How Not to Encrypt a File – Courtesy of Microsoft - <AUTHOR> https://medium.com/@bob_parks1/how-not-to-encrypt-a-file-courtesy-of-microsoft-bfadf2b0273d <comment><USER2> The author could spend less time bashing the original article and a little bit more explaining how to do things right.

This:

> Suggestion to use the encryption key as the IV

is a second sub-heading while the words "initialization vector" don't appear until much later. Initialization vector is pretty obvious, "IV" isn't.

Also the author spends time complaining that the original article misunderstands the use of initialization vector while providing no explanation of how it should be used.

After reading the post I haven't learned anything useful other than that the original article was bad.

<comment><USER3> Explaining to you how to do it the right way is not an obligation of anyone that says X article is wrong?

"This article on global warming could spend less time bashing governments for inaction and more time talking about how I can reduce my emissions."

"This bad restaurant review could spend less time bashing the chef's food and more time telling me where the good restaurants are."

Similarly maybe the author didn't explain what "IV" means because their audience understands that term.

"This article in CACM uses 'NVRAM' in the heading, while the words "non- volatile" don't appear until much later. Non-volatile is pretty obvious, 'NVRAM' isn't."

<comment><USER4> I was in the audience, and if I ever knew how one should use an IV, I forgot. The article would have been more valuable to me if it gave a summary of what IVs _are_ instead of what they _aren 't_.

<comment><USER3> What makes you think were the author's intended audience, exactly? It sounds like the author intended their article for people who know what an IV is. You don't, and, while there's no shame in that, it does seem to indicate that you're not in the audience.

This is like me complaining that I can't understand Terry Tao's blog when it's posted to HN. It's not written for me.

</comment></comment></comment></comment><comment><USER5> While I'm sure the article is correct, it doesn't even attempt to link to resources to say _how_ these things are misunderstandings. For example, I myself don't really understand IVs, and from my perspective I'm left with no clearer of anuidea about _why_ IVs shouldn't be considered secret, or why the IV isn't required to be able to decrypt the file again.

Regardless, it's obvious that the fact that bad encryption advice in a MSDN article is horrifying.

<comment><USER6> > I myself don't really understand IVs

Time to drop some knowledge!

IVs are used in a number of places in cryptography, so I'll just pick one (easy) example.

Consider the stream cipher ChaCha20. You can think of ChaCha20 as a black box. You input a key and an IV and out you get a really, really long stream of uniformly random bytes. (This is a simplification but sufficient here). ChaCha20 works in such a way that having any or all of the output stream doesn't help you figure out what the inputs were. It's irreversible. ChaCha20 is also deterministic; the same input will give the same output.

You can then use the output of random bytes to encrypt a message by XORing with your plaintext. To later decrypt, you feed the same key and IV, get the same stream, XOR the ciphertext with it, and by the property of XOR you'll get the plaintext.

Now why is there an IV? Let's consider a ChaCha without an IV. The system works like so:

        R = ChaCha(Key)
        Ciphertext = Message ^ R

So let's encrypt two different messages:

        R = ChaCha(Key)
        Ciphertext1 = Message1 ^ R
        R = ChaCha(Key)
        Ciphertext2 = Message2 ^ R

Notice how R is the same for both messages? Again, ChaCha is deterministic; the output is the same for the same inputs. Since the key is the same, R is the same. Now an attacker, knowing this, can do this

        Q = Ciphertext1 ^ Ciphertext2

What does Q end up being? Let's look:

        Ciphertext1 ^ Ciphertext2
        = Message1 ^ R ^ Message2 ^ R
        = Message1 ^ Message2

So Q ends up being equal to the XOR of the two messages. That's really bad. The xor of two messages might be enough to tell the attacker what the messages are, especially if the messages are predictable (like english text). But maybe that's not scary enough. Well there's another attack. What if you're encrypting a data format with a header. Headers often have the same data in the same places. So the attacker knows part of the message. Uh oh...

        R = Ciphertext1 ^ Message1

If the attacker knows the message (or any parts of it) they can recover the R of those parts. And now, since your key is always the same and your R is always the same, all the other messages you encrypt will have those bytes exposed.

This is where IVs come in:

        R = ChaCha(Key, IV)

IV should be unique per message. That means that every R is different! None of the above attackers work anymore. XORing two ciphertexts together returns gibberish:

        R1 = ChaCha(Key, IV1)
        Ciphertext1 = Message1 ^ R1
        R2 = ChaCha(Key, IV2)
        Ciphertext2 = Message2 ^ R2

        Ciphertext1 ^ Ciphertext2
        = Message1 ^ R1 ^ Message2 ^ R2

And if the attacker knows the message, all they can recover is R1 or R2 (or any R). But that's useless, because since all your IVs are unique that R will never be seen ever again.

That's the point of IVs.

> why the IV isn't required to be able to decrypt the file again.

It is required. Obviously you need all the inputs to ChaCha to get the byte stream again, to decrypt the message.

Now sometimes the IV is known from the protocol. So say you're using ChaCha to encrypt network traffic. You might set the IV equal to the packet number. So both sides already know the packet number.

But you always need the IV to decrypt.

> and from my perspective I'm left with no clearer of anuidea about why IVs > shouldn't be considered secret,

Consider again ChaCha20 as a blackbox. Key+IV goes in, stream of bytes comes out. There's no way to reverse that without the key (and IV). Since the attacker doesn't know the Key, they can't reverse it. Knowing the IV doesn't help.

Another way to think about it is that, instead of accepting a 256-bit key and a 64-bit IV, it's really just a 320-bit key. Knowing 64-bits of a 320-bit key doesn't help break a cipher. The cipher is still 256-bits strong. So you can share the IV without affecting security.

BIG NOTE: It's important that an IV is always unique. If an IV is ever re- used, the above attacks become available again because R will be the same for two messages.

Hope that helps. This is only one way that IVs are used. In ChaCha20 it's called a nonce, because ChaCha20 is geared towards usage on network protocols where the above trick of using packet number is applied. For block ciphers there are various cipher modes that get used, and most of them need an IV. The purpose is always the same; to make this "session" of encryption unique.

There's another way to use IVs, and I think they re-affirm the concept of what an IV actually is. Let's say you have a cipher that only accepts a key! No IV (like AES). You still want to make your encryption sessions unique. A way to do that is this:

        TempKey = HMAC (IV, Key)

And then use TempKey. HMAC is a form of hash. In this case it lets us combine a Key and IV in an irreversible way, yielding a new key. TempKey will be the right size key for the cipher (say, 256-bits). What this is doing is giving us a unique key for every encryption session. And that's the heart of IVs. And in many ways, ChaCha20 is doing exactly that. It's hashing together Key and IV and using the output hash to generate a long stream of random data that can't be reversed back to the key+IV.

(and in case you're wonder, yes, you can use a cryptographically secure hash function alone to build a stream cipher like ChaCha. It'll just be _really_ _really_ slow, because hash functions are really, really slow compared to ChaCha.)

<comment><USER7> Thanks for spending the time explaining this.

<comment><USER6> Happy to.

Is this something people find interesting? I was thinking of doing a small guide/tutorial/course where I teach these basics of cryptography, while building up to a working file encryption tool written completely from scratch. Probably such a thing exists already, but /shrugs these kinds of questions always seem to come up.

<comment><USER8> This is risky. Unless you are a pro, it is generally not a great idea to publish a "how-to" for crypto because of the risk you might get it wrong in subtle ways that now propagate through the ecosystem.

<comment><USER6> I know all the subtle things.

That said, I wouldn't write the course for people intending to become cryptographers or cryptographic engineers. That would require a university grade program. It would be geared towards people who have a curiosity of the inner machinations of encryption. Ya know, like the people who come to Hacker News, read articles like this, and ask questions.

</comment></comment></comment></comment></comment></comment><comment><USER9> Note: All my information re: Microsoft is from no later than 2013.

This is indicative of a classic challenge in the industry.

To ship code that uses crypto at Microsoft you have to go through an auditing process. To ship code that uses novel crypto, or works directly with crypto primitives, you have to be reviewed by a specialist crypto review board — that contains security and crypto people from across the company, names that you might know (e.g. Niels Ferguson was there last time I needed a review. Hi Niels!)

Samples and documentation aren't held to the same standard.

</comment><comment><USER10> Microsoft have already 404d the article: [https://support.microsoft.com/en- us/help/307010](https://support.microsoft.com/en-us/help/307010)

<comment><USER11> Luckily we have a snapshot: [https://web.archive.org/web/20170327154501/https://support.m...](https://web.archive.org/web/20170327154501/https://support.microsoft.com/en- us/help/307010/how-to-encrypt-and-decrypt-a-file-by-using-visual-c)

<comment><USER12> Also now dead - I just get a blank page apart from the header and footer.

<comment><USER13> If you disable JavaScript you can see the content, it seems like there's some script that replaces it on page load.

<comment><USER14> wat? why? they have some sort of 'message will self-destruct javascript' in their page which is carried into the wayback machine?

</comment></comment></comment></comment></comment><comment><USER15> As someone in charge of reviewing all crypto code for a sizable chunk of my company, I've yet to see a single case of someone using encryption primitives correctly by naive developers. To tell the truth, I don't think I've ever seen a single example of IVs used correctly.

At the very best of times I get AES-CBC-HMAC-SHA1 (usually Encrypt-AND-MAC) with binary keys and secret static IV.

I'm still waiting for the developer that will botch AES-GCM with a random nonce so I can have first world problems, but we're not there yet.

I wanted to call Microsoft sneaky for pulling out this article, but considering basically every top-ranked "how do I encrypt with AES" question on StackOverflow is full of bad advice, I'm glad they at least did something.

</comment><comment><USER16> The article says that DES "can be brute forced in a single digit number of days by a modern computer".

      2**56 keys / 9 days ≈ 92.7 Gkeys/s

Can modern computers actually compute DES _that_ fast?

<comment><USER17> This benchmark [1] gives 196.2 GH/s for DES using 8 Nvidia GTX 1080 Ti and Hashcat 3.5. So while your average computer is probably not quite sufficient it is certainly in reach.

[1] [https://gist.github.com/epixoip/ace60d09981be09544fdd3500505...](https://gist.github.com/epixoip/ace60d09981be09544fdd35005051505)

</comment></comment><comment><USER18> Another version of essentially the same article is still live here:

[https://support.microsoft.com/en-us/help/301070/how-to- encry...](https://support.microsoft.com/en-us/help/301070/how-to-encrypt-and- decrypt-a-file-by-using-visual-basic-.net-or-visual)

</comment><comment> d--b Yep, all over the place:

[https://searchcode.com/?q=ASCIIEncoding.ASCII.GetBytes%28sKe...](https://searchcode.com/?q=ASCIIEncoding.ASCII.GetBytes%28sKey%29%3B)

EDIT: ok maybe not "all over the place", but it's been done.

</comment><comment><USER19> The article author is complaining about an MSDN article not being updated. The content even says it applies to VS 2005 at its highest. That's a hint of how old it is. Is he going to get the print version and complain about that next. If programmers are using this without thought that is on them not the example code.

</comment><comment><USER20> Raymond Chen wrote some time ago about the variable quality of MS Knowledge Base articles: [https://blogs.msdn.microsoft.com/oldnewthing/20060424-21/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20060424-21/?p=31433)

</comment><comment><USER21> That's pretty disturbing. Though to be fair, the article in question was written a while ago (since it targets .NET 2005), and to be less fair, MS doesn't really review their documentation very well, at all.

</comment><comment><USER22> probably you are too youn, in the past when internet wasn't so ubiquitus, having a MSDN cd documentation was a live saver. the docs that today have serius content directly descend from that days, the res, as other already said, are just boilerplate autogenerated docs., which nobody maintains anymore because simply the technology is too fast. so probably this doc page abaut usage of DES is directly from 1990 or so... and in that days probably was good enough

</comment><comment><USER23> It does seem useless to make the IV the same as the key. But is there a reason making the IV the same as the key is worse than using 0 as an IV?

Just asking.

</comment><comment><USER24> To encrypt: tar cz foo | openssl aes-256-cbc -salt -out foo.enc

To decrypt: openssl aes-256-cbc -d -in foo.enc | tar xz

(foo can be a file or directory)

<comment><USER25> This does not contain a MAC though, does it? Also why CBC? Why not CTR/GCM instead? And why AES256 instead of Chacha20-Poly1305 or some other modern AEAD?

<comment><USER24> What are the advantages of GCM over CBC? And whats wrong with AES256?

<comment><USER25> \- GCM unlike CBC is an AEAD mode (has a MAC build-in)

\- CBC needs padding, which when misused can lead to padding oracle attacks

\- GCM allows for parallel encryption

> And whats wrong with AES256?

There are more modern, faster and better ciphers that are designed to not be vulnerable against many side-channel attacks that AES is difficult to protect against.

</comment></comment></comment></comment><comment><USER25> I feel disgusted after reading this. I wonder how many people applied the advices given by the original article because they made the bad decision to trust the official documentation by MS.

<comment><USER12> Oh, come on: whatever Microsoft's faults might be they have a _very_ long track record, stretching back decades, of providing overall high quality documentation for developers.

Yes, there are errors. Yes, sometimes there is deeply misguided advice. But, on the whole, MSDN and its ilk has helped me far more often than it's hurt me.

Key point: compared with much other vendor and OSS documentation, Microsoft are absolutely streets ahead.

<comment><USER26> Most of the documentation is boilerplate. There's very little real content now and most of it is filler.

<comment><USER27> Here's an example of a new API they added recently (the first one I thought of): [https://msdn.microsoft.com/en- us/library/windows/desktop/mt5...](https://msdn.microsoft.com/en- us/library/windows/desktop/mt595731.aspx)

It says things like this:

> Indicates that the data for the file should be obtained from a WIM file. On > access, data is transparently extracted from the WIM file and provided to > applications. If the file contents are modified, data is transparently > decompressed and the file is restored to the same physical form it had if > this API were not used.

This is "boilerplate" and "very little content" to you? What are you thinking of?

<comment><USER26> To be fair Win32 isn't terrible. Have you looked at the .Net docs?

[http://imgur.com/a/iK4uG](http://imgur.com/a/iK4uG)

<comment><USER28> You need to click on the overload of this method that you are interested in. This is just the top level "where do you want to go?" document.

<comment><USER26> It's not. There's a content about 11 screens down, not that you'd find it easily.

<comment><USER29> Again, GP just stated that these are local links, links to anchors on that very same page, explaining the overloads.

Are there too many? For this class, maybe. It's at least potentially worth discussing it. But the way the navigation works isn't "just scroll until something seems to fit".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> I always look at Microsoft in order to learn how not to do anything /s

</comment><comment><USER31> >It's a good thing the caesar shift isn't available in their library or it would probably have ended up in this tutorial.

[https://docs.python.org/2/library/codecs.html#python- specifi...](https://docs.python.org/2/library/codecs.html#python-specific- encodings)

Python does rot13 :)

<comment><USER32> But that's in the codecs library, not a cryptography library.</comment></comment>


Andrew Sullivan on revenue for journalism, why advertising is bad - <AUTHOR> http://www.capitalnewyork.com/article/media/2014/10/8553987/60-second-interview-andrew-sullivan-founding-editor-dish

<comment><AUTHOR> That advertising gives us all free news is a lie: [https://news.ycombinator.com/item?id=8458522](https://news.ycombinator.com/item?id=8458522)</comment>


Self promotion ideas: Novel resumes - <AUTHOR> http://blogof.francescomugnai.com/2011/04/self-promotion-ideas-15-new-modern-and-inspirational-resumes/

<comment><USER2> These "datavis" resumes exemplify everything that's wrong with data visualization today:

(1) cluttered and distracting

(2) vapid (a Frank Zappa quote and a timeline with tank top reference? a quarter page for a pie chart of one's intangibles?)

(3) terrible at actually visualizing data or information (okay...what, exactly, can these people do relative to others?)

They're beautiful resumes, for sure. But their ideas for communicating information are too clever, and if I'm hiring a datavis guy I would wonder how effectively they could visualize real information.

<comment><USER3> I agree with you, but I'd rather deliver a distracting, cluttered resume than a boring one. Anyways, most of the time, the resumes tell you very little about the person. Delivering one that's different tells you more of what you can expect, even if it's not a creative job, IMHO.

<comment><USER2> _I'd rather deliver a distracting, cluttered resume than a boring one._

I similarly agree with you, except that these poorly-visualized resumes would hurt if applying for datavis jobs. Why would I hire someone if they cannot even communicate their experience effectively?

They convey almost no information about the applicant, and they're surely worse at communicating info than a resume in Garamond that reads "worked with SQL, Python, and CSS/HTML/JS for 2 years."

</comment></comment></comment><comment><USER4> Some of the posted samples were interesting. The one from Rebecca Baxter (<http://www.behance.net/gallery/Infographic-CV-Resume/1175821>) was the most interesting for me, since it offered ideas I might actually use. She seemed interested in discovering new ways of presenting her information usefully. Most of the rest seem like they were just motivated by a desire to be different.

\---

 _Note for miller_f:_

On my 13" MacBook, your website's design is confusing.

The _Info_ section on the left contains the title of the blog post, but it's pushed down partly below the fold. It took me "forever" to figure out that it's the post's title.

Then the _Post_ section in the middle begins with a 280px-square ad, which pushes almost everything but the first header of your post below the fold. And since that header isn't the post title, it doesn't instantly register that the post is even there.

Finally, I think it's a symptom of poor design that you need text which literally points to the "Post" section.

<comment><USER5> It's horribly confusing on a larger screen, too. There's no hierarchy or distinction between ad, meta-info, and actual content.

</comment></comment><comment><USER6> I find this a great idea of self-promotion, IF you are looking to get hired in a creative environment/job/company. It might even do the difference between you and someone who is not chosen for he job, due to the way in which you show you are open and willing to work.

But if you are applying for a job like a more down-to-earth straight-up programmer or a construction engineer, all those little charts, the QR, and everything shown in the article will dazzle the employer, but won't convince him you are the best choice for his company - he needs straight facts, not pretty colored "pies" with information about you.

All in all, it is best you use the format that best reflects your abilities and your work, but always keep in mind the employer's profile.

</comment><comment><USER7> 5 years ago when I was applying to lots of agencies I sent out custom links to each one. So when they landed on the site, their company name was used in big letters at the top of the page ("Hi company X"). It also allows for tracking whether they actually look at your site. It's easy to do, shows that you're not just spamming people, and is not as involved as some of those more intense examples that target one specific company.

</comment><comment><USER8> I like the ideas of finding non-traditional ways to communicate with would-be employers. For ex, using Facebook pictures as the article mentions. Similarly, although perhaps not quite as creative, I like the idea of using submissions and metrics from various job-related websites if available: Hacker News, Stack Overflow, etc.

I question the usefulness of the brochure resume from the article though. In my experience most of my prospective employers have wanted resumes emailed to them rather than given to them physically. Even the ones that do want a physical copy will find it harder to store/organize them along with the rest of most-likely paper resumes that are given to them. Although in that respect I suppose that would make yours stand out that much more. Actually, I think my opinion has changed since the beginning of this paragraph. :-P If you're submitting a resume in person, via snail-mail, etc, it's probably a great way to get it better noticed.

I come from more of an engineering background though, rather than the graphic design background that this post seems to be more geared towards. What kinds of experiences have people had with these types of resumes?

<comment><USER9> Web-based HR systems that require filling in web forms to stitch your CV together are the worst. You instantly go from "cool infographic resume" to .nfo/ASCII-art resume. Whatever happened to simple e-mail attachments...

<comment><USER10> Could the forms be a security measure? Is it really smart for your company employees to be opening hundreds of PDF and Word files sent from random strangers?

</comment></comment></comment><comment><USER10> This is a horrible page design. It literally took me minutes to figure out where the main content of the post is and where are the navigation and info links. Add to that the fact that the first link I clicked in the main post turned out to be an embedded ad.

</comment><comment><USER11> I don't know where those guys live, but on my planet all resumes are communicated as PDFs. Nearly all shown examples lose some or all of their power when not in physical form.

That said, it seems it's most designers' resumes so maybe that's why. I wonder what CVs could be cooked up for more technical and/or organisational positions. A github printout comes to mind.

<comment><USER12> <http://resume.github.com>

</comment></comment><comment><USER13> Or check out my creative resume, which was designed to be sent as plain text. It was originally a response to a job site that required me to fit my experience into boring little boxes... [http://www.scribd.com/full/39705569?access_key=key- cwlk7b9tf...](http://www.scribd.com/full/39705569?access_key=key- cwlk7b9tfinftw80ul9)

</comment><comment><USER14> I like this guy's idea, which adds a hacker flavor to the resume concept. He created a business card with his CV on it, and handed it out on a job fare:

<http://www.aftenposten.no/jobb/article4063965.ece></comment>


How plain, old WiFi will revolutionize the cellular industry - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/21/how-plain-old-wifi-will-revolutionize-the-cellular-industry

<comment><USER2> had not heard of cell providers that were offering streamlined integration with wifi for call and text. I don't know if it's revolutionary, but it certainly got my attention.

thanks for the share.</comment>


Engineers Just Unveiled a New Blackest-Ever Material - <AUTHOR> https://www.sciencealert.com/scientists-just-set-a-new-record-for-the-blackest-material-ever-created <comment><USER2> Dupe: [https://news.ycombinator.com/item?id=20973667](https://news.ycombinator.com/item?id=20973667)

</comment><comment><USER3> There are darker things:

[https://www.youtube.com/watch?v=JoLEIiza9Bc](https://www.youtube.com/watch?v=JoLEIiza9Bc)</comment>


"Privacy Shield" proposed to replace US-EU Safe Harbor, faces skepticism - <AUTHOR> http://arstechnica.com/tech-policy/2016/02/privacy-shield-doomed-from-get-go-nsa-bulk-surveillance-waved-through/ <comment><USER2> It's really farcical. Nobody with the tiniest bit of common sense would take seriously any promise of privacy from a foreign government, especially the one which established the most far-ranging data collection ever. Not that you should be naive enough to think that the various EU intelligence apparatuses don't do exactly the same thing but with less money.

</comment><comment><USER3> Does anyone know how EU privacy laws will play out against TPIP? My understanding is that TPIP (and TPP for the pacific area) allow corporations to sue governments in tribunal courts that pass laws that negatively impact corporations' profits.

<comment><USER4> That's obviously a grotesque simplification. The investor-state dispute resolution mechanisms are supposed to protect against legislation that amounts to expropriation, or that unfairly targets only foreign companies. It specifically names environmental protection, consumer welfare and other legitimate aims of new legislation.

There's a lot to criticise with these mechanisms without resorting to misrepresentation.

<comment><USER5> The funny thing about law is it doesn't matter how it's meant to be used once it becomes law; power is power.

I'm sure when the trade agreements that allow tobacco companies to determine Australia's cigarette laws were signed there were plenty of people saying "oh, no, these laws are only meant for good things. We'll only use them when a country specifically targets a specific foreign company. They are for consumer welfare. We promise."

And then this happens: [https://au.news.yahoo.com/thewest/a/29064155/tobacco- giant-s...](https://au.news.yahoo.com/thewest/a/29064155/tobacco-giant-sues- australia/)

Just like when the PATRIOT ACT in the US was passed it was only going to be used for terrorism (Promise! There are legitimate aims!), not for drugs like it is the vast majority of the time today.

I think in this case it's not a "grotesque simplification" it's just stating the facts without running a free PR campaign on behalf of large multinationals.

<comment><USER4> Yes, big Tobacco is suing Australia. And I'll be first on the barricades if they win. Until then, it's just a lawsuit with dubious prospects.

In fact, that's the main problem I have with the ISDS doomsday scenario: these mechanisms have been part of trade agreements for what, the last 40 years? Yet there isn't a single example for any of these outrageous results people are predicting.

I've honestly looked into it with what I believe is an open mind and I couldn't find any.

(Nonetheless, I welcome the changes to CETA just announced today: [http://europa.eu/rapid/press- release_IP-16-399_en.htm](http://europa.eu/rapid/press- release_IP-16-399_en.htm))</comment></comment></comment></comment>


Is ADHD an Advantage for Nomadic Tribesmen? - <AUTHOR> https://www.sciencedaily.com/releases/2008/06/080609195604.htm <comment><AUTHOR> Seems to support the idea[1] that ADHD kids in simpler societies wouldn't have any problem at all.

[1] [https://news.ycombinator.com/item?id=10988042](https://news.ycombinator.com/item?id=10988042)</comment>


A Year on TC39: Dispatches from the Future of JavaScript - <AUTHOR> https://medium.com/braintree-product-technology/a-year-plus-a-little-on-tc39-a1acb87eb862 <comment><USER2> Author here. I'm incoming co-chair of TC39 for 2019, and happy to talk to anyone about our process, or why that one proposal you really like doesn't do the thing you really want it to do, or how to get more involved. Feel free to direct your ire and/or adulation this way.</comment>


Physicists Hunt for the Big Bang's Triangles - <AUTHOR> https://www.quantamagazine.org/20160419-string-inflation-triangles/ <comment><USER2> I don't speak the language used in this article.

But, are they talking about data structures in a block of storage, or what?

Are they talking about patterns on the surface (volume?) of a cellular automata?

Look at this sentence:

> "With each tick, it doubled the size of the universe, keeping nearly perfect > time - until it stopped."

...What? Double the size every tick? As in... 1, 2, 4, 8, 16, 32, 64?

Don't explain it to me like I'm five. Explain it to me like I'm a developer. Please?

<comment><USER3> > ...What? Double the size every tick? As in... 1, 2, 4, 8, 16, 32, 64?

> Don't explain it to me like I'm five. Explain it to me like I'm a developer. > Please?

It doesn't seem you need it explained to you; what you say is exactly what it means. For example, if you imagine a cube whose side increases by approximately 26% each clock tick, then each tick increases its volume by approximately (1.26)^3 = 2.00 (to 3 significant figures).

(I am not a physicist, so I may be misrepresenting, but, as far as I know, it is backwards to imply that it is somehow the ticking of a clock that _causes_ the expansion. Rather, in the early universe one can use the logarithm of the size of the universe as a measure of time: "the universe is currently 64 times its original size, so it's log_2(64) = 6 ticks since the beginning of the universe." This is much like how the equation `E = m c^2` allows one to speak of the _mass_ of a particle as a certain number of electron-Volts, which naïvely would be units of _energy_.)

<comment><USER4> I think that you're probably _technically_ right (the best kind!) and probably aligned with mainstream Physics, but...

I'm really surprised that Inflation got such a "foothold"... in that it's quite wobbly as a therory, AFAICT. For a kick-off it's pretty hard (impossible?) to falsify. Yes, we can all agree that something _like_ the Big Bang happened; just by looking at the expansion, everything was obviously a _lot_ more squished up. (Extrapolate backwards and you get 'silliness' like the Singularity... which is just a photosynthesis[1] way of saying NaN.)

[1] Shamelessly stolen from a redditor: "I like to use difficult words so people think I'm photosynthesis.".

EDIT: Honestly, I'm not a kook! Neil Turok usually has good introductory lectures for this field...

<comment><USER5> Without an inflationary era in the early universe, you would be left with having to explain 1) the fact that we see very few (none so far) magnetic monopoles; 2) the cosmic horizon problem; 3) the flatness problem.

Without inflation, how would you solve these?

Inflationary models make predictions about higher moments distribution of fluctations in the cosmic microwave background. These can be measured; so specific models can be falsified.</comment></comment></comment></comment>


What I've learned since quitting Elm - <AUTHOR> https://qiita.com/kimagure/items/93a42d67a8833f99fe2e <comment><USER3> Upon reading the post, I realized how click-baity the title really is.

There's only a brief statement about Elm, in the beginning, describing why the author has quit using Elm, and then:

> In this post, I'll just highlight some of the most important things I've > learned since the beginning of 2016 by using PureScript.

Quitting Elm has little relevance to what the author has learned about PureScript.

I guess the title could've just simply been _What I learned in PureScript_

<comment> star-techate You can learn things in one language that you might as easily learn in another. The argument here is that you _wouldn 't_ learn these things from Elm.

</comment></comment><comment><USER4> Anyone getting deeper and deeper into fp is destined to end up with Haskell or purescript. No matter if you start with elm, scala, elixir or reason. Then, of course you work with Haskell for a bit and end up going back to whatever you started with unless your work in PL research or similar

<comment><USER5> Reminder that lisps are FP too.

<comment><USER6> Depends on which lisp and who you ask.

For many, functional programming is just as much about expressive type systems, purity, and immutability as is about robust first-class funtions and higher order functions.

Lisp is like the python version of Haskell (as compared to Java I guess?) It's a rough metaphor but I think it makes enough sense.

<comment><USER5> I know that many today use "functional" to mean ML-derived languages but that definition is incorrect.

Lisps are not very much like Haskell at all, and have different goals. Which is why today's ML-centric worldview of functional programming so often forgets about them.

</comment></comment></comment></comment><comment><USER7> Qiita is a really interesting Japanese alternative to StackOverflow. It's rare someone writes something in English, but fun to practice your Japanese and technical Japanese is often cleaner and easier to understand than written or heaven forbid spoken colloquial Japanese.

<comment><USER8> Oh I guess that explains why the 'break-word' word-wrapping. I thought it was an odd choice!

<comment><USER9> Yeah, I was losing my mind trying to read that. Now it makes sense in context, but still.

</comment></comment></comment><comment><USER10> I feel like I went through all of the same frustrations as the OP starting from Elm. It's a fun language, but the restrictions the bdfl puts in place make you quickly outgrow it.

</comment><comment><USER11> I'm using elm so I don't have to learn any of these things. I enjoy knowing almost all parts of the language. Also, in 95% of the cases, it provides enough flexibility to solve the task at hand.

<comment><USER12> The problem is in the last 5% though. If Evan thinks it's a bad idea or requires more thought, you literally can't do it. The websocket package is currently being held hostage because he wants to improve the API. Since you can't include native code even in private projects now, you can't fork and fix numerous bugs that have an open PR for 2 years+. That means I have to stick with 0.18 which has several compiler bugs because 0.18 is not gonna get a bugfix release.

<comment><USER13> I say keep Elm weird, and _simple_. Just use socket.io with ports and chill.

<comment><USER14> I don't know if you inteded this, but in many contexts telling a person to "chill" is implicitly insulting.

You may find it distracts from whatever technical point you were trying to make.

<comment><USER13> Fair point. I'm just saying, maybe don't get too hung up on it. Just use ports and move on. I don't see why this is ever a big deal with Elm.

<comment><USER15> Right now, "Elm is Bad" is the new "Javascript is Bad". It'll blow over when it gets trendy to whine about something else.

<comment><USER16> It's a good demonstration of how nobody can resist a good lynch mob no matter how ridiculous the topic.

It's absolutely hilarious how Elm of all things was the #1 enemy of HN the last couple days. A language just about nobody uses (except me).

Yet suddenly everyone is just three degrees away from someone else who was irreparably _wronged_ by Elm's creator. People coming out of the woodwork to show that they, too, are offended by such reprehensible behavior like removing a couple features from a programming language.

Web developers are literally the most oppressed people on the planet. This Evan guy messed with the wrong motherfuckers!

<comment><USER15> What's even MORE hilarious, to me, is how Elm was the #1 Best Thing Ever for about a week sometime last winter, which is why I got into it in the first place.

It's a great language. The community has been nothing but stellar to me - <USER2> complete novice at not just FP, but also JS and web in general.

The entitlement is unreal. "How DARE you create this great free thing, and have the AUDACITY to make it work the way you want it to?!"

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Why is everyone talking about some email client from the early 90s. Switch to pine if you don't like elm.

</comment><comment><USER18> Man I need to do a sudo apt upgrade on my brain: I read the title and thought he was talking about ELM the email client, and was like: yeah, we all stopped using that in the early 90's when zmail showed up.

<comment><USER19> Every single Elm language thread there exists at least a person makes joke of ELM email client. And then somewhere there exists Elm developers make fun of those people.

<comment><USER18> i'm new here and learning that HN is more serious than /. or reddit. probably because people here refrain from posting obvious / useless comments like mine. getting the hang of it...

<comment><USER19> I'm also new :) and didn't intent to discount any comment (it's not useless)

I agree that HN is quite serious, that's why I rarely comment. I'm actually a fun person lol

</comment></comment></comment></comment><comment><USER20> OT: I've never seen this before, but for some reason when reading this on my phone the line breaks are... anywhere. In the middle of words in places that make no sense.

"... spare time trying o

ut Elm, to render..."

It's basically unreadable without Safari's reader mode.

<comment><USER21> Cause:

        word-break: break-all

<comment><USER22> It certainly did break-all of it!

</comment></comment></comment><comment><USER23> You tricked me. I thought this was about the email client named Elm.</comment>


4 weeks in the zone = my latest app (just for fun).  - <AUTHOR>

I just finished working on a 4 week project that seems to have turned out pretty OK.
http://www.myplaylist.biz/lyrics/
Do let me know what you think... <comment><USER2> Thanks, I've been holding out for a lyrics site that doesn't make me feel like my computer just contracted the clap.

<comment><AUTHOR> yes spam sites seem to dominate this space. Thought it could do with some respectability. hehe

</comment></comment><comment><USER3> Yea, I've written some similar code to this for fetching the lyrics based on arbitrary parts of the song. It's a fun challenge, and getting the correct lyrics is also hard. Well done on that account.

I see that you are using a flash player to display Flickr photos, presumably appropriated tagged, while playing an mp3 of the song?

I like the site though, well done!

<comment><AUTHOR> The flash player is custom built, I built it using the bones of the first app which is on myplaylist.biz (main).

</comment></comment><comment><USER4> Some great data sourcing, which really makes it compelling. Do you mind if I asked where you got the db from? (just out of curiosity)

<comment><AUTHOR> erm. Being a hacker... have a guess. (i.e would like not to say). Hope this does not sound rude.

</comment></comment><comment><USER5> <http://www.myplaylist.biz/Coldplay/Lost/269837>

this was displayed on the page above:

array(1) { [0]=> array(2) { [0]=> string(8) "coldplay" [1]=> int(0) } } here1 coldplayhere2 coldplay

And if I take the lyrics from this page, "Just because I'm loosing" or Just because I'm loosing, it doesn't find Coldplay. Am I incorrect in assuming it should find this?

I think it's pretty cool, but I would give the user the option of "playing" the song rather than doing it automatically. In my experience most people are already listening to the songs which they are trying to find the lyrics for.

This page also produces an error, I don't think Sting did a Wu tan song, but I could be wrong on that as well:

[http://www.myplaylist.biz/Sting/Wu-Tang-Cream-Team-Line- Up/1...](http://www.myplaylist.biz/Sting/Wu-Tang-Cream-Team-Line-Up/165567)

<comment><AUTHOR> u just caught me checking something hence the array. looking into the search problem now. thanks

<comment><AUTHOR> Turns out in FullText search In boolean mode, there are many stop words, "it's" "I'M" are just 2 of them. Seems I have hit a limitation there on the tech. It will have to be as good as it gets I'm afraid. Short of putting in a custom search engine, that's as fas as the tech allows for them moment, unless I build in a workaround to change all single quotes something else then change back. I will sleep on that...

</comment></comment></comment><comment><USER6> Cool stuff! A few bugs: under the "recently viewed" header, the same song appears twice in a row. You're getting text encoding funkiness -- [http://www.myplaylist.biz/Coldplay/Cemeteries-Of- London/2698...](http://www.myplaylist.biz/Coldplay/Cemeteries-Of- London/269836)

<comment><AUTHOR> 'You're getting text encoding funkiness --??' please explain what you see, all looks good here?

<comment><USER7> Same here - characters in the lyrics aren't displaying correctly - like the character encoding is incorrect. (Firefox on Windoze xp)

You need to sanitize the text you are storing to unicode. Here's a cut and paste:

Singing la lalalalala la lé… And the night over London lay…

<comment><AUTHOR> hmm thanks looks like a db rash. I will have a look at that. cheers

</comment></comment></comment></comment><comment><USER8> This is very cool :)

By default, if the search string consists of more than 1 word do you do an OR or AND search? It seems OR from the results I'm getting, but most people now are conditioned by Google to expect an AND search (which really makes more sense..)

Great work, either way.

<comment><AUTHOR> It is boolean enabled, so you can add in operators such as + = and - = not "" to get actual etc.

</comment></comment><comment><USER9> Found all three songs I looked for first try, but site is getting pretty slow. Might try whittling down the number of results returned. Also saw text encoding funkiness. Really nice tho, bookmarked. How are you getting the songs and pictures in the flash on the left?

<comment><AUTHOR> hmm, site getting slow. I have to be careful about robots, they can kill it, as its all generated dynamically thus memory is an issue and I just downgraded memory as I like to run a tight ship.

The flash widget I built, its all custom, Images from Flickr and MP3s sourced through Seeqpod, both have shit hot APIs.

<comment><USER9> Well the flash thing is really cool, it's awesome to have the song to listen to and because the images are pulled from wherever sometimes they're hilarious :). Really nice piece of work!

</comment></comment></comment><comment><USER10> Pretty sweet service. Where did you get a lyrics web service? I was looking for a lyrics web service some time ago for the following idea: certain times when listening to a song it would be useful/more entertaining if the lyrics would follow along with the song similar to karaoke, this could be done by running the song through some speech recognition software such as nuance to get the approximate words/time during the song. You would then tie that into the lyrics through the web service and would be able to display the lyrics along with the song for almost any song. This would be helpful to me anyway, and I think add an extra level of connection and understanding to your songs.

<comment><AUTHOR> there are some lyrics sources about, one i found after was: <http://lyricwiki.org/Main_Page>

But mine come from other resources :)

Nice idea, yours, but too complicated me thinks for my style, I prefer elegance, as in not trying to do too much but do what you dodo well.

</comment></comment><comment><USER11> Awesome. A barebones site that does what it is supposed to do. Great job.

</comment><comment><USER12> yeah i liked this. searched for hooker in minneapolis, and not only did i get the correct lyrics but i also got sweet version by neko case to hear. i have been looking for it for ages..whata bonus. nice one. just to nit pick. i would out-source your logo. try 99designs for $150-$200.

<comment><AUTHOR> Sorry m8, I know the logo might be a bit cheap (30 mins work) as I am, but I really could care less about the logo, I'm more fanatical about making it actually work well.

<comment><USER12> you have the ring tone but you could always link the sheet music for another source of revenue

<comment><AUTHOR> yes good idea. many thanks

</comment></comment></comment></comment><comment><USER13> I would highly suggest you get a license to feature the lyrics on your site if you intend on going mainstream. Aside from legal troubles you could face, I think intellectual property should be respected. Using someone's copyrighted material without their consent is never ok.

<comment><USER14> >Using someone's copyrighted material without their consent is never ok.

Sometimes it is fine.

<comment><USER15> It is almost definitely fine if you live outside of the USA.

</comment></comment></comment><comment><USER16> Are we supposed to comment on the coding or the business model? Not bad for four weeks coding. Might have a little trouble making money with the copyright issues involved.

<comment><AUTHOR> feel free to give your thoughts regardless

<comment><USER16> The work is good. The interface isn't very polished, but it sounds like you haven't really worked on it yet, so I assume you'll polish it up later.

On the copyright side, there have been issues in the past ([http://news.cnet.com/Lyrics-site-negotiates-copyright- issues...](http://news.cnet.com/Lyrics-site-negotiates-copyright- issues/2100-1023_3-221354.html)). I'm not sure how they were worked out, or if a defense of "everyone else is doing it" justifies reliance. You should look into any updates in the area, and also be aware that one day someone might disagree with you on if its ok (and by disagree I mean sue).

<comment><AUTHOR> yes that was like 10 years ago Published: February 8, 1999 11:25 AM PST

I think things have gotten out of hand since then.

</comment></comment></comment></comment><comment><USER17> Nice.

I vaguely remembered a song by Cake, knew it contained the phrase "prize fighter". Found the song "Shadow Stabbing" almost instantly.

Nifty.

</comment><comment><USER18> Also interested in where you got the database, it seems to be missing a lot of my favorite artists. Bon Iver for example.

<comment><AUTHOR> I have about 300K currently, I will add in more soon.

</comment></comment><comment><USER19> Pretty cool. Thanks, just bookmarked it.

</comment><comment><USER20> I'd like the volume control bigger.

<comment><AUTHOR> in full screen mode controls are more visible, its really best in that mode. So I encourage that rather than bigger more invasive controls

</comment></comment><comment><USER21> Really Great!

</comment><comment><USER22> Very nice.</comment>


Shooting the messenger (Secunia and VLC) - <AUTHOR> https://secunia.com/blog/372

<comment><USER2> Here is a response from the VideoLAN president:

[http://www.jbkempf.com/blog/post/2013/More-lies-from- Secunia](http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia)

<comment><USER3> I'd be careful about rushing to judgement on this. I'd rate both sources as equally credible and the issue here is pretty complex. Both parties have commercial incentives.

<comment><USER4> VideoLan is a non for profit association, and VLC is Free Software (GPL).

I wouldn't qualify their incentives as being the same (and VideoLan has no commercial incentive at all by definition).

<comment><USER3> I defer to you on this and apologize if I've mischaracterized VLC.

</comment></comment></comment></comment><comment><USER5> This is stupid. If one group says an exploit exists, and another says they fixed it, then one of the two is wrong! If you have an exploit, reproduce it! If it is not reproducible then there isn't much to be done!

Money and incentive should have nothing to do it. Is it free, do you make money are questions that do not matter, it is speculation on motive. You either have a bug or you don't and you either have fixed it or you haven't. I would expect engineers worth their salt able to communicate and resolve this for the betterment of everyone and shove their egos to where the sun don't shine.

<comment><USER6> Read the article fully , i think ..</comment></comment>


Biases Against the Creation of Wealth - <AUTHOR> http://www.reason.com/news/show/122019.html

<comment><USER2> I am a libertarian capitalist, who has made a reasonable amount of wealth. This article is good, but it ignores several _institutional_ sources of "unfairness" in common parlance. The most obvious ones through history were slavery, government-sanctioned racism, widespread sexism and so on.

Leaving those things aside, today active government policy promotes borrowing vs saving (through Federal Reserve credit policy), and actively bails out Wall Street speculators - who made a mint during credit bubbles.

Common people aren't stupid if they feel at times "the system is stacked against me". It often _is_ stacked against them. I am no socialist, but libertarians recognize that the fastest way to push people into socialism is to institutionalize unfairness this way.

<comment><USER3> Unfortunately capitalism doesn't help much in establishing what is fair and what is not.

<comment><USER4> Depends on your definition of capitalism.

</comment></comment></comment><comment><USER5> I'll take a contrarian point of view, just for fun:

> But economists who debate certain issues about the perfection of markets are > not debating, say, whether prices give incentives. Almost all economists > recognize the core benefits of the market mechanism; they disagree only at > the margin.

Sometimes, though, you wonder how marginal the 'margins' are. For instance, information asymmetry (<http://en.wikipedia.org/wiki/Information_asymmetry>). In a modern, advanced economy with complex products and services, who can really judge a product just by picking it up and looking at it? Even something so simple as the food we eat might be grown with toxic weedkillers, and we can't tell that just by picking it up and looking at it.

Not that I'm actually anti-market or free trade... far from it. I just like to push back, at times, it's healthy to question things.

<comment><USER6> I'll bite.

We likely have more information about product quality than at any time in history through the Internet. This is also an argument for allowing legal action like the class action lawsuit to discourage faulty and negligent craftsmanship. Although, if that is an argument for or against market forces I'm not sure.

<comment><USER5> Sure, but having that information is not the same as being able to utilize it. I can't look up everything I buy every day, nor would I really want to. It makes things easier if I can basically trust that people aren't trying to rip me off. I think in _most_ markets, it's in the interests of the vendors to not attempt that, but still, it's an interesting question, and I'm suspicious of all-or-nothing answers on any side (the market/government should take care of everything).

</comment></comment></comment><comment><USER7> One thing I have wondered is if enterprise software (like CRM and ERP packages; process automation stuff) is actually helping the common man. The theory is that all this enterprise software makes large companies more efficient by cutting their costs. Then since these large companies are so competitive, they will pass on the savings to the consumer by cutting the prices of goods/services. Thus consumers can more easily afford higher quality lives.

But it seems like in the past 20 years, prices have stayed the same or gone up, employee salaries have stayed the same or gone down, but executive pay packages have sky rocketed. Does this mean that all the innovation and "wealth" created by enterprise software is just making the rich more money?

<comment><USER8> How can you say prices have stayed the same or gone up? In 1996 I paid $2300 for a 486 with 16mb of RAM. A month ago I paid only $1700 for a Core 2 Quad with 4gb of RAM. Seven years ago a 50 inch plasma cost $10k.

Even outside electronics, which experiences persistent price deflation (and hence rising volume), prices are not rising as fast as wages. In constant 1990 dollars, gasoline cost $1.10/gal in SF in 1987. This rose to $1.66 (1990 dollars) in 2007. ([http://www.mtc.ca.gov/maps_and_data/datamart/stats/gasprice....](http://www.mtc.ca.gov/maps_and_data/datamart/stats/gasprice.htm)) Median wages in the same period rose from $14,498.74 to $23.962.20. (<http://www.ssa.gov/OACT/COLA/central.html>) $1.66/$1.10 = ~1.51 ... $23,962.20/$14.498.74 = ~1.65. Even gas is getting cheaper.

As random anecdotal evidence on food. My dad told me he started his career 33 years ago at $4.10/hr, and finished it in 2006 at closer to $40/hr, at the same company, without climbing into upper management. When he started, a week's worth of groceries cost him about $25-30. Now, they cost around $75-100. A threefold increase in the cost of food, but a tenfold increase in his income.

Sure, the sticker price may go up, but over the long run in a growing economy, wages increase just as fast, if not faster.

</comment></comment><comment><USER3> The trouble with these ideologic arguments is that the hard questions are never debated.

For instance, my own opinion is that it is good that you can get rich by creating things that others need. On the other hand we know that inequality of income creates inequality of opportunity in the next generation. Which means that not everyone has the same opportunity to get rich by creating something that others need.

<comment><USER9> Capitalism isn't perfect but it's the best income redistribution method we've come up with combined with a small government tax. What scares me is that capitalism is probably still going to be around once scarcity of energy is eliminated on Earth -- it seems like copyright is keeping a market around for information when there is no reason for one to exist anymore.

</comment></comment><comment><USER8> All I can say is wow, I wish someone would print 300 million copies of that and mail it to every man, woman, and child in the country.

<comment><USER10> Nobody would read it. (For approximate values of nobody.)

</comment></comment><comment><USER6> Here are some contrarian positions (to go with those already presented):

The article currently refers to "a society's wealth" but not the distribution thereof. The American economy has grown significantly since 2000, for example, but the median wage has not. Is there any point to a growing economy when the median citizen is not benefiting from it?

There is a brief mention of the irrationality of voters who do not trust increasing market forces as a means of solving health care problems. However, one can argue that we have a more market based health care system than the systems of Western Europe, for example, but worse health outcomes. How can we be sure, then, that increasing market forces even more will improve the situation?

<comment><USER11> _we have a more market based health care system_

Health care, whether anyone likes it or not, can never be a free market. A free market requires willing buyers and sellers. Health-care consumers are uniformly unwilling. This prevents the occurrence of something you see in penny stock markets: The formation of a spread, in which buyers and sellers are _unwilling_ to trade. In health care, the sellers can force a sale in such situations.

<comment><USER4> Sorry, I do not know if I really get your argument. Could you please elaborate?

<comment><USER11> It's simply that economists often assume that _all_ markets are (or potentially are) free, when that isn't the case. Some markets come close (items on eBay, stocks, commodities, currencies, etc) while others don't. If you start with a naturally "unfree" market, the same set of rules don't apply.

It's just economists' long-standing physics-envy coming through. They want to think their field has "laws of gravity" that are always true.

</comment></comment></comment></comment><comment><USER12> I've always found religious prohibitions on "usury" to be particularly disturbing. My parents are from Lebanon and are familiar with people who've gone through life with only cash transactions. The tight-knit communities there make things easier for people who won't pay interest, but even so, it must cool growth. Saving up to buy a car or a house in cash is no small order, and forget about entrepreneurship. (I wonder if applying to YC would be verboten...)

<comment><USER4> Yes. Luckily, often enough there are lots of loopholes in the religious laws. Just think of Islamic Banking.

</comment></comment><comment><USER11> Immigration shouldn't be debated in the same way as other sorts of trade. It's 90 percent externalities, good or bad.

</comment><comment><USER13> This is the kind of story that I used to love seeing on reddit. More please!! :)</comment>


"Responsible Encryption" - <AUTHOR> https://arstechnica.co.uk/tech-policy/2017/10/trumps-doj-tries-to-rebrand-weakened-encryption-as-responsible-encryption/ <comment><USER2> The only "responsible encryption" is encryption hard enough to break (yet easy enough to use) that you have to use the XKCD method to get around it ([https://www.xkcd.com/538](https://www.xkcd.com/538)).</comment>


US Government not subject to DMCA - <AUTHOR> http://arstechnica.com/news.ars/post/20080804-air-force-cracks-software-carpet-bombs-dmca.html <comment><USER2> While the DMCA issue is clearly a joke:

"The United States, as [a] sovereign, 'is immune from suit save as it consents to be sued . . . and the terms of its consent to be sued in any court define that court's jurisdiction to entertain the suit.'"

Which as far as I can read it means 'The government can only be sued if it WANTS to be sued'...

He developed this code as part of his employment with the Air Force. Then he sold it to someone else, who claimed proper ownership.

I don't know exactly what kind of 'IP' contracts you get with the air force, but I sure as hell know that if I write code that's "relevant" to my current employer, they can claim ownership. Sounds like the reality of the issue si a bit diff. from the suit.</comment>


How Girls Hold Themselves Back from Pursuing Computer Science (Infographic) - <AUTHOR> http://blog.play-i.com/girls-in-technology-infographic/

<comment><USER2> How do we know that girls study CS less due to misperceptions? The infographic is a collection of factoids, logical leaps, and prescriptions derived from those leaps.

</comment><comment><USER3> I'd be interested to hear the source of the line that "in college women make up 52% of math and science majors"

I'm aware that chemistry maintains gender parity [1] and that medical schools are near-parity [2] (if you consider medicine to be math or science) but I'm not aware of a 52% figure covering all math and science.

[1] [http://www.rsc.org/Education/EiC/issues/2012May/Yellowlees-w...](http://www.rsc.org/Education/EiC/issues/2012May/Yellowlees- women-chemistry-students.asp) [2] [https://www.aamc.org/download/277026/data/aibvol12_no1.pdf](https://www.aamc.org/download/277026/data/aibvol12_no1.pdf)

<comment><AUTHOR> On page 25 of the NCWIT scorecard it states that in 2009 women earned:

57% of all undergraduate degrees, 52% of all math and science degrees, 59% of the undergraduate degrees in biology, 42% of mathematics degrees, 18% of all computer and information sciences undergraduate degrees

We cross-checked 2 other sources for 2012 numbers as well.

[http://www.ncwit.org/sites/default/files/resources/scorecard...](http://www.ncwit.org/sites/default/files/resources/scorecard2010_printversion_web.pdf)

<comment><USER3> I was really hoping to find a field CS could look to for inspiration on achieving-gender-equality done right.

Looking at citation 32 from the PDF you linked it seems to be based on IPEDS [1]. Their data, for 2010 bachelors degrees conferred:

      IPEDS title                                | Table | Male    | Female
      Health professions and related sciences    |   326 |  19,306 | 110,328
      Biological and biomedical sciences         |   314 |  35,865 |  50,535
      Mathematics and statistics                 |   327 |   9,087 |   6,943
      Physical sciences and science technologies |   328 |  13,862 |   9,517
      Engineering and engineering technologies   |   320 |  73,833 |  14,896
      Computer and information sciences          |   318 |  32,410 |   7,179
                                                 |       |         |
      Total excluding health prof + related sci  |       | 165,057 |  89,070 (35% female)
      Total including health prof + related sci  |       | 184,363 | 199,398 (52% female)

So we seem to be relying on "Health professions and related sciences" to bring the average up. I assume that's SIP code 51 but that seems like a very broad category [2] - for example it includes medicine, dentistry, nursing, yoga, dance therapy, and medical insurance coding.

I'm not sure science as a whole should be patting ourselves on the back yet. It would be nice if we could get to gender equality without lumping all medicine in with science.

[1] [http://nces.ed.gov/programs/digest/d11/tables_3.asp](http://nces.ed.gov/programs/digest/d11/tables_3.asp) [2] [http://nces.ed.gov/ipeds/cipcode/cipdetail.aspx?y=55&cipid=8...](http://nces.ed.gov/ipeds/cipcode/cipdetail.aspx?y=55&cipid=88742)

<comment><AUTHOR> Carnegie Mellon has done some amazing work that has raised female enrollment in Computer Science from 7% in 1995 to 42% in 2000. We're going to do a follow-up examining what they've done. In fact, one of our female engineers went to CMU!

</comment></comment></comment></comment><comment><USER4> I'd rather see an info-graphic on athletes in CS (both genders). My experience is likely skewed by living in Boulder, but the national stats might still be interesting.

</comment><comment><USER5> Girls don't hold themselves back, they are just in general not as interested. This might change over time. None the less it's a non issue.

</comment><comment><USER6> My counter to this, is the documentary "Brainwashing" from Norway.

</comment><comment><USER7> I think the title and general argument here is horrible. Even if their point is accurate, how are you going to blame them for what they don't even realize they're doing? Wouldn't it be more effective to find a _positive_ way to express the idea that we should introduce kids to technology and eradicate stereotypes?

(Also, I would argue that "computer science as a career" is not necessarily a wonderful thing; lots of jobs in technology don't require a CS degree, and we don't have to push them towards that very specific track to get them working beside other CS and non-CS geeks)

<comment><AUTHOR> Hey Peter, I do agree that the title missed the mark and should have had a more positive spin. We didn't mean to put the blame on girls but merely to highlight the social and cultural factors that discourage girls from pursuing computer science.

</comment></comment><comment><USER8> At least they aren't blaming boys for it like the usual trope.</comment>


Microsoft WinObjC: Restore original licenses - <AUTHOR> https://github.com/Microsoft/WinObjC/issues/35 <comment><USER2> Speaking as someone whose job it is to make sure these issues don't happen at a similar large company:

No org can be 100% perfect all of the time, no matter what processes they put in place. This looks like just a regular process failure.

I don't know what MS's are specifically, but we do everything from training new employees to verifying headers on outgoing releases (much to the annoyance of plenty of engineers who just want to release shit). I suspect they do the same.

Replacing headers with a standard header is pretty common. However, we require code segregation to prevent the issue that happened here (IE all third party codes goes in third party directories with an associating LICENSE file describing the license/notices). That makes it easy to tell that someone screwed up when replacing headers.

 _Doing that_ is uncommon for most companies in practice (at least, when i surveyed my counterparts, most want to be doing it, but it doesn't really happen in practice with a > 50% rate due to not being closely involved enough with engineering and development practices to make it easy).

Most of them are happy to mix up third party code with their own code, or really bad at enforcing, and then when you go to release it, you don't notice things like what happened here.

Then again, we also tell new employees that we care about getting the notices and credits right not because we are worried about legal repercussions, but because of the golden rule (you'd be pissed if you ask for one small thing to use you code, and they can't be bothered to do it, and we don't want other people to feel that way about us).

I suspect that is pretty different too :)

But this seems like an object lesson in proving that. The people whose headers were changed feel aggrieved regardless of the fact that it was probably a simple process screwup / whatever. They don't care about that. They care that somebody decided they really wanted to use it, and that it saved them time/energy/helped/whatever, but despite that, when they made the choice to use it, they didn't seem to bother to put the one small thing the author asked of them on "the list of things to do before release"

(Regardless of whether this is actually the case).

<comment><USER3> > Replacing headers with a standard header is pretty common.

It shouldn't be. That's a fundamentally bad idea.

It'd be reasonable to put a standard header at the top, immediately followed by "Based on (other project):" and the header for that project. But _changing_ those headers is never OK.

<comment><USER4> > It shouldn't be. That's a fundamentally bad idea.

I don't think it's that bad of an idea. The MIT license says:

        The above copyright notice and this permission notice shall be
        included in all copies or substantial portions of the Software.

What that means is anybody's guess. I'd say if you include one copy somewhere you're pretty much off the hook.

<comment><USER5> A source file is reasonably "a substantial portion"; in fact, a per-file license is applicable to that file, and does not cover other files.

<comment><USER4> Yup. I'm saying (guessing, really) the header doesn't necessarily have to stay in the file. You might as well put it somewhere else (e.g., docs, license file).

\---

Per-file licenses are different. The only one I looked at is MPL2 and IIRC it mentions the little note doesn't have to be in the file.

</comment></comment></comment></comment></comment><comment><USER6> >> Someone at Microsoft needs to go back to the first commit and track down every bit of code that was taken, and investigate the origin of the code, and properly restore the copyright notices.

It is specifically to avoid these issues that most companies don't go through the trouble of open-sourcing their code. Not at all saying it's wrong to enforce licenses I'm just pointing out the obvious that companies that don't want to get into legal trouble avoid the issue altogether and discourage open source. A well known company I used to work for requires legal to sign-off anything that has to be open-sourced. A startup I currently work-off had to be audited for license compliance before a round of funding. One primary reason I see is that most engineers don't understand licensing very well. They don't understand when it's safe to use GPL and when it's not.

<comment><USER7> At D one huge reason we use github is to establish an audit trail of where code that gets incorporated comes from, which:

1\. discourages people from committing code that isn't theirs 2\. if there is bad code committed, we can determine the extent of it and so take corrective action 3\. it's a great defense against false claims of bad code

</comment></comment><comment><AUTHOR> There's been a brewing controversy on Twitter and GitHub today about missing/changed licenses on some of the code that Microsoft incorporated into their WinObjC release from yesterday. This GitHub issue seems to be the best summary of what's going on so far. The quick summary of the summary is that there are a bunch of files released under BSD/MIT-style licenses where Microsoft removed attribution, some files which are GPLd or even more restrictive, and at least one file which is not under an open source license at all.

Full disclosure: some of my code is in there, so I'm not an unbiased source.

<comment><USER5> The scrubbed copyrights are bad enough, but can be fixed. The incompatible licenses mean that this code is actually unusable.

I have no idea how MS is going to rectify this.

<comment><USER8> I feel a bit ignorant here, but are there open source license that simply can not co-exist?

For example, could I write program Foo.c (using CDDL license), which uses GPL'ed Bar.c and MIT'ed Dad.c (both unmodified)?

<comment><USER9> > but are there open source license that simply can not co-exist?

The GPL can basically not coexist with any other license, though lots of licenses (though perhaps fewer than the FSF claims, especially for GPLv2 and previous) allow code to be relicensed under the GPL (which is different from the code coexisting.)

The reverse is emphatically _not_ true, GPL code generally cannot be relicensed (downstream; the copyright owner can do whatever they want) to another license, except newer GPL versions if the optional "or any later version" clause is included with the GPL.

<comment><USER10> My understanding is that the GPL can usually coexist with licenses that are non-copyleft, or with some copyleft licenses, as long as the license doesn't require the resulting work have any license restrictions beyond what the GPL requires.

Anybody who's terribly interested in all of this will probably enjoy reading the GPL FAQ, especially this bit:

[http://www.gnu.org/licenses/gpl- faq.en.html#WhatIsCompatible](http://www.gnu.org/licenses/gpl- faq.en.html#WhatIsCompatible)

IANAL, YMMV, HTH, WTFBBQ, ETC.

</comment></comment></comment></comment></comment><comment><USER11> Microsoft is very serious about OS licenses, and I'm sure the team is currently sweating to get this right. Before Nadella, it was very difficult to get a permit to use OSS at all; With the new culture, openness (giving and taking) is encouraged, but some teams might have taken it too lightly. It's a learning process.

</comment><comment><USER12> What is proper procedure for open-source mashups? Setting aside GPL, if I have a project that lifts a single function each from separate projects that are individually zlib, mit, bsd, apache, mozilla, eclipse and boost. What do I do? Put a license url annotation on each function? What license can my project as a whole be?

<comment><USER3> Document the licenses for each, and include all the copyright notices and license headers, exactly as they appeared at the top of the files you took those functions from. The resulting file is under the conjunction of all of those licenses, requiring anyone who uses it to comply with all of them simultaneously. That's theoretically possible when the licenses don't conflict.

</comment></comment><comment><USER13> I hope they make it compilable with clang + mingw headers.

</comment><comment><USER14> I like the dude who thinks that the GPL hasn't been proven valid in a US court and that migueldeicaza has trouble getting a job in the industry.

<comment><USER15> it's quite irrelevant, but I was about to post the same -- the idea of Miguel "becoming unemployable" as a result of this is just delightful.

<comment><USER14> Yeah. Ironically, what _would_ actually make me hesitate to hire someone is seeing them post on a public issue tracker that they believe the GPL is unenforceable and that blatantly violating it is a good idea. Leaving aside their critical thinking abilities, soft skills, etc. it's a serious risk of legal liability to have such a person write code for my company.

<comment><AUTHOR> Indeed. They seem eager for Microsoft to intentionally violate the GPL in order to create a court case which they believe would result in invalidating the GPL. Who's to say they wouldn't see an opportunity for causing this to happen by incorporating GPL into whatever project they're working on at their job?

</comment></comment></comment></comment><comment><USER16> Oh no. First time I see something like this. Why can't Microsoft be like the good-guy companies, like Google (and Apple)?

</comment><comment><USER17> I Love open source, but I find its really disturbing that some code can't live together when licensed under different open source licenses. Under my Java Code I mostly avoid unnecessary Libraries altogether. That's the reason why I mostly Build my stuff with akka and undertow and postgresql jdbc only (and the jdbc stuff gets replaced as soon as my library async postgres driver does what I need) so that I only have Apache 2 Code (and some parts BSD which will be replaced).

Everything else is just too odd. And if I or any other people below me pulls a library in that isn't APL2 i will refuse the PR. It just sucks how aweful it is to write programs with awesome licenses that are incompatible. But you just want to use existing things, which you can't do cause people are dumb and doesn't write licenses which are happy together. I mean why can't I write GPLv3 Code and pull other Open Source licensed things, too? It's still Open. And that's the problem the Open in Open Source mostly isn't open. I see the source, but I can't do anything with it.</comment>


Mark Bittman on the politics of the plate (video) - <AUTHOR> http://www.youtube.com/watch?v=Gh-GzCBpuWo&feature=youtu.be <comment><USER2> It's pretty scary how much of US taxes are supporting fast-food and other corn/soy-based food. About 0.8% of the national budget goes to agriculture (<http://www.whitehouse.gov/issues/taxes/tax-receipt>) with billions of those dollars going to subsidize the production "staple" crops that make us obese ([http://www.gpoaccess.gov/usbudget/fy12/pdf/BUDGET-2012-BUD-5...](http://www.gpoaccess.gov/usbudget/fy12/pdf/BUDGET-2012-BUD-5.pdf) \- I've heard all of the "commodity" line items point to those subsidies, but it's hard to decode)</comment>


I've set up this blog for you to announce *updates* to your web 2.0 app.  Send me your updates by email or post them directly to the blog. - <AUTHOR> http://web2loop.blogspot.com/ <comment><USER2> Who are you, and why do you think people should fill out your blog with news for you?

How about you manually contact every Web 2.0 startup asking them for data to populate your blog with? That will make more sense: if you in need, you go out and ask.

<comment><USER3> Owners of Web 2.0 startups have far more to gain from this than Amichail does. Generally, economic returns accrue to those who do the difficult parts; it's far more difficult to start a Web 2.0 company than setup a blog, so far more gain accrues to the users of this than the blog itself.

I, for one, plan to use it as soon as we launch our startup. Unfortunately it's not much good if you're not ready for traffic, but I think it'll be a nifty added source of exposure.

<comment><USER4> You're assuming anyone will read it. I'm afraid this is far from given.

<comment><USER3> If nobody reads it, you're out the 30 seconds it takes to post. I'll take that bargain...

</comment></comment></comment></comment><comment><AUTHOR> If you would like to post updates directly to the blog, please send me your email to email@example.com so that I can give you permission to do so.

</comment><comment><USER5> Hey sure, will do.</comment>


About HTML semantics and front-end architecture - <AUTHOR> http://nicolasgallagher.com/about-html-semantics-front-end-architecture/ <comment><USER2> Whatever the opposite of "I stopped reading when they said X" is, I did that when Nicolas drew a distinction between local and global semantics. Anyone who talks semantics without understanding that they require contexts to have any meaning at all is someone not worth listening to, and man oh man is the "semantic web" full of people ready and indeed _anxious_ to make that fundamental mistake.

In the interests of counterbalancing the tendency to have nothing but criticism up in comments, let me just say: This is great stuff.

<comment><USER3> The topic here is completely unrelated to the semantic web, except in a tangential mention (the "etc"): "We can leverage the agreed "global" semantics of HTML elements, certain HTML attributes, Microdata, etc."

Your caricature of semantic web "people" is misplaced. Local specialized semantics is fully a part of the design. _No one_ believes there is a single master schema.

<comment><USER4> I don't think parent meant the semantic web as in the Tim Berner's Lee version of it, he just refers those "semantic" html advocates (hence the quotes).

As for the semantic web in the TBL meaning, it is not worthy of caricature, anyway, considered the utter failure of RDF and XQuery outside of tiny niches, not to mention the flawed premises under it all.

<comment><USER3> Tiny niches? All the data tables in Wikipedia; Apple acquires Siri; Google acquires Freebase; the Google and Bing search indexes, .... This story is not over.

Bitter, absolute statements like that are regurgitations of a myth. (And maybe you mean SPARQL not XQuery.)

<comment><USER2> "This story is not over."

Which is to say, the Semantic Web didn't happen as promised, and it didn't happen in exactly the way you would guess based on my message, which is that where you had something that could create a local context it could happen in pieces, but no global whole has emerged, nor is there any particular evidence one is emerging.

[http://reprog.wordpress.com/2010/09/02/bibliographic-data- pa...](http://reprog.wordpress.com/2010/09/02/bibliographic-data-part-1-marc- and-its-vile-progeny-2/) \- read parts 2 and 3 as well. It may not seem directly related at first, but you should soon figure out why I consider this three-part blog series to be the thing that proves global semantic contexts are a hopeless pipe dream. (And remember that entire bit is about _librarians_ ; if they are that hopeless nobody else has a chance.)

</comment></comment></comment></comment></comment><comment><USER5> Sound advice, I found myself nodding at the various bits in the article, and recognize that over time I have gravitated towards similar patterns even in my limited amount of frontend work. The underlying idea is that CSS classes should be treated as rigorously as any other kind of identifier in a programming language: naming structure, precision in usage and clarity of scope are important.

</comment><comment><USER6> So, this is the 'best practice' for the week then?</comment>


Show HN: F-Lock – Securely store and share your data on the cloud - <AUTHOR> Hello HN,
We are F-Lock, a new company that offers the first truly secure way to store your private data. Existing solutions cannot prevent the leakage of private information due to the way you access your encrypted files. F-Lock hides all the these patterns by utilizing strong cryptographic methods never used before.
Using F-Lock you can securely store files and databases in the cloud, while retaining search and retrieval functionality.
We further support encrypted file sharing, with each user being able to verify the true identity of the recipient (for the first time).
Check our video at http://bit.ly/2uuXTec and our website at http://f-lock.ca/, and let us know what you think. Which services would you use the most?
Thank you very much for the feedback!
The F-Lock team <comment><USER2> Is there any technical information available?

There are a number of references to competitors using "weak" cryptography but this would make more sense if you can explain why your solution is stronger.

Am I reading correctly that the only interaction I can make at this time is to sign up to a newsletter?

<comment><AUTHOR> Hello technion,

thank you for your feedback! At this time the website just presents the main ideas and you can only sign up to the newsletter. Regarding the tech behind our idea compared to the competitors, current solutions utilize Order (or property) Preserving Encryption or offer semantic security. This means that everything is encrypted once and uploaded to the cloud. Then, local indices help you retrieve the correct encrypted data. These approaches reveal the pattern of accesses (the frequency each encrypted file is accessed, if some encrypted files are accessed always together, and how many encrypted files are returned each time). It is proven that this information is enough for the cloud provider or anyone listening to the communication channel to infer the exact index information. The more attributes are indexed, the more information about your files/database rows is inferred and potentially, an adversary can reconstruct all your data without even breaking the encryption. There are strong cryptographic techniques solving this problem by essentially re- encrypting some of the files each time you retrieve data (e.g., ORAM), but they were deemed non practical. F-Lock uses the latest advances in the field of ORAM and Differential Privacy in order to overcome any potential attacks, while retaining the practicality of the solution. Sorry for the long reply! We hope this information is helpful.

The F-Lock team</comment></comment>