SEC Plans to Temporarily Ban Short-Selling - <AUTHOR> http://online.wsj.com/article/SB122178234612954617.html <comment><USER2> This is the biggest WTF moment. Ever.

Without the ability to short sell, the market can't even function effectively.

Convertible/Risk arbitrage people cannot do their job wihout short selling. The risk-free spread is there for the taking, but you can't take it.

Options market makers cannot hedge their PUT writes without short selling.

This is what I envision:

We'll see a massive short covering rally caused by a dry up in volumes by next week.

Option traders will stop trading as they cannot properly hedge their postions, as will all risk arbitrage, debenture, derivative and ETF traders. Traders of all financial products will not trade if they cannot hedge their positions.

Liquidity will dry up and volatility will increase drastically, which is exactly what the SEC wants to avoid.

The USA has decided to follow their Russian and Pakistani comrades in artificially controlling the market.

It's over fellas.

We've killed the banks. Now we'll kill the hedge funds and the options houses.

<comment><USER3> Are you an economist? How informed is this conjecture? Would you guess more or less than the people who made the decision?

<comment><USER2> I'm totally serious. You can ask anyone who knows about the market and get their candid opinions.

I don't know how long they're going to effect this ban but to give you a preview of what banning short sell can do, just take a look at the China stock market. The chart is like the Eiffel tower.

The shorts make the market effective as they provide a floor at a bottom where no one else may be willing to buy.

I'm all for a permanent ban on naked short sells but to have an outright ban of all short sells is plain stupid.

<comment><USER3> It's not that I disagree with you, I really don't have enough knowledge to decide. I haven't the slightest clue how long they want to prevent short selling for (I think the article got cut off since I don't subscribe) or what sort of effect that short term action might have.

I was just wondering how you came to the decision that it's stupid. It seems you'd need a lot of knowledge to be reasonably sure of that, given that other people with a lot of knowledge made the decision.

<comment><USER2> I would argue that this was a political driven decision rather than an economical one.

<comment><USER3> How so?

<comment><USER2> It's too much of a coincidence that this move is effected a few days after McCain publicly chastised SEC Chairman Chris Cox and said he would fire him if he were president.

<comment><USER3> Has McCain spoken out in favor of something like this? This would seem to be pretty out of line with typical Republican doctrine. I don't see this as being an attempt to save his job, it's clearly not going to happen if McCain is elected.

<comment><USER4> McCain is often pretty out of line with typical Republican doctrine. I'm not sure the ban is specifically a McCain thing, but it does seem very political. Far fewer people complained about rich Wall Street fat cats when those fat cats got rich by making mortgages cheap; now that a few of them have gotten rich by betting that mortgages would be priced rationally again, folks are upset.

<comment><USER3> It goes a lot deeper than that. Short selling is actually ruining the ability of financial institutions that aren't even exposed to the mortgage problems (or are minimally so) to get the inflow of credit they need. Or so the argument goes.

Again, I'm not an economist, so I don't have a strong opinion here. What I do know is that people who know a hell of a lot more than me (or probably anyone who posts here) are making these decisions, so dismissing them based on some generalized knowledge (i.e. short selling is bad because my econ 101 textbook said so) seems childish.

That's why I was asking the original commenter if, perhaps, he knew enough about economics to have an informed opinion. For all I know, he has a PhD in it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> DMV announces Friday that you are no longer allowed to turn left. You are only allowed to turn right as of tomorrow

<comment><USER6> Welcome to Boston.

<comment><USER7> And Michigan

</comment></comment></comment><comment><USER8> wtf? Do they even have the power to do this? What are they going to do, exactly? Stop all margin trades?

Also banned in the UK. <http://online.wsj.com/article/SB122177732212354285.html>

<comment><USER9> It's about shutting up the short sellers, not short selling in and of itself. People with big short stakes have been the ones going through the books and screaming on conference calls and to the media that various companies are toxic. Smart people have made billions in recent months. The government wants to shut them up so it has more time to triage.

<comment><USER2> But if what those big mouths like Einhorn/Eckman say is true (which it is), wouldn' that be to the benefit of the shareholders? These big mouths have alerted the shareholders of the innate problems in MBI and Lehman months before they capitulate.

Those crashes you've seen lately, I would argue, are the works of an efficient market. Isn't it prescient that the market drove down the price of AIG to near the fair value after the bailout ($2-5), well before it was actually bailed out?

</comment></comment></comment><comment><USER10> I don't understand enough about the stock market to comprehend the possible unintended consequences, but trying to interfere in the free market can result in things like the 70s fuel crisis.

I'm not sure where we are on the "people never learn / we're screwed enough to need this" continuum, but I definitely don't get warm fuzzies from this. :/

</comment><comment><USER11> I don't see how they can legally do this. If I borrow some shares from my friend, and sell them (which is what shorting is) - what exactly are they supposed to do?

Prevent me from borrowing shares? Prevent selling shares?

It's between me and my friend about returning the shares to him later.

The only thing I can see is preventing naked shorts - i.e. sell the shares without borrowing them first, and promise to make good on it later.

But covered shorting? Unless you repeal capitalism, I just don't see how it's legal. Or even possible - I could make a website where people can borrow shares for a small fee. What could they do about it?

Can they make a law making it illegal to loan someone shares?

</comment><comment><USER2> Here's a nice picture on how effective banning short selling is in curbing the market slide, courtesy of our friends from Pakistan.

<http://i33.tinypic.com/xlzfjo.jpg>

</comment><comment><USER12> I'm completely against it, but there is a theory that it was a stop-gap to what is being called a "financial" terrorist attack.

Most of the short sales put on this month were from overseas, mainly coming out of London and Dubai. It's still a longshot conspiracy theory.

Even so, the broker/dealers and the SEC have been far too complicit in naked short selling. The rules against this have been in place for years, just never enforced.

Sources: <http://bigpicture.typepad.com/>

</comment><comment><USER13> I had a premonition really bad things would happen (not that it took a genius), but this really caught me by surprise.

</comment><comment><USER14> I'll echo the posts claiming that a short-sell ban is a recipe for disaster. Short selling isn't _just_ a way of betting on the market declining. It's also a hedging strategy used by arbitrageurs, market makers, and options traders.

Actually, as far as speculative short-selling goes, one can argue that it doesn't do _enough_ in bringing prices to fair values. Here's why. With most stocks, it's possible to sell them short and make near-fair interest on the cash. For example, your clearing firm might charge you 3.8% on money borrowed for long positions, but give you 3.4% on cash held in short positions-- a 40bp spread, which is costly but not a show-stopper for a skilled trader. Although you can't withdraw the money without closing the position, because you have more cash than equity, you're earning interest on the cash component. In cases where a stock becomes hard to borrow, banks will lower the interest rate on cash held, sometimes to negative values. When this happens, the stock inevitably trades _higher_ than a fair market value, because of the penalty involved in short-selling it.

Another danger of short-selling, related to the hard-to-borrow factor, is that clearing firms (banks) can force short-sellers to close out their positions at any time. They're intrinsically limited in how much short interest their customers may hold, and will, on occasion, force less preferred customers to close out, possibly unfavorably, in order to allow preferred customers to short-sell.

In addition to "hard to borrow" securities and short squeezes, speculative short-selling is generally very dangerous, _especially_ in a bubble, for more intrinsic reasons. If you're short a stock, and it goes up in the short term, you must put more money in the account (to build equity to a reasonable level) or close the position, early and unfavorably. There are a large number of people who bankrupted themselves by shorting Nasdaq futures at 3000 in 1999. They thought tech stocks were overvalued, and _they were right_ , but they nonetheless were creamed when the thing shot up to 5000 before coming back down.

Arbitrageurs and market makers are _good_ for markets. They provide a lot of liquidity, meaning that bid-ask spreads tighten and it becomes possible to buy or sell large blocks without moving the market to an unfavorable price. Essentially banning what they do is going to result in complete disaster.

<comment><USER15> _If you're short a stock, and it goes up in the short term, you must put more money in the account (to build equity to a reasonable level) or close the position_

No. One might simply add to his position (e.g. short more). It is called "shorting into the rise".

<comment><USER14> What I meant, and I failed to explain this properly, was that the amount of equity you need to have in the account increases as the stock or index rises, and eventually it can happen that the position requires more money than you have, and you're hit with a margin call. You're correct that if you already have enough money in the account to hold the position, you can continue to short sell.</comment></comment></comment>


Google drive is down - <AUTHOR> http://drive.google.com/

<comment><USER2> It was also down for me but came up again. It's been long since I have experience my last Google outage, very curious what happened with this Service. Does anybody know?

<comment><AUTHOR> For me it is forever down :( I get a 502 error. I don't know what happened. Any suggestions? (hacker attack? ;) )

<comment><USER2> It has been down for others too: [https://twitter.com/hashtag/GoogleDrive?src=hash](https://twitter.com/hashtag/GoogleDrive?src=hash)</comment></comment></comment>


Batteries not included - <AUTHOR> http://www.nytimes.com/2009/04/19/magazine/19car-t.html?pagewanted=1

<comment><USER2> The lithium ion batteries need more work. Top Gear on BBC America was testing the new Tesla, and the think completely sucked!

I think the new hydrogen powered Honda holds a lot of promise, and so does the air car!</comment>


What Germans Are Reading - <AUTHOR> https://www.the-american-interest.com/2019/08/03/what-germans-are-reading/ <comment><USER2> My German is rusty but:

> Toleranz: Einfach Schwer (Tolerance Isn't Easy)

is an improper translation. That's "Tolerance: Simply Difficult" and that translates fine in English too since you can keep the same style while being accurate.

<comment><USER3> I might translate it:

Tolerance: Simply Hard

(Or _Easily Hard_ )

It more closely mirrors the German cadence and I've generally translated _schwer_ as _hard._ I always understood _diffizil_ to be the correct translation of the word _difficult._

Granted, I learned most of my German from my mother (plus a little self study and I lived there for nearly four years in my twenties), not in school. There are no doubt substantial gaps in my knowledge

<comment><USER4> > I always understood diffizil to be the correct translation of the word > difficult.

I think that's misleading or even wrong. Source: native speaker.

First, it's a very rare word that would definitely stand out, even in an already formal conversation. More importantly, "diffizil" is mostly reserved for problems that require a lot of fine motor skills or finesse. It would be wrong to say that lifting some large boulder is "diffizil", for example, except as a joke. You might use it for repairing a watch or a complicated negotiation ("eine diffizile Angelegenheit"), however.

<comment><USER5> Ha, I had thought that _diffizil_ resembled _filigran_ in meaning, but wasn't sure that weren't just me. I reasoned that _diffizil_ would be a diffizil word, by the sound of it, used by (to take your example) watch makers dealing with delicate problems.

</comment></comment></comment></comment><comment><USER6> As far as I know the Spiegel list, which has a lot of media and book shop presence does _not_ count Amazon. The GfK in German has an exklusive deal with Amazon for data, and they do not deliver the Spiegel list data. The Spiegel list also uses an additional voting scheme among their journalists.

I have found the Spiegel list a bit weird for years, it contains a lot of highly light reading or polemic stuff like that guy yelling at today's youth. That it does not include Amazon data explains quite something.

<comment><USER7> Also the Spiegel list removes books it doesn't like.

[https://www.welt.de/kultur/article167043384/Spiegel- verteidi...](https://www.welt.de/kultur/article167043384/Spiegel-verteidigt- Streichung-von-Finis-Germania.html)

<comment><USER8> Please be accurate. Correct would be: They removed a book they consider anti- semitic. That is quite different from what you stated.

But great to include the source.

<comment><USER9> Funny enough the owner of Der Spiegel was himself considered an anti-semite by the Wiesenthal Center[1] a few years ago which stirred quite some debate back then.

[1] [https://m.jpost.com/International/Wiesenthal-dean-labels- Aug...](https://m.jpost.com/International/Wiesenthal-dean-labels-Augstein- anti-Semite)

<comment><USER10> He isn't (and never was) the owner of Spiegel. He's the son of the Spiegel's founder and former editor in chief.

</comment></comment></comment></comment></comment><comment><USER2> Besides the obvious sampling issue (The Spiegel as a reference), not sure there anything interesting in that list, because it's a reflection of:

\- What is published in the German language (much smaller than in the English corpus)

\- What is published at all (choices from local publishers)

\- What matches the political/media agenda of the day/year: people are well known to read about the topics that is being talked about thru the numerous media channels they consume.

What is published and what sells is not always a reflection of the actual interests of the population at large - an easy proof is to show that it changes drastically from one year to another, akin to fashion more than anything else.

<comment><USER11> I am not sure what your comment is suggesting? Literally the third sentence is:

> Editor's Note: This is the first in a series looking at the books, authors, > and ideas capturing the zeitgeist in various countries this summer.

Isn't capturing the zeitgeist exactly trying to understand what's occupying the thoughts of a country? Also I think you're greatly exaggerating the speed of "fashion". These are all issues we have been talking about for a long, long time. From tolerance [1] to education [2]. I don't see at all how this arcticle talks about a irrelevant topics, I can assure you these are all isssues we have been discussing for a longer time now.

[1] since the refugee crisis it's one of the main themes of political discourse. We also experience a rise of the right and far-right and many are not sure how to react to this change of the policial landscape and where tolerance ends. I was quite active in politics 4 years ago and I remember it being important back then (which was even before the refugee crisis) because I had contact with a group organizing a counter demonstration to a far-right gathering.

[2] During my time in school i was in one of the first in a new system and when I finished (5 years ago) many switched back to the old system. Our pisa- scores are still a major point for public dicsussion.

<comment><USER12> > since the refugee crisis it's one of the main themes of political discourse.

That's very recent, so it may be fashion, who knows whether tolerance & diversity will still be a major topic in 2025.

From my personal experience, education is a big topic, but mostly top-down. It's in politics, it's in the media, it's in literature, but it's not like average parents discuss the education system a lot. They're involved with details, but I've never witnessed a discussion at dinner or a party about the education system (while it'll quickly go to politics, economics etc, and most of my friends have children of school age).

<comment><USER11> I am 24 years old. Maybe we have a vastly different notion of recent, but merkels decision was 2015, which is nearly 4 years ago.

Maybe it's really a matter of definition or "recent" and "fashion", but I am not sure whether tolerance & diversity will still be a major topic in 2025. I hope not, 2025 is in 6 years and would like to see that we have moved on and got to a mutual agreement in our society.

2025 would be 10 years after the migrant crisis! I don't think we absolutly need to drag every topic out for whole generations to be not counted as "fashion" or "temporary".

> From my personal experience, education is a big topic, but mostly top-down. > It's in politics, it's in the media, it's in literature, but it's not like > average parents discuss the education system a lot. They're involved with > details, but I've never witnessed a discussion at dinner or a party about > the education system (while it'll quickly go to politics, economics etc, and > most of my friends have children of school age).

I don't know if you're german? This is not what I experienced, like i said, i experienced two changes of the school system during my education, which lead to a lot of discussion. Also, while i am now out of school and in university for some time, the school system is still a topic of discussion in my extended family due to parents having to choose in which school their kids they should go. We have some private schools in germany that follows a different philosophy (and I really mean philosophy, there's a whole educational theory behind them), the "Montessori education". A part of my family is very convinced that the montessori philosophy is superior to the more rigid and less free philosophy in the public school system. This is not my point of view (I went to a public school), which I am willing to defend. This leads to real discussions over dinner or in the evening.

</comment></comment></comment></comment><comment><USER13> There are books and there are objects to back up your established beliefs in exchange for some cash without exposing you to any self-critical thoughts.

Of course that is a long etablished genre, but lately it gets a bit too obvious regarding any socio-political sentiment, relationship, diet or parenting style[1].

Germany's book and magazine market is also drifting into that category a lot, as basic information gathering shits more and more towards "free" online sources.

[1] as stated in the OP, Winterhoff is contrarian to most current research and just peddles his own theories for some decades now, as well as being a well booked pundit in talk shows.

</comment><comment><USER14> More curious about the topic.

Is there some particular reason to be interested in what Germans are reading? As opposed to say Swedes?

<comment><USER15> Germany's infrastructure has been stressed in recent years by immigration and other factors. The two books that the article places a spotlight on are: 1) "The Dumbing Down of Germany" and 2) "Tolerance Isn't Easy" (as roughly translated within the article). These books represent the german people's response to that.

The first book, "The Dumbing Down of Germany", suggests a frustration with the decline of their education system -- something that Germany has traditionally valued highly. This is particularly concerning because sentiments like this lead to the rise of Hitler and eventually WWII.

The second book, "Tolerance Isn't Easy", offers comfort with the influx of immigrants. This may be viewed as an attempt to stymie the tension. Alternatively, this may be viewed as an anesthetic that is wearing off. As of checking today this title is actually 13th on the list.

To answer your question. Why Germans as opposed to someone else? I suppose it is partially because Germany is a big player in the EU. It is particularly concerning because of Germany's role in WWII. To some it seems like things are trending in the same direction. As stated in the last paragraph: "Germany has been undergoing dramatic social change since the fall of the Berlin Wall, which occurred 30 years ago this November... Fear-mongering arguments against immigration and an Islamic takeover continue to attract scores of German citizens whose future economic prospects are less than rosy. Regardless, one cannot help but detect the political vestiges of an old GDR intolerance in its novel political manifestations."

<comment><USER14> Well I speak German and nationality wise am too. But I grew up in a decidedly English speaking context.

Hence my interest in hn's focus on Germans. It's not so much what's happening in germany more than why would western english media analyse german reading trends.

That is _not_ a question of what's happening in germany...but rather one of english speaking media somehow deemed this interesting. Why?

</comment></comment></comment><comment><USER2> > Since then, the entire eastern half of the country has been brought into the > fold of Western liberal capitalism—but not entirely successfully. > Unemployment is still higher in the east, and brain drain to the west > remains common.

Not sure how to understand this. I have traveled to the DDR and to East Germany after the reunification many times, and by far and large life is much better than it ever was. People can actually buy cars instead of Trabants. Of course an economic gap has long lasting consequences (the long tail of economic policies) but what you should point out is how much better it is now than it was during the DDR era.

<comment><USER16> Successful industries and top universities are in majority in the Western side of the country, thus people looking for higher salaries or more job opportunities leave the Eastern side. Over time that results in important disparities.

I don't believe that the article is saying that the situation was better during DDR time.

<comment><USER2> My point is simply that this kind of adjustment is likely to take a century or even more. Look at the long lasting impact of economic disparities in the US between the South and the North as another example.

Also, we would need to check in the economic History of Germany if the Eastern Lander of Germany were not always poorer compared to the Western Lander. The large economic output of the Rhur should already have tipped the economic scale way before the DDR.

<comment><USER17> There's also the fact that the Berlin split forced a whole lot of rather successful German companies to relocate from East to somewhere else in the West.

Siemens was originally started and HQ'ed in Berlin, until the wall split happened, making them relocate to the south.

Afaik this is the case for a couple of other rather successfull Western German companies.

</comment></comment></comment></comment><comment><USER18> There has been at least one book about how "Germany/Germans are getting dumber", "The Big Crash is Coming" or something similar on the Spiegel Bestseller list at all times. So far, the big crash didn't come yet. These books don't talk about a market correction or a financial crisis like in 2008, but a total economic crash, because "a finite world can't have unlimited growth", because "capitalism", because "climate change".

People don't feel rich. In many families, both partners have a job. Median incomes didn't increase much in the last 10-15 years. With an after-tax monthly income of 5,160€ as a family (or 3,440€ as a single), you belong to the top 10% [1] (translates to roughly 100,000€ / 70,000€ pre-tax anually). The median monthly net income is 1,869€ (roughly around 35,000€ pre-tax anually).

At the same time, people are highly suspicious of the stock market. People have less time for their kids, which spend more time in the educational system. So people wonder if the educational system is really that great for their kids.

I think this is interesting. It's like a vicious cycle: According to [2], 23% of Germans own stocks (although I remember that this number used to be around 15% a few years ago). So, people read books about how everything is going to crash down soon, because they're suspicious of the stock market (and to be able to say "told you so" afterwards). At the same time, these books reinforce the idea that owning stocks is risky.

Most people would rather buy a home, but houses got very expensive in cities in the last 10 years. In major cities, a house for a family of 4 would cost around 800,000€ and more, which is quite expensive for the low salaries of 90% of the people.

Then, major newspapers now have articles about the climate crisis every day. There's the uncertainty of the Brexit. There is uncertainty about immigrants, but also uncertainty and fear of the rise of right-wing parties in Europe (and the AfD in Germany).

So, we have books about how "the system" is shit, how "the crash is coming", how "Germany gets dumber all the time", how "something needs to change". Add some fears about the before-mentioned topics and there's your new book every few months, same content, different cover.

[1]: [https://www.zeit.de/wirtschaft/2019-08/institut-der- deutsche...](https://www.zeit.de/wirtschaft/2019-08/institut-der-deutschen- wirtschaft-einkommen-singlehaushalt-gehalt)

[2]: [https://www.zeit.de/wirtschaft/2019-08/geldanlage-sparen- ver...](https://www.zeit.de/wirtschaft/2019-08/geldanlage-sparen-verbraucher- zinsen-bankenverband)

<comment><USER19> I read somewhere that the German billionaire class controls 1T dollars. Why do people earn only 5k after tax ? There seem to be very little opportunities for investment in stock market. Real estate prices too seem insane.

<comment><USER20> Real estate prices are insane probably partly due to ECB negative interest rates which make buying on credit very attractive. I read an article on HN last week about zero interest 20y loans in Denmark. The DKK is pegged to the Euro.

[https://news.ycombinator.com/item?id=20647651](https://news.ycombinator.com/item?id=20647651)

Add to that all time lows (zero and below) for German bond yields which has bleak consequences for long time savers (future pensioners). Germany is a nation of savers.

Swiss 10y bonds are at -1%.

We are living in interesting times.

<comment><USER19> So what's a good strategy here ? Buy stuff on credit but sell to who ?

<comment><USER20> Dunno, but normally it's not a great idea to buy real estate when prices are insane and property taxes are high. Also if you buy on credit the asset is the creditor's until you pay it off, so you can't sell.

<comment><USER21> Not in the case of real estate. There you might have to repay the outstanding debt immediately including any losses of the bank. Unless you manage to sell the financing along the real estate. For private persons, investors and developers are different I think in terms of credit conditions.

</comment></comment></comment></comment></comment></comment><comment><USER22> > Michael Winterhoff's Deutschland Verdummt claims that German children today > "have no tolerance for frustration, and they avoid all exertion." By the > time they graduate, half of them still "have the psyche of a small child." > The author of eight previous books on childhood development, Winterhoff's > primary concern is that children today have become "tyrants." They don't > know proper boundaries; they have not been taught how to submit to parental > and social authority. And this, Winterhoff says, is entirely the fault of > parents themselves. Beginning in the 1990s, they have treated their children > like friends and partners instead of acting like authority figures and moral > guides, preferring to allow children the freedom to develop and move at > their own pace instead of submitting to the adult order of things.

Old man yells at cloud.

<comment><USER23> "not been taught how to submit" And a bet he wrote that unironically.

I remember a documentary on Berlin and Berlinners have a slang term there that basically means "you have been controlled" when one of the many petty bureaucrats, pulls you up over some trivial infraction

<comment><USER24> You may be mistaking "kontrolliert werden" for "being controlled" when it actually means "being checked".

Reminds me of when American friends were SHOCKED by a political poster that quipped "Vertrauen ist gut, Kontrolle ist besser" \- they thought it meant "Trust is good, control is better", but it actually means "Trust is good, but checking things is better"

<comment><USER25> Wait until they hear the German national anthem (well, the first verse) :D

<comment><USER26> I assume you're referring to "Deutschland über alles" (Germany over everything).

It's no longer the first verse due to the Nazi history, but it doesn't come from that time.

It actually comes from the mid 1800s (IIRC) when Germany didn't exist as a unified state. People lived in many different kingdoms and principalities and many yearned for a German state.

The anthem comes from this time and this line is supposed to mean that Germany is preferable to the various smaller states of that time.

Source: "Germany, memories of a nation" [https://www.goodreads.com/book/show/23113270-germany](https://www.goodreads.com/book/show/23113270-germany)

<comment><USER25> Yes, yes, I got that explanation.

But the first time a foreigner hears it, it sounds a lot like "Germany over everyone in the world", which can carry _the implication_ :P

</comment></comment></comment></comment></comment></comment><comment><USER27> I can't stand reading modern Germans. They generally read and think just like English, for one thing, so that you can barely tell you've entered another language.

It is pleasant, however to retreat to the 19th-century Germans, and bathe in their erudition and learning, from the period before the world went sour.

<comment><USER28> There is still a fairly regular stream of German-language "serious" monographs coming out, written by philosophers, media theorists, etc. Not usually found on the Spiegel bestseller list, though.

<comment><USER27> Indeed, the Germans remain good at "serious". It's just much more English- language derivative than it was pre-WWII. Today, I'd call their academic thought 5 years behind English-language academic thought instead of 5 years ahead of like it used to be.</comment></comment></comment>


Speed.cloudflare.com - <AUTHOR> https://speed.cloudflare.com/ <comment><USER2> Cloudflare: 455 Mbps down / 73.1 Mbps up / Latency 13.0 ms / Jitter 2.26 ms / Server: Ashburn via IPv6.

Netflix (fast.com): 790 Mbps down / 950 Mbps up / Latency 8 ms unloaded, 12 ms loaded / Server: Ashburn via IPv6.

Ookla (speedtest.net): 928 Mbps down / 938 Mbps up / Ping 1 ms / Server: Raleigh via IPv4.

DSL Reports ([http://www.dslreports.com/speedtest](http://www.dslreports.com/speedtest)): 611 Mbps down / 929 Mbps up / ping 16-41ms / Servers: Houston, Dallas, Newcastle DE, Nashville TN, Dallas.

Location: Raleigh. Provider: AT&T fiber.

Test run using Safari, macOS 10.15.4, Thunderbolt Ethernet.

Edit: the small file sizes used for some of the tests seem to drag down the overall speed measurement quite a bit. It's biased against upload measurements too since there's download files sizes of 25MB and 100MB whereas upload tests only up to 10MB file size. But even there, something seems off. The upload measurements are much smaller for the same file sizes (e.g. 170 Mbps avg vs 7 Mbs average for a 10 kB file).

I question this methodology. I care most about my 1Gps when I'm downloading the latest version of Xcode or some other huge file. I guess the smaller sizes are to better emulate downloading web pages, but in that case, the latency is probably what matters more. Even with 1Gps, when I'm out in CA, sites typically feel faster.

Edit 2:

speedtest.googlefiber.net: 800-900 Mbps down / 800-900 Mbps up (multiple tests to servers in Charlotte, Raleigh, Atlanta, seems to bounce around each time I reload the page).

Speedtest (Ookla) with server manually set to Windstream in Ashburn, VA: 886 Mbps down, 900 Mbps up. Confirmed that my router is measuring the same amount, so Ookla isn't just making up these numbers.

<comment><USER3> Thanks for the feedback, very much appreciated! I'm a product manager here at Cloudflare, responsible for launching this tool. Since the launch, we've found some issues that we're going to address:

\- Especially for users with a very fast Internet connection, speed.cloudflare.com reports upload speeds much lower than expected figures. We don't yet know what is causing this but will disable the upload part of the test until we know more.

\- In general reported download speeds are little lower than figures coming from other speed tests. We will revisit our methodology to understand the discrepancy.

\- Re: the speed test automatically starting: we appreciate the feedback and understand why some users may not want this as default behavior. We will disable the auto-start for now.

In the meantime, we appreciate any and all feedback, please keep it coming: you can reach me at achiel [at] cloudflare.com

<comment><USER4> > \- In general reported download speeds are little lower than figures coming > from other speed tests. We will revisit our methodology to understand the > discrepancy.

For what it's worth, Cloudflare shows me at 10mbps down, and Speedtest shows me at 160mbps (much closer to my expected 200mbps). This is a large difference.

<comment><USER5> Yes, that is. Want to drop me email (jgc @ cloudflare . com) with details?

</comment></comment></comment></comment><comment><USER6> Lots of people here are reporting lower-than-expected speeds with the Cloudflare tool compared to other speed-test sites.

I thought it was pretty well known at this point that ISPs optimize traffic for speed-test sites and throttle a lot of regular traffic, especially during heavy-traffic times like the after-dinner Netflix bump. Since this is a new tool, a plausible explanation for lower speeds is that not all of the ISPs' network engineers have had a chance to prioritize Cloudflare's speed test traffic on their routers along with the other speed test tools.

Part of me wonders if this is part of a ploy by Cloudflare to avoid throttling by ISPs. If they design it right, the ISP can't tell the difference beween the speed test and regular CDN content, which would be extremely clever.

<comment><USER7> Having worked on several ISP networks that practice isn't nearly as common as many people seam to think. It would be technically difficult to do that at the rate of a large ISP.

There could be capacity issues between an ISP and some content providers but that is different than throttling or optimizing traffic.

</comment></comment><comment><USER8> It doesn't work for me. When it starts, I get a bunch of errors:

Error fetching [https://speed.cloudflare.com/__down?measId=4466372954803167&...](https://speed.cloudflare.com/__down?measId=4466372954803167&bytes=1000): TypeError: i is undefined

Then it pauses itself. When I resume it, it runs for a few seconds (printing more errors) and pauses again.

I am using Firefox 76.0.1 on Fedora 32 x86_64. None of the adblocker addons I'm using are blocking anything.

<comment><USER9> Seems to be the case if you have a bit more locked down browser and don't allow all willy-nilly fingerprinting to happen.

<comment><USER8> Well, my browser is not that locked down. I have enabled cookies and JavaScript, and I think I am only using the level 1 blocklist (as explained here: [https://support.mozilla.org/en-US/kb/content- blocking](https://support.mozilla.org/en-US/kb/content-blocking)).

Edit: For the reference, I believe that the default should be at least as locked down as my thing (all third-party cookies blocked and so on).

</comment></comment></comment><comment><USER10> Something I find fascinating, over the last 5 years the main bottleneck on my internet connection has gone from the provider to my wifi, despite ~3 standard revisions in that time frame. It makes the notion of a wireless only provider somewhat appealing if they can manage similar speeds to wifi (within range of the 5G standard ).

<comment><USER11> Yes. Personally I am not at all happy with the direction WiFi is going. 802.11ax still sucks, compared to something like 4G LTE E-UTRA. Unfortunately MultiFire never took off.

And we are stuck with Gigabit Ethernet still. I know 10Gbps is too much to ask, but how about 5Gbps?

<comment><USER12> This feels to me that its due more to a lack of demand. Ever since I got off Comcast 10Mbps down/1 up in 2009 and went to Fios, which IIRC was offering 35/10 at the time, I haven't don't think I have ever felt that network speeds have been a problem. I occasionally do large file transfers, but its usually the SD card or hard drives that are more speed constrained than the network itself.

You can get faster stuff, but its all business level and it gets very expensive quickly. Until 8k video becomes a real thing (and thus far, 4k video isn't even much of a thing), I don't see any real need for faster network speeds. Do you?

<comment><USER11> I agree for most of our usage we dont need it. But it is often the peak that a system is designed for. And while my NAS cant bump out 1GB/s just yet. It could easy do 200 - 500MB/s.

And I often dont like the idea running into limits with Gigabits Ethernet, which is fine on itself. I just prefer to have headrooms.

For wireless that is entirely different. WiFi, even 802.11ax just aren't suited for multiple user with constant connection. People now prefer to use 4G / LTE for their speed and reliability. And that is why I would have liked to see LTE on Un-Licensed spectrum.

</comment></comment></comment></comment><comment><USER13> Love how Cloudflare keep coming out with all these new tools, 22.214.171.124 DNS, then VPN, isbgpsafeyet.com now this. The CEO is awesome too, and often hangs around HN.

I seem to be getting pretty accurate results unlike others here, not sure if it's been fixed or my peerings are better:

Tests (Download):

Cloudflare: 78, 73, 73, 73

Netflix: 74, 78, 71, 69

Google: 70, 70, 70, 65

Speedtest.net: 68, 67, 70, 71

I know this doesn't mean too much alone, but for me seemed to produce on average the highest speed.

<comment><USER14> Seems to be degrading since I first tried one hour ago, so nothing been fixed. Most likely the edge servers are not as great as they are made out to be, so we're seeing wildly different results depending on the location/edge server you're connected to.

</comment></comment><comment><USER15> Warning: The website starts an internet speed test as soon as you click on the link.

<comment><USER16> Good, that's why I went there.

The name is fairly descriptive; it does what's advertised without any subterfuge. And there's a Pause button.

<comment><USER17> A lot of the commonly used speed tests have a start or Go button.

This isn't bad behaviour, people just may not expect it based on what they are used to.

<comment><USER18> It's bad behavior if you're paying a lot for bandwidth…

</comment></comment></comment></comment><comment><USER17> Measuring and showing jitter by default is nice.

On the online gaming end of things it can be much more important than other metrics, depending on the genre. But there is an unfortunate amount of misconceptions floating around out there, and people tend to default to "higher speed = better" speed test results, when bandwidth doesn't really matter beyond a certain baseline.

</comment><comment><USER19> I have 100MBps Frontier FIOS:

Cloudflare: 244 Mbps

Fast: 100Mbps

Speedtest.net: 83 Mbps

Cloudflare seems to consistently report higher than cap speeds due to 100k and 1mb files not engaging the traffic shaper, while the 10MB files seems to be in line with the other speed tests which they seem to do a continuous download.

<comment><USER19> Also would be nice if the line chart had hover info to let you know which test it was running at the time.

</comment></comment><comment><USER14> Something seems severely wrong, either on Cloudflare's side, or on the way to the cloudflare edge that the test is measuring against. It's a shame as the UI gives you lots of information on just one page, especially like the jitter measurement which most speedtests don't seem to do anymore.

speed.cloudflare.com: 57.7Mbps (Server location: Madrid)

Fast.com: 320Mbps

Speedtest.net: 528.39Mpbs

</comment><comment><USER20> Seeing modern internet speeds still puts a grin on my face. It's _so_ fast. I really should not be getting >100 Mbps sustained to a regional server and 50 Mbps across an ocean -- those will always be local area speeds in my mind.

Not that you'd know it, browsing the web.

</comment><comment><USER21> CloudFlare - 595/29.8

Netflix - 700/280

DslReports - 400/638

Speedtest (Okla) - 602/621

All of these are on a Dell using a USB3 Ethernet adapter. The only thing that I currently have running gigabit not through an adapter is my AppleTV4 running the speedtest app.

AppleTV 4/SpeedTest (Okla) - 925/751

</comment><comment><USER22> I think it will be similar to netflix fast.com but it selected Mumbai servers when I am in Delhi(CF has servers in Delhi). Maybe this is intentional?

Kept getting the test paused automatically on Firefox Dev Edition. Looking at the console:

        Error fetching https://speed.cloudflare.com/__down?measId=2826350041244361&bytes=1000: TypeError: can't access property "transferSize", i is undefined

<comment><USER23> On ethernet always get close to 1Gbps on Fast.com by CF shows consistently around 300-400. Wonder if CF is more accurate or Fast.com? I'm imagining CF but such a difference.

<comment><USER24> Fast.com specifically measures your speed to a Netflix mirror, vs CloudFlare measuring your speed to a CloudFlare data center. Netflix probably has a box in your ISPs data center/head end that is closer to you (unless you live in a town with a CloudFlare data center, in which case the difference shouldn't be this drastic).

CF's score is probably more relevant since there's a lot more sites that are hosted there than netflix (which is just netflix).

</comment></comment></comment><comment><USER25> Feel embarrassed when looking at the consumer Internet bandwidth other developed countries are having.

Meanwhile in Australia (down-under), I've waited for so long to get NBN (can only get HFC at my place which was like over 20 years old? At least at my hometown Shanghai, had something better than that in 2001 (GFW wasn't in shape back then) - I remember it clearly because that's when I started Linux journey by install Mandrake 8.1 ;-).

I was quite excited when finally enjoying 100Mbps down / 40Mbps up (I was told here in Oz consumer Internet upload is always capped at 40% of download bandwidth), before the cable was 100Mbps/2Mbps, useless to the way I abuse network (mainly transferring data to North America).

Have been experiencing congestion and degraded upload bandwidth (only 4Mbps ~ 8Mbps) since the pandemic, it did not restore until public school students went back to school (last week...), finally the infrastructure issue got fixed by the lift of social restrictions LMAO.

</comment><comment><USER26> Nice. Didn't see anything about a terminal client. Still looking for terminal clients beside speedtest-cli. Thanks.

<comment><USER27> net7-client[0] is the reference implementation for doing speed tests with Measurement Lab, which is also behind the speed test widget in Google search results for the "speed test" query.

SpeedTest[1] is an alternative to speedtest-cli for the Ookla speed test, written in C++.

[0]: [https://github.com/m-lab/ndt7-client- go](https://github.com/m-lab/ndt7-client-go)

[1]: [https://github.com/taganaka/SpeedTest](https://github.com/taganaka/SpeedTest)

</comment></comment><comment><USER28> Neat, but there doesn't seem to be a way to change the server you're connecting to.

I wondered why map markers were always airports:

> Data center locations are tracked as airport codes and may not be 100% > accurate.

<comment><USER29> Airport codes are virtually universal, even across country lines. They're also tied into many other bits of information, such as weather.

</comment></comment><comment><USER30> Results don't add up for me.

Fast.com: 620 Mbps Down, 650 Mbps Up, DFW/ATL

Dslreports: 889 Mbps down, 944 Mbps Up, LAX/IAH

Ookla: 919 Mbps down, 934 Mbps Up, DFW/Richardson

Speed.cloudflare.com: 118 Mbps down, DFW/Arlington (closest)

I then tried to run the speed test from cURL by sending a GET to the same URLs this test uses, but it seems that I can't ask for anything larger than a 100MB payload. This is unusual since other speed tests allow you to download/upload up to 1GB in each direction.

I'm wondering if this speed test should use larger files for fast connections.

</comment><comment><USER31> Interesting... I got a result of 44Mb/s down, which is 8 more than I pay for and 13 more than any other speed test shows (i.e. speedtest.net, fast.com, BT Wholesale speed check).

</comment><comment><USER32> I'm seeing that my upload speed (90M) is way under both what is advertised, and what other speed tests show. Is there a good way to test what my actual upload speed is?

<comment><USER33> I see the same 90Mb/s as you, so I suspect they are capping at 90Mb/s. For another test, try fast.com and click "more info" after the download stops.

I have fios 1Gb service. From clouldflare I see ~500Mb/s down and 90Mb/s up, and fast.com shows 600Mb/s down and 900Mb/s up.

<comment><USER34> anecdotally - my results here show approximately the speed i'm paying for, which is higher than 90

</comment></comment></comment><comment><USER35> Cloudflare: ▼ 567 Mbps ▲ 50 Mbps Payload 100Mb Latency 15ms

Netflix _: ▼ 890 Mbps ▲ 160 Mbps Payload 720Mb Latency 13ms

_ Netflix Open Connect is inside my ISP network

<comment><USER36> _Netflix Open Connect is inside my ISP network_

And still a latency of 13ms? Here, Cloudflare, Netflix, Google, and Ookla Speedtest all have latencies of 4-6ms.

<comment><USER35> I'm 900Km away from the datacentre via a submarine fibre but the way routing is done it feels it is metadata surveillance.

</comment></comment></comment><comment><USER37> It is a shame there is not an option to force IPv4 or IPv6. It defaults to IPv6 which is good, except that because my ISP does not offer IPv6 I am forced to use a tunnel, and that tunnel gives a misleading result compared to my ISP.

</comment><comment><USER38> From their FAQ: "Why build another speed test tool?

There are many speed test tools out there. Our mission is to help build a better Internet. To do so, we believe in giving users a choice of different services: you shouldn't be tied to one provider and you should be able to compare results across different tools."

This tool would be more useful when it allows people to "compare" their speed with others.

Average speed in their country One network with another in the same country Compare a country's average speed with another Rank...

Add the benchmarks and put a share to social media button and HOPEFULLY.

One other thing - add (Megabytes per second)

</comment><comment><USER39> Why would they start the test without warning like that? I would have probably preferred to opt out of their data collection process.

</comment><comment><USER40> It would be interesting to actually see how Anycast is finding the Cloudflare edge location, and how the traffic is getting routed.

<comment><USER41> So run a traceroute?

</comment></comment><comment><USER42> Its showing my location as Kansas (0, US) despite being in SF. Tried a different browser, disabled add-ons...no dice.

<comment><USER43> Are you on IPv6 by any chance? I got the same thing, despite being in SoCal. I saw that the site was showing my IPv6 address, so I checked a couple of location databases and I'm getting results that are way off. A couple say New Jersey, one says "North America" and leaves it at that. I think that might match whatever Cloudflare is using since the dot is just in the middle of the US, i.e. Kansas.

Regardless, it's showing me as connecting to the LA server, which is almost undoubtedly the clostest PoP, so I'm not too concerned.

</comment></comment><comment><USER44> 897 / 343 Mbps, not too shabby but expected better.

In my region it seems only Azure manages to pump full gigabit up and down.

</comment><comment><USER45> > There are many speed test tools out there. Our mission is to help build a > better Internet. To do so, we believe in giving users a choice of different > services: you shouldn't be tied to one provider and you should be able to > compare results across different tools.

Under "About" section. That's a really weak argument to invent a new tool.

<comment><USER46> That's actually a _really_ strong argument to invent a new tool, especially for speed tests. Each provider can never paint a full picture on their own, so having multiple things to test against is useful.

<comment><USER45> You can make that argument literally for everything and anything.

Why need a new programming language? Well, because we think that our users deserve more choices.

That does not fly well when someone needs to fork out $$$ to fund the activity.

Back to the topic, what users _really_ need is a way to run all available tools (there are many speed test tools out there) and provide them a "full picture" in one shot. Sure, the test will take 3 mins to run but it would more useful if you're concerned about usefulness.

<comment><USER46> Indeed, you _can_ make that argument for everything, and it still holds. You want _more_ competition, not less.

From a speed-test service, difference is indeed in who you test against: _Location_ is a feature. No different than programming languages providing different features.

Without this service, you would not be able to speedtest towards cloudflare infrastructure at all. You'd need this at the very least to try to create the "monster" test-suite you suggest.

However, it is entirely impossible to provide "a full picture", simply because there is no such thing. In a given moment, there is a given possible throughput and latency for any given point A to point B, which holds no value for any other point, or any other time.

</comment></comment></comment></comment><comment><USER47> This gives me NaN's when hovering over the 10K download test.

</comment><comment><USER48> Would be nice to have manual IPv4/v6 switch.

</comment><comment><USER49> Wait... is the London one IN Heathrow airport?

</comment><comment><USER50> you can easily tell, it's a react app. if you've developed react apps. subtle data rendering bugs.

<comment><USER51> Care to point out any of these bugs or...?

</comment></comment><comment><USER52> ethernet: 860 \o/

wifi: 70 :'(

</comment><comment><USER53> Oh, cool! CloudFlare, my favorite company, just made a speedtest!

\- It starts as soon as you visit, other speed tests don't, which violates a user's consent.

\- It collects and saves your data, also without asking.

\- It gives wildly different results than other speedtests, with no explanation as to why.

Of course CloudFlare would screw up a speedtest. They screw up at everything else they do, so I'm 100% not surprised.

<comment><USER54> > It starts as soon as you visit, other speed tests don't, which violates a > user's consent.

1) fast.com, 2) this feels like a reach, isn't "going to a speed test site" a pretty clear indicator of what the user intends to do?

> It gives wildly different results than other speedtests, with no explanation > as to why.

I'm confused what your platonic ideal of a speed test is. Off the top of my head, I may care about:

* "speed to my ISP"

* "speed to something I care about that's 'nearby'" (fast.com to a Netflix box peered close to me)

* "speed to a CDN" (speed.cloudflare.com)

* "speed to a random data center somewhere" (speedof.me and friends)

* "speed to a box I own"

I'd be _amazed_ if I didn't see significant deviation between all of those measures.

<comment><USER55> I am on the fence about the consent thing. Yes, it's a speed test, but no, you don't really necessarily know that when it gets linked on some site. Burning through quite a bit of potentially metered data without asking first seems... rude, at the very least.

</comment></comment></comment><comment><USER56> The data on this page means nothing to me. And, I've grown accustomed to using Fast by Netflix - straight to the point.

</comment><comment><USER57> How precisely did they pinpoint you on the map? 100m/300ft here in a chromium derivative i reserve for stuff like that.

/me feels im/depressed.

edit: Latency varies but goes down to 6 to 5.5ms, similar for jitter, but even lower to just above 4ms. Line almost maxed out. Just missing 5up/2down. On really ancient HW :-)

<comment><USER58> It's about 8km off for me, in a different city.

They appear to be putting me exactly where MaxMind's GeoIP database thinks I am.</comment></comment>


Evolving Your Songs: The Beatles Principles – #1 - <AUTHOR> https://andrewsobel.com/beatles-principles-one-evolving-your-songs/ <comment><USER2> there's some truth to this, but generally it's important to remember that a good portion of the pressure to "make the same song" originates with audiences. there's a delicate balance to strike here.</comment>


Airlines, airports sound the alarm on long TSA lines - <AUTHOR> http://www.usatoday.com/story/travel/flights/todayinthesky/2016/05/10/airlines-airports-sounds-alarm-long-tsa-lines/84181668/ <comment><USER2> Perhaps we should try going back to metal detectors? Automated thing that goes beep, seemed to work just fine. Theoretically could move lines faster and with less errors.

</comment><comment><USER3> Somehow TSA manages to get by with only ten people where other countries would use three.</comment>


Why I design at Google - <AUTHOR> http://www.ryskamp.org/brain/?p=4284 <comment><USER2> _Long-term, I want my design work to influence the direction of large groups and societies, and to do that I need to learn how to work with and persuade people who aren't inclined or required to listen to professional designers._

I think that this is the most important bit.

</comment><comment><USER3> Are there any examples of amazing (Apple-quality) design coming out of Google?

<comment><USER4> Are you asking about Apple "quality" aesthetics?

Graphic design is about solving problems; aesthetics are secondary. Google's designs solve its problems--satisfying search results, simple access to email, etc--very effectively.

<comment><USER5> Apple solves problems without sacrificing aesthetics. Very rare to find companies who can achieve that level of quality.

<comment><USER6> Yes, the mice that ship with the iMacs are the best examples of solving problems without sacrificing aesthetics.

<comment><USER7> That's rather silly and outdated snipe. Have you used the new magic pad? I'd rather have that than anything else.

<comment><USER8> This is a silly issue of semantics, but the trackpad isn't exactly a mouse; still a pointing device though.

Anyways, his snipe is hardly outdated. Apple's most succesful products manage to balance form and function beautifully, but their mice are a pretty big hole where function has clearly been sacrificed for form.

</comment></comment></comment></comment></comment></comment><comment><USER9> You're missing 0. make great products, which at the big table are the only stakes that count.

This is too much me/my/I. It's a nice insight into why folks might think about design at Google, but a sharper insight into why design at Google has a ways to go.

<comment><USER10> The post is about _why_ he designs at Google, not _how_ he designs at Google. That'll necessarily be quite personal in nature. If you ask _how_ , that's much more focused on the end user, but also far more confidential. Get a job there if you're interested.

</comment></comment><comment><USER11> Larry Page, take a note: your employees may be more motivated by free food than by using geek gadgets or by the company mission

</comment><comment><USER12> Google needs designers? Wow.</comment>


Life of Brian (Krebs) - <AUTHOR> http://www.hackerfactor.com/blog/index.php?/archives/596-Life-of-Brian.html <comment><USER3> But wouldn't it be interesting if, in the dark of night, Brian Krebs actually was a serious cyber-crimnal. And he used his reputation and knowledge to frame himself from time to time, just to throw off the fuzz. He's certainly smart enough to pull it off. (no, I don't think that's true that he's a cyber- criminal :-) )

<comment><USER4> the old school version of this conspiracy is the AV software makers were the ones funding the virus creators.

<comment><USER3> I heard a rumor back in the day that the Chernobyl virus [1] (Also Win.CIH, I think) was released by Microsoft within pirated versions of Windows. At the time I was in high school and just believed it, because Microsoft was the big, evil corporation at the time. Now of course I'm more skeptical, though I still wouldn't be surprised.

[1]: [https://en.wikipedia.org/wiki/CIH_(computer_virus)](https://en.wikipedia.org/wiki/CIH_\(computer_virus\))

<comment><USER5> Thanks for reminding me of that one.

Some bogus design decisions by Packard Bell (no jumper/switch to lock out BIOS flash access) meant two of my machines were written off.

No, they weren't running pirated Windows, though I was on day 204 of my 31 day Paint Shop Pro evaluation.

<comment><USER3> A friend of mine had a pbell that was killed off by Chernobyl. I was on the phone with him when he booted it up. "I'm going to boot." "Don't do it man." "Nah I'm gonna boot. Here it goes. See it's fine." "Sweet" "Uh oh" "Uh oh?" "Uh oh"

And that was the end of that machine lol

<comment><USER5> I managed to get replacement motherboards for both under warranty, including engineer call out.

You'd almost think the virus shipped with the computer, the way they responded.

</comment></comment></comment></comment></comment></comment><comment><USER6> > Let's say that these intimidation techniques make Brian give up journalism. > Maybe he becomes too scared to write.

Advocates against anonymity do not get this. I guess they think the bad guys get arrested and the good guys have nothing to hide (asymptotically). They do not consider that the world is not black-and-white and that you may need to protect against technically lawful people.

Other than that, I did not know Krebs (but I had heard about this successful battle against spam) and it makes me want to know more. The website hackerfactor.com has a nice design and have potentially interesting content.

<comment><USER7> That site looks like something from the 90's. Has design regressed that much that the 90's look is cool again?

</comment></comment><comment><USER8> _" If the only thing protecting your security is a lack of others knowing the secret, then you have no practical security."_

My understanding is that "security by obscurity" is a condemnation of making algorithms and code _part of_ the secret. A system reliant on others not knowing your (say) private SSH key may lack defense in depth but isn't "security by obscurity".

<comment><USER9> Its possible that "security by obscurity" has a different meaning in the programming world. When talking about computer or network security it is used to describe any mechanism that attempts to defend a system by hiding something. One of the classic examples of security by obscurity is when a person disables the broadcasting of the SSID on a wireless router.

<comment><USER8> For what it's worth, Wikipedia disagrees:

"Security through obscurity is generally a pejorative term referring to a principle in security engineering, which attempts to use secrecy of design or implementation to provide security."

[http://en.wikipedia.org/wiki/Security_through_obscurity](http://en.wikipedia.org/wiki/Security_through_obscurity)

 _" When talking about computer or network security it is used to describe any mechanism that attempts to defend a system by hiding something."_

That is again a definition which would include ssh keys, which is to say a useless definition.

 _" One of the classic examples of security by obscurity is when a person disables the broadcasting of the SSID on a wireless router."_

I'm not sure that's an example at all, since hidden SSIDs can be readily sniffed from a publicly documented protocol.

<comment><USER9> >That is again a definition which would include ssh keys, which is to say a useless definition.

For those of us who work in security, its taken for granted that when we are talking about security through obscurity, we aren't talking about passwords and cryptographic keys. I should have been more clear.

>"Security through obscurity is generally a pejorative term referring to a principle in security engineering, which attempts to use secrecy of design or implementation to provide security."

That's the exact same thing that I said worded in a different way.

>I'm not sure that's an example at all, since hidden SSIDs can be readily sniffed from a publicly documented protocol.

And that's the entire point. Security through obscurity alone is not a good thing. Starting from the second sentence, and continuing through to the second and third paragraphs, the article elaborates on this.

>A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them.

>Security through obscurity has never achieved engineering acceptance as an approach to securing a system, as it contradicts the principle of simplicity. The United States National Institute of Standards and Technology (NIST) specifically recommends against security through obscurity in more than one document. Quoting from one, "System security should not depend on the secrecy of the implementation or its components."[1]

>It is analogous to a homeowner leaving the rear door open, because it cannot be seen by a would-be burglar.

<comment><USER8> It worries me a tiny bit that you work in security, and yet your thinking seems this muddled here. I'm hoping you haven't had your coffee or it's a failure of communication or something...

 _" its taken for granted that when we are talking about security through obscurity, we aren't talking about passwords and cryptographic keys."_

I agree that passwords and cryptographic keys are not what we're talking about - the question is _why_. Whether, confronted with a proposed setup that relies on the secrecy of X for its security, whether X should be seen as analogous to keys (and thus not a case of "security through obscurity"), or more analogous to protocol or algorithm (and thus a case of "security through obscurity"). There are, of course, other concerns as well.

 _" That's the exact same thing that I said worded in a different way."_

SSID is neither design nor implementation of a wireless network.

 _" Security through obscurity alone is not a good thing."_

I wholeheartedly agree that security through obscurity is not a good thing, but not everything that is bad is "security through obscurity". "Don't broadcast secrets from radios in cleartext" is a rather simpler (and stronger!) rule violated here if you are trying to use SSID as a secret.

<comment><USER9> >SSID is neither design nor implementation of a wireless network.

As it relates to the physical implementation of a network, part of the implementation includes configuring the devices. Security through obscurity can be something as simple as manually assigning a non-standard port to a service (such as HTTP). The example of disabling the broadcast of an SSID is also a valid example of security through obscurity.

You seem to have an issue with me using the SSID as an example because its so easy to defeat that it would be a waste of time to even try. Like I said before, that's the entire point. Its obvious to us now, in 2014, but for years people were told by 'experts' to disable it as a security measure. Some individuals actually used to attempt to secure their networks by hiding the SSID instead of using a password. The prevalence of this kind of negligence is one of the key reasons that disabling the broadcast became the prototypical example used to explain why security through obscurity doesn't work.

In short, its not an example I made up on my own formed from a lack of understanding security, its an example that's used in textbooks and security- specific certification study guides. Its an example that's taught in introductory IT and IT security classes. I'll try to find some more specific citations to put your mind at ease, its been quite a while since I've taken an introductory course on the subject.

[https://www.owasp.org/index.php/Avoid_security_by_obscurity](https://www.owasp.org/index.php/Avoid_security_by_obscurity)

>not everything that is bad is "security through obscurity".

And I agree with this, but my example most certainly is a valid case of security through obscurity.

Update: Better Sources

From Hacking Exposed: Wireless, 2nd Edition Pg. 80

From the first paragraph on security through obscurity:

>Many wireless networks today operate in hidden or nonbroadcasting mode. These networks don't include their SSID (network name) in beacon packets, and they don't respond to broadcast probe requests. People who configure their networks like this think of their SSID as a sort of secret. People who do this might also be prone to enabling MAC address filtering on the AP.

From Enterprise Security: A Data-Centric Approach, Chapter 7

>In order to provide security through obscurity, methods such as hidden SSIDs and MAC address filtering have been employed to keep the wireless network invisible to eavesdroppers and more difficult to connect to for an unknown host.

From Certified Wireless Design Professional Official Study Guide, Section titled SSID hiding.

>In order to provide security through obscurity, methods such as hidden SSIDs and MAC address filtering have been employed to keep the wireless network invisible to eavesdroppers and more difficult to connect to for an unknown host.

These are just a few examples out of dozens, if not hundreds.

I'd sincerely appreciate it if you would educate yourself before implying that other people are incompetent in the future.

<comment><USER8> _" As it relates to the physical implementation of a network, part of the implementation includes configuring the devices."_

Arguable, but then what makes keys and passwords "not a part of the implementation"?

 _" You seem to have an issue with me using the SSID as an example because its so easy to defeat that it would be a waste of time to even try."_

That is not my objection. I object to SSID as example of "security through obscurity" because I think it doesn't get at the core of what's wrong with security through obscurity and it has other far more glaring issues - <USER2> someone can fully grok that keeping SSID secret is not worthwhile and see "why" but without _that_ "why" generalizing to (say) the company saying "We use our own proprietary cryptosystem. We can't show anyone the algorithm; it's more secure that way!"

 _" In short, its not an example I made up on my own formed from a lack of understanding security, its an example that's used in textbooks and security- specific certification study guides."_

I wasn't questioning your understanding because you picked the example, but because you seem to persist in conflating things that seem clearly (and meaningfully) distinct. If textbooks and security-specific certification study guides use SSID as a canonical example of security through obscurity, I'm more worried not less.

<comment><USER9> >Arguable, but then what makes keys and passwords "not a part of the implementation"?

They are part of the implementation of a network, but the issues involving passwords and cryptographic keys are so complex that they generally aren't lumped into a conversation about security through obscurity. I made the statement in response to your claim that someone obtaining your SSH key would render SSH an example of security through obscurity, if my definition and the author's definition were used. With that line of thinking, the entire cryptography industry is merely security through obscurity and we should just give up. In practice, cryptographic technologies aren't considered to be security through obscurity unless the technologies are provably broken to a point where only an idiot would rely on them (such as WEP or LANMAN). As a caveat to this, when a cryptographic algorithm is hidden from the public in order to remain unbroken, it does become an example of security through obscurity. I just object to the idea that this is the only meaning to the phrase.

> I object to SSID as example of "security through obscurity" because I think > it doesn't get at the core of what's wrong with security through obscurity > and it has other far more glaring issues - so someone can fully grok that > keeping SSID secret is not worthwhile and see "why" but without that "why" > generalizing to (say) the company saying "We use our own proprietary > cryptosystem. We can't show anyone the algorithm; it's more secure that > way!"

The issue we began with was that you stated that it was not an example of security through obscurity at all. That was an incorrect statement and it still is. If you now want to argue that its not the best example, I would agree with you.

As an introductory example it does a good job of explaining the concept to a layperson or even a technical person that's still a bit inexperienced. Could you find a better example to give to a room full of newbies? Probably, but that wasn't the issue we disagreed on.

Its also important to note, that in a room full of security experts, you would be able to delve into the more complex aspects of the issue without losing the audience, so of course the example would be different.

<comment><USER8> Facepalm.

 _" The issue we began with was that you stated that it was not an example of security through obscurity at all."_

If you read up, that is not where this began. You initially responded to my objection to the phrase (from the article): _" If the only thing protecting your security is a lack of others knowing the secret, then you have no practical security."_

I still fully and full-throatedly stand by that objection - particularly since in a security context "secret" is often used to mean "key or password or...".

I did eventually state that I wasn't sure hidden SSIDs were actually an example of security through obscurity - I'm still not sure they are. Maybe I'm wrong about that. It's still appearing to me that you aren't really understanding my objections, though.

 _" As an introductory example it does a good job of explaining the concept to a layperson or even a technical person that's still a bit inexperienced."_

I still say SSID is - at best - a piss poor choice of something that is barely an example of the phenomenon. It does not do a good job of explaining the concept to anyone - newbie or otherwise - because it is poor security for more obvious reasons that have nothing to do with security through obscurity, and is therefore likely to lead to confusion.

<comment><USER9> >If you read up, that is not where this began.

You're right, the first thing we disagreed on was that the article's pretty much industry standard definition of security through obscurity was incorrect because in your opinion, its too ambiguous. I thought we had already resolved that considering the article you linked said pretty much the same thing that I did. It was your second post where you stated that the SSID isn't an example of security through obscurity.

>I still say SSID is - at best - a piss poor choice of something that is barely an example of the phenomenon.

Considering what you listed as your definition of security through obscurity, it isn't surprising that you think the example is piss-poor. Your personal definition is itself a very specific type of security through obscurity. Therefore, anything that deviates from that specific example is going to seem wrong to you.

<comment><USER8> ... I can't resist. Since when does "secret" in a security context _exclude_ things like keys and passwords? Usually it _means_ things like keys and passwords. You can't say "it's implicit to 'security through obscurity'" because the article was _defining_ security through obscurity. If the audience is expected to be sufficiently unfamiliar to need that definition, they aren't going to know that there's this mystical blessing of keys as "not a part of that". Seriously, where do you work anyway?

<comment><USER9> First, a failure to communicate doesn't have to mean that either of us is dumb. It just happens sometimes. Second, the thought that you might be trolling has crossed my mind as well, so it now seems unlikely that either of us are. Third, there really isn't any need to repeatedly resort to insults. I have no idea what you do for a living but I wouldn't be so ready to dismiss you as incompetent as you seem to be with others.

Let me try to clarify some of the things, because I often forget to add details that others might find important.

Security by obscurity is generally used to describe very bad attempts to secure something by hiding either the item intended to be secured, or something else that is used to secure it.

To clarify, a password CAN potentially be secured so inadequately that it represents an example of security by obscurity. For example, if a person tapes a copy of his password to the bottom of his keyboard.

Unfortunately, many of the best security mechanisms we currently have still use passwords, or RSA tokens, or something else that we have in our possession. In some cases, we don't yet have (or haven't popularized) anything better, so rather than lump some really useful, yet imperfect technologies in the same category as the jackass that tapes his password to his keyboard as "security through obscurity." We eliminate passwords/tokens that have been properly secured from the conversation.

To clarify even more, if a SWAT-team storms a secure facility, murders the guards, and spends several hours cutting open a hardened safe that contains cryptographic keying material, most security experts aren't going to look at the situation and say "Well, what else do you expect when you rely on security through obscurity? I knew someone would find that password." The situations aren't comparable.

So when I say that passwords aren't included in security through obscurity, what I mean is that the entire concept of having a password should not be considered an example of security through obscurity, because the phrase is generally reserved for practices that are considered very poor. In the distant future, if we find a way to eliminate passwords completely, to the point where only an idiot would depend on one, then things would change and the entire concept would be considered security through obscurity. Similar things have happened in the past. For example, WEP used to be considered secure, now only a fool would use it.

When I say that cryptographic algorithms aren't included, once again what I mean is that the concept of obfuscating your data through the use of a cryptographic algorithm itself is not supposed to be considered security through obscurity, because although most algorithms will eventually be broken, right now some of them are considered to be extremely safe. We aren't ready to abandon our most secure cryptographic protocols, and so the concept of cryptography itself doesn't qualify as a very poor security practice.

There are certain situations where a cryptographic system can serve as an example, such as the example you gave where the algorithm is hidden in order to 'keep it secure.' Another example would be when advances in computing power allows for a previously secure protocol to be broken through brute force. When it becomes trivially easy to do so, use of the specific technology would be accurately described as a form of security through obscurity.

So in practice, what happens quite a bit when two knowledgeable people are having an academic conversation about the theory of security through obscurity, we are taking for granted that passwords should be properly secured. We are also taking for granted the fact that we shouldn't be using broken or unproven cryptographic protocols. If we had to stop and explain the semantics behind security through obscurity to other security professionals it would be like a couple of senior software engineers having to remind each other what a global variable is every single time they want to talk about a complex engineering issue.

I hope I've done a better job of explaining the statements I made, I can see how they may have been overly vague, but I was focusing on your claim that the SSID broadcasts aren't a valid example of security through obscurity.

>Seriously, where do you work anyway?

This is extremely unnecessary and unproductive.

<comment><USER8> _" First, a failure to communicate doesn't have to mean that either of us is dumb. It just happens sometimes."_

Agreed. I'd meant my other comment to better indicate that those were potentially transient attributes. Also, smart people are perfectly capable of lacking understanding about something in particular.

 _" Second, the thought that you might be trolling has crossed my mind as well, so it now seems unlikely that either of us are."_

That doesn't really follow, but okay.

 _" Third, there really isn't any need to repeatedly resort to insults. I have no idea what you do for a living but I wouldn't be so ready to dismiss you as incompetent as you seem to be with others."_

I apologize where I was overly rude or confrontational.

 _" Security by obscurity is generally used [...]. I hope I've done a better job of explaining the statements I made, I can see how they may have been overly vague, but I was focusing on your claim that the SSID broadcasts aren't a valid example of security through obscurity."_

It still seems to me that you're more or less using it to mean "weak security", as opposed to a principle which can be used to guide what to fix. It's quite possible that the meaning has weakened/broadened since I first learned about it (plausibly here[1], though I feel like it was earlier), but if so I think that's unfortunate - I think the tie to Kerckhoffs' Principle is important.

 _" >Seriously, where do you work anyway?

This is extremely unnecessary and unproductive."_

You brought your profession into the argument. I'm not sure it's extremely unnecessary to establish it, or for the argument to reflect on your profession. Neither am I entirely sure that it was actually appropriate, though.

[1]: [https://www.schneier.com/crypto- gram-0205.html#1](https://www.schneier.com/crypto-gram-0205.html#1)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> My only "beef" with him, as such, is that he stoops to their level and releases the home address and contact information of people -- frequently young people if I remember correctly. I don't think these people should be free from consequences, but it doesn't warrant vigilante justice. I'm sure given that he has been personally targeted his judgment might be clouded though, and it's hard to know what I would do in that situation.

<comment><USER11> There was a recent post in which he refused to release PII due to the person being a minor: [http://krebsonsecurity.com/2014/02/the-new- normal-200-400-gb...](http://krebsonsecurity.com/2014/02/the-new- normal-200-400-gbps-ddos-attacks/)

``` "I don't see what a wall of text can really tell you about what someone does in real life though," said Rasbora, whose real-life identity is being withheld because he's a minor. ```

</comment></comment><comment><USER12> These Black Hats make their living off of companies and people with poorly implemented information security. Brian Krebs makes his living exposing Black Hats who themselves have poor information security. There is some delicious irony in the Black Hats' retaliation against Krebs.

</comment><comment><USER13> > hit by a truly huge attack that averaged 200-400 Gbps

I take it he's talking about _that_ [1] DDoS attack? So whoever it was launched the biggest attack in history to to get at one guy?

[1]: [http://blog.cloudflare.com/technical-details- behind-a-400gbp...](http://blog.cloudflare.com/technical-details- behind-a-400gbps-ntp-amplification-ddos-attack)

<comment><USER14> Note that the resources required to launch that attack were relatively small. From the cloudflare article:

 _it is possible that the attacker used only a single server running on a network that allowed source IP address spoofing_

So perhaps one technically adept attacker, which isn't quite so surprising.

<comment><USER15> >Technically adept attacker

It was a 15 year old kid [http://krebsonsecurity.com/2014/02/the-new- normal-200-400-gb...](http://krebsonsecurity.com/2014/02/the-new- normal-200-400-gbps-ddos-attacks/)

<comment><USER16> That the attacker was 15 doesn't preclude them from being technically adept.

</comment></comment></comment></comment><comment><USER17> Moderators changed the title from "Life of Brian" to "Life of Brian Krebs." I honestly think its a poorer title, and they could try and acquire a sense of humor.

<comment><USER18> It was also misleading. I didn't click on the link at first because I assumed it had something to do with the movie.

<comment><USER19> They could've at least made it "Life of Brian (Krebs)" or something.

<comment><USER11> Looks like they have now

</comment></comment></comment></comment><comment><USER20> Not the main point of the article, but I'm glad that he's going after malware authors. I don't think I've ever felt so simultaneously enraged and helpless as when I got infected.

</comment><comment><USER21> The description of security by obscurity in this article reads a lot like Kerckhoff's principle, which when employed correctly is actually a virtue. Not to defend cybercrime, but completely covering your tracks (digitally or otherwise) is a very tricky problem - one that people have long tried to solve with both malicious and benevolent intent - and failings in that vein aren't necessarily of the level of amateurishness that the term implies.

</comment><comment><USER22> To make the article more interesting to read you should've put the ending at the beginning (Barking up the wrong tree). Now while reading what you wrote I am trying to guess where it is heading. If you'd have written it reversed it would be more compelling and convincing.

Newspapers do the same thing; they write what is most important at the top and add details and examples further into the article.

Good thought and interesting examples though. :)

<comment><USER23> >Newspapers do the same thing; they write what is most important at the top and add details and examples further into the article.

Inverted pyramid (this style of newspaper writing) has historical roots. The idea was that a typeset story--often wire service copy--could be (literally) cut off at just about any arbitrary paragraph break to fit in the available space.

<comment><USER24> Interesting. The writing style was dictated by the constraints of newspaper layout and the technology's limited ability to meet those constraints. Does that mean that this writing style is obsolete now, or are there other reasons to prefer it?

<comment><USER25> One big reason is that it gives people the most important info they need up front. If they care about details, they can keep reading.

</comment></comment></comment></comment><comment><USER26> There's an undercurrent on the article that is somewhat dismissive of Krebs-- i.e. that all his scoops come from tips, and he gets good tips because he's so well known. It even says that if it weren't Brian it would be someone else.

The facts, are, though, that Brian started in the Washington Post mail room and has since worked his way into a column at the Post, and now success as an independent blogger. Neither of those were easy or assured for him.

So I would argue that there is something about Brian and/or his work that is special or noteworthy.

</comment><comment><USER27> I wonder how many times the heroin trick has worked?</comment>


Confbook-The world's first strategic networking platform for conferences/events - <AUTHOR>

Expanding professional network at conferences and events can be challenging. It's hard to create rapport with people even after meeting them.
Confbook is the world's first strategic networking platform where you can build a networking strategy for conferences and events. We find the perfect match for you and connect you with the right people.
We are on a mission to create a global community of conferences/events and their participants.
http://www.confbook.io/ <comment><USER2> This platform will surely help all people who feel uneasy in finding conferences.

</comment><comment><USER3> Looking forward for an app to launch.</comment>


The Path to Enlightenment - Palm Design Philosophies, Practices and user testing tips - <AUTHOR> http://www.access-company.com/developers/documents/docs/zenofpalm/Enlightenment.html <comment><USER2> This is fantastic. I've always really loved Palm software and now I know that it is for a good reason.</comment>


Building lattice reduction (LLL) intuition - <AUTHOR> https://kel.bz/post/lll/ <comment><USER2> This is probably my favorite crypto blog post of the year. LLL comes up a lot in attacks on asymmetric cryptography.

If you're interested in crypto or linear algebra but don't know what a lattice is, a great starting point is Hoffstein's _Introduction to Mathematical Cryptography_:

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.182...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.182.9999&rep=rep1&type=pdf)

(If you know what a vector space is, you know what a lattice is; it's a vector space where only integers are allowed as coefficients in linear combinations).

Here's Antoine Joux, one of the world's most renowned cryptanalysts, talking about applications of LLL to crypto attacks. Amusingly, he sort of opens by making fun of cryptographers for using LLL without really understanding it:

[http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.11.7...](http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.11.7624)

Here's Babai's application of LLL to finding close lattice points:

[http://www.csie.nuk.edu.tw/~cychen/Lattices/On%20lovasz%20la...](http://www.csie.nuk.edu.tw/~cychen/Lattices/On%20lovasz%20lattice%20reduction%20and%20the%20nearest%20lattice%20point%20problem.pdf)

From here you're a [boneh hidden number problem] Google search away from attacking dlog/ecdlog crypto from vulnerabilities like biased nonces.

<comment><USER3> To add to your post, lattice attacks (LLL/BKZ/etc) are becoming even more prevalent in cryptanalysis as they are the best known attacks against next-gen cryptosystems like NTRU, or anything based on the Learning-with-Errors problem, which includes schemes with "fun" properties like full P/poly homomorphism, attribute/predicate encryption, etc.

</comment></comment><comment><USER4> For context, LLL was used to prove that polynomial factorization can be solved in polynomial time. That is, given r(x) such that:

        r(x) = p(x) * q(x)

where the coefficients of each factor are integral:

        p_i, q_i in Z

LLL can be used to find p(x) and q(x) only given r(x).

There are other problems that LLL solves and there are more modern lattice reduction algorithms (PSLQ, etc.) but LLL was one of the first.

<comment><USER5> _There are other problems that LLL solves_

My favourite is integer relationship finding. For example, if you stumble across the value _194.927424491_ it's straightforward to figure out that it is pi * 23 + e * 29 + sqrt(2) * 31.

<comment><USER3> So, solving CVP? That's a pretty neat application, though.

<comment><USER6> The typical way you'd solve that would be to take

        [K * pi      1 0 0]
        [K * e       0 1 0]
        [K * sqrt(2) 0 0 1]
        [K * 194.927424491 0 0 0]

for some large-ish K, say 2^20, and look for a short(est) vector of this lattice. Basically you're minimizing the norm of (a * pi + b * e + c * sqrt(2) + d * 194.927424491, a, b, c) while giving the majority of the weight to the first component, which you hope to be near 0.

<comment><USER5> _look for a short(est) vector of this lattice_

Just to elaborate slightly on this: Finding the shortest vector in a lattice is (in general) hard, but finding a vector which is _no more than a constant times the length of the shortest vector_ is easy. So techniques which rely on lattice reduction usually construct a lattice such that the shortest vector is much shorter than the second-shortest vector -- in other words, the shortest vector is the only one which satisfies the "no more than X times the length of the shortest vector" condition.

In the case of integer relation finding, this translates into having enough digits and making the value K large enough.</comment></comment></comment></comment></comment>


Show HN: Easily add auth checks to any react component - <AUTHOR> https://github.com/hasura/react-check-auth <comment><AUTHOR> Author here: We had implemented this using redux before and then moved to the new context API. This pattern of passing user information in a standard way is very cool for reusability.

<comment><USER2> This is exactly what I was looking for. I was getting tired of passing user data around manually since I was using Firebase auth.

Now I want to switch from Vue back to React 16.</comment></comment>


Nginx Tutorial: Developing Modules - <AUTHOR> http://www.airpair.com/nginx/extending-nginx-tutorial

<comment><USER2> I would also like to see this approach in Lua by comparison. I find the performance loss negligible compared to the ease of writing / debugging Lua.

</comment><comment><USER3> In a cursory glance, this appears to be logic (token, redis, etc) that can be handled by Nginx+Lua. Is there any reason to do it this way vs the other?

<comment><USER4> The intent was to demonstrate how to write a module in C. This can be solved with Lua as well.

<comment><USER3> I was hoping for a performance related answer, but you are right. I might walk through this and see if one way is faster than the other. Thanks!

</comment></comment></comment><comment><USER5> I love how this tutorial starts by writing an automated integration test. More tutorials should do this. A fine job. Have a cookie.

</comment><comment><USER6> Excellent tutorial, thank you for posting. All tutorials should be this complete.

</comment><comment><USER7> thanks for this. It came in just at the right time as I was looking into this.

</comment><comment><USER8> Thanks for the video.

</comment><comment><USER9> This looks awesome!

</comment><comment><USER10> awesome video!</comment>


Up - Painlessly Setup Your Ruby Environment - <AUTHOR> http://up.jenius.me/

<comment><USER2> Great! Was a bit concerned about running a script off the web but it seemed to work with a few errors here and there.

<comment><AUTHOR> I guess I should've mentioned that's it's open source. <https://github.com/jenius/up/> You can see exactly what commands it's running. Could you add the errors you had into the Issues?

</comment></comment><comment><AUTHOR> Just wanted to share, what I think, is a great tool for quickly setting up a Ruby environment!</comment>


Directed Graph of Which Human Language Is Incomprehensible to Most People - <AUTHOR> http://languagelog.ldc.upenn.edu/nll/?p=1024

<comment><USER2> Remember, this is not a directed graph reflecting language fluency or anything like that. It only shows what the most common figure of speech in that language is.

So English -> "It's Greek to me." Chinese -> 《跟天书一样》

Others here. <http://www.omniglot.com/language/idioms/incomprehensible.php>

</comment><comment><USER3> "The suggestion that the Spanish-American word gringo comes from the expression "hablar en griego""

False. We say "está en chino" (it's in chinese).

<comment><USER4> The author of the post draws a lot of his examples from a page at Omniglot. The table there (link below) shows variation for a number of languages. Spanish in particular offers both Greek and Chinese as "incomprehensible" languages. Portuguese also offers Greek and Chinese. Slovenian has "Spanish village" and Chinese. (That odd phrase - "Spanish village" - shows up in Macedonian, too.) Greek has Chinese and Arabic.

In the comments to the Language Log post, a few German speakers describe variation in German as regional, and that may be true for the differences above.

Anyhow, the Omniglot table is here:

<http://www.omniglot.com/language/idioms/incomprehensible.php>

</comment></comment><comment><USER5> Hindi is not 'incomprehensible' to Arabic speakers. I reckon more of them can get by in Hindi than Farsi or Turkish. Urdu and Hindi are everywhere.

Arabs use Chinese ("Sini") as the archetype incomprehensible language.

<comment><USER6> And according to the graph, is there no language that is incomprehensible to Hindi speakers?

</comment></comment><comment><USER7> Cool. I'd love to see the nodes arranged geographically.

</comment><comment><USER8> I wonder if there is a connection between English as the 'international language of business' and how the graph shows that no one finds it incomprehensible.

<comment><USER9> I doubt it. These are all pretty much figures of speech that have been in most of these languages for a while.

It would be interesting to attempt to find historical references for them and see when they came into common use.

<comment><USER10> It definitely singles out older languages.

</comment></comment></comment><comment><USER11> I love the way Chinese is the only language that considers itself to be difficult.

<comment><USER12> Chinese is the perl of natural languages. (Pun intended)

<comment><USER13> So is German the Java of natural languages?

</comment></comment></comment><comment><USER14> I'm sort of disappointed the graph isn't connected.</comment>