Court Rules IRS Can Seek Information on Bitcoin Customers - <AUTHOR> http://www.wsj.com/articles/court-rules-irs-can-seek-information-on-bitcoin-customers-1480569311 <comment><USER2> You can't omit Bitcoin transactions from your tax return just because they seem anonymous. Concealment is the very definition of tax evasion, "Evasion... involves deceit, subterfuge, camouflage, concealment, some attempt to color or obscure events or to make things seem other than they are"

Quoting in full since its among the most misunderstood yet important distinctions in tax:

[http://www.irs.gov/irm/part9/irm_09-001-003.html](http://www.irs.gov/irm/part9/irm_09-001-003.html)

220.127.116.11.2.1 (05-15-2008)

26 USC §7201 – Avoidance Distinguished from Evasion

1\. Avoidance of taxes is not a criminal offense. Any attempt to reduce, avoid, minimize, or alleviate taxes by legitimate means is permissible. The distinction between avoidance and evasion is fine, yet definite. One who avoids tax does not conceal or misrepresent. He/she shapes events to reduce or eliminate tax liability and, upon the happening of the events, makes a complete disclosure. Evasion, on the other hand, involves deceit, subterfuge, camouflage, concealment, some attempt to color or obscure events or to make things seem other than they are.

<comment><USER3> So, if an individual buys BitCoin with some capital to not pay taxes for said amount of capital ,is he evading or avoiding?

<comment><USER2> IANAL but example taxable transactions might be to sell bitcoins for a gain, or to use appreciated bitcoins in a barter transaction. Losses are also taxable transactions, but in a good way.

Mining is awkward, since I believe mined coins are taxed as income on the day they are mined, even if you don't transact.

Best to talk to an accountant, of course, and not rely on the advice of a random HN commenter like me.

<comment><USER4> > Mining is awkward, since I believe mined coins are taxed as income on the > day they are mined, even if you don't transact.

The IRS has indicated that bitcoins are property and taxed as such, so that seems unlikely. Do you have a source for this?

<comment><USER2> [https://www.irs.gov/pub/irs-drop/n-14-21.pdf](https://www.irs.gov/pub/irs- drop/n-14-21.pdf)

<comment><USER4> (Q-8 is the relevant FAQ on that doc)

Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER5> So-- IRS seeks _all_ transaction records for all coinbase customers. Not just buying and selling Bitcoin but also people using their wallet services, which would mostly be users moving around their own funds (not a taxable event).

They're doing this on the basis that there might be evidence of tax evasion in there somewhere. Which is plausible, I suppose.

Thing is: All this same data was also emailed to the customers (as coinbase does email notification), likewise for their competitors.

Which means that the IRS could likely get the same data but more comprehensively by simply demanding Google turn over every single email for every user. I can guarantee this would include much more evidence of tax evasion.

So why is a coinbase dragnet a viable demand where a Gmail one-- which would include the same data plus even more tax evasion evidence-- not one? Or is it simply the case that the Gmail demand will show up after this one clears the courts? :)

<comment><USER6> Material transactions are already, for the most part, reported. This action isn't putting special attention on Bitcoin _ceteris paribus_. It is bringing it into alignment with U.S. dollar custom and law.

<comment><USER7> So shouldn't they only require Coinbase hand over "material transactions"?

</comment></comment></comment><comment><USER8> Oh good, another list I'm on. I'm going to have to start making a list of the lists.

Bitcoin seems obviously like money to me. But I wonder when the IRS is going to start cracking down on other electronic money you can earn. Think about computer games where you can buy credits, or earn them by playing. That sounds like income tax evasion to me; you're getting paid in Green Rupees instead of US Dollars, but you should still be paying income tax on that! And don't forget about frequent flyer miles. (Which are not counted as income because you "can't" sell them, but anyone who reads flyertalk knows that's not the case.)

It's all very interesting. People have been using alternative currencies outside of the IRS's radar for quite a while, and they've mostly ignored them.

<comment><USER9> In the linked article, the IRS is quoted as saying they are treating BitCoin like property. Essentially, they are looking to tax people who made a profit from selling Bitcoins using Coinbase.

They don't seem concerned with the currency aspect at all.

<comment><USER10> Say I buy two bitcoins, A and B, and combine them into a wallet C. Bitcoin A was purchased for $100 and Bitcoin B was purchased for $1000. If I sell half of wallet C for $500 - can I pick "which" bitcoin was sold? Because depending on which coin was sold the tax implication may change.

<comment><USER11> While I'm not a CPA, I have spent many dollars and hours since 2011 on Bitcoin tax questions in the US, so here's my two cents:

In general the US requires consistent treatment of inventory for earnings calculations. It's a little weird to have to worry about that as just a consumer, but if the coins are property and being held then sold, you probably should keep track of gains and losses.

Now, you discuss the question of combining up your two inventories. There are basically four ways of accounting for inventory in US accounting:

FIFO -- First in First Out

LIFO -- Last in First Out

AVCO -- Average Cost

Specific Identification (I think that's the term) -- cost associated with a given item.

It is generally fine with inventory to pick one of these methods and accrue gains / losses appropriately.

So, FIFO: You show a gain of $400. (Note your next sale at $500 will net a loss of $500).

LIFO: You show a loss of $500 (Note next sale will net a gain)

AVCO: You show a loss of $50.

Specific Identification: Depends on the coin.

If you want to _change_ your inventory accounting methods you definitely need to calculate out a charge (or credit) for the switch.

In general, I have thought for some time choosing specific identification rules and instrumenting a wallet to spend in the most tax efficient way possible makes a lot of sense, but it's way down the stack of projects for me at least.

<comment><USER12> > If you want to change your inventory accounting methods you definitely need > to calculate out a charge (or credit) for the switch.

I thought (and I could be wrong) that the normal thing to do with LIFO/FIFO as to track it _as if_ specific lots were sold (even if those aren't the actual items sold), so that if you switched between them you just changed the order in which you were treating the remaining (accounting, rather than actual) lots as being sold, without the charge/credit you would have if you refigured past history of sales to meet the new accounting method.

<comment><USER13> That's how I do it with mutual fund shares, which would be a similar situation to Bitcoins due to it all technically being one "pot".

If you use a tax-lot specific accounting method FIFO/LIFO/highest cost/other specific, you just need to track which "lots" you've already sold out of (fully or partially), and ensure that you don't sell something twice. Now, if you used average cost at some point, you're kinda screwed if you want to switch to specific lot.

</comment></comment></comment></comment></comment></comment><comment><USER14> I get that taxes are one of the few certainties of life, but this article makes me think of yesterdays "how to hide $400m" article about tax sheltering and offshore incorporation.

I wish there were a way to ruin tax sheltering for the wealthy by finding out the exact formula for what they're doing (say register a business in the Cook Islands ), then commoditizing that via an online service (like Wordpress does for websites), and using bitcoin. Now the masses can pay $29.95 to have a VPS on the Cook Islands, set up their bitcoin wallet on it, and have their own little tax-exempt haven.

Try to structure the system the exact same way the rich people do it, so that authorities necessarily have to shut down the rich at the same time.

<comment><USER15> Simplify the law, remove sheltering opportunities/loopholes, and lower rates?

Lower them to a point at which it isn't worth the cost to shield, and get more out of them than what we are losing to the sheltering.

</comment></comment><comment><USER7> Say someone bought Bitcoins from Coinbase and transferred them to their own wallet outside of Coinbase. They haven't sold them, so there's no taxes to pay and nothing to report to the IRS, right?

How is the IRS going to know the difference between that situation, where they have done nothing wrong, and someone who sold them outside of Coinbase and didn't pay taxes on it?

Are they just going to audit everyone over some threshold, or are they going to use this information in existing investigations (or in conjunction with other red flags)

<comment><USER16> It's difficult to guess how the IRS would treat it.

How are they going to know the difference? For one, you can tell them. I don't know what the proper form for this would be, but I am sure an accountant can help out.

Scaremongering aside, I've found dealing with the IRS rather sane.

I would think that the IRS would treat a transfer of coins from a wallet you own to a wallet you do not own as a taxable event. They would take difference in value of the coins between when you acquired them and transferred them away, and if it is positive, would call it a profit.

On the other hand, if you declared that you owned both the source and destination wallet, I would imagine that the IRS would not treat this as a taxable event, in the same was as transferring USD between your checking and savings account is not a taxable event.

The IRS relies in a huge part on you self-reporting things. They do get a lot of info from the source (bank transaction records, 1099's, W2's). In many cases, the onus is on the taxpayer to tell the IRS the information that they need.

By default, the IRS takes self-reported information at face value and believes you. However, sometimes, they may decide to investigate. This is called an audit, and then the onus is on you to prove that what you provided is true.

</comment></comment><comment><USER17> Few people know that federal taxation is primarily a way to spy on people. There are numerous alternative places to apply taxation within the economy that are not remotely as intrusive, time consuming or costly. Tax preparation is a $10 billion dollar industry and the IRS has a $12 dollar budget.

<comment><USER18> On its face ("the more money you make, the more taxes you pay") it's a good system. However, like most things, it doesn't seem to work exactly the way it's described.

</comment></comment><comment><USER19> So how would one go about settling up with the IRS on this?

<comment><USER20> The short and useful answer is talk to an accountant.

The longer and less useful answer is that it depends heavily on circumstances. Two relevant ones are "What sort of income do you have here?" and "How much are we talking about?"

If we assume the answers are "You have capital gains because you happened to purchase some Bitcoin, they appreciated, and you sold them, but you weren't conceivably operating a business while doing this" and "Enough money to matter but not enough that your failure to get better advice was clearly negligent" then your resolution is going to be fairly simple. Your CPA will calculate how much money you owe, file a 1040-X (amended return) for the years at issue, and say "On routine review of a prior year tax filing we found that we inadvertently understated income. We're amending the return as appropriate, and have remitted additional tax. We request an abatement for penalties for tax underpayment on the grounds that IRS guidance at the time was unclear and we're coming in voluntarily before you asked us to." You'd possibly get the abatement of penalties; you're likely to pay very modestly more than you would have if you had been more diligent about your obligations, because they don't frequently waive interest.

This is the "middle class Americans screw up their taxes all the time; we like to encourage voluntary compliance" answer. If you're talking about _mountains_ of money, on the other hand... expect rather less leniency. Other things that increase your risk: any hint of other-than-tax illegality around the business ("I underpaid on the capital gains I inadvertently generated in my drug smuggling business -- sorry about that, really didn't set up to be a currency speculator, I'm simply an honest drug smuggler") or the Bitcoins being used in a manner which was clearly straight-up tax fraud, like the prosecuted cases where someone's company paid a Bitcoin exchange $X00,000 for "technology services" and expensed it, took the Bitcoin over to Gox, cashed out, and then repatriated the money. (The Bitcoin here are just a red herring; this is a conspiracy to hide $X00,000 in income from the government. They take a dim view of that.)

<comment><USER21> > If you're talking about mountains of money, on the other hand... expect > rather less leniency

Well, according to Wikipedia, you can at least declare income from illegal activities, so that the feds can't jail you for tax evasion in addition to the crime itself. [https://en.wikipedia.org/wiki/Taxation_of_illegal_income_in_...](https://en.wikipedia.org/wiki/Taxation_of_illegal_income_in_the_United_States)

<comment><USER22> However you cannot deduct most costs arising from illegal activity, which typically causes taxes to exceed your profit margin.

</comment></comment></comment></comment><comment><USER23> I initially cringed when I saw this, so I went to go download my transactions from coinbase. I realized after looking through them that some of my BTC outbound transfers were to btc-e, and some of those were to cryptsy. So, considering cryptsy kicked the bucket with much of my coin, and I can't get their records...now what? Those outbound transfers are financial losses, and in the grand scheme I lost money due to Cryptsy; but will the IRS settle for that?

<comment><USER24> You should have filed a loss with the IRS for the money so you could get the tax write-off.

<comment><USER25> You can file amended tax returns for 3(?) years I think. I don't know how that works for capital losses though, I've only had to file amended returns for other types of deductions.

</comment></comment></comment><comment><USER26> There is a huge flaw in this logic from the IRS. If it is a possession, then I can give it away. Like a fudgable dollar I gift away, you cannot tax me on every transaction that doller is engaged in.if I give away the wallet and the dollar, nothing changes. The USA is just trying to stop bit coin with taxes.

<comment><USER27> That's kinda close to "I'm not going to pay you for what I bought. But I am going to transfer ownership of my wallet here which just happens to have cash in it to cover what you were asking for. But be clear, I'm giving you the wallet. Not paying you."

</comment></comment><comment><USER28> What if I buy something with appreciated Bitcoin? Is this a taxable event? If the IRS considers Bitcoin property, am I just bartering with Dell when I buy a laptop with Bitcoin?

<comment><USER18> > Is [buy[ing] something with appreciated Bitcoin] a taxable event?

According to the IRS, yes.

> If the IRS considers Bitcoin property, am I just bartering with Dell when I > buy a laptop with Bitcoin?

Yes, so if you buy 1 BTC for $750, the price increase dramatically and you buy a top-end gaming system from Dell (lol) then you're bartering and the excess value is taxable.

</comment></comment><comment><USER26> Their goal might be to harasss people into not using bit coin. This is a tax nightmare well outside of most peoples understanding.

</comment><comment><USER29> As at least one person has already struggled with this (subthread now deleted), hopefully the following will help others.

To read the article in full, please click the "web" link above, between "past" and "[...] comments".

WSJ articles can be read in full, if you click through from Google search results.

Note: simply copying the Google link and pasting it here won't work. Presumably Google needs to be the referrer.

<comment><USER30> Why do we allow WSJ submissions here if they don't want us to read their content?

I mean sure, you can go the "click web, then the right Google result" route. But that's like submitting a link to Adobe's most recent Photoshop update and then tell people "you can download Photoshop for free by starting your Bittorent client".

WSJ wants to hide behind a paywall. That's fine for them. But HN shouldn't be sending them traffic and enable that behavior.

<comment><USER31> Some HN users subscribe to the WSJ, others find the content valuable enough to use the web link. The submitter and those who up-vote the submission also believe the article has value.

The paywall is part of the WSJ's business model. HN submissions include the source of the article. If you choose not to support the WSJ or their business practices, you have the choice of not reading their articles.

<comment><USER32> I think the (fair) complaint that in situations like this where similar articles are written by a slew of sites, better good could be done sourcing from a site without a paywall; both in accessibility and in supporting non- paywalled news.

Even with the web links, that often doesn't work with WSJ any more with how they cookie; so I'm very supportive of non-paywalled links as a preference.

<comment><USER31> That's a good idea, especially for those that are essentially publishing the wire stories. If people find them, they can provide them in the comments, or perhaps submit them separately. Hard to tell sometimes if there's a better one out there.

I've heard people describe problems they have with the WSJ web links. I don't deny that they do, but I'm surprised I haven't seen them myself. I'm just running Safari with Ghostery. Never had an issue with WSJ (and I don't have a subscription).

</comment></comment></comment></comment></comment><comment><USER33> I basically expected as much. Wish the article wasn't subscriber only.

<comment><USER34> [https://www.google.com/amp/www.wsj.com/amp/articles/court- ru...](https://www.google.com/amp/www.wsj.com/amp/articles/court-rules-irs- can-seek-information-on-bitcoin-customers-1480569311)

<comment><USER29> Following this link doesn't work. Presumably Google needs to be the referrer.

</comment></comment></comment><comment><USER35> The solution to this is obvious: eliminate the IRS. And the income tax. And most of the federal government. Spin off the actually useful bits as private non-profit foundations (or possibly even for-profit companies depending on the scenario) and let them earn their own keep based on the value they provide.

A sufficiently small government can be funded without an income tax, as history shows us.

<comment><USER36> Of course. Taxes are the basis of state, which uses taxes to develop and maintain its capability to threaten you with violence if you dont't pay taxes.

It's a recursion which has plagued the world for centuries.

The whole system can in theory be replaced with non-profit investments funds, which crowdfund social projects.

You dont even have to elect 'leaders', because citizens will be involved full time in running things (by guarding their investments) similarily to how they now waste time on Facebook.

But good luck changing anything without a nuclear apocalypse :) There are a lot of people who like the system the way it is and they won't give it up because us idealists want a better world for their children..

<comment><USER37> I take it you live in a country where people are ok to see other people living off the street because they presumably "failed"? That's the only reason I can think of which would make it possible for charities to fit government action scale. Also, I wonder how local non profit organize against a nation wide invasion (not saying it's impossible, but you have to prepare for it, which costs money).

I live in a country where we're not ok seeing people in the street and we're not ok seeing sick people who can't pay for medecine. I'm ok with paying taxes for those. What I'm not ok with is having people who use what we all pay for, then try to not pay for their part by evading taxes. If taxes is a problem for you, I'm pretty sure there are a lot of countries where you can move and that you will find adequate.

<comment><USER36> >I take it you live in a country where people are ok to see other people living off the street because they presumably "failed"?

I live in Spain, there's no such thing here.

What I propose is for people to have the ability to specify _what_ their taxes are spent on. I dislike it when government wastes tax money on useless or corrupt projects, military, police, surveillance and other such things, which I personally would not support if I had the choice.

I would invest that money in more schools, hospitals, etc.

This would change what we now call 'government' from raw money spenders into project managers who seek public funding.

Citizens can fund public projects from their phones and get involved in the debates, votes, etc.

That's real-time democracy - no need for elections or politicians, just technocrats who monitor the needs of society and ask people for funding.

Think about it for a while and you'll notice lots of positive consequences of such a system.

<comment><USER38> There appears to be some merit to what you're proposing. But what about long- term issues, such as climate change, etc. How are a group of people going to convince a large enough group to pay money for it, and who is going to enforce it?

Also, things that don't affect majority of people will probably never get enough funding. For example blindness. How many blind people do you know? And do you think anyone is going to be convinced that a single kickstarter-type campaign is going to solve it? I imagine even the most motivated donors will start considering dropping out after 2 decades of spending money when they've produced no measurable results to curing blindness (or paralysis, cancer, etc).

EDIT: In fact, the more I think about it, the more it becomes obvious this sort of system couldn't work on a massive scale (such as a scale necessary to do what a government does). Each person is probably only going to be able to comprehend the need to address perhaps hundreds of specific issues. But my guess is that governments, in total, deal with probably 10's of thousands if not more different types of issues on a daily basis. Not only that but those issues that a citizen does comprehend, will he / she need to keep up with how each issue is being addressed? After all, otherwise I'm potentially just throwing money down a rat hole. Sounds like more than just a full-time job on its own. How would one find enough time to do that and still make money to bring home to their families, etc..

<comment><USER10> OP was making a principled stance for a more direct democracy. When you argue against a more direct democracy, doesn't that make you scratch your chin and wonder if you really support democracy at all? Do you really support your fellow man and his pursuit of happiness, or do you know what's best for him and wish to dictate how he lives. Based on what you wrote, you don't support democracy at all - which may possibly be a valid view.

<comment> wav-part Democracy is socially-accepted extortion from successful. So any proposed Democracy 2.0 that reduce welfare spending, will be met with opposition from _people_. This predicts quite many behaviours of people that supposedely support Freedom/Independece/etc.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: How do you share passwords simply and securely? - <AUTHOR> I saw lots of password sharing (especially at work, between family members or friends, purposely or non purposely) with plain text in the wiki, or restricted permission of doc.<p>Are there existing tools (or non-existing tools) that can simplify password sharing experience securely?<p>(Password manager seems a way of securely sharing password, but it usually requires registration and is guarded behind a paywall. Not simple enough IMHO) <comment><USER2> Bitwarden is 100% FOSS and was audited by Cure53.

[https://github.com/bitwarden](https://github.com/bitwarden)

[https://cure53.de/pentest-report_bitwarden.pdf](https://cure53.de/pentest- report_bitwarden.pdf)

This takes care of the paywall problem, at least.

Alternatively, age ([https://age-encryption.org](https://age-encryption.org)) or Magic Wormhole ([https://github.com/warner/magic- wormhole](https://github.com/warner/magic-wormhole)) should be viable choices.

<comment><USER3> I am using KeePass synced with Dropbox. Does Bitwarden have a way to import these as well as export out my stuff in case I opt to change to another password service?

<comment><USER2> Their help docs contain information about importing passwords from KeePass: [https://github.com/bitwarden/help/blob/master/_articles/impo...](https://github.com/bitwarden/help/blob/master/_articles/importing/import- data.md)

I don't know about exporting.

</comment></comment></comment><comment><USER4> Decades ago, tech-savvy people used to make fun of office workers who would put their passwords on Post-It notes stuck to their computers.

Considering that the world has changed and the vast majority of password security issues today come in through the network, and not the front door, it's amusing to think that pen-and-paper is probably one of the better options these days. After all, if the bad guys have physical access to the computer, there's pretty much nothing you can do to stop them, anyway.

<comment><USER5> Just don't do a video interview at your desk or take any pics of your workspace.

<comment><USER6> Those who cannot remember the past are condemned to repeat it. A known case happened to TV5Monde in 2015 [https://www.bbc.com/news/world- europe-32248779](https://www.bbc.com/news/world-europe-32248779)

</comment></comment></comment><comment><USER7> So when I saw people using onetimesecret.com to share sensitive credentials at work (this is a free tool hosted by a third party that IMHO there was no reason to believe is trustworthy) I was a little bit taken aback, because to me this seemed only marginally better than putting the password in an email, and in many ways potentially much worse.

Then I realized, it's open source, and you can host your own instance if you want to trust onetimesecret a bit less:

[https://github.com/onetimesecret/onetimesecret](https://github.com/onetimesecret/onetimesecret)

Then I realized (further) there is a fork that has been containerized and prepped for use on OpenShift (and ostensibly Kubernetes upstream, as well?)

I have not set up my own hosted versions of these, but the fact that it's Open Source makes me feel hopeful that it should be trustworthy. And if you want to be lazy and don't run a hosted service, there is always the public version:

[https://onetimesecret.com](https://onetimesecret.com)

Finally I realized, you can protect the exploding secret with a password, which I presume encrypts and decrypts in a localized context, in the browser (so data is not stored unsafely on onetimesecret's infrastructure in a way that it could be recovered by an adversary, without the shared secret at least, which granted could still be compromised.)

If it matters to you, you will need to verify all of that for yourself, but I think that all of those details are facts, (at least if I was onetimesecret I wouldn't have published the source unless all those things were true.)

<comment><USER2> [https://github.com/onetimesecret/onetimesecret/blob/8ba0511e...](https://github.com/onetimesecret/onetimesecret/blob/8ba0511e74b64280003691251dd99b04915d42ea/lib/onetime/models/secret.rb#L173-L176)

I really wouldn't trust that KDF.

<comment><USER8> Absolute layman here. Care to elaborate?

<comment><USER2> Sorry, I don't know how to best ELI5 the problem space as well as I probably should.

SHA256(x) is a hash function that transforms some string x (of any length) into a fixed size output.

SHA256(x) is deterministic. Every x maps to one 256-bit output.

SHA256(predictable junk) is going to look random, but will actually be predictable. This becomes security theater.

<comment><USER9> This looks fine to me?

I mean the process of putting secrets in a web site is fraught, but:

a) KDFs in general are deterministic, not sure about your point here.

b) As long as you have sufficient input entropy, using SHA256 to mix some stuff down to key size is fine. You don't need a heavyweight KDF unless your input entropy is really bad.

File an issue if you're really sure, I guess?

<comment><USER2> That's the ticket though: I suspect the entropy _is_ really bad.

This is how encryption_key gets invoked: [https://github.com/onetimesecret/onetimesecret/blob/8ba0511e...](https://github.com/onetimesecret/onetimesecret/blob/8ba0511e74b64280003691251dd99b04915d42ea/lib/onetime/models/secret.rb#L110-L115)

This is where the entropy is sourced from: [https://github.com/onetimesecret/onetimesecret/blob/8ba0511e...](https://github.com/onetimesecret/onetimesecret/blob/8ba0511e74b64280003691251dd99b04915d42ea/lib/onetime/models/secret.rb#L160-L172)

The global secret comes from: [https://github.com/onetimesecret/onetimesecret/blob/8ba0511e...](https://github.com/onetimesecret/onetimesecret/blob/8ba0511e74b64280003691251dd99b04915d42ea/lib/onetime.rb#L53)

self.key comes from gibbler.base(36): [https://github.com/onetimesecret/onetimesecret/blob/8ba0511e...](https://github.com/onetimesecret/onetimesecret/blob/8ba0511e74b64280003691251dd99b04915d42ea/lib/onetime/models/secret.rb#L11)

At no point is anything touching /dev/urandom, which is how cryptography keys should be generated.

(Additionally, HKDF-SHA-256 should be used for splitting a master key into multiple sub-keys.)

I don't know if I want to file an issue for this on Github or not. Usually when the crypto is this bad, there's a lot of cargo-culting and I don't have the emotional bandwidth to deal with a vim-crypt style debate.

<comment><USER9> Yeah I had a look and this is... not great.

I take it all back.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Ryan Huber wrote and open-sourced a single file web app called flashpaper for sharing secrets. Here's a version of it I've deployed - it's public to the internet, anyone can create a secret and share it via a one-time-use link:

[https://flashpaper.logsnitch.com](https://flashpaper.logsnitch.com)

Here's Ryan's code:

[https://github.com/rawdigits/go-flashpaper](https://github.com/rawdigits/go- flashpaper)

<comment><USER11> Flashpaper is great _if_ you have a trusted server and a trusted operator running it. Seriously, don't use a random flashpaper server on the internet if you want to keep your secrets secret.

</comment></comment><comment><USER12> Weird that it wasn't mention yet, but you should NEVER share passwords between people at work.

Employees should have their own user accounts for every service used, managed by some identity provider.

Anything else is hard to audit, hard to (de-)provision, and it's not secure.

\---

This of course doesn't apply for sharing between friends, or with really small businesses, where only a few people share them.

<comment><USER13> I mean you're right but that doesn't describe the reality.

* The AWS root account credentials.

* Redis

* Password protected certs.

* The Ansible vault password.

* The local admin account on your LDAP/AD server.

* IPMI devices that only have a single account.

</comment></comment><comment><USER5> Nobody else on my team wears a tinfoil hat like I do, but I'd be happy with [https://www.passwordstore.org/](https://www.passwordstore.org/) with the data stored on a private git repo that we can all access.

This is what I use for my own passwords and I'm able to sync them across devices, which is nice.

<comment><USER14> I use gopass ([https://github.com/gopasspw/gopass/](https://github.com/gopasspw/gopass/)) which works well, but I don't share with anyone. Always wondered how I might jump that hurdle.

</comment></comment><comment><USER15> I'm building Jam ([https://jam.link/](https://jam.link/)) to tackle this problem. You can think of it as a consumer password manager built specifically for sharing.

It's fully frontend encrypted, so Jam doesn't know what logins you save and it can't read your secret credentials. The cryptography is based on 1Password's design ([https://1password.com/files/1Password-White- Paper.pdf](https://1password.com/files/1Password-White-Paper.pdf)). I'd be happy to share details if people are curious.

Jam's focus on sharing comes through, right now, in the UI and default behavior. For example, when you save a new login, your friends in the system can proactively request access. To visually illustrate that: If I save a new login to Jam (like so [https://i.imgur.com/syM2bep.png](https://i.imgur.com/syM2bep.png)) then my friend gets a notification about that account, can see what it is ([https://i.imgur.com/ZUKwfBB.png](https://i.imgur.com/ZUKwfBB.png)) and can request access ([https://i.imgur.com/3SCcBm5.png](https://i.imgur.com/3SCcBm5.png)).

It's in private beta right now, it's free to use, and I'm looking for as much feedback as possible. I'm happy to add people from HN right away, just email me at john at jam dot link

</comment><comment><USER16> [https://0bin.net](https://0bin.net) is one of the few services that you can use without logging in + has a client-side encryption key in the URL.

Example paste: [https://0bin.net/paste/pfznjakZKHYGZyHS#rSk3vYexHzFn- NPPtfJT...](https://0bin.net/paste/pfznjakZKHYGZyHS#rSk3vYexHzFn- NPPtfJTHuX6hgivFCd6HArsGZebdYo)

<comment><USER17> Someone should tell them that you don't need Flash to implement "Copy to Clipboard" anymore.

<comment><USER16> Go crazy, either email email@example.com or go straight to the source and submit a patch, relevant parts seem to be here: [https://github.com/sametmax/0bin/blob/master/zerobin/static/...](https://github.com/sametmax/0bin/blob/master/zerobin/static/js/behavior.js#L655-L676)

<comment><USER18> Here's a PR aiming for that, for what it's worth. [https://github.com/sametmax/0bin/pull/128](https://github.com/sametmax/0bin/pull/128)

</comment></comment></comment></comment><comment><USER19> I use Signal which was verified on different levels as "secure" according to Kevin Mitnick, so that's good enough for me.

</comment><comment><USER20> I've found that the _simplest_ way to share secrets is through [https://sharelock.io/new](https://sharelock.io/new)

Do not expect complete security-- the apparent ease of use comes with a lot of caveats. Ref: [https://news.ycombinator.com/item?id=9110146](https://news.ycombinator.com/item?id=9110146)

Then there's the excellent _magic-wormhole_ for the more enterprising amongst us: [https://news.ycombinator.com/item?id=14649727](https://news.ycombinator.com/item?id=14649727)

Signal's _disappearing messages_ is probably a better but different alternative to sharelock: [https://signal.org/blog/disappearing- messages/](https://signal.org/blog/disappearing-messages/)

</comment><comment><USER21> I recommend first Keybase[1] if you can convince others to make an account and install on their systems. If you cannot (a common problem in business I've discovered) then PrivateBin[2] is my next preference. Their .info site explains the project and the .net site is a working example you can try[3].

If "Simply" is very important, go with PrivateBin. Keybase is not hard but it's a bit involved to create an account and manage your keys on multiple devices and such.

If you are at work I recommend setting up your own instance of it. I threw together a simple single-node instance of it that runs in a container (Docker) with systemd supervising. It uses nginx as a proxy and has built-in support for Let's Encrypt (because you are using TLS right?). I open sourced the scripts: [https://github.com/FreedomBen/privatebin- setup](https://github.com/FreedomBen/privatebin-setup)

If anybody is wanting to setup their own PrivateBin using those scripts and my images, let me know and I will document it better. I just haven't put in the time because until this moment I didn't know if it would actually be useful to anybody.

[1]: [https://keybase.io](https://keybase.io)

[2]: [https://privatebin.info/](https://privatebin.info/)

[3]: [https://privatebin.net/](https://privatebin.net/)

<comment><USER22> Would love to give your images a try and would appreciate a bit more documentation. Certainly useful! Thank you.

<comment><USER21> Cool, want me to shoot you an email (from your profile) when done? You're also welcome to email me (in my profile) as well.

<comment><USER22> Why not :) Highly appreciated.

</comment></comment></comment></comment><comment><USER23> [https://keybase.io/](https://keybase.io/)

</comment><comment><USER24> Hashicorps Vault has a feature called wrapping, this allows you to share a secret in a way that it can be opened once (with an expiration date as well)

</comment><comment><USER25> Fundamentally, you should not share passwords

1\. If only one person needs a password, they should always create a password themselves. For example, you might hand them a newly provisioned laptop with a temporary password to login. The first thing they should do is change the password.

2\. Multiple people using the same password is bad practice. Whenever possible, each person should receive their own user with their own private password if they need long-term access.

That said, sometimes a shared password is a simple practical solution. You could:

\- Write it down on paper and hand it to them

\- Use a password manager that allows sharing. Several password managers can do this (LastPass, 1Password) but it is a paid feature (inexpensive though at $4/month or less).

\- Host a password manager yourself, such as BitWarden. You will need to ensure it's configured correctly and securely, host it somewhere you control/trust, and maintain it.

\- Use a secure/anonymous (file) sharing service. I couldn't recommend one myself.

\- Use GPG/PGP or similar, to encrypt messages and send them via email.

At my job, we use LastPass with shared folders for certain credentials. At home, I write passwords down to share with my family.

</comment><comment><USER26> I often had to share passwords to services with students so they could work on a project. We all had shared access to a Google Docs area and a wiki, both password protected. So once a student was allowed access to either of these protected spaces I could use them to transfer a password. I'd type the password in some random document, tell the student to go look at that document, they'd email that they had the password and I'd remove it from the document. Getting the students access to the Google Docs or wiki was a simple process, they could request access to the Docs and my boss would vet and grant it, or a sys admin would add access to the wiki for them. So once you establish one relatively secure channel, you can leverage it for other secure purposes. Probably not highly secure, but we weren't protecting nuclear secrets.

</comment><comment><USER27> You can do this in many ways. But you should use End-to-End encryption to guarantee security. For example, you might use a secret conversation that uses End-to-End encryption on some software like Signal, Telegram and Conversations. Or you can use encryption software like gpg (see [https://gnupg.org/](https://gnupg.org/)) with public key encryption methods, to encrypt the password (or any message), and then you can send it using literally anything, like email or so on.

And here is a guide on email encryption ([https://emailselfdefense.fsf.org/en/](https://emailselfdefense.fsf.org/en/)).

</comment><comment><USER28> I think Keybase does a decent job here.

You can invite someone to a team by email, and they need to install the app, pick a username, and follow the join team instructions.

It's probably technically not as easy for a one off situation as onetimesecret.com, but the app download, setup and chat are pretty familiar UI models for many people.

In the long run, it gives you multiple ways of sharing that secret. Encrypt it and stick in the wiki, use an encrypted git repo, exploding messages via team chat, etc.

That being said, a real password manager is the proper tool here. I personally like LastPass, and it does require registration but has "1-to-1" sharing in the free version.

</comment><comment><USER29> Onetimesecret worked well for me. Can also be self hosted.

</comment><comment><USER30> Hey all, we built a tool for slack that integrates with Firefox send (open source) that allows you to send passwords securely through slack!

All you need to do is use a simple slash command

`/secure ...` and you'll be able to securely send images, files, or text through slack.

Check it out here: [https://slack.securesend.quantfive.org/](https://slack.securesend.quantfive.org/)

<comment><USER31> Will check this out, thanks! Was looking exactly for a Slack integration of Firefox Send, but never found anything.

Is it possible to use our own hosted Firefox send? Thanks!

<comment><USER30> Hey Mathie, we just pushed something today where you can set your own Firefox send url (or set it to send.firefox.com)

Just run this command:

/secure -set-url [https://securesend.quantfive.org/](https://securesend.quantfive.org/)

</comment></comment></comment><comment><USER32> I use help spot vault. It seems easy to use for technical and non-technical co-workers, clients and friends/family.

HelpSpot Vault . Encrypted expiring text. Make it easy and secure for customers and coworkers to share information with you.

Encrypted in your browser Encrypted on the server Unique EXPIRING secure link

[https://www.helpspot.com/vault](https://www.helpspot.com/vault)

</comment><comment><USER33> A psafe3 file ([https://www.pwsafe.org/](https://www.pwsafe.org/)) in a git repo.

<comment><USER34> My team has used a KeePassX database in a private git repo. Others use a company-wide install of Thycotic.

For other cases we have a company-wide install of Hashicorp's Vault, which has a secret-wrapping/sharing feature.

</comment></comment><comment><USER35> We have a keepaas file that has the passwords for a number of client resources. The clients don't roll their passwords very often.

</comment><comment><USER36> I send half of the password by email and the other half in a linkedin message for professional contacts outside my org.

</comment><comment><USER37> Like others, I also use keybase.io. By design it is not connected to the phone number, I can prove by myself the identity of the recipient and yes, it has exploding messages. They had a fiasco with unwanted cryptocurrency but now it is mostly forgotten/forgiven.

<comment><USER38> I'm not so sure that their crypto-foray was so easily forgiven and forgotten.

I know that I deleted my account as a result of it, and a couple of days ago there was a lot of noise about it in the discussion of [https://keys.pub](https://keys.pub) site:

[https://news.ycombinator.com/item?id=22995792](https://news.ycombinator.com/item?id=22995792)

</comment></comment><comment><USER39> magic-wormhole was our standard answer to this problem.

</comment><comment><USER40> You can try Passion - [https://github.com/heureka/passIon](https://github.com/heureka/passIon) passion.heu.cz/

Encrypted on client-side, the only thing server receives is the pass. You can check the request.

</comment><comment><USER41> If I'm sending credentials to one person, I'll send the username via one method (text) and the password via another (email). No context for either message (i.e. NOT saying "this is for the Yahoo account) - that is sent and explained in a phone call.

</comment><comment><USER42> An expiring message sent using an open source encrypted messenger (e.g. Signal, Wire, etc.).

</comment><comment><USER43> If you are just wanting to share the secret once (not persistently) this works really well: [https://onetimesecret.com/](https://onetimesecret.com/)

You can use the public version or host yourself.

</comment><comment><USER44> Privnote [https://privnote.com/](https://privnote.com/) is simple and does not require any sign up to create simple one-time links which are self destructive

<comment><USER45> I use this all the time!

</comment></comment><comment><USER46> I use a common account for sharing secrets with my family. The web app I use is Passfindr ([https://passfindr.com](https://passfindr.com)).

</comment><comment><USER47> The reason sharing requires a registration is so it can be end-2-end encrypted. Anything less than that is way easier for hackers to get their hands on.

<comment><USER10> You can have e2e encryption without registration and you can have registration without e2e encryption - they are orthogonal to each other.

</comment></comment><comment><USER48> You don't.

Whatever tool you want people to collectively use, everyone should have their own account to authenticate, there's absolutely no need to share a password ever. It's a lazy insecure solution implemented by people who either can't be bothered to do it the correct way, are too cheap to pay for a multi account subscription and rather compromise their own security or simply unskilled and don't know that everyone can use their own account.

<comment><USER49> > everyone should have their own account to authenticate, there's absolutely > no need to share a password ever. It's a lazy insecure solution implemented > by people who either can't be bothered to do it the correct way, are too > cheap to pay for a multi account subscription and rather compromise their > own security or simply unskilled and don't know that everyone can use their > own account.

We develop iOS applications. We have an organisation developer account with Apple that allows us to give each of our team members their own login, complete with varying permissions levels.

On a fairly regular basis, Apple updates their license agreement. This requires the account owner to read and agree to the new terms before we can make changes to our account. This is the one permission that cannot be delegated. It has to be the account owner and nobody else on the team can do it. Furthermore, that account must be protected with MFA.

We also develop Android apps. We have a similar account on the Play Store. We'd like to connect our API servers to the Google Play developer account so that we can verify receipts for in-app purchases to determine that they are authentic. Doing so requires the account owner to enable this API. No other team member is allowed to do it.

The account owner is on holiday / off sick / hit by a bus. How do we do this?

<comment><USER50> We have an old android phone for Authy MFA and SMS MFA. It lives in a safe and a few people can get access to it.

</comment></comment></comment><comment><USER51> Try SecureAppy. It is a modern vault that simplifies sharing passwords, photos and more with family members or others. It is exactly what you want - free, simple, and secure. It uses end-to-end encryption. Check it out: [https://www.secureappy.com/](https://www.secureappy.com/)

</comment><comment><USER52> Tell them verbally. For secret passwords put it on a sticky note.

</comment><comment><USER53> GPG Encrypt + Slack or Keybase exploding message$

</comment><comment><USER54> the answer changes depending on if you're talking about your Netflix Login or the login to the production work server

</comment><comment><USER55> Gramma's maiden name followed by our street address and the current date</comment>


Computational Power Found in the Arms of Neurons - <AUTHOR> https://www.quantamagazine.org/neural-dendrites-reveal-their-computational-power-20200114/ <comment><USER2> Knowing little about neuroscience outside of biology class, I've always wondered why neurons would be so simple as to just compute weighted sums and thresholds.

I mean there are unicellular creatures that can do incredibly complex things, and neurons, as all cells, are ultimately the descendants of such unicellular organisms, "teamed up" into a multi-cellular creature. They have a lot of internal structure, organelles, whatnot. Modeling them as some simple switches seems a stretch.

My point is, overall this doesn't seem so surprising to me as a layman. (Which doesn't mean more than just literally that. I'm not claiming laypeople should decide scientific questions from their armchairs.)

<comment><USER3> This is an intuition that many neuroscientists have shared, it's just that direct experimental evidence of 1) it happening at all in a non-trivial way and 2) it being relevant to the behavior of an animal is somewhat scarce.

Plus, the sum and threshold model actually gets you pretty far, as evidenced by artificial neural networks, so there might be some resistance to adding complexity that might not be necessary.

Edit: Google "dendritic computation" if you want to dig deeper.

<comment><USER4> Also: spiking neural networks. Doing useful stuff with them has been a work- in-progress so far though.

<comment><USER5> Yeah, spiking neural networks are a tough nut to crack. Check out Nengo if you're interested in learning more

</comment></comment></comment></comment><comment><USER6> For those of you that want to be horrified / amused by code, check out the materials and methods of the article itself. It contains a link to the full source code used to generate the modeling figures:

[https://senselab.med.yale.edu/ModelDB/showmodel.cshtml?model...](https://senselab.med.yale.edu/ModelDB/showmodel.cshtml?model=254217&file=/GidonEtAl2020_fig3andS9/_mod/Traub.mod#tabs-1)

The simulator used is called Neuron. Code for it is written in a custom language called Hoc and models are implemented in yet another domain specific language. Hardcoded parameters galore including whole sections of code that are prefaced with: this has been copied from this other publication.

[https://senselab.med.yale.edu/ModelDB/showmodel.cshtml?model...](https://senselab.med.yale.edu/ModelDB/showmodel.cshtml?model=254217&file=/GidonEtAl2020_fig3andS9/_mod/Traub.mod#tabs-2)

The dendritic tree geometry is specified as hardcoded set of point and branch declarations

[https://senselab.med.yale.edu/ModelDB/showmodel.cshtml?model...](https://senselab.med.yale.edu/ModelDB/showmodel.cshtml?model=254217&file=/GidonEtAl2020_fig3andS9/_morph/171122005.hoc#tabs-2)

(apparently that morphology was reconstructed from imaging data?)

<comment><USER7> Why horrified? A quick scan and it's actually nicely laid out and indented, split into logical sections and commented.

Without wanting to spend a lot of time on it, why is it horrific?

There's nothing intrinsically wrong with hardcoded values as they're biological constants, and nicely identified by the standard convention of using ALL_CAPS_VARIABLES.

Edit: Scanning a bit more, he's probably referring to this file, which is pretty horrific:

[https://github.com/ModelDBRepository/254217/blob/master/_mor...](https://github.com/ModelDBRepository/254217/blob/master/_morph/171122005.hoc)

</comment></comment><comment><USER8> As the saying goes, "if a brain were easy enough to understand, we'd be too stupid to understand it."

</comment><comment><USER9> As someone who studied neurobiology more deeply than most CS people I've been talking into the wind for a long time that neurons are not point objects that can be simply modeled by equations. They are organisms with incredibly complex _behaviors_ and internal gene regulatory structures and other information processing capabilities.

Neural networks are coarse grained models of large scale brain structure. The fact that these models can be taught to do very interesting brain-like things (especially pattern recognition) demonstrates that this structure is important and fundamental, but that doesn't mean it's the whole picture of what's going on in the brain.

I say talking into the wind because in my experience most CS people tend to hand-wave away biology at the cellular level and below. There's this zealotry around us being "almost there" with AGI and the rest that blinds people to the real magnitude of the problem and how much is really happening in the brain. This likely includes a whole lot that we haven't even started to really understand.

<comment><USER10> Amen.

</comment></comment><comment><USER11> > It may also prompt some computer scientists to reappraise strategies for > artificial neural networks, which have traditionally been built based on a > view of neurons as simple, unintelligent switches.

It has been suggested that neural networks have diverged from biological principles to the point where biological research does not provide any useful improvement to current machine learning techniques. Back propagation of errors was a major advancement in the 1970s, and it was developed purely based on mathematical principles like statistics, differential equations, and calculus. As far as I have read, error back propagation is not how biological NNs learn, and it seems to be a much more efficient strategy. Biology seems much more brute force in comparison.

<comment><USER12> _> Biology seems much more brute force in comparison._

A singly honeybee with its billion synapses can adapt to a variety of situations and environments, learn on-the-fly, perform complex sequences of tasks, cooperate and communicate with other bees. All of these capabilities are emergent and packed in its tiny head.

State of the art artificial neural networks (ranging beyond billions of parameters now) only do the thing they're specifically built for, only after training with bazillion specific examples and consume tons of energy while doing so.

Which one of these sounds like the brute force approach?

<comment><USER11> The majority of behavior in organisms like bees is instinctual, not learned in their lifetime. That training required millions of billions of trials over the course of hundreds of millions of years.

<comment><USER12> _> The majority of behavior in organisms like bees is instinctual, not learned in their lifetime._

It doesn't matter whether their behavior is considered "instinctual". What matters is that they can quickly adapt their behavior to entirely novel scenarios:

[https://science.sciencemag.org/content/355/6327/833](https://science.sciencemag.org/content/355/6327/833)

</comment></comment></comment></comment><comment><USER13> "Brains may be far more complicated than we think," as said by anyone who has worked with brains! Good stuff though, very interesting :)

<comment><USER14> As said by a brain studying brains

<comment><USER13> Don't get me started, if a complex brain can finally understand the brain, does that not mean we will still be missing the special sauce that was the cause of the complex comprehension, er, I'm out!

<comment><USER14> This is why in some philosophies, there is a big difference between experiential knowledge and awareness and empirical 'measurement' knowledge.

</comment></comment></comment></comment><comment><USER15> Ah, it's spiking edges as opposed to spiking node activations. I like this because it applies to 1 of many connections uniquely, rather than dividing the entire graph by spiking neurons. Exponentially more edges than nodes in a dense net. Connections are always more important than entities.

```The dendrites generated local spikes, had their own nonlinear input-output curves and had their own activation thresholds, distinct from those of the neuron as a whole```

How would this work in practice? Apply activations to multiplication values of the weight, or just don't perform the multiplication if the activation of the node is low?

<comment><USER16> Change the simulation unit from neurons to dendrites. Miss different kinds of gate and nonlinear activations.

Which is what's being done lately, but then we know next to nothing about the topology of real neural nets nor electrochemical communication inside a neuron.

</comment></comment><comment><USER17> I wonder if this is also the case for neurons in other animals. Probably it is, but it would be a stunning revelation if it is not the case.

<comment><USER18> From the top reddit comment:

> This paper is amazing. What is missing from the description above is that > this is the first example of how human neurons are qualitatively different > than rodent neurons (not only more computation power, but categorically > different computation).

> ELI5: the way the biological human neuron implements XOR is by a formerly > unknown type of local response to inputs, which is low below the threshold, > maximal at the threshold and decreases as the input intensifies above the > threshold. We never saw anything like that in any other animal. (link to the > relevant figure from the paper)

Rodents being presumably the go-to non-human object of study.

<comment><USER19> Could you link the Reddit comment please?

<comment><USER18> Oh. The link was changed on HN.

Here is the reddit comment: [https://www.reddit.com/r/MachineLearning/comments/ejbwvb/r_s...](https://www.reddit.com/r/MachineLearning/comments/ejbwvb/r_single_biological_neuron_can_compute_xor/fcx1ocb/)

</comment></comment></comment></comment><comment><USER20> OT, but "They obtained slices of brain tissue from layers 2 and 3 of the human cortex" has a slightly uncomfortable air to it.

<comment><USER21> [https://www.youtube.com/watch?v=Zj3RxtJ_Ljc](https://www.youtube.com/watch?v=Zj3RxtJ_Ljc)

</comment></comment><comment><USER22> The neurons in the Creatures video games come to mind.

      In Creatures Evolution Engine games such as Creatures 3, each neuron and dendrite is a fully functional register machine.

[https://creatures.wiki/Brain#SVRules](https://creatures.wiki/Brain#SVRules)

</comment><comment><USER23> I have written a short, clear, and dense book about this exact subject. It's free! Read it here:

[http://www.corticalcircuitry.com/](http://www.corticalcircuitry.com/)

<comment><USER23> A preprint that came out after I released the book that I would have mentioned:

[https://www.biorxiv.org/content/10.1101/613141v1.full](https://www.biorxiv.org/content/10.1101/613141v1.full)

They model a single cortical neuron as a deep neural network with 7 hidden layers consisting of 128 hidden units each.

Biological neurons are A LOT more powerful than "neurons" in neural networks. If you hear a claim about computer-brain parity being close - the people making it almost certainly don't understand the power of cortical neurons.

</comment></comment><comment><USER24> Question for ML people: would backpropagation work if some of the neurons had nonmonotonic activation functions (for example exp(-x²)), or would the gradient descent get stuck on one side or the other?

<comment><USER25> Gradient descent should have no issues with a function like exp(-x^2). Actually, softmax (softmax(x_i) = exp(x_i)/sum_j(exp(x_j))) is sometimes used as an activation function. It could make sense to modify the softmax function to use -x^2 in place of x, for some use case. However, it doesn't always make sense as a drop-in replacement for other activation functions like ReLu or Sigmoid. It really depends on your use case.

</comment></comment><comment><USER26> Anybody know where these super neurons are supposed to be located in the brain ? Are they exclusively located in the Neo Cortex ?

<comment><USER27> neocortex, from the anterior temporal lobes of epileptic patients . This kind of dendritic response has not been found the dendrites of other mammals so far. it's not a new type of neuron

</comment></comment><comment><USER28> So does this point to us being biological machines? Is it already accepted that we are biological machines?

<comment><USER29> You'll have to be more specific with what you mean by "machines". In what ways would machines be different from non-machines?

<comment><USER28> That's a good question.

I guess I'd say a Turing machine is my definition of a machine.

And I suppose the implication is that if we are machines, operating on a stream of input, does that make us deterministic?

EDIT: What I'm ultimately interested in is if we, as humans, are operating in a realm that logic cannot operate in. If that makes any sense? I'll probably have to define realm!

<comment><USER30> You could argue that "man-made machines", "biological machines" (all of life, animal, vegetal and fungus) and "simple matter machines" (like stars are engines or telluric planets are combustion heaters), even the "surface natural ecosystem of Earth", are all different _material implementations_ of machines: organized systems. Carbon-based, copper-based, hydrogen-based... you might map the whole periodic table of elements minus the rare column perhaps.

Ultimately you'd find a common unicity — like electrical charges, strong/weak force, arrangements of "gates" and "structure" etc. — but used in different ways (for instance iirc charged clouds of gas in space don't form new stars because gravity at close range is weaker than the charge that repels them, only strong enough at larger distances to hold them together; that's dramatically different from the use of charges in biological cells).

The cosmos itself is but a big machine. Who's to say we (I mean the whole planet, maybe star system, maybe galaxy itself) aren't actually just a single "cell" of the cosmos? That we are part of a much bigger machine, that we are like those processing units on dendrites in the article, if the universe is a big brain of sorts?[1]

These are all _types_ of machines (X. process of information; Y. engines to convert energy; Z. structures that "restrict" "flow" like gates, transistors, cell membranes, dendrites; N...), which apparently may be expressed, materially implemented in different ways.

To take your question about logic.

If you mean the universal logic exposed above, I don't think so personally — merely because there's no evidence for it whatsoever, no observation; and there's also no need if we accept that from such "machinery" complexity may emerge complex systems (e.g. humans).

If you mean logic from _within_ the human mind — and this begs the question of whether maths and physics are "invented" or "discovered" in the background — then we must assume a subjective answer, at best an aggregate of "non- disproved facts" that we can all agree on within normalcy (edge cases helping us understand said average norm).

"Logic" is but one of several operating modes. Are we more than that? Most certainly yes. That's the experience of all of us. Because perception is so centered on thought, we tend to overappreciate the importance of thinking in our lives, in our behaviors and even values; but the relative picture gradually revealed by biology and psychology and sociology and economics etc. is that we are _mostly irrational_ , _mostly automatic_ (trained habits, patterns recognition, educated intuition, etc), and actually very little in the way of "logical behaviors units".

I'll let you ponder the discrepancy from an absolutely (perhaps) low-level logical machine to the possibility of a chaotic non-logical emergent high- level behavior. What it means for life, for AI, and possibly much bigger or smaller things we consider "inert", for now.

[1]: I mean, look at the larger structures of the universe, tell me it doesn't look like a sample from a biological tissue... [http://cosmology.com/GalacticWalls.html](http://cosmology.com/GalacticWalls.html) (figure 6: [http://cosmology.com/images/darkmatterdistribution.jpg](http://cosmology.com/images/darkmatterdistribution.jpg))

<comment><USER28> > Because perception is so centered on thought, we tend to overappreciate the > importance of thinking in our lives, in our behaviors and even values

Very true. Thought can become our master easily. As a programmer, I often find myself struggling to get out of 'logic' mode or 'thinking' mode.

> I'll let you ponder the discrepancy from an absolutely (perhaps) low-level > logical machine to the possibility of a chaotic non-logical emergent high- > level behavior. What it means for life, for AI, and possibly much bigger or > smaller things we consider "inert", for now.

Wonderfully put! I think the ideas of emergent behaviours are a saving grace for the incessant desire of ours to reduce everything to its atomic (in the sense of an atomic operation, not an atom) components. The emergent behaviours, _can 't_ be predicted. They can't be algorithmized. Becuase to build algorithms one must go down to those atomic operations.

My wider concern is that we are currently obsessed with analytical thought and philosophy and that the continental philosophy has become a 2nd class citizen. I think this has happened becuase analytical thought lends itself to being algorithmized, whereas continental philosophy does not.

Sorry, that was a bit of a tangent!

Yes! Love the pictures! I have had the same thought/feeling when I first saw them too!

<comment><USER30> > I think the ideas of emergent behaviours are a saving grace for the > incessant desire of ours to reduce everything to its atomic (in the sense of > an atomic operation, not an atom) components.

Very well said! Humans think a lot in terms of dichotomies (here the micro/macro, or whichever scale you want to consider), but I've heard biologists and physicists explaining that the closest to fundamental functions is closer to _e_ (natural log), _sinus_ (and hyperbolic stuff), the notion of "binary polarity" is very specific and quite limited — look at the Standard Model, it's clearly more complicated.

I personally think that's how the dimension of time emerges in our perception (any perfect observer): periodicity in all phenomena (but with e.g. Fourier it gets extremely complex at emergent thresholds), the arrow of time (non- periodicity is basically high entropy, 'heat death'/homogeneity).

Cue any such human-driven dichotomy (I think this one is relatively easy: the deepest processing system is probably close to "emotions", and these at the lowest level work in terms of "rather good" and "rather bad" (different sub- regions of the brain) + some "general integration" (third region). And what do you know, we tend to be heavily polarized in general, it's like most people feel reassured (familiarity) when things are explained in terms of black and white, left and right, ones and zeros.

(Just my thoughts on it.)

> My wider concern is that we are currently obsessed with analytical thought > and philosophy and that the continental philosophy has become a 2nd class > citizen. I think this has happened becuase analytical thought lends itself > to being algorithmized, whereas continental philosophy does not.

Strongly agreed. I think we're witnessing a kind of "revival" through many fields (some spiritual, some historical). Things are moving. I think dumb things like numbers also influence people, it's been ~20 years since the turn of the millenium and that's enough for 1 generation to weigh in and the others to accept change because "oh new era, obviously, new number!" — this plays at the subconscious level of very crude processing, me thinks.

Nice tangent, hopefully not too hyperbolic. ;-)

</comment></comment></comment></comment></comment></comment><comment><USER31> I remember reading this before, in a comment somewhere here on HN</comment>


Ask HN: Best tool to write book to publish on Amazon/apple/eBook and print/POD - <AUTHOR> So i am writing a technical book. And i want to get it out to the most places i can. I would like to publish it online as an ebook and print using a Print on demand service.
I have been going through so many posts on HN and other places, but i can't get a easy answer.
The problem i am seeing is, if i use one tool. It will create a good ebook, but wont be good for a POD service, or amazon.
Can anyone recommend a single app for OSX that I can use that will output the final book for EPUB/PDF/MOBI and then can also be used for a Print on demand service. Or if no single tool, maybe a easy process from a single point of writing/editing?
I was playing around with the OSX iBooks Author app which i like, but i am not sure how good that will be with a service to POD and amazon. <comment><USER2> Disclaimer: I am the author of Helpinator - a single-source technical writing tool. It is for Windows, but some of my customers successfully use it on Mac via Parallels. It has EPUB/MOBI/PDF support.

I recently added LeanPub support too, so now you can publish the same project on LeanPub too. Here's the blog post about it: [https://www.helpinator.com/blog/2019/08/23/leanpub- tutorial-...](https://www.helpinator.com/blog/2019/08/23/leanpub-tutorial- publishing-your-book-using-helpinator/)

There's also a post by Davide Barranca depicting his experience on getting LeanPub book published paperback with LuLu: [https://www.davidebarranca.com/2019/04/printing-leanpub- book...](https://www.davidebarranca.com/2019/04/printing-leanpub-books-on- lulu/)

</comment><comment><AUTHOR> Indesign ended up being the best, and using ingramspark

</comment><comment><USER3> LeanPub or SoftCover should do more or less what you're looking for.

</comment><comment><USER4> LeanPub +1</comment>