Movfuscator – Single instruction C compiler - <AUTHOR> https://github.com/xoreaxeaxeax/movfuscator <comment><USER2> Of course, no post like this is complete without OISC:

[https://en.wikipedia.org/wiki/One_instruction_set_computer](https://en.wikipedia.org/wiki/One_instruction_set_computer)

(Then, there's my contribution: NISC -- the Null Instruction Set Computer! It's a revolutionary architecture, in that die sizes and TDP can be scaled down, seemingly arbitrarily, with no loss in functionality. In fact, NISC can transcend the solid state entirely, and be implemented directly on the quantum foam of the vacuum!

Another benefit: NISC machines are entirely immune to all buffer overflow and use after free exploits! In fact, they are free of all exploits, whatsoever!)

<comment><USER3> Nope, it's trivial to DoS them. Attackers don't even have to do anything.

<comment><USER4> If the attackers can't do anything how will they DoS them? Wait I think I understand now how it can be implemented on the directly on the quantum foam of the vacuum.

<comment><USER5> It doesn't matter that they can't do anything if they don't need to do anything. Things attackers can't do only matter if they'd need to do them.

<comment><USER2> Newsflash: NISC system weathers huge DDOS attack, _with no discernible effects!_

 _> Things attackers can't do only matter if they'd need to do them._

BUT, by the same token, things attackers _can_ do don't matter either! NISC computers: So advanced, they make all attackers _meaningless!_

</comment></comment></comment></comment></comment><comment><USER6> Best part of the project is at the bottom, in the FAQ:

> Q: Why did you make this? A: I thought it would be funny.

<comment><USER7> This is real hacker news.

</comment></comment><comment><USER8> Without taking anything away from the author, calling MOV a "single instruction" stretches things quite a bit. It's more of a big family of instructions that happen to share an assembly mnemonic.

<comment><USER2> _MOV a "single instruction" stretches things quite a bit. It's more of a big family of instructions that happen to share an assembly mnemonic._

But if you look at the serious attempts to implement OISC, you'll find that the "single instruction" has so many parameters, some might think it might as well be a big family of instructions.

<comment><USER9> new OISC instruction: RUN <x86 instruction you want to run> <parameters>

<comment><USER2> That was like one of my professor's version of Object Oriented programming. He would simply message pass to his undergrad assistant, Mark. "Mark, code up an X."

</comment></comment></comment></comment><comment><USER10> I'd recommend the video presentation linked off the page, where he walks through how he actually turned mov into a machine. It's very weird and interesting!

[https://www.youtube.com/watch?v=R7EEoWg6Ekk](https://www.youtube.com/watch?v=R7EEoWg6Ekk)

<comment><USER11> I love how he nonchalantly throws in a 0-day x86 PoC in the end.

</comment></comment><comment><USER12> So as there's no branch prediction, this is good defense against spectre type attacks?

<comment><USER13> For a certain value of "good", yes.

> This is thought to be entirely secure against the Meltdown and Spectre CPU > vulnerabilities, which require speculative execution on branch instructions.

> The mov-only DOOM renders approximately one frame every 7 hours, so playing > this version requires somewhat increased patience.

[https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali...](https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom)

<comment><USER14> Should be good enough for console players.

</comment></comment></comment><comment><USER15> in a similar vein, here is an exmple program that runs using only x86 CPU faults.

[https://github.com/jbangert/trapcc](https://github.com/jbangert/trapcc)

</comment><comment><USER16> [https://hn.algolia.com/?query=movfuscator&sort=byPopularity](https://hn.algolia.com/?query=movfuscator&sort=byPopularity)

</comment><comment><USER17> Who would win: the world's most popular CISC architecture or one MOVey boi?

</comment><comment><USER18> This is awesome and it gets posted periodically. Previous discussion:

[https://news.ycombinator.com/item?id=12372242](https://news.ycombinator.com/item?id=12372242)

</comment><comment><USER19> On a slight tangent, I remember minimal lambda languages like Iota, Jot and Zot that I think were derived from Unlambda.

</comment><comment><USER20> Ha! This is actually pretty darn clever!

I wonder what the final binary sizes are in comparison to normal GCC compilation, as well as execution speed.

I can't believe you made a floating point emulator just for this as well! Quite impressed.

<comment><USER11> Considering that the floating point library is big enough to be disabled by default tells me you might run out of disk space compiling a single application.

That being said, if this can increase difficulty of sidechannel attacks and branch prediction, maybe it'd actually make sense for very isolated parts of some services.

<comment><USER20> >That being said, if this can increase difficulty of sidechannel attacks and branch prediction, maybe it'd actually make sense for very isolated parts of some services.

I agree, I can see how it certain special circumstances/services this could be very useful.

However, I still expect someone to compile Quake with it by the end of the year.

<comment><USER21> They've apparently done DOOM already, and it's hours per frame. I don't want to think what Quake would be like.

</comment></comment></comment></comment><comment><USER22> Why haven't Single Instruction-Set architectures taken off?

If mov is Turing Complete it seems like there'd be a big win here... You could parallelize this massively.

Edit: can someone explain why this is being down voted please, because this is a legit question

<comment><USER23> They're impractical and massively inefficient?

<comment><USER22> Okay?

I'm asking because I don't know; can you elaborate on why that is?

Aren't most modern GPUs similar in that they're designed to just shit out triangles as fast as possible, massively parallel?

<comment><USER24> > "can you elaborate on why that is?"

Might as-well suggest we use a single letter, instead of 26.

<comment><USER25> .... --- .-- .- -... --- ..- - - .-- ---?

<comment> munk-a ............... .............. .....

............. ......... ....... ........ ....................

....................... ............... ................. ...........

</comment></comment></comment></comment></comment></comment><comment><USER26> At first look, the code produced by Movfuscator is mind boggling. But despite its perceived entanglement there exist some deobfuscators that bring the code back to Harvard (e.g. human readable) model.

TL/DR obfuscation by translating a program to "mov" instructions is susceptible to static analysis and thus fully reversible.

<comment><USER27> > there exist some deobfuscators that bring the code back

Care to elaborate? The author of Movfuscator is very experienced and capable at reverse engineering. In one of his video talks he hits some Movfuscated code with some tools and says he doesn't know of anything that can deobfuscate it. That may have changed since then -- I'd be curious to know.

<comment><USER28> There's the demovfuscator: [https://kirschju.re/demov](https://kirschju.re/demov)

<comment><USER27> Thanks! That's really cool.</comment></comment></comment></comment>


Ask HN: Custom labeled flash drives/cds/dvds - <AUTHOR>

does anyone know any good suppliers for these that would print ones corporate logo on it? I haven't taken the time to look yet, I'd like to get some recommendations. <comment><USER2> I was recently researching DVD replication. I haven't ordered anything yet, but from a price perspective these two looked good. Both offer custom printing on the disk.

<http://www.newcyberian.com> <http://www.nationwidedisc.com/>

</comment><comment><USER3> Google for it.

There are thousands of these companies out there. I've always just gone with the cheapest company at the time for the product/qty I wanted.</comment>


Interview with Michael Fogus - <AUTHOR> http://blog.fogcreek.com/dev-life-interview-with-michael-fogus/ <comment><USER2>
        struct SLevHeader {
          uint32		mUnknown1; //always 0?
          uint32		mUnknown2; //might represent a bank or collective size

          uint32		mNodeCount; //28 bytes each
          uint32		mPlaneCount; //40 bytes each
          ...

I remember picking filetypes apart by browsing through C header files to 'steal' images and sounds from games.

Which brings me to my question, how did developers manage revisions and migrations of datafiles and code back then? I'd love to hear about some homegrown tools. These days you could just store all the parts of a WAD file in a SQL database!

<comment><USER3> Your question brings to mind this post about using hashes for strings... and getting collisions :)

[http://cbloomrants.blogspot.se/2010/11/11-19-10-games- withou...](http://cbloomrants.blogspot.se/2010/11/11-19-10-games-without- strings.html)

</comment></comment><comment><USER2> >> 'hacked G2'

I love Pilot pens, anyone have an idea of what he would have done to it?

<comment><USER4> [http://www.instructables.com/id/Save-$200-in-2-minutes- and-h...](http://www.instructables.com/id/Save-$200-in-2-minutes-and-have-the- worlds-best-wr/)

Probably that. Take mont blanc refil, put in G2. I have one on my desk and it works wonderful for the 8 words I write per month.

<comment><USER5> Your link seems to be broken: [http://www.instructables.com/id/Save-200-in-2-Minutes-and- ha...](http://www.instructables.com/id/Save-200-in-2-Minutes-and-have-the- Worlds-Best-W/)

</comment></comment></comment><comment><USER6> I love that Fogus is into the Violent Femmes, my coworkers think its an odd band to listen to while coding.</comment>


Are paid social networks the future? | Time Wasting Chronicles - <AUTHOR> http://timewastingchronicles.wordpress.com/2013/07/03/are-paid-social-networks-the-future/#respond <comment><USER2> Maybe I'm wrong but you can't beat free...Besides, since FB is worth 112$ billion, it means it works. I don't think people care about privacy enough to pay a subscription. And don't think those websites are bulletproof.

<comment><AUTHOR> Free definitely has its advantages. I guess it's more about awareness since many people don't really know the cost of free. But you could be right. People just don't care

</comment></comment><comment><USER3> What if I don't care about privacy?

<comment><AUTHOR> Well then thats your choice. But the more incidents we have where people who don't know this end up being caught by surprise the more I think people will care and want another option.</comment></comment>


Show HN: Run PyAnnotate in your pytest test suite, autogenerate type annotations - <AUTHOR> https://github.com/kensho-technologies/pytest-annotate <comment><AUTHOR> OP and author here. This work extends Dropbox's recently-published PyAnnotate tool by making it super easy to run as part of your tests.

It's as easy as:

      pip install pytest-annotate

      py.test --annotate-output ./annotations.json</comment>


Email's not sexy - <AUTHOR> http://blog.joellehman.com/index.php/2011/11/emails-not-sexy/

<comment><USER2> This is something that has been bothering me for a decade. and I know what is wrong with it. The problem is not the technology. It would be trivial to fix email technology.

The problem is the people running email servers. They're the worst anti- social, celibate, neckbeard stereotype you can possibly imagine. and they fear change - trust me I've tried.

It would be so trivial to simply remove many of the options in a modern email system (do you really need uucp at all today?) and produce an email server that could be setup by anyone.

In fact, I would suggest someone begin a new protocol by building a hybrid mailserver. One that supports the ancient smtp/pop/imap stuff, and that supports a new utopia protocol. At the EHLO foo.com split off into your new utopia. The neck beards will fight you tooth and nail against that though. Simple way around that though - target the users.

Good luck to anyone who tries. The challenge is not technical, it's social.

</comment><comment><USER3> Email is indeed one of those dead things that just keeps on going because the network effect driving it is so strong.

Most improvements to email have taken place in walled gardens like Facebook and enterprise products like Exchange and do not benefit everybody.

Google Wave incorporated some of these ideas and even combined mail and IM into one communication medium, but alas it never took off.

A viable replacement needs to:

1\. be an open protocol 2\. do everything email can do and more 3\. be open to future enhancements 4\. play nice with the current email infrastructure 5\. be easy to setup/install/administer

It's more of a marketing problem than a technical problem. We already know how to help people communicate. We need to create something worth adopting over email.

<comment><AUTHOR> I agree, I think in the next few years _something_ will be able to fill this gap. And maybe the problem is adoption right now.

Anything we're not really excited about and is based on ancient paradigms (email is exactly what you would think electronic version of regular mail would be like) seems ripe for replacement, although getting people to jump from something so deeply engrained into a lifestyle is difficult.</comment></comment>


Review my app: MockupTiger - <AUTHOR> http://www.mockuptiger.com/wireframe/mockups/mt.php?x=DEMO

<comment><USER2> Seems like a useful app and it works pretty well. Others have mentioned the font, but in general I think if you worked with a designer on improving the overally appearance and the design of the different elements, the app would benefit greatly.

<comment><AUTHOR> thank you. not being a designer I tried to keep it basic. Can you point out any specific design/appearance issue. Is it the interface or the widgets?

<comment><USER2> I was thinking primarily the widgets. I'd check out a program like Omnigraffle or Visio to get a sense of the kind of objects they have there and see the visual style that they are using. I am assuming this is kinda meant to be a lightweight replacement for one of those.

</comment></comment></comment><comment><USER3> Is there a grid at all? It make it hard to line things up. I was trying to select more than one object, to try aligning, but I couldn't figure out how. No shift click or option click or command click.

<comment><AUTHOR> Thank you for trying it out The grid is there under the container section <http://www.mockuptiger.com/how-to-build-table-grids> You can use the rubberband to select multiple and then use the align buttons in the top toolbar. You can use ctrl+click. Shift click is not supported.

<comment><USER3> Ah, sorry, I didn't mean a grid in a table. I meant a "snap to" grid so you line up elements like you were using 960.gs, for example.

Also, control+click isn't working for me (Firefox 5/Mac).

<comment><AUTHOR> ok, yes snap to grid will be added soon. It is there but not enabled for this demo

</comment></comment></comment></comment><comment><USER4> Seems like it could be useful with some polishing, but I can't get past the Comic Sans.

<comment><AUTHOR> @skylervm

You will be able to change the font. I just set the initial font but never got to change it. sorry about that

</comment></comment><comment><AUTHOR> Hi All, just released the beta

I made it easy for everyone to check it out. If you wish you can also download the application on your desktop using this link <http://tinyurl.com/3f4rcco>

You can also register for the full access <http://www.mockuptiger.com/wireframe/mockups/register.php>

Let me know what you think. :)

Thanks

</comment><comment><AUTHOR> Please use Firefox or chrome. IE is not supported as it uses HTML5 canvas element. Sorry for the inconvenience

</comment><comment><AUTHOR> @cschmidt - Thank you for trying it out The grid is there under the container section <http://www.mockuptiger.com/how-to-build-table-grids>

You can use the rubberband to select multiple and then use the align buttons in the top toolbar.

You can use ctrl+click. Shift click is not supported.

</comment><comment><AUTHOR> What is a better handwritten font that I could use from this list?

[http://www.google.com/webfonts?subset=latin&category=han...](http://www.google.com/webfonts?subset=latin&category=handwriting)

</comment><comment><USER5> Remove comic sans and it will be awesome. Make use of Google WebFonts.

<comment><AUTHOR> thanks very much. I will replace comic sans tonight :)</comment></comment>


Windows 10 "Developer Mode" - <AUTHOR> http://www.hanselman.com/blog/Windows10DeveloperMode.aspx <comment><USER3> There are so many annoying if not dangerous default settings (like hiding known file extensions, virus.pdf.exe appears as "virus.pdf") that like many people I have scripts to do that. Microsoft would help me more by making the system more scriptable (try setting the sound mode to No Sound in script!).

<comment><USER4> In case you just want to disable all sound, in Powershell.

Get-Service -Name Audiosrv | Stop-Service -Force

Windows is quite scriptable, it is just a matter of knowning the right knobs.

[https://blogs.technet.microsoft.com/heyscriptingguy/2013/03/...](https://blogs.technet.microsoft.com/heyscriptingguy/2013/03/01/use- powershell-to-explore-windows-audio-drivers/)

<comment><USER3> I do not think this turns off the windows sounds. It shuts down all audio, including non OS sounds. I just want to get rid of the annoying click noises and beeps.

There is a registry setting that sets the control panel to no sound but it has no practical effect. The only suggestion I found that works is to delete the wav files, but that's kind of messy

<comment><USER5> Open the volume mixer and set "System Sounds" to 0?

<comment><USER3> I can also open the sound control panel and set windows to no sound.

We are discussing about automating changing the default settings of windows. Not of how to change them manually through the UI.

<comment><USER6> All of the Windows shell supports UI automation, so if you run into corner cases like this that aren't scriptable, you can just use PowerShell to automate the clicks.

</comment></comment></comment></comment></comment></comment><comment><USER7> Having left the Windows ecosystem 7 years ago or so, I couldn't be more confused these days when sporadically having to use it. For the reasons mentioned here: all power user features are burried. Though it's very debatable if full paths and hidden files should be that much tucked away to begin with.

<comment><USER4> All successful desktop operating systems tend to cater for the use cases of the common man.

Those people that don't even know what save means and scatter files across all devices in the locations suggested by the applications, using whatever was suggested as default name.

These are the people that macOS, Windows, Ubuntu/GNOME, browser based OS cater for.

I share the same feeling every time I have to dig into Chrome or Firefox settings, specially on Canary.

<comment><USER8> That's why they all kind of suck.

I mean, there's a tradeoff - by catering to the use cases of the common man, you're limiting them to _your_ interpretation of what the common man's use cases are. Computers are tools for creative problem solving - limit them too much, and you're literally taking away almost all the reasons to have one.

I particularly dislike ideas like "hide full path of folders" or hiding extensions for known file types - because it's in fact confusing the common man in a misguided attempt to help them. The filesystem and the way the OS interacts with it is a set of abstractions. Hierarchical folders and associating files to programs via name extensions isn't that hard to grasp. But when you obscure that abstraction, paper over it with some nice display features, you're taking away the ability of a common man to ever understand what's going on. When before one could be expected to maybe figure out a mental model for those things, now it's close to impossible - because the OS is lying or refusing to divulge essential information.

So I actually agree with dozzie's parallel comment. By treating users like idiots, we're turning them into idiots. And since "pros" are a market niche, we're literally turning mainstream computing into toys for idiots. It's a waste of potential, IMO.

<comment><USER9> Hiding file extensions is uniquely dangerous on Windows as the file extension is the canonical reference of what type something is. Change the .doc to .exe and the system will try to treat it as an executable. At least on other systems it's a convenience and the system identifies type and executable bit in somewhat more robust ways.

<comment><USER8> Yes, that's true too. It's a common Windows malware distribution vector - <USER2> actors send files with names like "photo.jpg.exe" or even "photo.exe", with the icon resource in executable's metadata set to look like default image icon, or even a thumbnail of some real photo.

<comment><USER4> Not only on Windows, on other OSes as well.

Many developers don't rely on the OS API to check the file contents and use a simple extension checking.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is nice, but I still want a "Shibboleet" switch where a single action sets lots of settings to what a developer is likely to want. Then I can focus on a few deltas, rather than a whole raft of individual settings and configuration changes made, usually, over the course of a week or two. [https://xkcd.com/806/](https://xkcd.com/806/)

<comment><USER11> Isn't that what developer mode is? A switch to set lots of settings that a developer is likely to want.

<comment><USER12> I think we may be confusing "power-user who uses Windows" versus "developer employed by Microsoft to debug and develop Windows".

</comment></comment></comment><comment><USER13> For better or worse, instrumenting Windows and analyzing the telemetry is what enables features like this to be developed scientifically rather than based on superstition, whimsy, or prejudice. It's the same principle found in Google Analytics, Tesla's latest models, and the Juno space probe. Good data makes informed decisions more likely. It has to come from somewheres.

TANSTAAFL.

<comment><USER14> The problem with telemetry/analytics is not that they exist. The problem is, no one knows what they do, and everyone's afraid they may send something sensitive.

Give me a dialog somewhere, in which I would be able to see what's going to be sent (in somewhat human-readable format - i.e. not binary but a slightly commented source for that binary), a place to ask questions ("hey, there's a weird long hex string among the data - what does it encode?") and I'll be completely satisfied, and even praise them for doing things the smart and conscious-user-friendly way.

Well, as long as telemetry doesn't send something I consider sensitive, like an actual screenshots or keystrokes, of course.

<comment><USER15> Individual events in analytics data may be human-readable, but you can't call a list of 10,000 events human-readable.

<comment><USER16> Does 'grep' have an analog in Microsoft-world?

<comment><USER17> Windows has Select-String in Powershell and findstr in cmd.

</comment></comment></comment></comment></comment><comment><USER18> To those complaining about missing file extensions, etc...can I mention that OSX does the same thing by default, and this drives me crazy as well.

Are we trying to make it so users can barely understand the rudimentary concepts of computing before jumping in to using them?

The iPad is a similar situation. :/

<comment><USER19> It seems to me like the obvious way to handle file extensions is to hide them by default, have an option to show them, and always show them when the file is being renamed. The hoops you have to jump through to change a file extension in MacOS are excessive.

<comment><USER20> I think the main reason Windows hides them is to prevent users from changing or deleting them while renaming files.

Inadvertently changing a file extension often "breaks" the file for inexperienced users.

</comment></comment></comment><comment><USER21> Scott seems to be very excited about this and very happy that he can formally declare himself to be a developer and have it done with, but I can't disagree more. You shouldn't have to formally declare yourself as a developer, because there are a lot of developers and programmers and power users who are not formally developers. If I click "developer mode" and I formally declare myself as a developer, that's a lie because I am not.

I've won awards at work before for creating scripts to automate a certain part of our team's workflow, saving hours each time we have to perform a certain action. But if I was a formal developer, that would just be my job. I'd get no special recognition for it. But I did get special recognition, because I am not a developer by trade.

I don't want to make a _formal declaration that I am a developer_ because formally, I am not. But I'd like to side load apps, see the full path, use Remote Desktop (is that a developer thing? Always seemed like more of a sysadmin thing, I use it every day) and keep my PC awake all the time.

None of those things are developer-specific features. None of them include "install gcc++" or "download Visual Studio" or "change Notepad to vim". What I'd rather make is a formal declaration that I _own this computer_ , not that I am a software developer.

\- edit - apparently everyone replying to me failed to read the article. My response is not to Microsoft's decision to call it "developer mode" but Scott's decision to call it a "formal declaration that I'm a developer".

<comment><USER22> It's just a checkbox that's called "developer mode", it's not really the same as formally declaring yourself a developer. The important and interesting thing here is that there is a general power-user mode with shortcuts for people who know about advanced computer usage. That you own the computer is not a good measure of your capabilities with it, that would probably be a pretty confusing checkbox for the vast majority of users. I guess you have a point about the naming, but it needs to be (from msft point of view) some kind of name that doesn't tempt non-technical people to enable it.

<comment><USER21> Did you read the article? Where Scott, the author, said verbatim:

"it's got amazing potential, again as a _formal declaration that I am a developer_."

That's what I'm responding to.

</comment></comment></comment><comment><USER23> Previous experience tells me that developers will use this "feature" and write software that requires users to have it enabled.

Previous examples for example being software that requires Microsoft SQL server to be installed on client machines as the software needs certain dll files that comes with Microsoft SQL server.

<comment><USER24> > Previous examples for example being software that requires Microsoft SQL > server to be installed on client machines as the software needs certain dll > files that comes with Microsoft SQL server.

I don't think this is true, Microsoft ship all the client-side components of SQL Server as a bunch of MSIs you can pick-and-choose between. Since at least SQL Server 2005 [1].

[1] [https://www.microsoft.com/en- au/download/details.aspx?id=247...](https://www.microsoft.com/en- au/download/details.aspx?id=24793)

</comment></comment><comment><USER25> Anyone have an idea why they are catering to developers so much, when their treatment of users in general has become so much worse over the past year?

I mean, I guess, developers are sort of the only demographic which could realistically switch to another operating system, and since they are also users, Microsoft kind of has to make up for the assholish treatment that they've been giving users in general, but it seems still quite extreme, if it's only for that reason.

Could be, though, that I'm just suffering from the usual "All others are more naïve than I am"-syndrome, as I myself am for example still far away from ever wanting anything to do with Microsoft again, and I wasn't really opposed to Microsoft before the Windows 10 shitshow either...

<comment><USER26> The success of an operating system depends on the availability of other applications. By extra focus on developers they are hoping to grow the ecosystem.

At least that's my understanding of it.

</comment></comment><comment><USER27> So Microsoft begins to realize that developers should be helped instead of letting them suffer? They should have done that a few years ago, before most sane persons turned Windows down and never looked back.

</comment><comment><USER28> So are there any disadvantages to developer mode? The other "developer mode" that lets you load unsigned kernel modules is very keen to remind you that it's on and I believe it disables a couple of things.

<comment><USER5> It looks like they just put a bunch of the irritating-to-find settings that you always need to change from vanilla to do any real work in one place, rather than scattered across folder settings, registry hacks, group policy and and all the other control panel sections that they were hidden in.

</comment></comment><comment><USER29> Windows 7 has already a Developer mode (called "God Mode"):

      1. Create a new folder

      2. Rename the folder to

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

      3. Double-click on it, the God Mode control panel window opens

Probably Microsoft forgot about it.

<comment><USER30> That isn't a developer mode. Nor is it called "GodMode". It's just a way to view control panel applets as a list rather than a hierarchy. It's the same as the search results list that's filtered when you search for something. It give you nothing that isn't available in the normal control panel, it's just a different view. The important part is the GUID, the part of the name before the period doesn't matter - you can replace "GodMode" with anything you like.

<comment><USER29> The GodMode allows one to access many useful settings from a curated grouped single list view that isn't available anywhere else. The hidden feature is available since WinNT 6 (Vista).

The Win10 DevMode doesn't give you anything that isn't already available from the control panels too. The whole point is, that it's accessable from one page.

And for Win9x (95,98,ME) there were the far more powerful TweakUI tool from Raymond Chan hosted on microsoft.com. An updated improved TweakUI for WinXP was available as part of the PowerToys collection from microsoft.com as well.

Don't downplay my comment. The GUID triva info doesn't add anything and is well known to many Win devs.

<comment><USER31> > curated grouped single list view that isn't available anywhere else

Yes it is. Via the search box in Control Panel. Microsoft calls it "All Tasks" and it is literally just that, all Control Panel tasks as a list.

> The hidden feature is available since WinNT 6 (Vista).

Coincidentally when they added the search box to Control Panel...

> The Win10 DevMode doesn't give you anything that isn't already available > from the control panels too.

Incorrect. Developer Mode enables sideload apps, debugging apps, remote debugging, and remote debug discovery. There is nowhere else (aside from the registry) to enable these development settings.

> Don't downplay my comment.

The so called "Godmode" trick is useless, it shouldn't be shared. People can already open Control Panel and search, same thing.</comment></comment></comment></comment>


UI Design for Startups - Monthly Service - <AUTHOR> http://fairpixels.pro/?ref=Mail <comment><USER2> Voting rings are not ok here.

<comment><USER3> Quite right, I did wonder how this post had shot so far up the home page so quickly when it's clearly marketing a service.

</comment></comment><comment><USER4> I don't think this can work. The idea is nice but usually you want someone "inhouse" that knows about the business, the customers and can craft a solution for them.

Additionally I think this is very overpriced. I mean "(Without having to pay $6,000/mo+ for an in-house UI designer)" is completely absurd. Here in Germany a proper designer will be happy with a 3k/mo salary, since there are so many and the market is competitive and crowded with good designers... so I would rather bring someone on board full-time than paying nearly the same amount to a external firm, where you never know what happens.

Also oftentimes you need something "fast", so a 3-4 days wait time is not working most of the time.

</comment><comment><USER5> So I'm in the market for a service like this, but the presentation/pricing is a little bit wrong for me. I'd rather have less "unlimited" access and more speed when I do need service. I'd also like to see more examples and more about the designers. The design challenge we have is maintaining consistency across different interfaces, so having a designer on retainer is appealing. But I could probably accomplish the same thing for 1/2 the price on an outsourcing site.

Also, the headers and site payment buttons are broken on Safari.

</comment><comment><USER6> This is an interesting idea for companies that just want a cookie-cutter product design for your MVP. Past that, good product design requires a level of business/user problem solving that no service like this could possibility fulfill.

<comment><USER7> In my experience "cookie-cutter" (in other words "consistent") UI is more effective than custom UI most of the time.

Absent A/B testing - which isn't part of most product design processes - there's no utility gained from deviating from conventional UI for common elements like dropdowns, buttons, lists, links, and the like. In my anecdotal experience there's more often a negative impact on the utility of custom or unconventional UI design, usually because the user is confused or not familiar with novel UI design.

Put simply, is it effective to reinvent web forms for every product? I don't think so.

</comment></comment><comment><USER8> Not the first time I've seen a service like this. Main site design itself doesn't resonate with me, although the multiple sample images do.

Some nitpicks/thoughts:

* I would have to have a Mac and Sketch to use this. Not unheard of that people will be using other types of services (why not provide me actual web assets?)

* pricing - $2k/month is... it's not unreasonable but for 4 day turnaround time, I may not actually get as much values as working with a local freelancer who has a more transparent workload (and maybe has references I trust).

* Arguing against "on-staff $80k/year designer", then charging $5k/month for 24hr turnaround... it's not a huge savings. Benefit may be I can switch designers from FPP - to get different styles/abilities, but that's not made obvious anywhere I can see. We don't all live in SV, and many areas you can find a reasonably priced designer who you can meet in person for less than $5k/month (I've worked with some).

Not sure who the target audience is here - the unfunded startups I've worked with would not spend $5k/month, and would even balk at $2k/month for a 4 day turnaround time. The funded startups I know would just hire someone, because that's what the funding was for (hiring a team).

</comment><comment><USER9> I'm pretty skeptical of design work that doesn't involve close dev interaction/iteration.

And especially for mobile apps there are things that are outside of just 'design' and I feel they would introduce a lot of variability in the amount of work involved per-project. How does a flat fee take that into account? Things like:

\- responsive design: scaling to different phone/tablet sizes

\- aligning to Android/iOS conventions (e.g. should not allow swipe-from- bottom on iOS)

\- animations

\- sound

\- theming

Does this all come with every project as part of the fee for, example, the 'Startup' package? If _none_ of this comes with any of the packages then I think the prices for each package should definitely be lower.

I like the idea though - the unlimited revisions part was pleasantly surprising. I'm not sure how that would scale for the business but it sounds nice :)

<comment><USER4> Their own website ist not even properly responsive so I wouldn't expect too much.

</comment></comment><comment><USER10> I hope this works. I would love to offer something web development wise but packaging those services this way probably doesn't make sense.

</comment><comment><USER11> looks broken [https://imgur.com/a/Ndm5z](https://imgur.com/a/Ndm5z)</comment>


Google makes progress on image search - <AUTHOR> http://www.bloggingstocks.com/2008/04/27/google-makes-progress-on-image-search/

<comment><USER2> Whoever cracks the image analysis algorithm will be the king. There are so many applications for this its crazy. I did an internship one year at Intel working on Image Analysis algorithm optimization. Even though we were not super accurate with our algorithms, it was obvious that this is going to be a big thing and the computer hardware would play a big role.

Any one here working on Image analysis algorithms?

<comment><USER3> I am. I expect to post the first version of my startup within a few months here.

It's indeed a very exciting area to be in.

</comment></comment><comment><USER4> This Google work was previously posted a little over a month ago:

<http://news.ycombinator.com/item?id=176367>

Also, it was one of the topics of Norvig's talk at YC's Startup School:

[http://www.omnisio.com/startupschool08/peter-norvig-at- start...](http://www.omnisio.com/startupschool08/peter-norvig-at-startup- school-08)

(Skip to slide 6 to get right to the image search segment.)</comment>


An ultimate privacy hack – just requires a monitor and 3D glasses [video] - <AUTHOR> http://www.winextra.com/archives/an-ultimate-privacy-hack-just-requires-a-monitor-and-3d-glasses-video/

<comment><USER2> Why do you need 3D glasses? Couldn't you use any frame?</comment>


"First tweet from my iPad/Kindle/Nexus/Surface" - <AUTHOR> http://i.imgur.com/cg6O5.jpg <comment><USER2> How do you know when somebody is an <x> user?

They'll tell you!</comment>


Brigate: Event-Driven Scripting for Kubernetes (JS) - <AUTHOR> https://brigade.sh/ <comment><AUTHOR> [https://github.com/brigadecore/kashti](https://github.com/brigadecore/kashti) Dashboard for your Brigade pipelines</comment>


Insights from analyzing NYC Subway delay notices every 10 minutes for a month - <AUTHOR> https://readypipe.com/blog/subway-january-2019/ <comment><USER2> I told you last thread not to clickbait headlines ([https://news.ycombinator.com/item?id=19058260](https://news.ycombinator.com/item?id=19058260)) and you did it again.

EDIT: You changed it to "Insights from analyzing NYC Subway delay notices every 10 minutes for a month" which does not match the article title.

EDIT2: Titles are now matched.

<comment><AUTHOR> Apologies - I just updated now to be more in line with what you suggested last time.

EDIT: the original post and the title here are now the same</comment></comment>


Automatically Valgrinding code with AX_VALGRIND_CHECK - <AUTHOR> https://tecnocode.co.uk/2014/12/23/automatically-valgrinding-code-with-ax_valgrind_check/

<comment><USER2> Good initiative, but automake is meant to generate POSIX-compatible Makefiles and this is very heavy on the GNUisms.

<comment><USER3> To be fair, for all the platforms supported by Valgrind[1] there's a GNU Make port available and assuming GNU Make (or any modern Make, fwiw) saves a lot of headaches. :)

That said, I'm sure that excluding non-GNU Makes is not intentional here and it's only due to the fact that the macro has been developed on Linux by a Linux developer: interested parties are welcome to join the effort and provide patches to clean up GNUism.

[1] [http://valgrind.org/info/platforms.html](http://valgrind.org/info/platforms.html)</comment></comment>


Update on Bitcoin Cash - <AUTHOR> https://blog.coinbase.com/update-on-bitcoin-cash-8a67a7e8dbdf <comment><USER2> I have been a long time coinbase user. I have been very unhappy with their support. I have been unable to add additional funds to buy both additional ethereum and btc from their site, even after contacting them repeatedly about this ... but never getting a reply. I did multiple identity verifications and connected bank and credit cards. No luck in being able to transact properly. Bitcoin Cash was a forcing function and last week I sent my funds to a private wallet. I am also buying additional crypto on Gemini and other exchanges. To give an idea of my frustration with them, I first tried to buy ethereum thru then at $40. I gave them benefit of the doubt in solving my issues ... and waited and waited. By the time I realized that they were not listening to me, ether had shot up to more than $200. I ultimately bought on Gemini. This was their business to lose and they did exactly that.

<comment><USER3> I, too, have had terrible past experiences with Coinbase and I no longer use them. I now buy on Gemini for fiat -> BTC and use other exchanges for altcoins. That said, I no longer keep _any_ crypto on any exchange, including Gemini. The whole point of Bitcoin is that you are your own bank via ownership of your private keys. By giving them to Coinbase, you centralize the system, concentrate the risk, and create honeypots for hackers. Remember, the government doesn't insure Bitcoin balances like it does with USD in banks and so much Bitcoin has been lost via exchange hacks in the past few years.

Don't let centralized authorities keep your private keys.

<comment><USER4> Given the high profile attacks on crypto exchanges over recent years, how much trust do you place in Gemini securing your SSN, proof of ID, and proof of address?

<comment><USER3> Not very much, but only because those are byproducts of a cryptocurrency hack. If they didn't control centralized private keys and thus implicitly have one of the biggest bug bounties, I would be less worried about people hacking my SSN, ID, etc. from Gemini.

That said, I also don't care as much if those get hacked as I can recover from stolen identity, while it's impossible to get back stolen bitcoin.

</comment></comment></comment></comment><comment><USER5> Is there a viable alternative to Coinbase? Their support is absurdly awful. Two months and they sent two auto-replies to a simple ticket that couldn't be answered by the knowledge base. They don't care about your money - so long as it's already in their vault.

<comment><USER6> VP Ops at Coinbase

We are trying to scale our support team as quickly as possible. Wish I had a better answer for you. [https://blog.coinbase.com/improving-customer- support-139d99e...](https://blog.coinbase.com/improving-customer- support-139d99e72876)

If you still need help with your issue, send me an email (in my profile).

<comment><USER7> biggest thing you need to do to improve support is stop sending mailings from a no-reply email address. Replying should create a support ticket automatically if the email it came from is associated with an account. Further verification could be required depending on the request.

<comment><USER8> > stop sending mailings from a no-reply email address

This should be a general rule for the whole internet.

<comment><USER9> I think sending from a no-reply with a reply-to defined works though.

</comment></comment></comment></comment></comment><comment><USER10> Honestly, I don't understand why everyone trashes Coinbase.

I work very closely with numerous crypto exchanges for a living (I write code which interfaces with them). Outside of work, I've personally chosen to open a Coinbase account and trade on GDAX.

Coinbase is, in my opinion, the most reputable exchange out there by far.

<comment><USER11> I generally agree here, but 1. their buy/sell ACH fees are insane, 2. They're always the first to go down in those high panic button situations that have been happening every other week since may. FWIW, Kraken may require a wire, but my money always gets in the exchange for $5, and site is more reliable... the fees are 80% cheaper.

<comment><USER12> > their buy/sell ACH fees are insane

It's a form of price discrimination. Only ignorant end-consumers pay the crazy broker fees. Anyone slightly sophisticated deposits USD via ACH (nearly free) and then transfers to GDAX and does their trading there (0-0.25%).

</comment></comment></comment><comment><USER13> Coinbase is a horrific company: they give the superficial impression of being a reputable place to hold money, but one can go months at a time without a human response to support queries despite holding a substantial balance with them.

I cannot warn other potential victims of Coinbase strongly enough; hopefully the chaos and incompetence around BCC will alert people more publicly about the dangers of getting entangled with them. Hold your cryptocurrency in your own wallet that you control yourself.

</comment><comment><USER14> Say what you will about Coinbase, but I really appreciate their willingness to adapt and respond to customer feedback.

I personally didn't want to take on the risk of creating a paper wallet and having to move my small amount of BTC from my Coinbase vault, so this is great news for me.

<comment><USER15> Taking 5 months to enable trading doesn't seem like "adoption"

<comment><USER16> You should visit the headquarters of some slow-moving enterprises.

<comment><USER15> Slow moving enterprises in technology world are an age old phenomena. Even - long established, waterfall pattern following - enterprises are acknowledging this and speeding up their cycles. In the current world of fast pace technology, one cannot justify by giving such examples.

</comment></comment></comment></comment><comment><USER17> Coinbase could easily avoid, or be unable to, provide BCH balances to their bitcoin holding customers.

There's no telling how Coinbase operates internally. You can't just assume that 1 customer == 1 permanent bitcoin address in Coinbase's backend. Perhaps they shift funds around all the time into new addresses, without keeping references/keys to the old ones. In that case, BCH balances would be lost, with no way to restore them to the 'owner' at the time of the fork.

Luckily (for would-be BCH holders) that seems to not be the case, but I think Coinbase deserves credit for going the extra mile when they could justifiably say that it is not their problem to deal with.

<comment><USER18> > without keeping references/keys to the old ones

You are correct, but this would be a new level of stupid for a leading cyrptocurrency exchange that actually tries to build a reputation and appearance of quality, safety, compliance and being a "legit" service for financial institutions etc.

</comment></comment><comment><USER19> Maybe I'm just not getting something in my slow brain, hopefully someone here can explain. How does taking out my BTC out of CoinBase ensure I will receive an equivalent amount of BCH?

I bought 200$ worth of BTC in the past from CB, and promptly moved to an Exchange. Does that mean I will get whatever amount of BTC I purchased back then in BCH? If so, why? I understand there was a fork, but I don't get why I'm entitled to the same amount of BCH... what if there are more forks in the future, I'll just keep getting more of those offshoot coins as well?

<comment><USER20> You got a lot of replies, but I don't see one critical point addressed. You said you moved from Coinbase (no internal caps) to an exchange. So we can't tell whether you'll get any BCH. If you don't know the private keys for your funds, then you can't spend those funds. You can only ask whoever has your funds to spend them on your behalf. Coinbase hasn't implemented the infrastructure to spend from anything but the main chain. We don't know whether the exchange you're using has, either.

Someone at Coinbase is slapping their forehead right now reading your story because you pretty much jumped out of the frying pan into the fire when you transferred from Coinbase to an exchange (rather than a wallet you control). That's exactly what Coinbase _didn't_ want you to do if you wanted full control over your funds.

<comment><USER12> > Someone at Coinbase is slapping their forehead right now reading your story > because you pretty much jumped out of the frying pan into the fire when you > transferred from Coinbase to an exchange (rather than a wallet you control)

Actually, transferring from Coinbase to an exchange was the correct move. If you transferred BTC before the fork to an exchange that quickly implemented BCH trading you would have been credited and been able to trade right away. People (like me) who did the 'correct thing' and withdrew to their own wallets now have to wait days to deposit to a BCH exchange and will likely never see $700 BCH again.

<comment><USER20> Your statement is completely right, but the way the question was asked, OP probably didn't know whether it was an exchange "that quickly implemented BCH trading." So maybe a better analogy is being in the frying pan and pressing the hyperspace button.

By the way, why would you need to wait to sell a BCH deposit? That confirms almost immediately, right? I could understand AML/KYC on a cash withdrawal, but incoming crypto is zero risk to the exchange.

<comment><USER12> Takes 80h to confirm because of the low hash rate on the fork.

<comment><USER20> Doh. I thought the fork code had a built-in contingency for a quick difficulty adjustment in case of slow blocks. Maybe I just dreamed that.

</comment></comment></comment></comment></comment></comment><comment><USER21> So does this mean the cost of a lawsuit was deemed greater than the cost of adding support for BCC?

<comment><USER20> That's awfully cynical. They took a wait and see approach. Would you run your engineering team any differently? How do you tell a viable fork from the (many) others that have failed? If BCH falls to $10 in two weeks, would you still direct your engineers to support it?

<comment><USER21> > That's awfully cynical.

If you knew me in person you'd know the cynicism was intentional. I've got quite a bit to start with and double so when it comes to anything involving digital currencies.

> They took a wait and see approach. Would you run your engineering team any > differently?

On the contrary, I agreed with it. I said as much the day before: [https://news.ycombinator.com/item?id=14915884](https://news.ycombinator.com/item?id=14915884)

> How do you tell a viable fork from the (many) others that have failed? If > BCH falls to $10 in two weeks, would you still direct your engineers to > support it?

I don't think it's possible to tell after less than a day if it's a viable fork. It's way too early. That's why I'm thinking this is driven more from the perceived cost of lawsuits vs. the development cost of supporting the feature.

<comment><USER20> I see. I made this point somewhere else in this thread, but there's no lawsuit threat because of the terms of service (just arbitration), and if someone were a big fish but asleep at the wheel for the last few months, Coinbase could easily make them whole quickly by just manually sending them the BCH they wanted. Engineering full support as they're doing almost surely costs more than any conceivable loss customers could suffer in the interim (assuming anyone with a nontrivial balance takes responsibility for their actions or inaction).

</comment></comment></comment></comment><comment><USER22> Dumb question:

Supposing BCC eventually becomes of comparable value to BTC, does this mean everyone's fortune was just doubled?

<comment><USER23> Only if you believe BTC would've been at that same value without the fork.

<comment><USER24> Right. It's like a stock split, except the company actually splits into two essentially identical competitors.

No matter which competitor "wins", your assets should keep the same total value they had before.

<comment><USER25> Unless the competitors increase the whole market (increasing total value) or—as is plausible with a cryptocurrency with netomwork effects—the lack of a single clear choice _reduces_ the overall value of the market compared to a don't clear choice that everyone uses.

<comment><USER24> Yep. It might not be zero-sum.

</comment></comment></comment></comment></comment><comment><USER26> so inflation comes in terms of forks in the realm of crypto currencies.

Isn't it how it started with gold-based government currencies as well? every government created their own currency/fork of gold.

edit: typo, inflation

<comment><USER27> Do you mean inflation ? Crypto currency space is new still, forks are innovation and competition. That is good.

<comment><USER27> Can someone who understands pros and cons of bcc vs btc explain to me ( us ) which one of the two is more likely to scale / win ?

<comment><USER28> they are two diferent ways to solve the same scalability problem, Btc doubles the current number of transactions by increasing the block from 1mb to 2mb and adds a new service the segregated witnesses that allows off-the-chain private transactions, Bcc simply increases the block to 8mb for roughly 8x times more transactions.

<comment><USER29> It's a quite a bit more complicated than just increasing the block size to 8mb, actually, and in reality Bitcoin Cash ended up using one of SegWit's key changes in modified form.

The default Bitcoin signature algorithm has quadratic performance due to repeated hashing and if the block size is increased above 1MB an attacker can use this in a fairly nasty DoS attack that, worst case, might be able to fork the blockchain. The BTC/SegWit side fixes this by creating a new transaction type that moves the signatures outside the main block into a separate "witness" and uses more efficient signature hashing. The new transactions appear to older nodes as though they simply didn't require signatures, so existing software keeps working. This also fixes an annoying issue called "transaction malleability" which allows attackers to change the transaction IDs of other people's transactions; all of the data hashed to compute the transaction ID is now signed. It's apparently this malleability fix that makes off-chain payments easier.

BCH essentially replaces the original signature hashing algorithm with the SegWit one but keeps the signatures in the block. Bitcoin also has a hard cap on the number of expensive CHECKSIG operations that can be carried out to prevent DoS attacks and both sides take different approaches to raising that, neither of which is straightforward.

<comment><USER30> Just to test my understanding: Segwit essentially moves the signature in a transaction (and changes what is being signed). This fixes most "transaction malleability" problems. Transaction malleability means that one of the nodes in the bitcoin network can change some of the information in the transaction. It can't change where the money is coming from, where the money is going, or how much the transaction is for, but it _can_ change some of the other information in the transaction.

It also appears that there were some proposals related to SegWit that advocated putting the signatures in a separate block, but the actual implemented SegWit does _not_ do this. Instead it simply moves the signature to the end of the transaction (which allows them to fix most of the malleability issues).

There are many proposals for scaling bitcoin. One of the proposals is to increase the size of the blocks. Segwit _also_ does this by changing how much the signature "counts" as part of the block size. This will allow blocks to be roughly 2mb in size.

Most other scaling techniques can't currently be implemented because they rely on the transaction not being malleable. If SegWit is successful, then these other scaling techniques could be used (but they don't have to be).

It appears that one of the things some people don't like about SegWit is that it was introduced as a "soft fork". This means that it won't be activated in the client unless 95% of the clients support it. Some people feel that this will never happen because some miners are against SegWit. There are also other proposals for fixing the malleability issues and so there isn't a complete consensus about how it should be done (some people appear to complain that the implementation of SegWit is too complicated).

So instead on waiting for other scaling techniques, BCH has advocated a hard fork which increases the block size, but that does not address the transaction malleability problem. Some people have suggested that increasing the block size is the only thing necessary for scaling bitcoin and that other scaling techniques are unwanted.

My understanding is that SegWit will not, in itself, solve the scaling issue other than making a small increase in the block size (effectively doubling it), but that it paves the way for other techniques later (none of which have been decided on yet, but there are working implementations of several).

Is that accurate?

<comment><USER29> More or less, except that the reason Bitcoin Cash happened is that SegWit seems almost certain to be activated at this point as a result of interesting political wranglings. The other subtle detail is that older nodes see a stripped version of SegWit blocks with the "witness" parts of the transactions removed, and it's this block that they apply the 1MB limit to. So while the signatures technically aren't part of a seperate block, they're not part of the main block either. This is why the non-witness part of transactions has to count as being more expensive.

<comment><USER30> Ah. I see! Thank you for that. It makes complete sense now. I was wondering why they had such a convoluted method for calculating the block size.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> Summary:

"Over the last several days, we've examined all of the relevant issues and have decided to work on adding support for bitcoin cash for Coinbase customers. We are planning to have support for bitcoin cash by January 1, 2018, assuming no additional risks emerge during that time."

</comment><comment><USER32> Does this mean that customers in a short position owe Bitcoin Cash?

<comment><USER33> Matt Levine at Bloomberg wrote a fascinating piece on this yesterday:

[https://www.bloomberg.com/view/articles/2017-08-02/bitcoin-e...](https://www.bloomberg.com/view/articles/2017-08-02/bitcoin- exchange-had-too-many-bitcoins)

It's an interesting read even if you don't care about shorts or bitcoin at all.

<comment><USER34> I wonder if this was a big part of why coinbase decided not to support BCH initially.

This really is an interesting situation. In the hours approaching the BCH fork an absolutely massive number of short positions were opened on various bitcoin exchanges, but the price remained steady. I assumed people were shorting in expectation of a crash, but the outlined scenario makes much more sense.

Similarly to the trade outlined in the article, if you already held bitcoin, you could short the equivalent amount and you would still receive bitcoin cash. This trade also had the nice side effect of your exposure to fiat currency staying flat through all the potential fluctuation.

<comment><USER35> Who was loaning BCH? What exchange could you borrow BCH on?

<comment><USER36> > _What exchange could you borrow BCH on?_

Anyone who borrowed BTC may have implicitly borrowed BCH. Suppose Person A owns shares in OldCo. Person B borrows those shares and sells them short to Person C. OldCo spins out NewCo. On Thursday evening, you go to bed with 1 OldCo share in your account; Friday morning, you wake up with 1 OldCo share and 1 NewCo share.

Bought Person A and Person C own OldCo shares, and so expect to receive one NewCo share. The company provides one. Who provides the other? The short seller. Presumably by buying Person A's NewCo shares. Same thing happens with dividends.

So if you borrowed BTC pre-fork and returned it post-fork, you're may find yourself owing BCH. Shorting is complicated, which is why I'm bemused by its proliferation around a blockchain that doesn't even natively support lending or interest rates.

</comment></comment></comment></comment></comment><comment><USER37> So many people in this thread complaining about coinbase when I've had no issues with them. You people complaining about coinbase must have not been around when Mt.Gox was the only option. If you want to talk about lack of support... Now that's lack of support.

<comment><USER3> I don't see how this is a valid argument. So what if Mt.Gox was worse? The point is there are many better exchanges than both Mt.Gox and Coinbase nowadays from a fees, customer-support, and reliability perspective.

Coinbase has three major advantages: (1) incredible marketing, (2) flashy and good UX, and (3) (claimed) safety via cold storage.

The first (1) is a counter argument in my book, (2) is irrelevant, and (3) only matters if you let them control your private keys, which is stupid and the antithesis to Bitcoin.

</comment></comment><comment><USER38> _" We are planning to have support for bitcoin cash by January 1, 2018, assuming no additional risks emerge during that time. Once supported, customers will be able to withdraw bitcoin cash."_

They are so going to get sued if the price of Bitcoin Cash crashes by the end of the year. Where do they get off telling customers they can't withdraw an asset for five months?

This is what lawyers call "conversion"[1]. _A person who knowingly or intentionally exerts unauthorized control over property of another person commits criminal conversion. The element of knowledge is found when the accused person engages in the conduct and he /she is aware of a high probability that he/she is doing so. An essential element of criminal conversion is that "the property must be owned by another and the conversion thereof must be without the consent and against the will of the party, to whom the property belongs, coupled with the fraudulent intent to deprive the owner of the property."_

It's legally equivalent to theft.[2] The typical example of conversion is renting something and then refusing to return it.

Coinbase execs, you really need to be talking to good securities lawyers.

[1] [https://conversion.uslegal.com/criminal- conversion/](https://conversion.uslegal.com/criminal-conversion/) [2] [https://www.justice.gov/usam/criminal-resource- manual-1317-n...](https://www.justice.gov/usam/criminal-resource- manual-1317-national-stolen-property-act-stolen-converted-taken-fraud)

<comment><USER39> > Where do they get off telling customers they can't withdraw an asset for > five months?

When they say it will take them time to implement, it's an honest statement. They literally have to implement software, do lots of code review, check their accounting, pentesting, or at least they should be doing these things, and 5 months is an unusually short timeline. Even if they took 10% as fee to hire extra developers to work on this project, 5 months is not guaranteeable at all.

The short timelines proposed for hard-forks is one of the reasons why so many bitcoin developers have voiced caution about hard-fork proposals: [https://en.bitcoin.it/wiki/Segwit_support](https://en.bitcoin.it/wiki/Segwit_support) (far right columns)

Cryptsy was quickly installing random altcoins on their servers until one of the 200 coins they installed ended up being malware (a reverse shell or whatever) and poof goes their exchange, plus or minus some other possible fraud occurring. There is value to caution and review when upgrading software systems.... much less financial systems. With backwards-compatible upgrades, you can be more certain about the net impacts. For example, if the changes were compatible with the pre-existing bitcoin rules, then none of this new coin stuff would have happened, and the whole industry could benefit from the compatible upgrades.

<comment><USER40> Not to mention that anyone can create a new bitcoin-fork.

Animats-coin could be created and supported by 2 machines. Is Coinbase obligated to support it just because you have a couple graphics cards and forked code?

If so, there are many near-worthless bitcoin variants and forked chains they aren't supporting.

Whenever someone gets rainbows in their eyes about the magic of the blockchain, I can't help but think "you can imagine the perfect, utopian future - the same one we imagined about the internet in 1994 - but none of the unintended side effects."

</comment></comment></comment><comment><USER41> At first I was like, why a whole year?!

Then I realized there is a little less than 5 months left of 2017... Time is fucking flying!

</comment><comment><USER42> When Ethereum Classic hit the markets Coinbase did the same, ignoring it first, then giving in, however it turned out because of missing replay protection (thanks to vitalik) Coinbase had to buy back ETC on other markets first. Feel free to draw your conclusions based on this information.

</comment><comment><USER43> Do you think this mean they will support ethereum classic? I don't see how the two are different.

<comment><USER44> They added Ethereum after the fork while they had Bitcoin before the Bitcoin Cash fork: [https://blog.coinbase.com/coinbase-adds-support-for- ethereum...](https://blog.coinbase.com/coinbase-adds-support-for- ethereum-b8046cf486d0)

<comment><USER43> Ah jeez you're right. Thanks for the reminder.

</comment></comment></comment><comment><USER45> Good on them. Finally some integrity in the cryptocoin exchange market.

</comment><comment><USER46> Where do I buy Bitcoin Cash today from a reputable exchange?

<comment><USER47> I'd say Bittrex is the most reputable out there.

</comment></comment><comment><USER48> What an inconvenient waste of time trying to be proactive and moving my BTC out of Coinbase ahead of the fork -- just like Coinbase said to. Would have been nice if they could have decided this before hand...

<comment><USER20> Moving out of Coinbase took you fewer keystrokes than typing that comment.

<comment><USER48> Right, withdrawal is easy. Figuring out how to actually claim my BCC was a (figurative) eternity. Appreciate your dismissive attitude though! Bottom line, Coinbase could have made this easy. It's not like this was some random fork by some nobody faction. I want crypto coins to succeed and it won't happen as long as we have to manage our own wallets and such.

<comment><USER20> You make it sound like adding support at the level they have for their other currencies is something they can do on a whim. Unless you've worked in commercial software, that's a forgivable attitude, but it's very far from reality for a company like Coinbase that is establishing a brand of trust and stability, not chasing the latest sparkly fork (of which there are many) and saying oops sorry when they screw up by moving too fast.

"It's not like this was some random fork by some nobody faction." That's Monday-morning quarterbacking, and in fact we have no idea whether we're at halftime or end of game for BCH. Results-oriented thinking like that is one step away from cargo-culting.

"Figuring out how to actually claim my BCC was a (figurative) eternity." Right, so imagine having to solve that same problem for a million or so users in less time than it took you for yourself.

<comment><USER48> Nope, not even asking for the level of support they have for BTC/ETH/LTC. I was talking a simple ability to access/withdraw out the BCC post-fork.

I do work in consumer software and I stand by my recommendation. I'm pretty sure they wish they would have just done it to start with PR-wise. No doubt it will be a hassle for them but being willing to take on the right hassles is what inspires loyalty from consumers like me.

I don't understand how it's "Monday-morning quarterbacking". I mean it's not controversial to say this fork was a long time coming and had a solid bloc of support. Coinbase is basically implicitly agreeing here that they should have done this to start or at least publicly left it open to support BCC should it prove legitimate. It's almost like they came out against to try to make it go away "these aren't the droids you are looking for"-style.

Just for the record, I've enjoyed using GDAX/Coinbase thus far to trade the coins they do support.

<comment><USER20> We're not going to agree on this because we interpret the facts differently. We agree companies should take on only "the right hassles," but I remain far from convinced, even today, that this is one of the right ones for Coinbase.

You think "a simple ability" takes less time. I think making it simple actually takes even more time, especially when Coinbase has a history of indemnifying its customers even when it wasn't responsible for the loss (GDAX/ETH flash crash), which means that a bare-bones tool with a ton of CYA documentation isn't going to cut it for them.

You saw a "solid bloc of support." I saw a fracas of tweets, bitcoin.org posts, and /r/b* proselytizing on many sides (not just for/against BCH but also for/against the other BIPs, as well as other things unilaterally calling themselves "consensus" or "agreement"). I'm still not convinced anyone but ViaBTC is in it for real ([https://www.coindesk.com/even-miners-hate-bitcoin- cash-might...](https://www.coindesk.com/even-miners-hate-bitcoin-cash-might- want-mine/)).

You probably believe BCH is currently valued in the mid-$200s. I see a thin market controlled primarily by exchanges imposing extremely conservative deposit requirements (up to 20 confirmations) that happen to function nicely as supply controls as well, and while I can't predict the future, I doubt an unconstrained market would send the price upward at this point.

Remember, the point of BCH was to make day-to-day on-chain transactions a realistic, scalable proposition. We're not even close to that being a reality, even in contrived pizza-buying scenarios. I'm still concerned that this fork will make exasperated merchants nope their way out of cryptocurrencies entirely, especially when intermediaries like BitPay face the practical usability nightmare of BCH and BTC addresses being visually identical.

Bitcoin has its practical use cases that have been hard-won over nearly a decade. Ethereum's elevator pitch is ICOs. Both of them have clear reasons to exist. But Bitcoin Cash's pitch at this point is "like Bitcoin but without the network effects." I understand where it wants to go, but for now it's just a speculative vehicle, and I understand why Coinbase doesn't want to help enable that usage.

<comment><USER48> Oh but we are going to agree on this because...I'm opening my mind to what you are saying. Way too much energy behind this for you to just be some guy trying to win an argument on the Internet. Thanks for the perspectives.

<comment><USER20> :) Be well.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER49> Can we stop with this Coinbase spam?

</comment><comment><USER50> Question: if Coinbase never claimed the Bitcoin Cash, would there be any grounds for a lawsuit?

<comment><USER51> They don't have to claim it. Purely by controlling the addresses that held BTC at the time of the fork, Coinbase controls the BCH that magicked into existence.

The issue is that BCH belongs to the original owner of the BTC it was forked from. Despite Coinbase _telling people to withdraw their BTC if they wanted the BCH_ a lot of people no-doubt now feel aggrieved that they're unable to access the new theoretical windfall.

<comment><USER50> How is that not bullshit though? Like, if I were a company that didn't want to take a side, had projects in the pipeline, and didn't want to have to build out infrastructure, extra warnings, and educational content for the speculators that will probably send BCH <-> XBT, I don't see why I can't tell all the BCH enthusiasts that my company won't redeem the BCH, and to send their funds out so that they can redeem the BCH they're entitled to.

It costs a lot of man hours to add infrastructure work for that, and they're setting a precedent that they'll support every single fork that people speculate with.

I personally think this is lazyman bullshit where people harp about how Coinbase being amicable with the feds are bad until they want to file suit lol. People who were knowledgeable enough about the fork but too lazy to learn how to move their Bitcoin out, not have their private keys stolen/lost, and redeem the coins on two chains without fucking up feel entitled to free money that costs Coinbase man hours and technical debt. Despite all ideals about them technically controlling the BCH, they should be able to draft a legal document placing their licensing at stake that asserts they're not claiming customer BCH and get back to answering my limit increase email.

*Disclaimer: I don't work for Coinbase or a Bitcoin company

</comment></comment></comment><comment><USER52> And all it took was the threat of a lawsuit.

<comment><USER53> Now we see how many other forks rise up and demand inclusion.

<comment><USER54> It doesn't work that way. BCC isn't just any fork. It has large miner and industry support.

<comment><USER53> ... and you don't think this'll set a precedent with those miners and industry folks to support other forks?

</comment></comment></comment></comment><comment><USER55> coinbase's android app is utter shit. sorry but had to say it

<comment><USER56> What other trading platform has a good android app?

<comment><USER55> bitstamp worked pretty fine, if I don't remember wrong

</comment></comment></comment><comment><USER57> lost my faith with bitcoin and ethereum due to chain split

Ripple's XRP will win

</comment><comment><USER58> Bitcoin cash is BCH not BCC.

<comment><USER58> I originally wrote this comment because BCC has been reserved for BitConnect prior to the existence of Bitcoin Cash.

Looks like BitConnect might need to come up with a new short-name?

</comment></comment><comment><USER59> I'm a blockchain money noob. From my stand point this virtual money looks like pure speculation. Nice to see that ressource limitation can be bypassed by forking. So this speculation seams doomed to me.

<comment><USER60> Do you believe that stock splits are also creating money?

</comment></comment><comment><USER61> They reversed stance so quickly, it seems plausible this was a calculated move to increase news coverage of Coinbase.

<comment><USER20> There was a slightly different amount of information available in the time you call "so quickly."

Any "calculated move" that involves repeated pleas to one's own customers to withdraw all their assets from one's platform to protect themselves from that move... well, you can characterize that as well as I can.

<comment><USER61> I admit that "calculated" might be a stretch, considering how far off their delivery date is. Despite that, the original announcement could have been more realistic ("we might support it soon ") but it wouldn't have made nearly as many headlines.

It does seem like they're understaffed. Maybe they were hoping the fork would wither away quickly and they wouldn't need to deal with it. As one of the largest exchanges they should have better contingency planning than that.

I hope they continue to succeed because I do like Coinbase.</comment></comment></comment>


Ask HN: Mental fatgue after a long day, what do you do to sharpen your brain? - <AUTHOR>

I'm curious what HN users use to wake-up or re-sharpen their mind after a long morning. I usually hit the afternoon wall and am trying to get some ways to sharpen/stimulate my mind when I hit that wall. Chemical suggestions are welcome, but I'm really trying to collect a group of activities.
Activities I've found useful:
- The game SET (there's something about the pace and focus)
- Ping Pong (focus and response time)
- Kneeling to standing jumps (speed of the movement is oddly refreshing and stimulating)
- Walks/Jogs/Gym-time (I find these refreshing, not  great at sharpening/stimulating my mind)
Looking forward to other things to try. <comment><USER2> Do you consume caffeine? I found quitting it to be very painful, but it got rid of the 'afternoon wall'. Now I feel equally exhausted all day.

<comment><AUTHOR> I do, maybe one coffee per day. I'll try to go two weeks with no caffeine.

I find snacking throughout the day helps a lot for consistency of energy (been known to forget to eat for most of some days...not good).

</comment></comment><comment><USER3> Eat healthy. Seriously, the fatigue is almost-always due to crashing blood sugar. Very rarely are we working hard enough to actually be mentally exhausted (like those 4hr physics exams in school).

Eat healthy != whole grains and carbs. Eat veggies and protein. Balance your blood sugar through the day and you'll 100% better.

<comment><USER4> Anecdote, but still - ketosis in combination w/ resistance training and solid sleep made me increase my productivity by 85% for the past ~8 months. To be honest, this discovery is probably one of the best things in my life. However, I would emphasis on "eat healthy fats and veggies".

<comment><AUTHOR> Great anecdote.

I'm playing with ketosis/fasting at the moment. Right I now am waiting to eat till early afternoon and then grazing the rest of the day. I still find I need to refocus sometime between 3-5. Trying a caffeine-nap seems like a good thing to explore for me.

</comment></comment></comment><comment><USER5> I find 15 minute naps the most effective way to reset and have a productive rest of the day. I don't do it every day, but I can feel when I need one and am operating at lower effectiveness. Anything longer is bad though - if you do 30+ minutes you're in danger of hours of grogginess. You may not feel the immediate benefit of a short nap, but you'll notice if you think about it an hour later how much fresher you are.

Some people don't seem able to take naps. My advice is: give it a few tries. For me it took a few attempts for my brain to figure out how to shut down like that. And some days it just doesn't happen.

I've found nothing better than taking some caffeine and immediately taking a power nap. When the refresh from both hit about 45 minutes later, it's like starting the day over, energy-wise.

</comment><comment><USER6> Swimming - easy to get into a pattern, almost meditative in a way.

</comment><comment><USER7> TLDR. Keep an healthy diet, and exercise. Sleep enough.

Im lucky to have a gym 10 meters from our office, so 3 times a week i use my lunch ti go to the gym, and eat afterwards something light at the office, i try to go jogging twice a week on to of the gym.

Try to eat a fiber rich diet, if you choose to exercise. And never pass breakfast. Its important, the most important meal of the day.

Now for the mental part, here the most important thing is to sleep. Dont watch TV, read a book instead.

</comment><comment><USER8> I'm not an exerciser. I'd love to be but am not.

I'm not doing this now but when was working on my startup and working a regular job, I was taking "caffeine naps" at 4:30. There was something about this time of day which was magical in terms of how tired I was and how much extra productive time it granted me through twilight.

</comment><comment><USER9> Hello, ever tried with a short siesta? When your brain is tired, nothing beats some sleeping. Some caffeine may follow.

<comment><AUTHOR> I nap often (in the sun too). I find there's nothing quite like a stimulating activity though.

There's interesting research on caffeine-naps (or nappucinos). Empirically, these are useful--[http://www.huffingtonpost.com/2014/09/03/coffee-sleep- power-...](http://www.huffingtonpost.com/2014/09/03/coffee-sleep-power-naps- science_n_5753360.html)

</comment></comment><comment><USER10> I practice Taoist Tai Chi every week and meditate as much as possible (not enough)

Both gives me a lot of mental energy!

</comment><comment><USER11> _Kneeling to standing jumps_

Just doing a quick set of push-ups is good too. It doesn't have to be anything fancy, just do it smoothly and with good form.

Sleep is good too. A 20 minute nap after lunch can sometimes work wonders with my attention span and mood.

</comment><comment><USER12> Podcasts, especially funny ones. Laugh a bit at something totally unrelated to the work you're doing. I feed off of the energy of others, like a vampire.

Some of my favorites: No such thing as a fish, Here's the thing, The Bugle.

<comment><USER13> one podcast that i recently discovered: Nerdist podcast

they have weekly guests(I think) mainly consist of comedians!

</comment></comment><comment><USER14> A timed 20 minute nap followed by a shower. Sleep is the only thing that truly recharges mental capacity in my experience. Sleep is 100x more important than the next most important thing.

</comment><comment><USER15> I personally try to meditate. I'm pretty sure I'm not doing it properly but it works. Close your eyes and don't think about anything.

<comment><USER16> It is even easier than trying to empty your mind [https://www.youtube.com/watch?v=D5Fa50oj45s&noredirect=1](https://www.youtube.com/watch?v=D5Fa50oj45s&noredirect=1)

</comment></comment><comment><USER17> I got rid of the afternoon wall by stopping the consumption of carbs. Other than that, rest when it is needed.</comment>


What the coronavirus forcing me into lockdown's taught me about cooking - <AUTHOR> https://www.reddit.com/r/Cooking/comments/f0qjm9/what_the_coronavirus_forcing_me_in_lockdowns/ <comment><AUTHOR> This is probably the most interesting thing I've read since the outbreak started; it's a really fantastic read. I think it gives a more authentic look at what's actually happening in China compared to the average news outlet's columns on it, plus it goes into some really fascinating things on cooking. (The cooking is the main highlight, so maybe I got the order of that list reversed.)</comment>


The Homeless Billionaire - <AUTHOR> http://blogs.wsj.com/wealth/2008/05/19/the-homeless-billionaire/ <comment><USER2> From the article:

 _And of course it's easy for a billionaire to say "money and things aren't important."_

The important thing that they always miss is _why_ its easy. It goes beyond just being able to afford to hotel hop. In a very real sense _everything_ belongs to him. At least everything that is mass producible. This guy doesn't need a car because wherever in the world he is, he can simply say "get me a car" and one will appear. Substitute boat, plane, ham sandwich, whatever and its still true. When you have that much money, "ownership" becomes entirely a matter of semantics.

<comment><USER3> I think in some sense we're all moving towards this model of "ownership", in one way or another.

For example, when it comes to the most easily mass producible thing in the world--information--we're all "billionaires" now. I can ask Google to get me all kinds of information, and it just appears. Even 15 years ago some fairly trivial Google searches would have required privileged access to sources of knowledge (libraries, universities, etc... stuff not always available everywhere in the world) and lots of free time.

There are very few limits (or if there are, we haven't reached them yet) on the reproducibility of information. The marginal cost of reproducing information for another ten or twenty billion human beings is fairly negligible. Will it ever be the case that we can overcome the limits on the reproducibility of material goods? Or are there fundamental constraints on material goods that don't exist for information? If we can overcome them, then one day we will all be "billionaires", in this sense.

EDIT: Amazon Web Services is a good example of this kind of transformation; it's made all of us "millionaires" when it comes to computing. A few years ago, "get me a thousand servers" would have required millions of dollars, a fair amount of time, and a lot of technical expertise. With EC2, it requires $100/hr.

<comment><USER4> > Will it ever be the case that we can overcome the limits on the > reproducibility of material goods? Or are there fundamental constraints on > material goods that don't exist for information?

Yes, in a sense: see reprap.org, and further along in the future, molecular nanotechnology. However, there will always be a (small) cost for the raw materials that go into the finished product.

<comment><USER3> I think I'm fundamentally a pessimist on this front.

I think, for example, that the rising price of oil is a symptom of the absolute physical limits that material resources face.

Some raw materials have a small cost, others have a high cost.

</comment></comment></comment></comment><comment><USER5> By "homeless" they mean "living in 5 star hotels year round".

<comment><USER6> True, although I suppose if they put "houseless" you probably wouldn't have read it...

</comment></comment><comment><USER7> Anyone really serious about being humble would pay his laywers big money to make sure he never appears on the WSJ. I mean seriously this is what they call "substract to add". You give the impression that you dont care for material goods, although ou have spent a lifetime acquiring them. aS a result you become even more famous and richer.

<comment><USER8> Quite the contrary. Only someone who was serious about _appearing_ humble would try to prevent publicity. While the article might not make him appear humble, true humility does not require the appearance of humility.

<comment><USER7> I consider W. Buffett humble. Leaving in the same house you purchased when you were not even a millionaire, let alone the second richest person on earth. Seriously there is not one person on earth who needs more than 5 million to survive. I say pledge the remaining 2.995 billies. And finally is it truly humble to say that you stay in 5 star hotels across the planet.

<comment><USER9> yeah, those people with 4 million have it pretty tough.

you can live very comfortably the rest of your life off of 500,000 even in some of the richest counties in the US if you know how not to squander money.

</comment></comment></comment></comment><comment><USER10> _But his perspective seems to be increasingly common among today's superwealthy — and even wealthy — who are looking for more lasting meaning in their lives beyond their possessions._

I suspect that this is not increasingly common, but rather as common as it ever was. People with money who learn that it doesn't convey lasting meaning will inevitably look for it elsewhere.

</comment><comment><USER11> Here we see the demand side of the equation decreasing. If this spreads, is it actually bad?

<comment><USER12> Depends. Are you in the real estate business or the luxury hotel business?</comment></comment>


Ideas are fragile - <AUTHOR> http://natari.us/post/26962853054/ideas-are-fragile

<comment><USER2> I see what the author is saying, but this seems more like how to protect a fragile ego rather than a fragile idea.

</comment><comment><USER3> Sivers did a ted lighting talk about this: [http://www.ted.com/talks/derek_sivers_keep_your_goals_to_you...](http://www.ted.com/talks/derek_sivers_keep_your_goals_to_yourself.html)

<comment><AUTHOR> Thanks for sharing

</comment></comment><comment><USER4> The best solution is to write the idea down. This will help you remember it later or develop it further. Writing helps you think. So, you might come up with more ideas while writing.

For Mac, I love the full screen mode on the iA Writer. There is no way to spend time formatting your text and no other distractions.

<comment><AUTHOR> Good one.

But I guess it also depends on how your brain is wired...in my case its more visual, so sketching things help me a lot :)

</comment></comment><comment><USER5> I really think this advice depends on the idea and the person. If I had a great idea, and more and more people kept telling me how great it was, I would be even more motivated to go out and make it happen. On the same token, if everybody told me it didn't make sense, that's the type of feedback you need to refine an idea, make it more clear, or even decide to scrap it. At some point you need some sort of outside validation or criticism

On the other end, I agree with the author it's important to spend a lot of time with your idea before you share it. 9 times out of 10 you haven't fleshed it out enough, considered all the angles before it's ready to share, and that's when an idea is really fragile

<comment><AUTHOR> Thanks for your feedback.

I think that its hard to just pitch a idea to somebody else...its all left to their imagination. Better to have already a prototype or something and have people play with that. The feedback will be much more valuable, then just shooting out some draft idea over a beer...you know what I mean!?

</comment></comment><comment><USER6> So is the link... site down (15min after the post)

<comment><AUTHOR> Can't believe Tumblr is not able to handle the traffic :(

sorry man

</comment></comment><comment><USER7> <http://shirt.woot.com/offers/your-ideas>

</comment><comment><USER8> thanks for sharing this!</comment>


Ask HN: When am I qualified to call myself and engineer? - <AUTHOR> <comment><USER2> If you are a real engineer you would already know the answer because there's a defined path. If you are a software developer/programmer that's not engineering, so you can call yourself that whenever you want, it's meaningless. You can also call yourself a ninja or rockstar.

[https://www.theatlantic.com/technology/archive/2015/11/progr...](https://www.theatlantic.com/technology/archive/2015/11/programmers- should-not-call-themselves-engineers/414271/)

</comment><comment><USER3> I assume this is for a role where you can get an engineering license. I would say after passing the requirements in your country that enables you obtain the license, then you can call yourself an engineer.

</comment><comment><USER4> industry perspective (emphasis mechanical/civil/electrical):

degree < 2 years experience: training/require supervision

degree 2 < 5 years: experienced, capable, get responsibility

degree > 5 years: lead positions/expert (if narrow focus)

so i would say degree + 2 years you can say 'engineer' (without training wheels)</comment>


A Five Year Old Discovered An Xbox Security Exploit - <AUTHOR> http://www.engadget.com/2014/04/04/xbox-live-five-year-old-hacker/?ncid=rss_truncated

<comment><USER2> [https://news.ycombinator.com/item?id=7531140](https://news.ycombinator.com/item?id=7531140)</comment>


Show HN: Temple.io – Read, annotate, and search popular religious texts - <AUTHOR> http://temple.io

<comment><USER2> Fascinating - what I'd love to see is the debate (probably in annotations) vs how verses are interpreted.

<comment><AUTHOR> Yeah, still trying to plan out some of the UX.

</comment></comment><comment><USER3> Totally minor point. When you're searching something that doesn't bring up any results, it's just a blank page. It should say something like "No results found" or similar.

<comment><AUTHOR> Thank you, missed that

</comment></comment><comment><USER4> It seems like the search queries against all books, it would be nice to only query the text you're on (or maybe just a checkbox). Very cool though!

<comment><AUTHOR> Still have to work this out. There might be some benefit to actually letting users know the verse or parts of verse they are looking for is also similar to other texts. Still not sure though. But thank you for the point.

</comment></comment><comment><USER5> Very nice clean and simple interface! I'm not religious but this is a pretty awesome reference to link to for use in discussion online. It would be cool to be able to link parts of the text to others and even cross text (to allow for users to link similarities).

<comment><USER6> We would like to implement something like this in the future. A lot of our ideas require building a community first. It's just the two of us, so we need help from the community to improve this site as a resource.

</comment></comment><comment><USER7> Very cool! I had an idea some time ago to create something like hyperpolyglot.org but for philosophic / religious ideas. Any plans on doing something similar?

</comment><comment><USER8> How about having the Bhagavad Gita in Sanskrit (and preferably for me) transliterated Sanskrit (since much of the beauty comes from how it's sung)?

<comment><AUTHOR> Our top priority right now is to get as many of the languages available up :)

</comment></comment><comment><USER9> Great service! I'm really curious to see how the community will interact with it and if serious debate will be discussed.

<comment><USER6> Thanks! We are working on getting more texts, versions, and translations. We also need to work on getting more user interaction and growing a community.

</comment></comment><comment><USER10> Why the King James version??

<comment><USER6> It's the most popular version. We are working on getting more versions up!

</comment></comment><comment><USER11> You must find some way of doing A/B testing ;)

<comment><AUTHOR> note :)

</comment></comment><comment><USER12> Just curious; what did you use to build this?

<comment><USER6> Ruby on Rails, Bootstrap, some python for scraping data.</comment></comment>


Bcrypt - symmetric encryption - <AUTHOR>

I'm investigating whether I can use bcrypt not just for password hashing, but to encrypt database contents as well.
The idea would be to run a strong password through bcrypt (with an appropriately high work factor, so that the operation takes perhaps 10ms), and then use the digest created as a symmetric key to encrypt the database record.
I would obviously NOT store the digest in the database; rather, to authenticate the user, I'd decrypt their database entry and verify that it was correct (something cheap like checking the first few bytes for a known value, for instance).
I would certainly store the work factor and the salt, as those would be needed to re-hash the provided password and generate the symmetric key.
It looks like bcrypt outputs a 186-bit hash (31 base64 chars, and I don't know why it says 184 bits here: http://stackoverflow.com/questions/5881169/storing-a-hashed-password-bcrypt-in-a-database-type-length-of-column).
Not sure if it would it be safe to pad that out and use 192-bit AES as my symmetric algorithm... or is there something insecure about that which I don't realize? Would it make sense to use a different algorithm?
Would love some feedback on whether this scheme makes sense, whether there's something better to do, and any pointers to additional reading. <comment><USER2> Stackoverflow is right: the last two bits are just padding, and not at all unpredictable. AES was not designed to work with a partially-known key, so I wouldn't recommend it.

Unlike bcrypt, PBKDF2 was explicitly designed for this purpose, so I'd recommend using that if you do go this route. It'll also get you a strong 256-bit key (in the correct variant). (If you really want to use bcrypt, just truncate at 128 bits and use AES-128, which is good enough. Really.)

Whether using bcrypt or PBKDF2, you'll want to use a salt, which should be stored in the database. Whether using bcrypt or PBKDF2, some users will choose pitifully weak passwords and allow their data to be decrypted (no password hash can save you if you pick "password" or "iloveyou"). You can more-or-less solve this by integrating e.g. <http://www.openwall.com/passwdqc/>.

All that said, I'm not sure this is a good idea:

\- you expose yourself to DDoS by repeated logins, fixable only by setting the work factor for bcrypt/PBKDF2 dangerously low (100 POST "/create_new_account.php" requests per second is _not_ much);

\- if your front-end machines are compromised, the attacker can gather passwords from legitimate logins, so you still need to secure your front-end machines;

\- encrypting everything that could be useful to an attacker means that you can only use your RDBMS as a networked hash table;

\- crypto is hard, and easy to get subtly wrong.

Then again, implementing this would most likely increase your security quite a bit. Just don't rely on it.

<comment><AUTHOR> Wonderful reply, thank you! Glad to know about PBKDF2. It seems like the right fit.

In this application, I'm actually generating strong passwords and assigning them to users — it's a unique case where that's not a usability concern, and the data is very rarely accessed. My thought with this setup is that I could assign, say, a 64-bit password, which I'd then use to generate longer keys for AES with a purposefully slow algorithm. I'd prefer not to assign users 128-bit AES keys directly because it will be harder for them to deal with the longer string.

In thinking about the code length, I'm trying to form an estimate with rough numbers like so: \- I'd like to be able to generate the AES key in 10 microseconds (I lowered that based on your DDoS concern) \- I'd like a brute- force attack to take 100 years \- An adversary could devote 10,000 times my computing power to cracking (really not sure how to estimate this though... botnets, gpus...)

Given those numbers, my keys need log2(100 years * 10,000 / 10 microseconds) = 62 bits of entropy. So I'd assume 64-bit keys would be secure, if I generate them correctly.

Basically I'm trading off computation time on my server for giving users shorter keys.

I do want to rely on this. Most of the user data should be visible only to the user, although I'll keep some parts (account info) in plaintext or encrypted with a master key. I don't know of a way of avoiding the front-end risk other than making sure to secure it, because the key has to come from the user; only they have it.

Any thoughts on my estimate of the key length and the feasibility of this system?

<comment><USER2> [Sorry, I haven't forgotten about this message, but things are really hectic right now. I'll try to get to it tomorrow.]

<comment><AUTHOR> That is so kind! Thank you for this advice. I'll pay it forward online....</comment></comment></comment></comment>


Ask HN: Is internet down? Cannot ping any major DNS - <AUTHOR> <comment><USER2> Yes, it is a global problem, see [https://news.ycombinator.com/item?id=24322513](https://news.ycombinator.com/item?id=24322513) [https://downdetector.com/](https://downdetector.com/) etc.</comment>