The Sex Recession - <AUTHOR> https://www.theatlantic.com/magazine/archive/2018/12/the-sex-recession/573949/ <comment><USER2> Honestly I think it's the top 20-10~ percent are having a lot more sex and the rest is having less. I believe this is because people's potential mating/social circles have grown to encompass the whole world via the internet.

Where before a very attractive person might only have access to the people in their friend group/workspace/etc and wind up settling/sleeping with/marrying one of them, now they can expand beyond that and literally shoot to the top of the gene/status pool, e.g. a very attractive girl might date a professional basketball player instead of the cute guy in the office.

This can happen on a smaller scale as well because of things like Tinder. Why date the amiable and friendly but 6/10 coworker when there is a rich, successful, charming 9/10 down the block.

Even if people are not doing this they might not be partnering up as much because of the possibility of it happening. FOMO is constant in relationship these days, IMO.

<comment><USER3> If what you say is true, then it would require that these highly attractive people all monopolize multiple mates simultaneously. Particularly in a gender- imbalanced fashion. Then, we'd notice a steep dropoff in the percentage of people in exclusive relationships, and the amount of time they remain in exclusive relationships. (Stats which one should be able to verify or falsify fairly easily)

If, however, monogamy has remained the norm, then the percentage of people in relationships will probably be about the same, and the only prediction one might be able to make about internet access is that it would strengthen the trend of assortive mating.

If the latter is true, then the decline in sexual activity remains a phenomenon to be explained.

<comment><USER4> Yeah, the comment you're replying to is very red-pill and based on a weird asymmetrical set of standards.

My feeling is that the high-libido (HL) people are assortatively mating with other HLs. They're no longer pursuing the medium-libido (ML) or low-libido (LL) people. The internet helps this a lot.

Without the HL people, the ML/LL people are free to have a more relaxed and less active sex life. That may mean being single if the libido isn't high enough to overcome social anxiety or inertia but at least they aren't stuck in a mono relationship with an unhappy HL who's prone to cheating.

<comment><USER3> This is an interesting take on assortive mating, and likely has at least some explanatory power.

I suppose, also, prostitution can skew the numbers. If some people regularly service hundreds or thousands of people, then that could have a similar effect on the total numbers. It would seem like there's less sex, but really the number of sexual sessions is the same or more, just with a fewer percent of the population.

</comment></comment></comment></comment><comment><USER5> I used to do a lot of online dating and the worst dates were with recent grads.

Usually, they would be either about to graduate, or else they had graduated a couple of years earlier and had just worked steadily since then.

They would have zero hobbies. They would listen to top 40s music but couldn't name a band, sometimes watch a movie (but didn't care much what movie), didn't have opinions on things, had almost no stories to tell. They didn't have ideas about what to do on a date. They were awkward. Our date would almost always be the first they had been on in a long time.

It was like they postponed becoming real people in order to become excellent students and professionals. I get that - their programs are HARD. What a high cost though.

<comment><USER6> > It was like they postponed becoming real people in order to become excellent > students and professionals.

Has it crossed your mind that some people simply don't care about the generic mass consumption pop culture you follow, and instead have other interests thay have nothing in common with yours? After all, your complain boils down to criticising others for not liking the bands you like or having other experiences that you enjoy.

<comment><USER7> But he's complaining about them only listening to top 40s music. And nothing else he's said implies that only generic mass consumption pop culture matters. Naming a band doesn't imply naming mainstream band, it just implies name A band, ANY band, and have a bit of preference or taste. Same for movies. Nothing jammygit has said implies that they need to like the same things he does. He is, however, implying that they don't like ANYTHING.

</comment></comment></comment><comment><USER8> An aspect of this article that I find interesting is that parents encourage their children _not_ to date while in school because it's a distraction. I personally find this idea to be misguided because, at least for myself, having a person there to support you during the emotional rollercoaster of college is critical for success. A team can do more than an individual.

</comment><comment><USER9> Standards/expectations are higher now that both genders are expected to compete professionally on an equal playing field.

The general attitude towards the opposite sex is more adversarial than ever.

</comment><comment><USER10> Because they're financially stressed and can't afford kids.

<comment><USER11> The article mentions the availability of free birth control in some places. Can you describe how being 'financially stressed' has anything to do with the ability or desire to have sex?

<comment><USER12> Relating back to the feeling of "not being good enough". You are scared that your mate might reject you because you are too poor or have less to offer than whoever else you're competing against. Which, in terms of dating in the modern world, is pretty much everyone in the world. Less money/confidence also relates to less time spent on personal hygiene and grooming and also less willingness to put yourself out there.

In general, I think that having less money does not directly correlate to you having less sex as the promiscuity rates in many lower income neighborhoods is higher than the average. But the feeling of "financially stressed" more relates to intelligence AND the lack of financial resources.

</comment></comment></comment><comment><USER13> Maybe it has to do with the increased availability of porn.

<comment><USER14> I think Porn will make you want more sex, not less.

See, if you saw SD quality porn, you want HD quality then UHD quality porn after that and maybe VR at some point, realistic sex doll and then finally something more real.

Do you see the progression? Real sex can't be replaced with porn. Both of them are not equal in sensation acheived.

<comment><USER15> Maybe it makes people want more sex, but decreses chances, because of fear of not beeing able to held the high expectations set from porn.

</comment></comment></comment><comment><USER16> Huh. I've seen this posted several times here, now.

Here in Toronto, that most assuredly does not seem to be the case.

Perhaps it's because I'm a lesbian and on the fringes of the fetish community, but I certainly don't see a lack of sexual activity in the city here. Tinder is super popular as wel.

<comment><USER17> I think this is actually a controversial thing to say, but I've always pretty much assumed that women who wanted sex could have it essentially whenever they wanted (or to be less absolute, 90% of women), whereas men wanted it but found it unattainable (or, again, say, 90% of men). So I always figure if women aren't, it's because they don't want to and if men aren't, it's because women don't want to.

<comment><USER14> It might be easier to get sex for a woman but while having sex you need security/trust which she might not get from everyone.

If all you want is sex as a man, there are also prostitutes and escort services. But yea, they might not be available everywhere.

Sex is easily available in market.

</comment></comment></comment><comment><USER14> I am a psychologist.

This is based on my high tech dating experience of dating many people.

1\. Perfect looking people have insecurity because they've six pack abs but their penis size isn't as big as the pornstar they saw last night.

These people don't wanna show anyone their nude body.

It's all time high because of Instagram models.

Even the people who look 9/10 feel insecure because of Instagram.

A person looking 9/10 when coupled with makeup, professionals photography, Photoshop, look out of the world.

2\. STD/STI awareness is all time high. People don't wanna live with HIV/AIDS

Remember the news stories where guys would secretly remove the condom and go bareback without their partners knowing? Yes, people are afraid now.

3\. Cameras everywhere. No one wants to be recorded while having sex and next day leaked to web just because they decided to breakup and someome got mad.

Taking it upto to social network and threatening with your follower count is a real thing!

Felt even a little bit of injustice? No worries, let the world decide who is wrong and post all photos, videos, communications and the smear campaign starts.

4\. They are preparing for professional life and yes it's getting tougher. People have little money left after all neccessaties in life and no time.

5\. Romantic interests don't stay around for long if they don't get sex from you by 2nd or 3rd date. So lots of people who wait for some special connection before they jump in bed, don't really find anyone.

Back in time people spent months to years courting a romantic interest before getting in bed. But now, people show interest for few days and if they don't get what they want, they are off to Tinder to look for someone who is more willing to have sex fast.

6\. You need to be genetically gifted.

Used studio quality photos on Tinder with makeup on and Photoshop. Got bunch of folks interested? They ask you to snap your photo or they'll block you. You quickly comply but guess what, you aren't genetically gifted so you aren't handsome/pretty as they thought. You got ghosted.

After a while you get pissed off by being treated like this and stop looking for anything related to love/sex.

Who wants to go through this humiliation again?

No one sees anything outside your face and body. People are comparing numbers against numbers. Personality will get a chance after you pass their aesthetic and number filters.

7\. Sleeping with executives/managers is more rewarding so why sleep with same kind of people?

There is lots of sexual harrasment at companies. People either shutoff their sexual desires or sleep with executives to get ahead in their professional life. Now, this executives isn't in same age group so less young people get to have sex as a result.

8\. Internet expanded the dating pool. Now, the people who want to have lots of sex can easily find another person with similar libido. This effectively decreases the number of people who will get to have sex with this person possessing high libido

9\. People aren't perfect. But now, if you make a mistake in real life, someone who ask about your mistake on reddit and someone's else will label you as asshole or something then you are ghosted.

Edit: Not sure why my personal experience is being downvoted.

<comment><USER11> Actually, the article covers a number of potential causes for the observed behaviors. Absolutely none of them are the weird things you have listed here.

Also, is it me or are the top comments here on HN for this post exceptionally terrible..

<comment><USER6> > Absolutely none of them are the weird things you have listed here.

Those weird things are also known as real life.

<comment><USER11> I believe the correct term is 'anectdata.' The article uses a study with many participants to try to explain it, while this comment does not.

<comment><USER14> Sure, it's my experience.

I am a psychologist. Take a look at my comment history.

About the study, it just asks people. Do you expect people to be truthful?

You should consider asking people if they'll do something amoral if you offer them money, also tell them you are doing this for a study.

And you'll see majority of people will answer, NO.

But in realife, you can pay people to do ammoral things and lot many people will be willing to accept it.

In some cases, they'll need a long term connection with you before they take your offer.

Study isn't necessarily always more accurate. Specially, if it's about self reported data regarding humans on subjective matters.

You can ask someone, how many times they had sex.

You might get an accurate answer. But you can't expect accurate answer when you ask them, why aren't they having more sex. Most people don't have introspection ability to accurately identify their real reasons. This is why you need a pyscologist which is what I am.

<comment><USER18> For a psychologist, you've easily suckered yourself into a common cognitive bias: appeal to authority. (and likely Dunning-Kruger)

You've presented only anecdata, then incessantly restated your credentials to shroud them in authority. But there are a lot of psychologists, and a decent proportion of those are crackpots. How can I trust you're not a crackpot?

<comment><USER14> The article also uses "this is a study".

So I decided to use "this is a psycologist".

Both of which are factually correct. If it makes, it appeal to authority in my case then it's equally applicable to the study defined in the article.

See, i am not presenting here any groundbreaking theory or refuting anything stated in the article but merely stating my experience.

How can it make me a crackpot?

<comment><USER19> lol, that's not how this works. You and a peer reviewed study do not share the same kind of legitimacy and definetely not equally applicable. Yours is, at best an opinion. The fact that as a 'pyscologist' (that's not how you spell it by the way), you can't see the difference makes it look like you're proving his point.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Speak for yourself!</comment>


Defaulting to private browsing mode - <AUTHOR> http://blog.jgc.org/2011/03/defaulting-to-private-browsing-mode.html

<comment><USER2> Firefox 4 beta 12 (on OpenBSD) actually has a "Permanent Private Browsing mode" checkbox on the privacy tab. So you can already do this. ;-)

That said, you may be interested in <http://panopticlick.eff.org/>, which shows just how private private browsing is...

</comment><comment><USER3> I've been doing this for about a year (not "private browsing mode" specifically, but setting Firefox to delete all history, cookies etc when it closes, which amounts to roughly the same).

Honestly I haven't noticed a lot of difference to my user experience, except except every week or two I have to click the login buttons on a handful of favourite websites. Since FF is still remembering the passwords, I don't have to retype those.

Other useful extensions I'm using: NoScript and HTTPS-everywhere.

<comment> mike-cardwell This.

I don't get why browsers allow long term cookies by default. Session cookies should be allowed by default, but "normal" cookies should be off by default. I've had mine off for years now without any noticably bad effect on my browsing...

<comment><USER4> I'm not sure how you know the difference between a session cookie and "other" cookie from a technical level.

You could do a per-cookie approval, but that gets tedious quickly.

<comment><USER5> A session cookie is a cookie that is sent without an explicit expiration time, and is explicitly specified to be so in the standards.

<comment><USER4> Sorry, you're right. Wasn't thinking properly.

</comment></comment></comment></comment></comment><comment><USER6> You can set up default private browsing/incognito mode if you want to. None of the major browsers have support for doing it through the normal options GUI as far as I know, but getting it working isn't at all hard.

In Firefox, set the "browser.privatebrowsing.autostart" about:config flag to true.

In Chrome/Chromium, append " --incognito" when starting to open an incognito window. Alias it or add it to your GUI shortcuts to start it that way by default.

In IE8+, append " -private".

<comment><USER7> Firefox has the option via the GUI, in the privacy tab, select custom settings for history and tick the first checkbox.

</comment></comment><comment><USER8> You don't need to use private browsing mode for this.

Just change the various setting to not store cookies permanently, not store history for more than 1 day, etc, etc. I assume you still want a disk cache? Private browsing disables that, but that has a detrimental effect on your browsing.

This is a terrible idea for most people though. Every time I go to my bank it needs to re-authenticate me? It doesn't remember the sites I go to frequently? I need to login again every time I go to HN?

<comment><USER9> _Every time I go to my bank it needs to re-authenticate me? It doesn't remember the sites I go to frequently? I need to login again every time I go to HN?_

You can still let your browser remember your passwords. This reduces 'authenticating' to simply clicking a button. Or you could configure a whitelist of sites that _are_ allowed to keep your cookies for a longer time.

And to 'remember' sites I go to frequently I have bookmarks (and my own memory). Then again, browser history did save my ass multiple times. It's the cookies that annoy me.

<comment><USER10> > Or you could configure a whitelist of sites that are allowed to keep your > cookies for a longer time.

This, I do. All cookies are session cookies except for my bank, to save their "I use this computer a lot" cookie so I don't have to be challenged in addition to the anti-phishing and password stage. And, I trust my own website so that I can put 'newblog' into the awesomebar and start writing quickly.

The only problem I've had is determining _which site cookies are important._ The bank uses a 3rd-party provider for the Internet Banking Area, so their cookies have no relation to the bank name. Once Firefox has forced a cookie to session lifetime, it doesn't go back to being saved when you whitelist that specific cookie's domain, which was confusing when next I visited the bank and it had forgotten me. But after _that_ visit, it was fine.

</comment></comment></comment><comment><USER11> This is a bit extreme for my case, but I do agree there lots of good use cases for privacy mode. My favorite one is when someone needs to borrow my computer: Giving them a browser in privacy mode means they don't have to log out of my gmail/facebook/etc to check theirs.

<comment><USER12> I have a "guest" account set up on my computers for exactly this reason. Windows' "fast user switching" gives me a nice way of quickly providing someone a handy "clean" environment for them to go wild with.

Not sure what the equivalent of this is in OSX or Linux.

</comment></comment><comment><USER13> I agree with him on 3 of his 4 points. I want third-party cookies disabled by default, I want forms never to remember anything and I don't want passwords cached. But I DO want my history remembered. In fact I want every page I ever visit automatically indexed (somewhere) that I can easily search against when I'm trying to find some page I've previously visited. Of course, the ability to easily remove pages from history/index though is a must ;)

</comment><comment><USER14> I've had Firefox configured to behave like that for ages.

The problem is that in the meantime I have started to never close my browser (notebook always just goes goes to sleep, no restart). So those settings aren't as useful as they used to be anymore.

</comment><comment><USER15> [https://chrome.google.com/extensions/detail/phodabgmalihpnmm...](https://chrome.google.com/extensions/detail/phodabgmalihpnmmlgoplifofcdnjoll)

there's also this chrome extension, but it only blacklists, not whitelists.</comment>


Anonymous speaks: the inside story of the HBGary hack - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars <comment><USER4> Computer security is obscenely asymmetric - an attacker only has to find one flaw, once, somewhere. A defender needs to constantly monitor, test, review isolate and basically never make any mistakes.

It is easy to look at almost any intrusion and attribute it to poor defenses. If HBGary didn't have a SQL injection, they'd have had a XSS vuln. Or a employee would get spearphished. Or an attacker at a local coffee shop would compromise a mobile client. Or a backup service would get compromised and unencrypted. Or a interviewee could plant a network listening device. Or the CEO's daughter could win a pre-owned iPhone. Or a secretary gives out a VPN login. And so on and so on.

Did HBGary suck worse than usual? Possibly - but consider Google china got hit by ie6+acrobat vulns, DOD lost hundreds of thousands of classified documents from an air gapped and physically controlled system to a private, Open BSD may have included side channel backdoors, Kaspersky lost their source code, PS3/iPhone/Xbox/HTC etc. are unable to secure their platforms.

The truth is, a motivated attacker will rarely fail. Anyone reading this would be unlikely to survive 24 hours of a coordinated attack whether it's done by 16 year olds, chinese university students, russian mafia, FBI or simply nerds that know how to google vulnerabilities.

Fighting back against a group like Anonymous provides the same asymmetric warfare problems as the US military experiences in fighting terrorists, including the inability to respond with similar tactics for legal reasons.

Bottom line is, almost any organization can be subject to this kind of embarrassment without warning.

<comment><USER5> The 'real' story is that HBGary charges that big bucks to tell other companies and/or government agencies about how they aren't following security best practices, yet they themselves weren't doing so. I don't think that anyone would be ragging on HBGary for lax security if Anonymous had pulled out some 0day kernel exploit to break into HBGary's systems.

They failed in:

\- Keeping their systems patched and up-to-date.

\- Convincing/forcing their users to use strong passwords.

\- Convincing/forcing their users to use separate passwords per system.

\- Convincing/forcing their power users/admins to use a unique, strong password on key systems (i.e. Google Apps Admin).

\- Not-invented-here syndrome (or maybe security through obscurity -- hey! if we use an obscure CMS then it won't be exploitable!) with respect to their CMS. I can be a little lax on them here. Had they chosen 3rd-party software people would doubtless be railing on them for _which_ off-the-shelf 3rd party software they were using (e.g. had they been exploited through a Wordpress vuln, then people would be lambasting them for using Wordpress vs <insert-cms- here>).

<comment><USER4> The 'real' story is that a motivated attacker will rarely fail.

You can take almost any intrusion and write it up in wildly different ways.

If HBGary had not failed in everything that you listed, odds are you would be listing some other comparable set of failures:

\- something somewhere is always unpatched and out of date

\- humans always deviate from best practices

\- 99.99% of intrusions involve traditional threats, well known vulnerabilities, unpatched systems and human error

I could write up 100 different intrusions done in 100 different ways and almost always make the victim sound incompetent, or like a real life spy novel, or make the defenses sound like fort knox, or make the intruders sound like gods, or make it sound like my product would have prevented them, or draw the conclusion that the security environment is hopeless and out of control.

In the end it doesn't really matter how it happened or what I make it sound like.

Bottom line: Did you get owned [Y/N]

<comment><USER6> Then again, a motivated defender is a _very_ though adversary. Think "web server serves plain files only and is disconnected from the internal network"[1], "secure OSes everywhere"[2], "password quality checker installed"[3], "full-disk encryption for all serious data"[4], "SSH logins only via public key"[5], etc. Yes, this takes (some!) real effort. No, getting 0wned by "please drop the firewall and send me the root password" is not acceptable if you're a security outfit.

Really, you can go years without patching if you choose your software properly. (Except browsers - those just suck.)

[1] e.g. <https://github.com/mojombo/jekyll> [2] e.g. <http://www.openbsd.org> [3] e.g. <http://www.openwall.com/passwdqc/> [4] <http://www.openbsd.org/faq/faq14.html#RAID> or the equivalent for other OSes [5] All over the internet. Or set up a Kerberos environment and get single- sign on too.

</comment></comment></comment></comment><comment><USER7> Amazing write up - this is one of the best pieces of technical journalism I that I think I've seen. There is no hype, it's informed, it's detailed - <USER2> not super technical, i.e. math showing password complexity to rainbow table size tradeoffs etc.

Any journalists out there, this is how it's done.

<comment><USER8> Ars Technica regularly comes out with good pieces like this. Out of all the tech news sites I've seen, they're generally the most professional (other than their photoshopped story images; those usually go for humor) and thorough in their coverage.

</comment></comment><comment><USER9> Very well written article - it does a terrific job of explaining things like rainbow tables for a non-technical (or at least, technically-but-not-security- minded) audience. The only part that seems off is the theme that /all/ of the exploited vulnerabilities were necessary to render HBGary vulnerable:

"Even with the flawed usage of MD5, HBGary could have been safe..."

They homebrewed their own password system. Can someone switch on the tptacek bat-signal?

<comment><USER10> _They homebrewed their own password system._

the story says hbgary hired an outside company to make this cms for them, which may explain the crappy security on that particular system.

 _Can someone switch on the tptacek bat-signal?_

thomas' security company also got hacked a couple years ago and had sensitive information plastered all over a mailing list. rumor was that it happened via their use of wordpress for their weblog.

i guess the moral of the story is... you will get hacked by crappy third-party software?

<comment><USER11> > the story says hbgary hired an outside company to make this cms for them, > which may explain the crappy security on that particular system.

Doesn't that make them look even more amateurish and incompetent? They chose an insecure content management system and, most importantly, they didn't isolate it enough. So penetrating that resulted in a complete penetration of their site.

If they were selling hand-made baskets, nobody would blame them, but they sell "security" and charge big bucks for it, so they deserve the ridicule.

It is an interesting perspective I guess on selling "security", both as a service and a product. One can charge lots of money, but unless there is a serious attack and penetration, it is hard to know what the quality of they security product is. Of course once the penetration happened, there is at best pity and at worst ridicule and blame.

<comment><USER12> Not really, they should've tested the site themselves and there's evidence that this actually happened on the main site but not federal. Normally a company contracts an external company to do the work for them and either asks the external company to independently check the security of the output or organises it themselves. In the case of federal it may have been the case that neither happened.

> If they were selling hand-made baskets, nobody would blame them, but they > sell "security" and charge big bucks for it, so they deserve the ridicule.

I disagree. Anonymous were a highly motivated persistent attacker. It doesn't matter whether or not there was SQL injection involved, they'd just keep on going until they get in regardless. If there wasn't a SQL injection bug there'd be something else. Tptacek's company has been hacked into, our website got hacked into years ago (through having shared hosting - someone else had a SQL injection bug on the same box and the hackers defaced every site on the box. The difference is that we did a risk analysis beforehand and decided to never to store sensitive data there nor use the same credentials for that account anywhere else). Given a long enough timeline, everyone gets hacked. While the SQL injection bug was the way in, the real schoolboy error was Aaron Barr using a weak shared password for Google Apps admin.

<comment><USER13> > the real schoolboy error was Aaron Barr using a weak shared password for > Google Apps admin.

I've been reading through some of this HBGary stuff, and I have come to the conclusion that Aaron Barr is kinda a dipshit.

Read the email analysis at <http://www.wired.com/threatlevel/2011/02/spy/> and its filled with Aaron Barr "hacking" into people's facebook accounts and then posting pictures of their kids as if he made some awesome discovery.

</comment></comment></comment></comment></comment><comment><USER14> Good TLDR: "So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willingness to hand out credentials over e-mail, even when the person asking for them should have realized something was up."

</comment><comment><USER15> HBGary isn't anywhere near the only company to have security holes like this open. It's just worse because they're a security company and they happened to piss off Anonymous.

Getting employees or users not to reuse passwords is probably the hardest thing to do.

Also, Ars' coverage of this story has been great.

<comment><USER16> One point in favor of requiring ssh keys for external access is that the users don't get to blow it on passwords. Though it does require sysadmin staff who are willing to walk users through the process of creating the keys --- and stubborn enough to explain that this _is_ the procedure until following it becomes the path of least resistance.

<comment><USER17> Changing passwords is a lot easier than changing keys.

<comment><USER18> Also, passwords are compromised much more often than keys. To get someone's SSH key you have to have access to their local workstation, which is probably going to be more troublesome than access to a colo'd server, if for no other reason than most workstations go to sleep after they've been inactive for a while (there are other reasons, though).

Also, changing keys isn't that hard. You just re-run ssh-keygen and delete the old key from authorized_keys and replace it with the new one.

<comment><USER17> replacing the private key is the hard part. it's the kind of thing where you don't discover that the new private key for your server isn't on your backup laptop until you need to login and don't have access to a system with they key.

</comment></comment></comment></comment></comment><comment><USER19> <rant>As others have said, the most serious thing is that it is a security company, and they seem to have ignored EVERY security best practice ever! Did they do anything right?

As a security specialist myself, I always do my very best to follow best practices, not only to protect myself, but to show others that I am willing to follow my own advice. I have met security people doing presentations that need to elevate to admin, and they are logged in as admin already. Sometimes even with UAC turned off. This completelly shatters my confidence in them. I am always logged in as normal user and have long (20+) passwords, and make sure people see that I have long passwords. I don't hold others to the same standard, but I know people. If they see that I use 20+ characters, they will not think that the 10 that I want them to use is that bad.

This is the way the security landscape should work. We should all set ourselves to much higher standards than the advice we give others. We should always follow up on it. We KNOW lazyness will cause breaches, so therefore we should never be lazy when it comes to security. For a security company - <USER3> especially the president - to have such low security lowers the confidence for the whole industry.

Yes, security is asymmetric. That is why companies must always follow at least the recommended best practices. If they are followed, the target might be too hard to break into and a hacker might go someplace else where it's easier to break in. Targeted attackers might still get it, but we should all make sure they have to work DAMN hard to succeed! If we start thinking that the attackars will succeed anyway, we might as well drop all defences. Display the admin passwords at the bottom of the "About us"-pages.

Bottom line, HBgary fucked up good. They showed the world that they give advice that they don't follow. They deserve the burn and anybody thinking about hiring them should think again. Even if they change the problems that allowed this breach, the basic problem is that they obviously don't understand security. If they did, none of this would have happened.

</end rant>

</comment><comment><USER20> Wow. Did they do _anything_ right?

I can understand a typical organization making most of these mistakes, but a security firm?

<comment><USER21> I don't mean to shatter your dream of how security firms are run, but on the whole, I'd bet we're no better than the industry at large.

This might be a "cobbler's kids shoes" issue, or just a general failure of people and process.

One of the only truisms I've found so far when dealing with breaches is that almost no one gets this right proactively. You almost have to be the victim of a breach (the more public the better) to actually rethink how your people/processes are implemented.

This seems true for the largest banks in the world, and the smallest security firms.

And it's easy to look back in hindsight and say "how could they have possibly had things set up that way?", but the truth is that this was not an opportunistic attack; if these vulnerabilities weren't present, then they'd have looked for others.

That's the problem with securing your environment, you have to get everything right, and the attacker only has to get one thing right. That being said, as with most "disasters", this was a series of cascading failures (like most airplane crashes, or oil rig explosions).

Hopefully they'll learn from this (assuming the negative fallout doesn't completely bankrupt the company).

<comment><USER22> _I don't mean to shatter your dream of how security firms are run, but on the whole, I'd bet we're no better than the industry at large._

If it's ever possible for me to hire a security firm that has higher standards than this, I'm going to do that!

<comment><USER23> I agree with stcredzero. You need some standards if you're going to put yourself out there as a security company. I'm a random chick with some web programming and I know that you should iterative hash or salt your hashes. I also know you shouldn't use the same passwords, and what sql injections attacks are. Hey, maybe I should start a security company!

<comment><USER22> It's more of an issue with, "do they practice what they preach?" "Do they eat their own cooking?"

When people at a company don't do this, it's often a symptom. A friend of my girlfriend worked at an AT&T store. She could've gotten a huge discount on AT&T mobile? Her answer: no thanks.

</comment></comment></comment></comment></comment><comment><USER12> This is a very well written summary of how it all went down. From this, we can conclude:

* An initial entry point through SQL injection (from which we can infer that the federal site was probably never security tested)

* The use and re-use of weak administrative passwords

* The adoption of poor practices (such as sending passwords in cleartext via email) at rootkit.com

Of all of these, the attack would've probably been limited to the federal site had Aaron used decent strength administrative passwords (or just not reused them). The issue regarding the website comes down to risk ownership. If Aaron Barr was the risk owner for the website, it falls down to him. If in his contracting the company, Aaron had a plan to test the website then whomever tested it missed the SQL injection (which could've been implemented after a test by the CMS firm without him knowing, or any number of things). If Aaron didn't have a plan to get the site checked out, then that's both strikes falling on his shoulders. The third strike is quite clearly stirring the hornets nest.

Moral of the story: Don't antagonise groups that will strike back without a plan to deal with it.

Moral #2: Don't reuse passwords.

Moral #3: Retest your app on every significant change (including initial deployment).

</comment><comment> wh-uws SQL injection and MD5... on a "security" company? In 2011?

I'm sorry but thats just egregious. Thats like being a bodyguard and not even putting a lock on your own house.

The rest of the attacks could have happened to anyone. We all know its best practice to use many different passwords but most don't because its more convenient to only have one or a few. And if the email is coming from the email address it should you could brain fart and give up the info without thinking.

But the first two parts of the attack should NOT have been possible for them to even pretend to call themselves a computer " _security_ " firm in 2011

<comment><USER24> You are completely wrong to justify people using the same passwords in multiple places because it is convenient.

<comment><USER25> Understanding a behaviour isn't the same as justifying it.

</comment></comment></comment><comment><USER26> I just took an introductory course in web security. This explained many terminologies that fly over my head on HN.

</comment><comment><USER18> This really makes the case for much more public-key cryptography everywhere -- if all of the emails between HBGary, even internally only, were encrypted, HBGary would have gotten out with just a small DDOS and been meandering along just fine today. I think that people that run a computer security company should at least be able to figure out Enigmail.

<comment><USER27> not sure how e-mail encryption would have helped... ? They SQL injected and got the DB, obtained the passwords and then proceeded further (social engineering: FW policy change, ssh password through e-mail, etc.)

<comment><USER28> If you protect your keys well enough, you can protect the content of your emails. If they're stored on an IMAP server, downloading them will do you no good without the keys. Additionally, compromising a single machine may only yield the key to some subset of a company's emails.

</comment></comment></comment><comment><USER29> _One: the root password to the machine running Greg's rootkit.com site was either "88j4bb3rw0cky88" or "88Scr3am3r88"._

There must be more to it than this. If you know it's one of two passwords, why bother asking - couldn't you just try both? (In retrospect, maybe it was to give Jussi confidence that he was communicating with the real Greg? [Who else, after all, would know the root passwords?])

<comment><USER30> That was the root password, and remote root was disabled, so they had to social engineer an account that could remote in over ssh so they could su to do the real damage.

</comment></comment><comment><USER31>
      HBGary used Google Apps for its e-mail services

So, this high flying super duper high tech hardcore company actually uses an external email provider for their (I suppose) super secret emails?

The more I learn about this incident the more Mr. Barr and HBGary look like a bunch of amateurish dolts that may give good power point presentations, but I for one sure wouldn't take my security business there.

<comment><USER12> We use Google Apps for our e-mail and we're a security company not entirely dissimilar to HBGary (the main company, not federal, and in terms of services, not practices).

We moved to Google Apps as they bought Postini. We had an adult discussion of the benefits and drawbacks, and as everyone had PGP made it a straightforward job of encrypting things according to policy. Google Apps (for business, at least) offers SSL encryption on everything and offers relatively little by way of additional risk compared to using someone like messagelabs for your AV. Obviously they're storing the data for you, but you'd get that with any hosted provider.

</comment></comment><comment><USER32> FYI, it looks like Anonymous is aiming for total humiliation as far as HBG is concerned - they have even set up a pretty web interface/search for the entire collection of stolen emails - see <http://hbgary.anonleaks.ru/>

</comment><comment><USER33> Relevant: <http://news.ycombinator.com/item?id=2227181></comment>


Carly Fiorina endorses waterboarding 'to get information that was necessary' - <AUTHOR> http://www.theguardian.com/us-news/2015/sep/28/carly-fiorina-endorses-waterboarding <comment><USER2> Good - more diversity is needed in war criminals.</comment>


Refactoring using mathematical properties of min - <AUTHOR> https://bor0.wordpress.com/2018/06/15/refactoring-using-mathematical-properties-of-min/ <comment><USER2> The blog post doesn't mention integer overflows. If integers wrap around on overflow, min(INT_MIN - 1, 0 - 1) = -1 but min(INT_MIN, 0) - 1 = INT_MAX. However, in PHP the values are converted to floats, which should preserve the equation min(a -c, b - c) = min(a, b) - c.</comment>


Removing Coordinated Inauthentic Behavior from Russia - <AUTHOR> https://newsroom.fb.com/news/2019/01/removing-cib-from-russia/ <comment><USER2> Wow, a grand total of 75 user accounts, and $130 000 of ads.

How is this anything but a drop in the ocean? If this is the extent of 'Coordinated inauthentic behavior' I'm rather unimpressed with the capabilities of Russia.

<comment><USER3> 790,000 followers

<comment><USER4> What % of them do you think get feeds from these russian actors that make it to their main feed. FB has said they filter 99% of the 1000's of posts happening that you could be following due to overload, so that would be a couple hundred people.

</comment></comment></comment><comment><USER5> What about "Coordinated Inauthentic Behavior" from elsewhere? FB is just feeding the coordinated desinformation spread by the US. Billions in ADs, targeted manipulation, phone bots, media monopolies spreading bullshit round the year, but don't worry about that, look Russia...

<comment><USER6> Top comments all are trying to relativise the stuff Russia is doing, what a surprise - basic propaganda tactics.

The things the Russian propaganda machine is spreading are just intense. Misinformation on repeat, with real life consequences. That big US corps manipulate too is another story, but what Russia is doing is clearly at another scale and state sponsored with clear foreign policy aims, most importantly to undermine trust in institutions and the actual news media and secondly to try different alternate narratives and see which ones stick. The key aim of these many sites is to disseminate and diffuse the disinformation to come from 'many sources' at once, to make it more convincing (what we hear often enough we believe).

This series of bans is a very good initiative, although I'd say far too little too late. Sputnik and co are not media, they are propaganda machines that happen to intersperse some true stories and occasional facts in their package of lies. If you don't believe me- look at the site. Solid news mixed with outlandish conspiracy theories, and all that 100% state sponsored.

For context I very much recommend anyone interested to take a look at Oxford's excellent computational propaganda research:

[https://comprop.oii.ox.ac.uk/](https://comprop.oii.ox.ac.uk/)

This official EU initiative is similar, taking apart individual pieces of disinformation:

[https://euvsdisinfo.eu/](https://euvsdisinfo.eu/)

<comment><USER7> > Top comments all are trying to relativise the stuff Russia is doing, what a > surprise - basic propaganda tactics.

FWIW, the commenting guidelines ask you _not_ to impute astroturfing or shillage in HN comments. Although I do wonder to what extent such a suggestion might apply to _this_ thread - "Coordinated Inauthentic Behavior" being as good a definition of astroturfing as any - it makes sense to err on the side of caution, if only for the sake of having a productive discussion!

</comment></comment></comment><comment><USER8> In case anyone from the FB team behind this is reading: Was stealth banning the relevant accounts considered? If so, curious to know why it was rejected.

<comment><USER9> In such coordinated operations, the impact is usually verified via independent accounts which are not participating in spreading, which are nearly impossible to distinguish from actual victims. So stealthban is not particularly effective. As a part-time consultant on countermeasures for opinion manipulation in social networks, I can say that passive defenses are usually not reliable enough.

</comment></comment><comment><USER10> "Coordinated Inauthentic Behavior" is a nice euphemism!

<comment><USER11> Sounds like a good definition to me. Better than the widely used "troll", which used to mean a different thing, before being appropriated by the mainstream media. Trolls used to mean people provoking emotional reactions with the intent of disrupting communities and ridiculing their members. And unless Putin is doing this for the laugh...

</comment></comment><comment><USER12> By calling it "coordinated inauthentic behavior" FB is themselves being inauthentic. Authentic would be to describe actually what it is and what the problem is. Is the problem that it was coordinated? That it was not true to the poster's personal belief (inauthentic)? Not actually true assertions (not authentic)? Maybe the behavior is the problem? Or some combination? So if the Russian state clearly put out content saying "This is Russia and we think you should vote for X" is that okay (coordinated authentic behavior)? What about all the "CIB" originating from inside the US? Or, how about FB's own "CIB", like the link in question?

<comment><USER13> I don't understand their claim it was inauthentic either.

Their writeup says the pages claimed to be independent, but were actually linked to employees of Sputnik News.

OK, but all the screenshots they showed (in the first batch) had the word "sputnik news" in the URL. That doesn't look very surreptitious to me, let alone inauthentic. If Sputnik employees are linking to stories they worked on or their employer published, how is that different to journalists tweeting stories from their news outlets on their personal Twitter accounts? Is there some formal rule now that all employees of news agencies have to loudly identify themselves as such before re-sharing content from their employer? If so, where did Facebook announce that?

The odd way Facebook are describing this action also makes me wonder about their claim the accounts were "linked to" employees of Sputnik. What does that mean exactly? Not owned, if they were owned presumably Facebook would have said so. Rather they are "linked to". This could mean many things.

</comment></comment><comment><USER14> > We are constantly working to detect and stop this type of activity because > we don't want our services to be used to manipulate people

Right, as long as you don't count American political content and advertising!

<comment><USER15> I had a similar reaction... It seems that's the entire point of the platform. Perhaps more accurate would be "we don't want our service to be used to manipulate people in ways we disagree with/could get in trouble for"

</comment></comment><comment><USER16> I'd be very interested in seeing if there's a similarly worded vkontakte or livejournal post from their admins, about removing "coordinated inauthentic behavior" from american sources.

Edit: I'm not alleging the US is doing such a thing in an organized manner, as the Russian "internet research agency" does, what I'm asking is whether the knee jerk response from Russian Facebook competitors (or state media like RT, Sputnik) will be to make the same allegations but in reverse. And if so, what form that will take.

<comment><USER17> It does beg the question of whether Facebook will, or will be even allowed to, combat _covert_ Western influence operations.

(I'm OK with _overt_ influence operations that are clearly labelled, like the BBC World Service)

<comment><USER16> In my past experience the US' foreign language government run media operations are pretty transparent. The BBG, broadcasting board of governors, is part of the federal budget and is regularly audited, is subject to FOIA requests, etc.

BBG is the parent entity of Voice of America, etc.

The US runs a lot of foreign language media which people might not know exists, if they aren't a native speaker of the target language/culture.

For example Radio Azadi, which is the VOA/RFE for Dari speakers in Afghanistan. It also produces Pashto content.

[https://en.wikipedia.org/wiki/Radio_Azadi](https://en.wikipedia.org/wiki/Radio_Azadi)

And Farda for Iranian Farsi.

[https://en.wikipedia.org/wiki/Radio_Farda](https://en.wikipedia.org/wiki/Radio_Farda)

<comment><USER17> The transparent ones are visible, but what about the deniable ones we can't see?

<comment><USER16> Totally personal opinion, but they're more likely funded by private corporations that want to influence society to buy more of their product, or slush funds of lobbying money similar to how the Kochs fund PACs in the USA. Mercer family funds, etc.

People who have vested interests in organizations such as Saudi Aramco maintaining the status quo.

<comment><USER18> It's worth noting that US propaganda operations even on US soil are not unprecedented. During his tenure Obama signed a national defense authorization act[0][1] that some claim has re-legalized propaganda operations on US citizens. The CIA has admitted doing so during Operation Mockingbird[3] and in other situations[4] in the past. Given that I suggest that you remain highly skeptical of all media and independently verify claims as much as possible as it seems historically governmental as well as corporate interests have manipulated the media for their purposes and that is appears it is legal for the CIA to do so today.

[0][https://www.businessinsider.com/ndaa-legalizes- propaganda-20...](https://www.businessinsider.com/ndaa-legalizes- propaganda-2012-5)

[1][https://www.rt.com/usa/propaganda-us-smith- amendment-903/](https://www.rt.com/usa/propaganda-us-smith-amendment-903/)

[3][https://en.wikipedia.org/wiki/Operation_Mockingbird](https://en.wikipedia.org/wiki/Operation_Mockingbird)

[4][https://en.wikipedia.org/wiki/CIA_influence_on_public_opinio...](https://en.wikipedia.org/wiki/CIA_influence_on_public_opinion)

Edit: made comment more clear

<comment><USER17> While what you say is almost certainly true, I note the irony of linking to a Russian propaganda news organisation to support it.

Even more ironically the only reason people follow RT is that they're often covering things that the western media status quo has a blind spot to.

<comment><USER18> I noted that myself, rather suspiciously western media failed to cover it at the time. I can find the text for the bill and prove that he signed it via official government sources but business insider is the only reasonably reputable source that covered in the US to my knowledge. I'm not a lawyer so I'm not going to assert that it does what they say it does but it leaves me skeptical.

<comment><USER19> > I noted that myself, rather suspiciously western media failed to cover it at > the time. I can find the text for the bill and prove that he signed it via > official government sources but business insider is the only reasonably > reputable source that covered in the US to my knowledge. I'm not a lawyer so > I'm not going to assert that it does what they say it does but it leaves me > skeptical.

The take you're promoting seems to have originated with Buzzfeed, then got picked up by BusinessInsider and amplified by Russia Today. Given that it's pretty unbelievable that there's a coordinated Western-media conspiracy to suppress it, my bet is that take has some major flaws and/or there's less to it the take makes it seems.

Based on some quick Googling, the law that was modified was the one that authorizes The Voice of America and related organizations, and (according to Wikipedia) the prohibitions on its US dissemination were originally put in place because some Congressmen in the 40s thought the State Department _was full of commies_ (really).

This NY Times from 2018 gives some perspective ([https://www.nytimes.com/2018/07/19/technology/facebook- ads-p...](https://www.nytimes.com/2018/07/19/technology/facebook-ads- propaganda.html)). VOA is still not permitted to advertise to Americans, and it characterized the law RT was writing about as:

> As with all affiliates of the Broadcasting Board of Governors, Radio Free > Europe/Radio Liberty is governed by the Smith-Mundt Act, a 1948 law that > banned government-funded media outlets from disseminating their content > inside the United States. The law was amended in 2014 to allow state-funded > media organizations to distribute their content "upon request" to American > viewers.

It seems that it amounted to giving organizations like the VOA permission to send their content to individual Americans who ask for it. It seems like prior to that it was available "for examination only."

[https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act#Provis...](https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act#Provisions)

I would only be skeptical of something based on an RT story if you actually do the digging yourself to see if there's really a there there. In this case, I don't think there is.

<comment><USER18> That New York Times article is interesting, if it is indeed illegal to target propaganda to American citizens it seems that VOA did so in violation of law and only stopped when caught doing so.

That leads me to one of three conclusions:

1: Someone working for VOA felt that it was not illegal for them to do this making Business Insiders interpretation of the law at least plausible if not correct.

2: VOA knowingly used Facebook to target Americans with illegal propaganda.

3: Workers implementing VOA advertising were unable to understand that if you select "United States" as a target in Facebook's geo-targeting tool[0], that advertising indeed will be shown in the US.

Three seems the least likely to me personally given the historical context and since being skeptical of news releases is likely good practice anyway I'm not convinced that you shouldn't be.

To quote the same article:

Weston R. Sager, a lawyer with firm Gallagher, Callahan & Gartrell who has written about anti-propaganda laws, said that it was disturbing to see government-funded news agencies targeting Facebook ads at Americans, no matter their content.

"I'm concerned that we're seeing the beginning of government efforts to try to influence public opinion in the United States through the B.B.G. and its affiliate entities," Mr. Sager said. "It's one thing to read a tweet by Donald Trump. It's another to receive a very polished news story from an organization that holds itself out as objective and fact-based."

[0][https://www.facebook.com/business/help/202297959811696](https://www.facebook.com/business/help/202297959811696)

<comment><USER19> > That leads me to one of three conclusions:

There's a fourth speculative possibility:

4\. The VOA ad-buyer isn't a robot and bent the rules to target ads at the US for testing purposes (e.g. to see with his own account).

You could call such an act "propaganda illegally targeted at American citizens by the US government," and while technically true, it'd also be a hyperventilating overreaction. Especially since:

> The ads included several human-interest stories about Russia and a graphic > about NATO's popularity.

It's also worth noting a fact about the VOA's history. It was meant as an antidote to Soviet propaganda efforts, which featured heavy censorship and deliberately concocted lies [1] [2], by reporting truthfully according to Western journalistic standards. While that might still arguably be classified as propaganda (in its broadest form, an effort to convince someone of something), I'd find it difficult to honestly condemn it. I've read memoirs of dissidents that spoke very highly of it and its reporting, and they wouldn't have done so if it had been merely censoring and lying with a different bias. In my view, the modern desire to keep it out of the US is mainly born out of tradition and an abundance of caution.

[1] [https://en.wikipedia.org/wiki/Disinformation#Defections_reve...](https://en.wikipedia.org/wiki/Disinformation#Defections_reveal_covert_operations)

[2] [https://en.wikipedia.org/wiki/Operation_Infektion](https://en.wikipedia.org/wiki/Operation_Infektion)

> Three seems the least likely to me personally given the historical context > and since being skeptical of news releases is likely good practice anyway > I'm not convinced that you shouldn't be.

I'm appropriately skeptical of news releases, but it's possible to be over- skeptical as well. That over-skeptical state is actually the goal of some forms of propaganda.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Facebook carefully guards its monopoly on coordinating inauthentic behavior! :)

<comment><USER20> Yep. It's ok when SCL, AggregateIQ, Cambridge Analytica, Data Propria etc do it of course!

</comment></comment><comment><USER21> Does Facebook have the same amount of concern for massive "Coordinated Inauthentic Behavior" campaigns originating from Israel/JIDF and US Intelligence Agencies that dwarf the Russian ones pointed out in this post?</comment>


Bitfusion: Supercomputing for the masses - <AUTHOR> http://www.bitfusion.io/blog.php <comment><USER3> Another example of a company or product web page that fails to explain what they are offering. You make stuff go faster, got that. But how do you do it or even more what do I have to do? Hand you a binary? Hand you source code in this or that language? Rewrite my source code using a library you give to me? Something entirely different? Put this in the first one or two sentences - <USER2> make stuff go faster by, for example, recompiling your C++ source code to a net list for an FPGA - then you can go on with this marketing stuff telling me how important all this is and what opportunities it offers and so on. I will of course skip reading that.

<comment><USER4> Hello, a cofounder of Bitfusion here.

Thanks for your question, you can take a look at our TCD presentation for an overview: [http://techcrunch.com/2015/05/05/bitfusion-helps- developers-...](http://techcrunch.com/2015/05/05/bitfusion-helps-developers- get-more-power-out-of-their-existing-hardware/)

Bitfusion is a software layer that discovers available hardware accelerators and then automatically applies accelerator libraries, smart load scheduling, and dozens of software optimization techniques to make acceleration "plug and play".

Specifically, our software is built on top of OpenCL which allows our software to take advantage of any device that supports OCL. It's a solid basis for hardware compatibility, and it allows us to take advantage of FPGAs that just recently started supporting OCL robustly. Second, we've build a bunch of functionality to make simultaneous use of multiple accelerators — even from different vendors and types. This is an important step because a fundamental problem for widespread adoption of heterogeneous hardware is being vendor and device neutral to keep software development sane and tractable. Thirdly, we've been developing, curating, and partnering to combine the most promising automatic software optimization tech to deliver to our customers to address app performance more generally.

Hardware acceleration to the masses is *primarily about friction: apis, code optimization, vendor-specific code. Bitfusion is all about bringing this friction down to zero. We love talking about this stuff all day, so send us a note if you'd like to talk more.

Mazhar

</comment></comment><comment><USER5> So, is this some kind of super-JIT (binary translator) that translates and vectorizes x86 code and then passes it on to GPUs and FPGAs?

Automated X86 to GPU native translation is looking more and more feasible, with some caveats. Especially SIMD operations are a natural fit. But the issues... GPUs are sequentially very slow. Single thread execution is over an order of magnitude slower than for CPUs. Latency between host CPU and GPU is usually significant, measured even in milliseconds. Other than memory bandwidth, CPUs are catching up on GPUs anyways. If x86 SIMD keeps getting wider, we might be just a few years away from CPU and GPU processing power parity.

But FPGAs... Does it place and route itself, or use something like OpenCL as a backend? Or does it make "netlists" out of x86 code and somehow make existing FPGA tools to compile them to chip fabric?

Anyways, when it comes to this product and FPGAs, I believe only when I see!

<comment><USER4> Most automatic code generation to GPUs can be summarized as glorified autovectorization. This includes the bunch of work converting Java to CUDA and C to OCL/CUDA. Autovectorization paired with automatic injection of OMP pragmas can be a great way to introduce increased parallelization.

For FPGAs, OpenCL support is still very new. Both Altera (now Intel) and Xilinx have toolchains that compile OpenCL source into gates through first highlevel synthesis and then taking the output through the normal synthesis, implementation, bitstream flow. It's a huge development that should increase adoption of FPGAs for more common use which is why we're excited about it.

Mazhar Bitfusion.io

</comment></comment><comment><USER6> What are advantages over renting GPU enabled AWS instances?

<comment><USER7> Seems their product is software, not hardware.</comment></comment>


Birka - <AUTHOR> http://raa.diva-portal.org/smash/record.jsf?pid=diva2%3A1291190&dswid=6500 <comment><AUTHOR> >This was Birka, the only town on the Scandinavian peninsula in the Viking Age.</comment>


Is there anything new in Visual Studio 2010? - <AUTHOR> http://coliveira.net/2009/05/visual-studio-10-beta-is-available/

<comment><USER2> Oliveira's "new features in Visual Studio" are all programming languages it now supports-- in other words, the development environment is synonymous with the compilers bundled with it.

When I left Windows as a development platform (maybe 10 years ago), it took a while to appreciate how deep the Unix philosophy of "compact, orthogonal tools" really runs. Now, though, it would never occur to me to describe a new compiler as a "feature" of the other tools I use.

I'm not sure that the difference in worldview really matters. I doubt that I'm significantly more productive now than I was with Visual Studio. However, I do feel incredibly straightjacketed whenever I have to go back to VS, as if that monolithic view of software is imposing itself on me, rather than letting me do what I want as I want.

<comment><USER3> It seems like adding features often reduces functionality or utility.

</comment></comment><comment><USER4> It's a shame the author isn't really distinguishing between Visual Studio 2010 and v4 of the Common Language Runtime / Dynamic Language Runtime.

VS 2010 has some neat integration points but isn't really of interest to the HN community - an in-depth look at v4 (particularly the DLR) however is worth chatting about sometime.

</comment><comment><USER5> To be honest, what I'm looking forward to most in VS2010 is the revamped IDE, and particularly the Call Heirarchy feature - which shows you the heirarchy of everything your method calls into (and vice versa).

<comment><USER6> The IDE is redesigned and now uses WPF. Also, the Historical Debugger sounds intriguing.

</comment></comment><comment><USER7> VS is required to develop software that will run on Windows (and that will forever be handcuffed to Windows). I do not wish to develop such an abomination, but many people won't have the same moral objections.

VS is Microsoft's "Office for developers" application. It's only reasonable to tout the features os languages and compilers not available elsewhere from Microsoft as features of the whole thing, because Windows developers have no other option.

<comment><USER4> _VS is required to develop software that will run on Windows_

I'm sure the user base of the delightful open source #develop making Windows apps will be sad to hear this, as will everyone using VS to develop against Mono.

Which compilers are part of VS that aren't available elsewhere?

<comment><USER7> Mono is something weird. I confess I fail to understand what drives clever people to hand over the design goals of their open-source project to Microsoft. They are clever people doing an extraordinarily stupid thing. And .NET apps are as much Windows apps as Java or Squeak apps are - they happen to run on Windows and, if you care enough, you may be able to run them elsewhere - and many do.

At least until the next broad Microsoft patent-infringment lawsuit. Mono is toxic in that regard - Microsoft may decide to start a FUD campaign anytime they want and Mono just gives them a huge stick. If that's not a dumb thing to do, I am not sure what would qualify.

As for the compilers, I am quite sure you cannot obtain any Microsoft compiler that is sold as part of VS without at least some part of VS. You can run them from the command line (if you could call cmd.exe a command-line) and you can download them from Microsoft for free, but saying that they are available "elsewhere" is a bit of an overstatement.

<comment><USER8> You obviously have _no_ idea what you are talking about and if anyone is doing FUD, it would be you.

The .NET compilers costs absolutely nothing and are part of the free (as in beer) .NET SDKs you can download whenever you feel like.

As for mono: Microsoft has actively supported the community, helped out with getting moonlight (the opensource Silverlight implementation) working, and as part of the Silverlight package you have IronPython, IronRuby and the DLR (dynamic language runtime) which are all largely opensource.

Even if Microsoft _wanted_ to bail out at this point, it would be too late.

Not to sound rude, but I think you had _one_ thing right in your comment: "Mono is something weird. I confess I fail to understand". How about the simple explanation? The .NET framework (despite the silly name) is a solid framework, C# is a good language, the CLR is sexy and people want to use it on more platforms than just Windows?

<comment><USER9> Why do you think that MSFT's current behavior toward mono will continue in perpetuity? If mono ends up negatively affecting profit motive, then MSFT will attack with full force, as it should. If mono doesn't have some security in writing, then mono may be vulnerable - and that's a perfectly fair issue for commercial developers to concern themselves with.

There's all kinds of ways to spin the mono future. One might be that, as MSFT realizes the OS is being devalued, let mono become popular, then work a licensing deal after litigation. How is this different from Novell caving in on Suse?

<comment><USER8> I'm pretty sure Microsoft themselves having contributed to mono projects would invalidate any such lawsuit. Also, Microsoft submitted the whole common language infrastructure (CLI), the core of .NET, to ECMA as an open standard.

So, unlike most things Adobe and Apple, Microsoft has actually made the .NET infrastructure open, but you don't see people decrying people for wasting their development efforts there.

So if that's a perfectly fair question, the FOSS world should immediately start reviewing pretty much all efforts not currently centered around POSIX, OGG and Theora as possibly wasted.

<comment><USER7> "I'm pretty sure Microsoft themselves having contributed to mono projects would invalidate any such lawsuit"

No. It wouldn't. And, most of all, it has no effect on where they take .NET in the future. If they decide to break Mono by moving the reference platform and to make Mono developers run in circles, they can. If they decide to sue _users_ of Mono programs, they pretty much can, unless at least a significant part of the code being used is licensed in a patent-litigation-proof license, which, I gather, is not the case.

The whole case is that you just have to trust Microsoft to, for the first time in its history, act in a civilized way. You may judge it's an acceptable risk for you and your users, but I just don't think that way.

<comment><USER8> _If they decide to sue _users_ of Mono programs, they pretty much can_

Now you are pretty much talking bullshit. If this is actually somehow allowed in the US, that is a failure in the US justice system and for the remaining 95% of the world unrelated to actual reality. With all this time spent trying to avoid lawsuits, I sometimes wonder how people in the US manage to be productive at all.

Anyway, your arguments seems to boil down to that any platform which isn't under 100% open source control is a risky investment and that it's not worth it. If that is your point of view, I can respect that, but at the same time you have to accept that puts you in a _very_ narrow window with regard to what markets and platforms you can develop for.

To me, from _my_ point of view, that's just too deep into Stallman-land and not a viable strategy in the real world.

<comment><USER7> "that any platform which isn't under 100% open source control is a risky investment"

No. Not at all. I have invested a lot in AIX, DB2, Oracle and Solaris over the years. It's just that handing the reference to what your product should be compatible with to Microsoft and then trying to compete against them in one of their cash-cows is pretty much the ultimate stupid thing one could try.

Microsoft has been caught more than once in unethical and illegal activities, so, why take the risk? Are the APIs so far superior than anything else around? Is it working? Is it bringing a meaningful flow of new cross-platform software? Are the languages so wonderful nothing else comes close?

And yes: the US patent system is deeply flawed. And so is he justice system that allowed MS to abuse its monopoly numerous times. I can only hope both get fixed because the US is too an important market to ignore. It seems the EU has a good grip on the situation and maybe the US can follow its leadership on this.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


A New Plan for Keeping NASA's Oldest Explorers Going - <AUTHOR> https://www.jpl.nasa.gov/news/news.php?feature=7446 <comment><USER2> What I find fascinating about the Voyager probes is that we can't replace them in less than decades, barring some new tech breakthroughs. They're so far out there that in all likelihood it will be many centuries before anything is further out than them.

V1 is over 145 AU from the sun, traveling 3.6AU per year, or around 60,000km/h, 17km/s. Even if you got a probe moving twice as fast, it would take close to 40 years to catch up. And moving a probe twice as fast (after escaping the sun's gravity well) would take a heck of a lot of energy. More likely you'd need a bunch of gravity assists from other plants, and waiting for the right time for those takes even longer.

They're irreplaceable. They're ancient. And they're still doing science.

<comment><USER3> It always upsets me that there aren't assembly lines of successful designs, flinging them in every direction

<comment><USER4> It's not really practical. For one, that's expensive. In addition, our space crafts are becoming increasingly better designed. Eventually, as in 50 years, it's increasingly likely we can do your suggestion at 1/1000 the cost with more sensors. It probably makes more sense to invest in developing future technology than doing your suggestion today.

<comment><USER5> I'm not arguing your point but I am wondering, will we say the same thing in 10/20/50 years?

</comment></comment></comment></comment><comment><USER4> I wonder if these instruments are actually providing accurate measurements though... if they weren't designed for such temperatures how can we be sure that they are not introducing artifacts?

<comment><USER6> Well I don't think scientists blindly trust the instruments. They probably say "instrument X provided measurement Y" and then they can argue for decades as to the accuracy of the measurement.

</comment></comment><comment><USER7> The fact that we can even receive the minuscule signal from these things is incredible.

What a great human achievement.

<comment><USER8> It's also impressive they can receive our signals. For us receiving we can use I guess a bigger dish. For them receiving I guess we can just blast a stronger signal.

</comment></comment><comment><USER9> Have we sent any missions over the solar poles?

<comment><USER10> Yes.

[https://en.wikipedia.org/wiki/Ulysses_(spacecraft)](https://en.wikipedia.org/wiki/Ulysses_\(spacecraft\))</comment></comment>


GeForce Now loses all Activision Blizzard titles weeks after launch - <AUTHOR> https://arstechnica.com/gaming/2020/02/activision-blizzard-abruptly-removes-its-games-from-geforce-now-streaming/ <comment><USER2> Perhaps laws should be created to acknowledge that time invested _has value_! The original content is not the only thing with a cost.

It is possible to spend endless hours to achieve something that _only_ has meaning as long as a 3rd party decides to enable the foundation you are building on. This is true for games, 3rd party add-ons, time spent reviewing, etc. If a 3rd party plans to just rip your foundation away, then they should either be forced to give you some option _not_ to do that (local server, etc.) or they should be forced to compensate you.</comment>


Twitter And Facebook Really Are Killing RSS  - <AUTHOR> http://techcrunch.com/2011/01/03/techcrunch-twitter-facebook-rss/

<comment><AUTHOR> Memes like this bother me ala the whole declaring things dead. The problem of subscribing to content still exists. It always will.

When RSS came along did that kill email newsletters or email subscriptions to content? No. RSS was just another solution to that problem. Twitter, FB, social,etc. is just another solution to the problem, it doesn't mean it kills RSS.

Is RSS used less now? Yup, but that doesn't mean it's dead. RSS has become a background technology. I haven't clicked the subscribe to RSS feed orange thingy in a while. I do use Pulse and get updates from key sites there. I bet that uses RSS to get the content. That's fine, that's probably how RSS should be used. Now everyone wins.

If we're talking about direct syndication and subscription and not complementary tech ala fb/twitter, then I don't see anything killing it currently.

Until the problem is no longer there, it's hard to say a technology ala solution to that problem is "dead".

<comment><USER2> I think this is only a terminology problem. In tech press, "A killed B" means that B is used less now, is not that cool anymore, etc. It doesn't mean that B is dead or is going to completely disappear. So in this light, I think the TC article is spot on.

</comment></comment><comment><USER3> Maybe it means that many readers don't want to read every article that TC puts out, so don't subscribe to the RSS. When there's an interesting article forwarded from a friend, they go and read it.

Personally I love Reader. I use it for high signal-to-noise writers only, where I want to read (or be aware of) almost everything they write. I regularly remove blogs who feel they need to put something out every hour, just because.

<comment><USER4> This. Not every article from who-n-who's blog is going to be posted on HN, or hit the front page of Reddit, or be shared on Facebook. Somebody does actually have to subscribe to blogs they like and read it, somewhere. It can't be aggregation all the way down. RSS is probably too complicated for normal people (being named something as pointless and confusing as "Real Simple Syndication" doesn't help).

I can see how some people might be able to get by, but when I'm one of maybe 100 people subscribed to a blog, I'm not going to see it drift by on FB.

</comment></comment><comment><USER5> I very rarely click through Reader to view the underlying post and I never stay subscribed to blogs that don't push their entire post through RSS. I don't have a problem with ads and the smart ones will embed them anyway. I just find it more convenient to read everything from a centralized setting. I like to avoid opening superfluous tabs on my crappy windows machine at work if I can help it, it needs all the free memory it can get just to stay unfrozen.

</comment><comment><USER6> I dislike google reader. I prefer native clients which cache the content I read. Currently, I use newsfire (mac) [1], before I was using newsbeuter (command line). Yes, I am aware that you can technically switch reader to an "offline mode". It just isn't the same as a native client with cached content.

Maybe the trend has been away from using google reader, and towards using native rss clients.

[1] <http://www.newsfirerss.com/> [2] <http://newsbeuter.org/>

<comment><USER7> > It just isn't the same as a native client with cached content.

It is exactly the same. It just 'feels' different because your mental model doesn't connect the same dots.

</comment></comment><comment><USER8> TC is one of the now-days rare RSS feeds that includes the full article content; because of this I rarely have any need to click through to the full article.

<comment><USER9> This. I read this entire RSS Is Dead article in Google Reader, never clicking through. With a Twitter or Facebook post, you don't have a choice but to click through in order to read it. Of course this is going to skew the stats.

</comment></comment><comment><USER10> Technology don't die it just re-emerges in other shapes.

The problem with these kind of discussions are that they confuse the product with the technology.

The real discussion they seem to be having is whether open is better than closed and we all know where that kind of discussion leads.

</comment><comment><USER11> RSS is dying from its overuse (too many blogs) and misuse (spam and pointless feeds).

Also the lack of innovation from RSS reader apps isn't helping.

</comment><comment><USER12> Of course it is -- Facebook and Twitter are nothing but aggregators for the masses, aggregating information that the masses care about in a centralized, simple way. The user doesn't have to download a reader, look around for an RSS button, copy the URL to an XML file, or anything like that; he just has to click "Follow" or "Add Friend".

Facebook and Twitter are not new concepts -- they are aggregators for their consumers and publishing platforms for their producers, and your mom uses Facebook or Twitter to follow the things she cares about for the same reason you use RSS to follow the technical blogs you care about.</comment>


TechCrunch Staff in Phantom AI Car Accident - <AUTHOR> https://www.youtube.com/watch?v=zGoE6Hco4jE <comment><USER2> Wow. Pretty big mess up. Standard new cars have auto-breaking that prevents these types of accidents. Clearly their AI is not only weak, but sub-par when compared to standard, non-AI technologies that have been on the market for 4+ years.

There should be a regulation to trying to technologies out on public roads.

<comment><USER3> > _There should be a regulation to trying to technologies out on public > roads._

The video doesn't say where this happened, but e.g. in California Phantom AI holds the required license, has to report incidents and might lose their permit if found violating the regulations for autonomous testing. ([https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/testi...](https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/testing/))</comment></comment>


Ask HN: Websocket/Node on local loop, why so slow? - <AUTHOR> https://gist.github.com/netgusto/0920eda110121eb7fdb382345c7db5d2 <comment><AUTHOR> What: Node server asking 100 clients to update once per second via websocket on a localhost loop.

Context: Server maintaining state for remote clients, clients issuing operations to alter state (some kind of remote game loop).

Mechanics:

1\. Server broadcasts update 2\. Every client (100 clients) queries state on server via emit api 3\. Server handles api requests and answers clients with api response (dummy data) 4\. Client processes state, generates a state update operation, and emits update to the server (dummy operation) 5\. Server aggregates operation to state (dummy operation)

Why so slow ? I was kind of expecting the connections to be handled in a parallel fashion, but it seems they're in fact processed sequentially by node. Could that be properly parallelized somehow ?

<comment><USER2> The Node server is single-threaded and multiplexes requests when they yield control (for instance, when they make an async database call). Depending on how realistic your "dummy operations" are, that may not be happening at all.

If you want parallelism, you'll need to add it yourself:

[http://mobilenext.net/scaling-node-js-multi-core- systems/](http://mobilenext.net/scaling-node-js-multi-core-systems/)

<comment><AUTHOR> > If you want parallelism, you'll need to add it yourself

I guess that's the way to go. The article you mentioned has an interesting demo : [https://github.com/chaudhryjunaid/multicore- demo/blob/master...](https://github.com/chaudhryjunaid/multicore- demo/blob/master/bin/multicore.js)

Though I'll yet have to figure out how to share the server state between the server workers then. Thanks for your answer.

<comment><AUTHOR> Maybe more appropriate even than the node "cluster" in this demo is [https://github.com/xk/node-threads-a-gogo](https://github.com/xk/node- threads-a-gogo)

> Why threads ?

> 4.- The threads of a process share exactly the same address space, that of > the process they belong to. Every thread can access every memory address > within the process' address space. This is a very appropriate setup when the > threads are actually part of the same job and are actively and closely > cooperating with each other. Passing a reference to a chunk of data via a > pointer is many orders of magnitude faster than transferring a copy of the > data via IPC.

</comment></comment></comment></comment><comment><USER3> This might make the basis of an interesting question on codereview.stackexchange.com. Assuming of course that it meets all that site's requirements.

<comment><AUTHOR> Didn't knew this sub-SO :) thanks !</comment></comment>


Watch "Coronavirus: Microdroplets Transmission" on YouTube - <AUTHOR> https://youtu.be/Ch5GwLg0I58 <comment><AUTHOR> This is why masks are important for infected and uninfected. After looking at it wearing a mask when out should be the default even without the current pandemic.</comment>


Relief for retpoline pain - <AUTHOR> https://lwn.net/Articles/774743/ <comment><USER2> You're probably not going to get much upvotes if it's not a subscriber link.

<comment><USER3> [https://lwn.net/SubscriberLink/774743/351fbaab94b06554/](https://lwn.net/SubscriberLink/774743/351fbaab94b06554/)</comment></comment>


SOD: An Embedded OpenCV Alternative - <AUTHOR> https://github.com/symisc/sod <comment><USER2> Cost's money to use commercially.

<comment><USER3> Yes, I went through the pricing: For a non-defense contractor standard app, for a company employing less than 10 people, is $2100/yr.

Otherwise it's GPLv3.

I wish they had some testimonals or customer list... Unfortunately the restrictive license of many CV libs cause them to be subpar. SLAM in particular has this problem. The reason OpenCV is so successful and has so many contributions is due to the BSD license. I am a huge open-source proponent but it's the reality of commercial software.

<comment><USER4> I'm not up to speed with GPLv3 vs GPLv2, but with GPLv2 you could technically develop the smallest possible functionality around the library, and make that part open source. At the end of the day, with any ML product it's gathering and labeling the training data that is the biggest differentiator.</comment></comment></comment>


Former US president Carter uses snail mail to evade NSA - <AUTHOR> http://news.yahoo.com/former-us-president-carter-uses-snail-mail-evade-191220813.html <comment><USER2> I hadn't though of this, maybe we do need to keep the postal service around! Well, until we find out that the NSA can read letters without even opening them...

<comment><USER3> Right about now is the time lead lined envelopes seem like they might just be a good thing.</comment></comment>


Relativistic-microwave theory of ball lightning - <AUTHOR> http://www.nature.com/articles/srep28263 <comment><USER2> The theory of Prof. Aguste Meessen published well before Wu's article in Nature already explains ball lightning as a plasma bubble [1]. It is surprizing that Wu didn't reference this work in its introductory review.

In its most simple form the thin layer of the bubble is a plasma made of electrons oscillating radially. Like soap bubbles, a plasma bubble may have multiple ecapsulated bubbles.

A plasma ball is a dynamic system at an equilibrum using ions like ozone as energy source. The plasma ball will follow ions gradient. It explains why lightning balls may follow complex path like circling in a room and suddently going through a cheminey or a key hole.

He explains why plasma balls can traverse windows which are electrical and chemical reaction insulators.

This theory is now ready to be tested experimentally.

[1] [http://www.meessen.net/AMeessen/BL- Theory.pdf](http://www.meessen.net/AMeessen/BL-Theory.pdf)

<comment><USER3> Note that Wu's article is in Scientific Reports, not Nature. SR is far lower in the "prestige rank" of physics journals, and it's far easier to get papers accepted there, so omissions are more likely. On the other hand, Meessen's paper appears to be unpublished (or according to google scholar, maybe published in a predatory open access journal) --- and it raises some red flags that the author didn't want to / couldn't get it published via standard channels. Not planning to read it, but critical eye may be warranted.

<comment><USER4> A critical eye is always warranted, but the prestige of a journal has no bearing on the correctness of the claim. This attitude is harmful to science. Perhaps his analysis is incorrect or lacking somehow, but that's not the argument you make.

<comment><USER3> Generally speaking, if a paper is published in a bad journal, it often means it was submitted first also to other journals, but rejected by reviewers. Hence, it is more likely there's something wrong with it. Reading papers takes time, so it is useful to be aware beforehand of how likely the time is well spent. How is it in this specific case is then a different question. (Predatory open access _is_ bad --- publishing work on your own website OTOH is fairly neutral.)

<comment><USER2> I disagree on your logic that discredit articles not published in high ranked peer review journals. First this assume that peer review is unbiased which is wrong. There are subjects that will be rejected because they are simply too controversial and present a risk for the credibility of the journal. This is totally independent on the scientific validity, value and pertinence of the article content.

Some articles may be rejected or strongly frowned upon by referee just because the author has also published on controversial topics like UFOs while the submitted article is not addressing a controversial subject. Again this is to protect the credibility of the journal.

Finally, the fact that the author is known or not also strongly influence the referee's criticism. An author which is known through conferences and communication exchange is more likely to be trusted on the seriousness and validity of his work. A submission of a much less known author will be examined with circonspection and strong criticism, against just as a protection measure.

You don't take in account those bias while what should really matter is the scientific validity of the content. If you don't have the compentence to judge the content, then your red flag raising has nothing to do with science. It's just gossip.

<comment><USER2> There is another bias in your analysis. You assume that an author of a theory will always submit his article to a peer review journal. You deduce that if he doesn't, it implies that the article was rejected. This is wrong logic.

People woes career is research tend in general to focus on one specific research domain and do publish in peer review journals or perish (loose financial support and eventually their job). But this is not the case for everybody and especially not for Prof.Meessen woes job was teaching physics in a university. He had the luxury to be free to chose any research topic he wanted and found interesting (not possible anymore). This explains the diversity of his research topics. Also as a theorist all he needed was a very good chair, paper and pencils. He had no dependencies on budgets, lab space and instruments, or personnel.

The assumptions I read in this thread apply to career researchers but can't be used as a tautology.

Another wrong assumption is that referee are always perfectly competent, impartial, objective and honest judges. Referee are humans raised in school of thoughts, have opinions and have limit in their domain and depth of competence. Implying that a rejected article MUST be crack-pottery is completely ignoring this and is thus also a bogus logic.

If an article is rejected, the scientific validity and pertinence is thus a priori UNKNOWN. What IS determinant to evaluate the scientific validity of an article are the ARGUMENTS of rejection. You don't even consider them.

As an example Prof. Meessen submitted an article on his study on the rotating compass. In his article he used as example a testimony involving multiple military ships and I think documented in the project blue book. Based on the theory presented in the book a referee computed the intensity of the EM field that should have been produced by the UFO. The intensity was many Tesla if I remember well. The referee said something along the line that no known material could sustain such EM magnetic field or an EM field of this intensity can't be produced. I'm not fully sure because I heard of it more than 25 years ago.

The objective and true reality is that we DON'T KNOW if it's possible or not. The article was thus rejected because of the ASSUMPTION (belief/opinion) of the referee that it was impossible and the editor buying it. Of course Prof.Meessen didn't waste more time to confront with such types of referees and clueless journal editors who can't distinguish good referees from impostors. He than published his work in the Book on the Belgian UFO flap. Red flag you say ?

Another wrong assumption of yours is that articles are always rejected because referee reject articles. It may happen also that referee say they can't decide and don't want thus to endorse the publication of the article. In these rare case, met by Prof. Meessen for his space time quantification theory, it is then common practice that the journal editor ask the author to suggest referees. These then act in fact as endorsers. If you have a strong network and are in close contact with well known people working on the same research subject, you can provide them to the editors and these people know if you are a crook or a respectable scientist. But if you worked mainly alone as did Prof.Meessen you are stuck. So in this case the lack, or small number, of publications doesn't prove anything beyond the fact that he doesn't have many publications. Again completely bogus logic.

If you are a scientist I would advise you to reconsider your career because your reasoning is deficient and wrong in so many ways. I guess you know where to put your red flag now.

<comment><USER2> Einstein was very lucky that the chief editor of Annalen der Physik was Max Planck [1] who was a really smart and open minded scientist. He would have had a huge red flag I guess. We are missing such types of editors and scientists.

[1] [http://blog.oup.com/2015/11/einstein-planck-general- relativi...](http://blog.oup.com/2015/11/einstein-planck-general-relativity/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I witnessed what I think was ball lightning in my front yard as a kid, here in South Florida where lightning storms are a +thrice weekly event.

What happened was that lightning struck the ground at the edge of our yard while we were waiting at the front door for the rain to slow (so we could get to the car). I jerked my head to the right because of course the sound and flash scared the heck out of me, and right as I looked there was what looked like a glowing ball of electricity, the size of a beach ball, just above the ground, for what seemed like a few seconds.

<comment><USER6> Nice, maybe this happens on the sky when it's a Earth -> Cloud lighting, which is a lot less common from what I've read.

</comment></comment><comment><USER7> This is the reference 6 of the spectrum recording of ball lightning from 2012: [http://physics.aps.org/articles/v7/5](http://physics.aps.org/articles/v7/5)

Impressive that the model has "passed all the tests" for an acceptable theory of the origin of ball lightning.

</comment><comment><USER8> This sounds a bit like the process that is believed to lead to terrestrial gamma ray bursts in the upper atmosphere, I believe.

</comment><comment><USER9> nit: would be helpful if the abstract or introduction gave numbers on how frequently ball lightning occurs, instead of just saying "rare". Is it 1 in 1,000 rare or 1 in a billion rare?

From some Googling, there are 8M lightning strikes per day on earth, so say about 3.5B strikes per year. Let's say 3% of those strikes are in populated areas. So ~250,000 lightning strikes per day in populated areas. In the past 5 years, that is ~500M lightning strikes in populated areas. Let's say that there's at least one person or video camera filming the sky during 20% of those strikes.

Given we only have 1 video of marginal quality of ball lightning, that makes 1 in a 100M strikes a reasonable guess. But that also makes me think it really could just be 0 and eye witness accounts are just some visual misperception.

<comment><USER10> There's no way to compute an approximation here since reports of ball lightning are so infrequent.

"Populated area" is somewhat subjective here since those that live in a rural, open area, especially the prairies, are able to observe more lightning activity.

Most of the reports that I've read about involve those living in the country where the artifact of the strike, the resulting ball, can be readily observed.

I'd read about a laboratory trying to recreate this phenomenon using submarine batteries and were more successful in blowing the roof off the warehouse than creating ball lightning.

</comment></comment><comment><USER11> tl;dr: Under the right conditions the step leader of a lightning strike can have a small bunch of electrons out in front of the rest of the tip, and the extremely strong electrostatic forces at play can then accelerate that bunch ahead of the tip to relativistic velocities. The bunch then hits the ground and releases an intensely strong (hundreds of gigawatts) coherent microwave radiation pulse. Also under the right conditions this microwave pulse can get trapped as a standing wave inside of a plasma bubble which it maintains through its own energy, lasting for several seconds. Scientists should be able to test this theory and create ball lightning artificially if they can build microwave devices in the 100 GW range.

</comment><comment><USER12> Not an expert but it seems neat that their model apparently explains many known properties of the phenomenon.

</comment><comment><USER13> I read "lightsabers are totally possible". Where can I preorder?

<comment><USER14> That would be more like light-flails or light-maces.

<comment><USER15> I need a lightsaber to keep my jungle of a yard under control. Would a light- flail do the trick?

<comment><USER14> Flame thrower. It's more reliable and cost-effective tech.

</comment></comment></comment></comment><comment><USER16> disappointed that there is no mention of Terminator.

<comment><USER17> Movies and science are - at least to me - in different aesthetic compartments.

</comment></comment><comment><USER18> My summary is that if I see a ball lightning coming, I'm going to run.</comment>


Machine Learning with Naive Bayes - <AUTHOR> http://blog.rokkincat.com/machine-learning-bayes/ <comment><USER2> If you want to see an implementation w/o using scikit, checkout this implementation that classifies the newsgroup dataset: [http://www.eggie5.com/66-naive-bayes-classifier- implementati...](http://www.eggie5.com/66-naive-bayes-classifier- implementation)</comment>