-them/)

<comment><USER3> To make matters worse, much of Google's Knowledge Graph -- their database of facts -- is taken from Wikipedia. There are many problems with this approach. Wikipedia facts are often unreliable. They are easy to vandalize. Many pages are unchanged for years because editor numbers are rapidly declining. Pages are also easy to game, both by external forces (spammers) and internal forces (bias seekers).

Wikipedia editors are now working as Google's unpaid fact checkers. It's true that people edit Wikipedia for a variety of reasons, but for many contributors the site was supposed to be a free resource: contributed to for free with the promise that the content would be free to the reader and free of advertising. Instead it is being used to further Google's profit.

</comment></comment><comment><USER4> Ha. SEO is about to get a lot easier. SEO is search engine optimization. Easy is an adjective and is the opposite of hard. "Ha" is an expression of laughter.

<comment><USER5> "A source that has few false facts is considered to be trustworthy," \-- this leads me to believe that the algorithm punishes for including false statements rather than reward for including true statements, so this method wouldn't work

</comment></comment><comment><USER6> What is "fact" is actually highly subjective and puts Google in the place of picking the "winners" for arguments or perhaps pushing their own political and religious agenda.

Fact: Vaccines are Dangerous Fact: Vaccines are Safe and prevent spread of deadly diseases. Fact: I nearly died from a vaccine. Fact: Vaccines contained mercury[1] for decades and poisoned untold millions of people. Fact: Google now decides which facts you get to see.

I understand Google is trying to get rid of lots of useless add pages but determining "truth" is potentially just pushing an agenda and burying those facts they disagree with.

[1][http://www.fda.gov/BiologicsBloodVaccines/SafetyAvailability...](http://www.fda.gov/BiologicsBloodVaccines/SafetyAvailability/VaccineSafety/UCM096228)

<comment><USER7> Someone, somewhere has to make that call: the current situation is untenable.

<comment><USER8> It's a whole lot more tenable than appointing a referee, which is what Google is trying to become here. An organization with the power to "settle" contentious debates becomes a target for corruption, a single point of failure for the integrity of the entire system.

For example, maybe the Waltons decide they don't like the national conversation on minimum wage laws; could they lobby/bribe/extort/whatever their way into having their "facts" be treated favorably in search results?

Or could the Democratic party decide that Republican candidate so-and-so is a pedophile/spouse-beater/alien, and make that a settled "fact" by promising Google employees favorable tax breaks in exchange for aid in "narrative building?"

Under the current system, "facts" are democratized. Sure, sometimes bullshit makes its way into the popular consciousness, but it's more random than not. When I see some tripe about "OBAMA TO INJECT TRACKING CHIPS INTO AMERICANS USING THIS ONE WEIRD TRICK," I'm relieved to know that there is no amount of money or power in this world to make that an established "fact."

</comment></comment></comment><comment><USER9> While i like to see some certain sites removed, i fear that this could give google too much power of what is considered "truth" and what not. Does anyone knows good literature about such things and their implications?

<comment><USER10> It might make google's results less relevant. People don't believe in the truth. They follow the general consensus. They might switch to a different search engine because google 'gives bad results'. Mob mentality is real.

<comment><USER11> According to the article, Google's measure of truth is actually a measure on consensus. Which I find rather troubling.

<comment><USER12> In a sense, it already is. The link-based ranking system is a measure of popularity.

</comment></comment></comment></comment><comment><USER13> This sounds like an inverse information measure -- ranking sites highly based on their redundancy (repeated content).

And the people who are in the business of repeating their content in ever more inventive and adaptive ways are advertisers. So over time this seems likely to devolve into promoting the adverts and infomercials ahead of the content.

For instance rather than farming links, the spammers would switch to farming quotes or paraphrases. Expect "one weird trick..." to turn up a lot outside of just the advertising box, and the battle to be how then to stop the algorithms from classing it as truthy.

</comment><comment><USER14> So if they count the absolute number of errors in a page, that's yet another incentive to cut content in even more pages, that drive even more ads, and even more profit for Google.

On the other hand, if they count the relative truth in a page, pages will bloat with marginal content, will get harder to read, people will scan them more shallowly, and as a result we will end up having different versions of the same content page but with marginal content tilted on one direction or another. So we will need to use more web search. So another win for Google.

Sounds fair :)

</comment><comment><USER15> Google makes money (via ads) by showing the results the user wants, not by showing the results the user should want. If I want to go to an anti- vaccination site to reinforce my pre-pre-existing beliefs, it's hard to imagine Google will care, let alone make it more difficult to find it.

</comment><comment><USER16> The thought of websites doing "fact stuffing" at the bottom of a page instead of keyword stuffing makes me smile.

</comment><comment><USER17> Better title "Google is _researching ways_ to rank websites based on facts _along with_ links"

Not as sexy, but a bit more accurate.

</comment><comment><USER18> This is an interesting case, and will probably be useful in some verticals, but not all. It's widely thought and sometimes verified by Google that they treat different verticals differently in search. "Payday loans" searches are treated differently from "New Macbook Air" for example, in which case we don't have to see it as an all or nothing approach. For example, today you only get the right-hand knowledge box on some searches, but not all.

I also wonder how New Scientist blanketing their page with ads like it's 2003 is affecting their rankings?

</comment><comment><USER19> >> Facts the web unanimously agrees on are considered a reasonable proxy for truth. Web pages that contain contradictory information are bumped down the rankings.

But if there are contradictory sites then the web is not in unanimous agreement, is it? Something about this statement bothers me. Is there no chance that the web could be in "unanimous agreement" about something which is wrong? Seems to me that human populations make this mistake quite often, and since it is humans (for the most part) who write the web the same fallibility should show up there.

</comment><comment><USER20> The article makes it sounds like they are replacing PageRank. According to the paper it's orthogonal to PageRank. It's just another signal to consider. The other assumption seems to be that this will cause site authors to fact-stuff. However it sounds like they more interested in using wrong facts to penalize a site than using correct facts to promote a site.

</comment><comment><USER21> Is it just me or are google results getting worse with time? Five or six years ago I used to find everything on the first page of the first search, but these days I have to keep "rephrasing" my searches to find what I want.

</comment><comment><USER22> Anddd this is why I no longer use Google but rely on DuckDuckGo.

<comment><USER23> So you use Yahoo.com which itself uses Bing.com.

DuckDuchGo (DDG) is a meta search engine that relies on the Yahoo & Yandex search API ([http://en.wikipedia.org/wiki/Yahoo!_Search_BOSS](http://en.wikipedia.org/wiki/Yahoo!_Search_BOSS)) and adds some related Wikipedia/Yelp/Yummly/etc. snips.

So if Bing.com implements a similar rank algorithms your DDG/Yahoo results will too. [http://en.wikipedia.org/wiki/DuckDuckGo](http://en.wikipedia.org/wiki/DuckDuckGo)

<comment><USER24> It's meta-searchengine-ness is exactly why I personally use it. A `!` away from any search engine I need.

<comment><USER23> True.

An open search engine was on "Show HN" on Saturday: [https://news.ycombinator.com/item?id=9122397](https://news.ycombinator.com/item?id=9122397) -> [https://deusu.org](https://deusu.org)

Another open search engine from last year: [https://news.ycombinator.com/item?id=6152839](https://news.ycombinator.com/item?id=6152839) -> [http://www.gigablast.com](http://www.gigablast.com)

The European Union sponsored the development of an European Google competitor: [http://www.heise.de/newsticker/meldung/Quaero-Erster- Vorlaeu...](http://www.heise.de/newsticker/meldung/Quaero-Erster-Vorlaeufer- der-europaeischen-Suchmaschine-110725.html) -> [https://www.exalead.com/search/](https://www.exalead.com/search/)

</comment></comment></comment></comment><comment> bjr- I wonder how this will affect media companies' pagerank.

</comment><comment><USER25> I wonder how the Goog will gauge the facts that Google sucks and that Google does evil.</comment>


"gcc will quietly break nearly half of all the packages that it compiles" - <AUTHOR> http://www.metzdowd.com/pipermail/cryptography/2015-October/026841.html <comment><USER2> Headline is misleading.

What's going on here is that the GCC developers feel free to change the generated code for behaviour undefined in the C spec. This means they might alter the behaviour of code since 40% of all packages in Debian (the "half of all packages" mentioned here) contain code whose behaviour is undefined.

But the poster seems to define any change in behaviour as "breaking" code, which is ridiculous. How much of that 40% is rare edge cases or similar, such that in reality the behaviour of the code doesn't change in practice?

The follow-up email raises this exact point, noting that in the specific example of pointer overflow:

 _In executions where overflow does not happen, the gcc produced binary will match the behavior of the abstract machine in the C spec._

Which means that the cited static analysis, while correctly identifying code containing UB, may not actually have an issue at runtime as the condition may never occur in practice.

The real problem is any software that truly relies on undefined behaviour for correct operation (which, I'll bet, is far less than the 40% cited here). That code is fundamentally non-portable to other compilers specifically because each compiler may produce semantically different output.

<comment><USER3> _The real problem is any software that truly relies on undefined behaviour for correct operation (which, I 'll bet, is far less than the 40% cited here)._

I'd bet it's well into double digits relying on undefined behaviour, and over 50% relying on unspecified behaviour. It's hard to write interesting code in C that doesn't, where interesting means code that couldn't just as profitably be written in a different language with stronger memory safety.

Programmers have a mental model of many things - in particular, 2's complement signed numbers, and the idea that pointers are just numbers indexing memory - that are not guaranteed by the C spec. Much of the reason for programming in a lower level language is to take advantage of lower level machine characteristics, like tagged pointers, unsafe unions, structs with blobs of data appended to avoid an indirection, custom memory allocators, etc., but the C abstract machine doesn't necessarily give all the guarantees required, without a lot of care and attention to details.

<comment><USER4> Even C compiler developers can't always get it right. There have been a few bugs where, for example, one compiler pass optimised a struct initialisation into a single write that wrote into the slack space after the end of the struct, and a subsequent pass detected this undefined behaviour and removed the initialisation altogether. (These optimisation tricks inherently make compiler development more risky, because they mean that composing safe compiler passes is likely to create something unsafe.)

</comment></comment></comment><comment><USER5> Now that's some flawed logic here:

\- Some paper says that 40% of Debian packages have undefined behavior in them.

\- gcc's optimizer is sometimes unforgiving w.r.t. undefined behavior (see also: strict aliasing), changing the intended meaning of the code.

\- Therefore, it breaks 40% of packages.

And boom, there's your clickbait headline...

</comment><comment><USER6> The only reasonable thing to say about this was already said upthread of the page, and quoted here:

> _I have worked on many programs, and whenever I found such a problem > (typically called a "portability problem"), where the code was assuming > something that the language did not guarantee, I fixed the program rather > than bitching about the compiler._

<comment><USER7> IMO, it's a little subtler than that. It's not the compiler's fault, it's the _language 's_. Plenty of languages have no undefined behavior that can be written by accident. Go and safe Rust, for instance, have just about no undefined behavior at all, and are both performance-competitive with C. (Go has UB if you cause race conditions, and Rust has UB within `unsafe` blocks analogous to C's UB.)

A C compiler, meanwhile, has to aggressively take advantage of undefined behavior to get good performance, and the C specification has been keeping behavior undefined for the benefit of compilers.

You can hope that you find all such problems in C (which you might not) and "fix the program", but you can also "fix the program" by switching to a better language.

<comment><USER8> Yes, the C language specification is a bit shit, it leaves too much leeway to compilers so that C compiler for broken, niche architectures can be written. However, I disagree with you. All this badness in the C specification did not stop people from writing reasonable C compilers for reasonable architectures for decades.

The real problem here is competition. Gcc is in a competition with clang to produce fast code which makes the gcc developers feel justified when they exploit undefined behaviours for marginal optimizations.

This is a case of following the letter of the law (in this case the C standard) while disregarding its spirit: all the undefined behaviour was so that C compilers could accomodate for odd architectures while remaining close to the metal, not so that compiler programmers could go out of their way to turn their compiler into a mine field.

<comment><USER6> > This is a case of following the letter of the law (in this case the C > standard) while disregarding its spirit: all the undefined behaviour was so > that C compilers could accomodate for odd architectures while remaining > close to the metal, not so that compiler programmers could go out of their > way to turn their compiler into a mine field.

Computers don't have spirits; they work as you tell them to work, to the letter, and if you're remaining close to the metal, your language will indicate that fact. Optimizing undefined behaviors doesn't make C a minefield; low-level programming for different architectures just is inherently a minefield. C was a minefield before these optimizations were added.

Rust is extremely impressive because they've found so many ways to do high- level programming while maintaining low-level performance. But they can only do that because they have the benefit of the 4 decades of programming language research that have occurred since the basics of C were designed.

<comment><USER8> >Computers don't have spirits

But standards committee do.

>Rust is extremely impressive because they've found so many ways to do high- level programming while maintaining low-level performance. But they can only do that because they have the benefit of the 4 decades of programming language research that have occurred since the basics of C were designed.

I doubt rust could be ported to a 8bit PIC microcontroller, or to a 6502 keeping reasonable performance characteristics or letting the programmer take advantage of the platform quirks. It's not just "4 decades of programming language research" it's also that it's intended to work only on "modern" processors.

<comment><USER7> > I doubt rust could be ported to a 8bit PIC microcontroller, or to a 6502 > keeping reasonable performance characteristics

I don't believe this is correct. Most of why Rust avoids UB is that it uses static types much more effectively than C does. Static types are an abstraction between the programmer and the compiler for conveying intent, that cease to exist at runtime. So the runtime processor architecture should be irrelevant.

For instance, in C, dereferencing a null pointer is UB. This allows a compiler to optimize out checks for null pointers if it "knows" that the pointer can't be null, and it "knows" that a pointer can't be null if the programmer previously dereferenced it. This is, itself, a form of communication between the programmer and the compiler, but an imperfect one. In Rust, safe pointers (references) cannot be null. A nullable pointer is represented with the Option<T> type, which has two variants, Some(T) and None. In order to extract an &Something from an Option<&Something>, a programmer has to explicitly check for these two cases. Once you have a &Something, both you and the compiler know it can't be null.

But at the output-code level, a documented compiler optimization allows Option<&Something> to be stored as just a single pointer -- since &Something cannot be null, a null-valued pointer must represent None, not Some(NULL). So the resulting code from the Rust compiler looks exactly like the resulting code from the C compiler, both in terms of memory usage and in terms of which null checks are present and which can be skipped. But the communication is much clearer, preventing miscommunications like the Linux kernel's

        int flags = parameter->flags;
        if (parameter == NULL)
            return -EINVAL;

Here the compiler thinks that the first line is the programmer saying "Hey, parameter cannot be null". But the programmer did not actually intend that. In Rust, the type system requires that the programmer write the null check before using the value, so that miscommunication is not possible.

There are similar stories for bounds checks and for loops, branches and indirect jumps and the match statement, etc. And none of this differs whether you're writing for a Core i7 or for a VAX.

> or letting the programmer take advantage of the platform quirks.

I'm not deeply familiar with that level of embedded systems, but at least on desktop-class processors, compilers are generally better than humans at writing stupidly-optimized code that's aware of particular opcode sequences that work better, etc.

(There are a few reasons why porting Rust to an older processor would be somewhat less than trivial, but they mostly involve assumptions made in the language definition about things like size_t and uintptr_t being the same, etc. You could write a language with a strong type system but C's portability assumptions, perhaps even a fork of Rust, if there were a use case / demand for it.)

<comment><USER8> > I don't believe this is correct.

Did rust find a way to defeat the halting problem and push all the array bound checks to compile time? How well does rust deal with memory bank switching where an instruction here makes that pointer there refer to a different area of memory?

<comment><USER7> > Did rust find a way to defeat the halting problem

I don't understand why the halting problem is relevant to this conversation. Just about all practical programs don't care about the halting problem in a final sense, anyway; see e.g. the calculus of inductive constructions for a Turing-incomplete language that lets you implement just about everything you actually care about implementing.

The halting problem merely prevents a program from evaluating a nontrivial property of another program _with perfect accuracy_. It does not prevent a program from evaluating a nontrivial property (bounds checks, type safety, whatever) with possible outputs "Yes" or "Either no, or you're trying to trick me, so cut that out and express what you mean more straightforwardly kthx."

This realization is at the heart of all modern language design.

> How well does rust deal with memory bank switching where an instruction here > makes that pointer there refer to a different area of memory?

This problem boils down to shared mutable state, so the conceptual model of Rust deals with it _very_ well. The current Rust language spec does not actually have a useful model of this sort of memory, but it would be a straightforward fork. As I said in my comment above, if there was interest and a use case for a safe language for these processors, it could be done easily.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The article is just complaining about undefined behavior, and what compilers do when they encounter code not written to spec.

Rather than rehashing the arguments for and against it, I'd really recommend anyone interested to read these articles:

[http://blog.llvm.org/2011/05/what-every-c-programmer- should-...](http://blog.llvm.org/2011/05/what-every-c-programmer-should- know.html)

[http://blog.regehr.org/archives/213](http://blog.regehr.org/archives/213)

</comment><comment><USER10> Inknow people are quick to complain about programmers relying on UB here but this really is a long standing disagreement with the gcc folk. They are language lawyers of the worst sort and do not consider security implications being a point of discussion :(

<comment><USER6> > _On two occasions I have been asked, — "Pray, Mr. Babbage, if you put into > the machine wrong figures, will the right answers come out?" In one case a > member of the Upper, and in the other a member of the Lower, House put this > question. I am not able rightly to apprehend the kind of confusion of ideas > that could provoke such a question._ \--Charles Babbage

The modern version of this seems to be:

"Mr. Babbage, I put the wrong figures into the machine and the wrong answers came out! Please fix it this, this has security implications!"

You can't reasonably expect the compiler to make your insecure code secure.

Calling them "language lawyers" is some entitled crap. GCC commits to implement the specification of the language. Expecting them to maintain some huge number of undefined behaviors is literally expecting them to do something they never said they would do and couldn't do even if they said they would.

<comment><USER4> The problem is that it's often perfectly clear, reasonable code on all the systems it was intended to run on. For example, on all Unix-like systems, pointer arithmetic is simply arithmetic and behaves like it. (C's predecessor didn't even have separate pointer and integer types.) So prior to compiler optimisations, this series of operations is safe and well-behaved on all architectures Linux supports even if a is NULL:

      int *b = &a->something; // pointer arithmetic, doesn't dereference a.
      if(a == NULL) return 0;
      else something_critical = a->somethingelse;

However, some non-Unix address models that Linux doesn't support don't permit pointer arithmetic on NULL pointers. So the ANSI C standards committee declared it undefined. Which means that gcc can - and eventually did - eliminate the NULL pointer check. This has resulted in privilege escalation vulnerabilities in Linux that didn't exist until gcc decided to optimise the code, some of them quite well-hidden.

<comment><USER6> I understand the problem, I'm saying that it's not GCC's problem. If you don't want undefined behavior, don't put undefined behavior in your code. The code you wrote _isn 't_ clear or reasonable, because it relies undefined behavior. It's a valid criticism that this code does appear to be straightforward when it isn't, but that's not a criticism of GCC, it's a criticism of ANSI C. If you don't like it, use a better language. C was designed 4 decades ago; and they can't possibly have forseen every problem that we've discovered in that time.

<comment><USER11> > If you don't want undefined behavior, don't put undefined behavior in your > code.

I'd quip that this is statistically impossible for a sufficiently large codebase.

> it's a criticism of ANSI C. If you don't like it, use a better language.

This is my basic stance. However, if I'm e.g. in a situation where I have a C or C++ codebase I can't afford to rewrite from scratch, I'd like to use a "Better C" compiler, where "Better C" is a slightly less bad version of "ANSI C" \- some undefined behavior removed, for example.

As shorthand, I'll generally refer to compilers for "Better C" as "Good C Compilers".

GCC is not trying to be a Good C Compiler. They've decided these things aren't their problem. Which is... fair. That's their choice. I do not for one minute pretend to understand that choice however - and it gives me yet one more reason to switch to a Good C Compiler.

<comment><USER6> Good luck with that. I suspect the only good C is not C.

<comment><USER11> I don't disagree - but there's value in harm reduction, no?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> _Since compilers (and by "compilers" I mean gcc mostly) quietly break your code behind your back, you have no way of telling whether you really fixed things or not._

Compile your test suite with -fsanitize=undefined.

<comment><USER5> That will catch a _tiny_ part of undefined behavior.

<comment><USER13> Why doesn't the compiler emit a warning for all UB it finds while compiling? Or do regular programs rely on this too much to be feasible? It must be something like that, or there'd not be much performance gains to be had by exploiting UB right?

<comment><USER14> Any time you add two (signed) integers, that's potentially undefined behaviour.

</comment></comment></comment></comment><comment><USER15> Bad craftsmen blame their tools.

<comment><USER16> [https://c4.staticflickr.com/8/7226/7095238893_5000f6e57d_b.j...](https://c4.staticflickr.com/8/7226/7095238893_5000f6e57d_b.jpg)

</comment></comment><comment><USER17> Since when is 40% "nearly half". Can we change the title to something like:

"40% of Debian packages might break if GCC changes the way it handles undefined behavior"

<comment><USER18> When has 40% not been nearly half? What is the minimum threshold for a quantity to quality as nearly half?

<comment><USER19> "Nearly half" is a subjective concept so different people can give different answers if you ask them wich value "nearly half" has. I also think that it strongly depends on the absolute number we are talking about, not only percentage.</comment></comment></comment>


Not Every Hobby Has to Become a "Hustle" - <AUTHOR> https://lifehacker.com/not-every-hobby-has-to-become-a-hustle-1821625978 <comment><USER2> While true, then most jobs need to pay enough to afford to own the crappiest home within a reasonable commute of your office. The majority of jobs in 2018 do not meet this threshold.

Most people don't want to spend their lives "hustling" and selling things. They do, however, want healthcare, a home, and the ability to retire.

So?

<comment><USER3> This article discusses the benefits of having a 'pure hobby' that you perform for personal enjoyment (not necessarily to turn a profit). Whether your chosen employment enables you to purchase a home (as a single individual?) seems completely tangential to the point of the article. I rent and have non-hustle hobbies. They give me something to do during my evenings and an outlet for personal expression. Also the results of my hobbies are usually suitable as gifts to friends and family. I am not trying to monetize them for the same reason as what is mentioned in the article: the hobby becomes work; stress increases & enjoyment goes down; you lose the positive influence the hobby had on your life.

There will always be capitalistic and opportunistic people who view every moment of their life in the framework of "how can I profit off this situation?". Those hustlers aren't going away. The flip side is there are also people who recognize the value of internal alignment and seek that instead of capital/wealth growth.</comment></comment>