The genetic code now has a workable text editor - <AUTHOR> https://aeon.co/essays/we-now-have-a-good-text-editor-for-your-genetic-code <comment><USER2> What I would like to know, and haven't heard talked about in any of these articles yet, is if it's possible to substantially alter the genome of an already living creature.

This article touches on it briefly at the beginning, but doesn't elaborate on the idea:

> This means it's possible to create genetically modified plants or animals of > practically any species, as well as to modify the cells of adult organisms, > including humans.

But so far, I've seen every article go to great lengths to avoid a very obvious question. Aside from medical cures, is it possible to use this technology for cosmetic purposes? Will I be able to change my eye color permanently? Cure baldness in adult humans? Alter metabolism?

<comment><USER3> >if it's possible to substantially alter the genome of an already living creature.

Yes, but it's tricky right now. The delivery mechanisms are still rough. But for certain applications, in certain tissues, for certain kinds of diseases it is being done today (see Sangamo getting cleared for a gene therapy for hemophilia last week)[1].

Currently we have two ways to direct a genetic payload - one is localized (cellular) control of the actual delivery mechanism, the other is (biologically-relevant) temporal control of when the payload gets 'fired' or used.

Practically, we can strip some kinds of mammalian viruses of their own payload (and their ability to replicate), and utilize their own DNA insertion machinery (which is very nicely evolved to match our physiology) to insert a desired payload into the genome of a live organism. Some tissues are better at receiving specific payloads than others. (If you find a tissue and corresponding virus that delivers a tissue-specific viral infection, we can likely deliver a tissue-specific viral gene therapy to that tissue.)

Once the genetic payload is loaded into the genome we have other ways to control when the payload is actually turned on. We can make the payload sensitive to tissue-kind, or biological timing events, or sensitive to other kinds of biologically relevant environmental cues.

Both of these methods alone, however, are generally leaky. If the changes you are making are critical either for effect, or for preventing off-target effects, then these two methods alone are likely insufficient for a general population therapy to not be a dangerous gamble. The consequences of injecting the wrong code (or the right code to the wrong place) can be fairly catastrophic (induced, and immediate cancer). And that is precisely why a good 'text editor' is valuable.

One intervening point is that most viruses inject their payload into your genome randomly. And if they happen to overwrite some required genetic code of yours they cause cancer. Some viruses actually _intentionally_ overwrite the code for your viral defense mechanisms (see HPV overwriting the P53 gene). In general, random injection of genetic payload into a live organism's genome (source code) is a bad idea.

The ability to have a good 'text editor' means we can now ensure that _if_ the payload gets to the desired cells, then we can insert that payload into the genome in a _desired_ location that is unlikely to cause problems. And since we can further regulate when the payload is fired, we now have 3 levels of control ( 1: localized cellular delivery, 2: localized genetic insertion, 3: biologically controlled activation). And those three levels together can significantly reduce the chance of mis-editing a live organism's genome.

Once these three regulatory mechanisms are made safe enough to not just be used in situations where risk/reward ratio is skewed by the lethality a disease, there is no reason they cannot also be used for an arbitrary biological effect.

[1] [http://investor.sangamo.com/releasedetail.cfm?releaseid=9448...](http://investor.sangamo.com/releasedetail.cfm?releaseid=944828)

<comment><USER4> I made a bet to myself about 30 years ago that the mechanism for gene expression would be found to be describable as a non-linear system. It doesn't sound as if this is a solved problem yet.

<comment><USER3> We understand very well how gene expression works. It's the editing, with precision, in trillions of living cells, without harm, on an entire population, that's tricky. What do you mean by non-linear?

<comment><USER4> > What do you mean by non-linear?

I mean in the mathematical sense [1], if modifying a piece of DNA can still produce unpredictable results then I wouldn't really feel we should claim that we understand how the whole process works.

[1] [https://en.wikipedia.org/wiki/Nonlinear_system](https://en.wikipedia.org/wiki/Nonlinear_system)

<comment><USER3> >Wouldn't really feel we should claim that we understand how the whole process works."

It's more like classical vs quantum mechanics [1]. Both are correct in their limit. And yet we also know that neither is actually _True_. With respect to genetic regulation we understand the largest terms in the non-linear system, and many of the smaller terms. Does that mean we 'understand' it completely? No, but like physics, we understand it 'completely enough' for many engineering purposes. The fun of it is that there are still exceptions and edge-cases to play with and learn from.

[1] [https://en.wikipedia.org/wiki/Correspondence_principle](https://en.wikipedia.org/wiki/Correspondence_principle)

</comment></comment></comment></comment></comment></comment><comment><USER5> It's interesting that searching for "CRISPR" in the essay gives 0 results.

<comment><USER6> Agreed. It's very strange that the article doesn't mention any of the very real recent scientific advancements in this space. I expect better on HN :).

</comment></comment><comment><USER7> It will probably take a century or two of debugging to get human editing right. Generations are just too long.

Backwards compatibility may be a problem. Pfizer people may not be able to mate with Genentech people.

</comment><comment><USER8> Trying to use current computer science to work with biology is like using a hammer to reliably modify the behavior of an ant colony. It may work but only in some special cases.

Even with the Von Neumann model, we already have ecosystems where many things are interdependent. And the difference is that the actors in the ecosystem are all designed by people who coordinate and communicate in other channels. They have common standards etc. Now imagine having some monolithic open source code with all the libraries mixed into it that has been forked many times and trying to have a process that will change some of the source code to achieve a desired effect, reliably in even THREE random forks. How would you know the side effects of all your changes? All you can do is make some very simple change and gather statistics on how often your change leads to more instability and crashes.

You can't just edit an organic system with tons of interdependencies. As humans building software we specifically limit the scope of the dependencies, we make protocols and conventions etc. So we can reason about the impact of a change and make the source code we produce more maintainable. How would this apply with DNA?

<comment><USER9> Computing theory and information theory apply to much more than just Von Neumann architecture computers.

<comment><USER10> ...but to far less in the biological sciences than some computer scientists care to admit. If I have to hear one more talk about how e.g. "natural selection is a highly efficient algorithm", I'm going to shoot myself.

</comment></comment></comment><comment><USER8> Funny that Ctrl X followed by Ctrl V will paste what was there originally after it was cut

</comment><comment><USER11> I am firmly in the terrified camp. "Genetic engineering is not new." Oh yes it is, and it's scary.

</comment><comment><USER12> How can one get started?

<comment><USER13> API Reference: [https://www.addgene.org/crispr/](https://www.addgene.org/crispr/)

Tutorial/Cookbook: [https://www.addgene.org/CRISPR/guide/](https://www.addgene.org/CRISPR/guide/)

</comment></comment><comment><USER14> Next, vim-genetics

</comment><comment><USER15> Relevant XKCD:

[http://xkcd.com/1605/](http://xkcd.com/1605/)

<comment><USER16> The problem with DNA 'source code' is not that it's hard to read, it's that we don't fully know how to read it. Yes, we know what protein sequence comes out but the chemical consequences are not particularly well known. With google's source code, you could, in theory, look at it long enough and have a working understanding down to the level of electrons moving around specific spots in the chips in the Google datacenter.

As a professional (wet) biochemist and also a coder, my personal feeling is that biology is much, much shallower. However, the knowledge required is broader but incomplete. If you're trying to, say optimize an enzyme, beyond molecular biology, you'd do well to incorporate knowledge from biochemistry (is this an active site amino acid? Maybe I shouldn't touch it. What sort of yield changes can I expect if this enzyme catalyzes the rate-determining step vs. not), cell biology (will adding this amino acid sequence send it to the wrong compartment?), biophysics (will changing this residue mess up the protein fold?), electrochemistry (is the electrical potential of this iron- sulfur cluster consistent with the process I want?) etc etc.

A lot of 'biohackers' are script kiddies that just ctrl-c/ctrl-v gene sequences and hope that it works. That's why you see a lot of gene synthesis companies claim a offer of "codon optimizing" a gene. It's something that sounds hard, sounds critical, and gets _something_ done. The rest of it is much, much harder, and requires actual thought.

<comment><USER17> I'm not sure I understand what you mean when you say that "biology is much, much shallower". Shallower than what, and in what way? What might it look like if it were deeper?

<comment><USER18> When we use a computer programming language, we are directing an abstract machine to interpret and manipulate data to get a result that we want. We have all the knowledge we need about the machine because we conceived and designed it ourselves.

DNA is like a programming language for a biological computer, a living cell. However, we don't know nearly everything there is to know about a living cell. We can't predict its mechanisms. There is no debugger. The compiler didn't come with an instruction manual. The code bootstraps itself into its own machine and runs in an environment we can't predict. And the syntax has been obfuscated and optimized by a genetic algorithm that's been running in parallel on quintillions of cores for a billion years.

Because the code executes on an unknown machine in an unpredictable physical environment, many features we might expect to see in a programming language are missing. This might be what he meant by "shallow".

<comment><USER16> I mostly meant that there is tons of encapsulation in computer programming. Like one could be a full-stack engineer that could go from soldering a transistor (or designing an IC from scratch, to writing a web app that uses web sockets that sit on top of HTTP which is on top of TCP/IP sockets, which is served ruby sitting on top of linux which is virtualized by Amazon AWS which is managed by a hypervisor sitting on top of a cluster of computers, all talking to each other via TCP/IP..... etc.), and there are so many layers 'deep' to that cake.

And this is a personal feeling, but there is less encapsulation, in biology. There are less 'categories' of things that build on top of each other that you have to learn, but those categories are immense and the knowledge in each of those is incomplete. I suppose you could say the knowledge in some of programming is 'incomplete' by virtue of closed-source encapsulation (trust us, this hardware works like you think it does), but that is somewhat artificial.

<comment><USER17> Thanks for that explanation. Do you really think the stack is smaller in biology? Biology has been optimized over three billion years - if we've already invented more layers than there are in biology then are we not overthinking it?

This is what I came up with in a hurry for biology:

      ...elements
      atoms
      chemicals
      nucleic acids
      genetic circuitry
      peptides
      proteins
      multiprotein complexes
      microcompartments
      organelles
      cells
      clusters of differentiation
      organs
      organisms
      communities...

Care to fill in or improve the list?</comment></comment></comment></comment></comment></comment>


Linux 3.7 released - <AUTHOR> http://kernelnewbies.org/Linux_3.7 <comment><USER2> Optimization of file deletion in ext4 gives nice results (from a commit message):

> X86 before (linux 3.6-rc4):

> # time rm -f test1

> real 0m2.710s

> user 0m0.000s

> sys 0m1.530s

> X86 after:

> # time rm -f test1

> real 0m0.644s

> user 0m0.003s

> sys 0m0.060s

The commit affects 5 lines only.

EDIT. Not sure if this optimization applies to filesystems mounted with standard journaling options...

<comment><USER3> Sounds nice, good find!

I dug up the commit: [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git...](http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=18888cf0883c286f238d44ee565530fe82752f06) which seems to be a bit older than I would have expected. Of course, this being Linux, "old" means it's from September 19th.

<comment><USER4> The merge window for 3.7 opened on September 30th, so it's not _that_ old.

</comment></comment></comment><comment><USER5> >'"Fast Open" is a optimization to the process of stablishing a TCP connection that allows the elimination of one round time trip from certain kinds of TCP conversations. Fast Open could result in speed improvements of between 4% and 41% in the page load times on popular web sites.'

Interesting... anyone know more about this?

<comment><USER6> <http://en.wikipedia.org/wiki/TCP_Fast_Open>

I guess CentOS will get this in 2020, sigh, still waiting for initrwnd 10 support.

<comment><USER7> Ah, the downsides to stability.

The particularly unfortunate part is, as much of the world's commercial hosting runs on RHEL, it's the world that doesn't get this until 2020. Well, except for services that roll custom kernels.

<comment><USER6> Yup - I realize it's the stability in trade.

Every so often I am tempted to fiddle with debian, looks like more and more people are thinking that way:

[http://w3techs.com/blog/entry/debian_is_now_the_most_popular...](http://w3techs.com/blog/entry/debian_is_now_the_most_popular_linux_distribution_on_web_servers)

<comment><USER8> I highly recommend making the switch. They've been doing the package management thing the longest, and it shows, both in package selection and how smoothly it all generally runs. And I've never had less trouble upgrading from one version to the next than on Debian.

<comment><USER7> On the other hand, one of the nice things about RHEL is you hardly ever have to upgrade major version... RHEL4 has been around since 2005, and is only now finally being phased out.

In comparison, I think "sarge" was the stable Debian in 2005. "sarge" is no longer oldstable- nor is etch. oldstable is "lenny", released in 2009.

Don't get me wrong, I like Debian, but when you compare "ease of upgrading", don't forget to consider "need to upgrade"!

<comment><USER9> True, but don't forget that the longer you wait with upgrading, the more compatibility issues you may run into when you finally _have_ to upgrade. Linux has changed a lot since 2005.

<comment><USER10> Agreed with this!

I'm more devops than sysadmin, so more expertise may have changed my experience, but when I did run a CentOS server, I thought, "yay, this is great"... until it came time to actually update.

Then, I realized that I had simply been accumulating up all of my upgrade pain as debt - with compound interest.

By comparison, upgrading Debian servers from version to version felt like hopping from bed to bed in a mattress store. Aside from a missed footing or two, it was usually a nice soft landing.

<comment><USER8> Yes! Plus I get an unreasonable amount of satisfaction out of that server I last imaged in 1998 running the latest version of Debian. So awesome -- it might outlive me, and if it does, it'll be up to date!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11>
      perf trace will show the events associated with the
      target, initially syscalls, but other system events like
      pagefaults, task lifetime events, scheduling events, etc.

I'm excited.

<comment><USER12> Can you explain this a bit more? It sounds interesting.

<comment><USER13> This allows developers to see what their programs are doing in more detail. They can then use that information to optimize their code.

<comment><USER12> There's nothing similar in older linuxes?

<comment><USER14> There is, strace does just that. perf trace is still evolving though and appears promising. See, for example, scripting support: <http://lwn.net/Articles/371448/>

</comment></comment></comment></comment></comment><comment><USER15> I think this is important: "JFS: TRIM support". This just added another choice of filesystem for SSD drives.

</comment><comment><USER16> How long does this stuff usually take to get into a more comercial release? When will we see it in Ubuntu? Android?

<comment><USER17> Arch Linux will probably get it in a couple of weeks.

Android, on the other hand, will take much longer. It's sad as there are so many goodies in this for ARM, especially the multi-platform support. This will make updating Android version a lot easier (for manufacturers, hackers). Right now the one of the bigger issues is updating the kernels (and the closed drivers, to be honest).

<comment><USER18> :( I just upgraded my arch a few days ago to 3.6.9, and now I'll have to do it again.

<comment><USER19> You can always blacklist a package (such as linux) in /etc/pacman.conf to avoid upgrading it during pacman -Syu, for example. I had to do this during a power regression in the kernel. However this isn't a long term arch strategy. Note also that arch has LTS kernels, should you prefer.

<comment><USER20> Not updating a package is the best way preventing security flaws to get fixed

<comment><USER21> If not upgrading the kernel every week or two is a security hole, most people are pretty screwed. I personally do not like to restart that often. Turning off automatic updates just gives you control of when to upgrade.

</comment></comment></comment></comment></comment></comment><comment><USER22> Has anyone used this or a prerelease with the btrfs fsync improvements? I'm interested to see if dpkg performance is usable now.

</comment><comment><USER23> Kernel newbies is down: <http://www.isup.me/http://kernelnewbies.org/Linux_3.7>

Cached version: [http://webcache.googleusercontent.com/search?q=cache:vjkg- vG...](http://webcache.googleusercontent.com/search?q=cache:vjkg- vG3p8QJ:kernelnewbies.org/Linux_3.7+&cd=1&hl=en&ct=clnk)

</comment><comment><USER24> ARM x64, wow. Is this really necessary? Or just a prelude to some new applications?

When i think of ARM i think of Mobile Phones, total ram isn't an issue(yet?) Are there other advantages?

<comment><USER25> Better performance, and yes, it won't be long now before mobile devices ship with more than 4GB of memory.

Don't forget AMD's announcement about ARM64 based servers.

<comment><USER26> ARM64 isn't required for > 4GB physical memory. The cortex-a15 can already address up to 1TB and is already shipping. Only the per process limit is locked to 4GB on a 32 bit core.

<comment><USER25> I think you're splitting hairs. In fairness, I didn't explicitly call that out, but as soon as you have more than 4GB of memory, there's going to be an application that wants to use more than 4GB. So yes, 64-bit is necessary in my opinion. Especially when you consider the server market.

<comment><USER26> > but as soon as you have more than 4GB of memory, there's going to be an > application that wants to use more than 4GB

Maybe, but my desktop has 32GB of ram, has a 64bit CPU, and I've rarely seen a single process use 4GB of memory unless it was leaking memory. My laptop has 8GB of ram, also 64bit, and I'm pretty sure I've never had a single process use 4GB. The only exception I can think of was doing some silly data manipulation, e.g. doing the initial build of a property graph of the entire Boston area transit system. I bet some high end games or video/photo editing software would use more than 4GB. Point is, those are all pretty niche situations, I'd bet the majority of memory usage on an average person's computer comes from browser processes, few hundred MB each if that and office applications, also a few hundred MB. Those processes add up though, so having more ram is usually a really good thing even if no processes uses even close to 4GB.

I also challenge the need in server loads. I'd bet the vast majority of applications never use 4GB either on the app server or the database server. Most of what gets discussed here on HN are large high scalability applications that you wouldn't host on ARM cores anyway. We often forget that the vast majority of website are tiny and low traffic.

<comment><USER27> Datacenters have a lot of stuff running in them. Big servers and databases arn't just for public facing large scale applications.

Database servers in particular wants as much memory as possible, and it doesn't take that big of a business support application that have a working set of data > 4Gb.

Same goes for a lot of the memory hungry Java application servers that sits around in a lot of businesses.

<comment><USER26> Apparently we're crossing wires here. I'm in no way shape or form saying these applications don't exist (I'm currently writing one).

What I am saying is that for ever such application there are probably more than a thousand sites hosted on free with your domain or $5 a month php + mysql hosting that use no where near 4GB per process. For the companies hosting those sites a cortex a-15 with a ton of ram is an awesome solution. This isn't all or nothing, we're talking about two different markets.

<comment><USER7> But how does "64bit is needed in specific applications that are not the majority" translate to "64bit is not needed"?

<comment><USER26> It doesn't, and I don't see where I've made that claim. I'm refuting the opposite. The initial claim was:

> I didn't explicitly call that out, but as soon as you have more than 4GB of > memory, there's going to be an application that wants to use more than 4GB. > So yes, 64-bit is necessary in my opinion. Especially when you consider the > server market.

I'm just saying I don't agree. There is a massive market very open to the power saving offered by arm that have no use for > 4GB process spaces. That doesn't mean there aren't markets where 64bit will be useful.

<comment><USER7> I think we are on different pages with the word "necessary". I am using it as "needs to exist as an option", and I think you're using it as, "needs to be used by everyone".

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> Sorry for being such a noob. But could someone please tell me the difference between "linux" and other linux builds like Ubuntu, RedHat etc?

<comment><USER29> If you've never been in the Linux world, can certainly see how this is confusing.

This announcement is for the Linux kernel. The different Linux distributions (Ubuntu, Redhat, etc.) all bundle different versions of the Linux kernel and umpteen number of packages around that to create a cohesive Desktop or Server experience.

The kernel is the one core, similar piece between ALL of the distros. It is the desktops, package managers, etc. that differs between the distros.

</comment></comment><comment><USER30> from "TCP Fast Open: expediting web services": <http://lwn.net/Articles/508865/>

> Furthermore, the server should periodically change the encryption key used > to generate the TFO cookies, so as to prevent attackers harvesting many > cookies over time to use in a coordinated attack against the server.

What is going to do this? I hope this is built-in somehow.

<comment><USER31> It looks like the key will be accessible via the proc filesystem. But it's anyone's guess how many distros will faithfully schedule a cron job to rotate the key.

EDIT: Looks like the key is chosen at kernel module "late init" time. I think this is before any init scripts have had the opportunity to add back any entropy persisted from previous boots. So the entropy in the kernel pool is minimal. It may be plausible for a remote attacker to guess the key for a bunch of servers.

Also, if the key is not rotated by cron, it provides a single-packet method for a remote attacker to observe that a server has been rebooted since he last checked. This will give a good indication of how often security patches have been applied.

[http://git.kernel.org/linus/1046716368979dee857a2b8a91c4a883...](http://git.kernel.org/linus/1046716368979dee857a2b8a91c4a8833f21b9cb) [http://git.kernel.org/linus/168a8f58059a22feb9e9a2dcc1b8053d...](http://git.kernel.org/linus/168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef) [http://git.kernel.org/linus/8336886f786fdacbc19b719c1f7ea91e...](http://git.kernel.org/linus/8336886f786fdacbc19b719c1f7ea91eb70706d4)

<comment><USER32> Might be better to have the keys rotated after a certain number of TFO cookies are generated rather than on a time-based schedule. This will prevent attackers from trying to make a huge number of requests in a set period of time.

<comment><USER31> The TFO cookie is only generated once per client "source IP" and is good until the key is changed on the server. (Scare quotes because at the source IP may be spoofed).

For an attacker to learn a cookie that's valid for a given victim "source IP", he only needs to be passive observer somewhere along the route. Even if we believe that's very hard in most cases, if it's possible at all, he has the mother-of-all anonymous reflected DoS amplifiers. [http://tools.ietf.org/html/draft-ietf-tcpm- fastopen-02#secti...](http://tools.ietf.org/html/draft-ietf-tcpm- fastopen-02#section-6.2)

So, yeah, using a key that's rotated after a short amount of time -or- number of uses (whichever comes first) seems like a good idea.

<comment><USER33> It's very easy to do in NAT'ed environments and the Linux kernel doesn't implement the suggestion of the RFC draft to include timestamps too.

An attacker who doesn't want to do a MITM attack because that might be noticed can set up sessions to all kinds of servers outside the NAT which support TFO. Then all these TFO cookies are used in spoofed SYN packets with the source IP being set to the host behind the NAT that the attacker wants to flood. Easy enough.

<comment><USER31> Yep.

Of course, some will argue that if the attacker is inside your NAT, you're already pwned.

I don't think that's a very good principle for the security design of internet protocols.</comment></comment></comment></comment></comment></comment>


Beyond Cyberpunk: A Do-It-Yourself Guide to the Future (1991) - <AUTHOR> https://archive.org/details/BeyondCyberpunkMacintosh <comment><USER2> I love the artistry and creativity around the HyperCard community.

Years ago I stumbled on this (wonderfully dorky) episode of Computer Chronicles, that focuses on HyperCard:

[https://m.youtube.com/watch?v=FquNpWdf9vg](https://m.youtube.com/watch?v=FquNpWdf9vg)

I love how the used-car salesman created his own application to help potential buyers find the right car. This was truly the "bicycle of the mind" era for computing; the user base was fairly self-selected, and people wanted to take full advantage of this new tool. [1].

The range of HyperCard was pretty amazing — famously, Myst was originally created with it:

[https://m.youtube.com/watch?v=EWX5B6cD4_4](https://m.youtube.com/watch?v=EWX5B6cD4_4)

1: [https://www.folklore.org/StoryView.py?story=Bicycle.txt](https://www.folklore.org/StoryView.py?story=Bicycle.txt)

</comment><comment><USER3> I participated in a HyperCard game jam this weekend... I'm not much of a programmer and have never made a game before, but it was so easy to get something up and running.

I will probably make some more things in HyperCard when inspiration strikes.

[https://itch.io/jam/merveilles-hyperjam](https://itch.io/jam/merveilles- hyperjam)

</comment><comment><USER4> The hypercard stack translated (transcoded?) to HTML here: [http://www.streettech.com/bcp/](http://www.streettech.com/bcp/)

</comment><comment><USER5> Requirements:

      Mac Plus or higher
      5.5MB of hard disk space
      1.5MB of RAM
      HyperCard 2.0

<comment><USER6> Sure, that's why archive offers a macintosh emulator that starts by clicking the large image at the top of the page.</comment></comment>


Summer Vacation - <AUTHOR> http://xichekolas.blogspot.com/2007/05/summer-vacation.html <comment><USER2> I think the corporate world is designed to eliminate any desire of employees to work on their own ideas. Work takes up a lot more of your time and energy than you imagine. Even if you only work 40 hours a week.

In reality you get up, spend 30 minutes getting ready, another hour eating and commuting, more like 9-10 hours a work, another 30min or an hour getting home. After this whole ordeal you don't have any desire to even THINK about anything except relaxing.

On the weekends you're trying hard to find something to do that gives your life some kind of meaning besides the job you have.. something that doesn't include sitting in front of a computer.

The only way you can really work on something of your own is to quit your job and live off your savings. And still it's up for debate how much one person, without any investment can achieve working by themselves. You might be able to make a simple website.. But you won't be able to pay to promote it.

<comment><USER3> I believe this even consciously occurs to many employers. It's part of the reason why very few companies would be okay with you working 4 x 10hr hour weeks vs 5 x 8hr. Even 4 x 12hr wouldn't make them feel secure.

I suppose it's jealousy and greed. And this exists in almost every culture (from what I know) -- I hope things eventually change. Even Google is guilty of this form of "Evil".

<comment><USER4> Actually, Google does give employees time to work on their own ideas. It's just that they own anything that comes out of that time. Arguable this is just as evil, so your point stands.

I think the solution may be to think of your job as buying you time. Set a baseline salary that'll let you live a simple life with adequate health & safety. For a single guy, that's about $20K/year (= grad student wages); for a married guy with a couple kids, about $40K. If that seems low, remember that 50% of America lives on that.

Then take the difference between your actual salary and your cost of living, and think of it as time. For example, if you graduate with a $60K/year job, set aside 2/3 of your salary as savings, and every hour you work is buying you 2 hours of freedom. When you have enough time saved up to accomplish what you want, quit and "spend" it.

For example, I'm currently saving about 2 hours of time for every hour I work. I'm looking to quit after slightly more than 2 years at my job (that'll be another 6 months or so), at which point I'll have 4-5 years saved up.

I met an innkeeper in Alaska who followed this strategy. He and his wife decided when they got out of college that they'd live like grad students. They worked in the computer field. After 15 years, they each quit their jobs, bought a sailboat, and sailed around the world with their son, stopping at every port they came into. They finally settled in Seward, Alaska (pop. 3000), bought an old building, and fixed it up as an inn.

<comment><USER3> I think you're right and that is a great strategy. I know programmer who works 6 months in a major world city (it varies) then spends 6 months in Missouri at his cabin on a lake. He's also slowly bought quite a bit of realestate as his nest egg.

Where's your _Buying Your Freedom As a Modern Day Wage Slave_ essay? ;-)

<comment><USER4> I'll wait until I actually have my freedom. ;-) Advice falls rather flat when the advisor is still working his tail off with both a day job and a startup.

</comment></comment></comment></comment></comment><comment><USER4> Am I the only one who _liked_ my summer jobs? I've had one all but two summers, since my junior year of high school. They were (grr, I wish news.YC had Markdown...):

1999: Did a website for a local town newspaper

2000: Worked for an all-teenage venture funded dot-com (yeah, it was _that_ easy to come by funding during the bubble).

2001: InstallShield scripting for said dot-com's parent company. (2000/2001 bookended a "gap year" between high school and college, so I was working there all year, with various projects.)

2002: Worked for a contract programming shop.

2003: Summer off - spent it learning Lisp and Dylan, attempting the ICFP programming contest (didn't finish), starting an Eclipse plugin for Dylan (didn't finish), and designing the database schema for FictionAlley.org (eventually did finish, but it wasn't till 2005).

2004: Worked for a financial software startup that eventually became my full- time employer.

2005: Summer off. Spent it finishing up FictionAlley.org. Well, that and going on a cruise.

If I had to rank the years from best to worst, it would probably be 2000, 2001, 1999, 2004, 2003, 2002, 2005. Two of the three worst were the years that I had no job, while all of the best involved a job of some sorts.

I suspect it's because when I had an internship, I spent the summer learning new technologies, which is exactly the same thing I would've been doing without an internship. However, with the internship, I a.) got paid b.) usually completed a project or 3, and c.) had people around me. When I was working on my own stuff, none of those were a given.

</comment><comment><AUTHOR> Sorry to shamelessly link to my own blog, but I wrote this to motivate myself a bit, and thought maybe someone else would find it motivational. I'm about to quit my job for a few months of living off savings, and it's a bit scary for me.

<comment><USER3> Really great writeup, thanks for sharing. I, for one, certainly don't mind people submitting their own stuff.

This is a great topic for people who are still working for someone else. One issue I've had is that I'm basically incapable of treating anything like a "day job". I want work really hard and pour passion into anything I do. When I have a day job I tend to give my best energy to it, draining me from my own projects.

</comment></comment><comment><USER5> I've worked some kind of job at all times since I was 16. Painting houses, cashier at a grocery store, retail stores, lab consultant, summer research, internships, and now job job job. No long breaks. Just work.

I spent my teens and college years thinking the kids who traveled all summer were idiots. That they weren't contributing to society. Now I'm 27 and wishing I had taken a break.. Done something because I wanted to, not because it was "what you did". I thought that being a "year behind" would be disastrous for my career. Well guess what.. 1 year is nothing when you have to work for 50 more.

If you are young and able to just LIVE... do it. If living is working on your own startup, do it. If it's building a working replica of a PDP machine out of legos, do it. Just get out there. There's plenty of time for work.

<comment><USER6> With 27 you are still young - why don't you take that break now?

<comment><USER5> Planning on it. Just thought I'd toss some advice out for the whippersnappers out there :)

</comment></comment></comment><comment><USER7> I agree with the stuff about summer jobs, as I had a few totally useless ones in college (2000-2004).

However I had no idea what else I could be doing. I didn't realize that you could make a decent web application and attract users, for instance. The problem was that I didn't have any friends or mentors to guide me in the right direction.

To the people who are working on their startups full time now - how much money are you spending in living expenses per month?

</comment><comment><USER8> you have a good point, it's much better to be working from passion than working for money. but when you're young, it's more about gaining experience. so the real question is "what should i do to gain the most relevant experience to prepare me for the future?"

summer jobs are a place where you get paid to learn. not only do you pick up technical skills, but you learn an assortment of soft skills (e.g. managing people, communicating, success metrics, company culture, etc). if working on your own projects will yield more relevant experience than at any summer job, then go out on your own.

in the end, summer vacation is long enough to learn a ridiculous amount, but short enough so that if you don't like it, you can grind through it.

</comment><comment><USER9> """So, if you are a student, don't get that summer job just to fill the summer."""

A huge regret of mine.

</comment><comment><USER10> Very 'graham-esque' ... Enjoyed it and logged in for the first time in ages to vote it up.

<comment><AUTHOR> Thanks... it's probably so 'graham-esque' because I have been rereading his essays lately for mental fortification.

</comment></comment><comment><USER11> $2000 covers your expenses for two months?! Man, I wish it were that easy for me

</comment><comment><USER12> Lovely idea but I'm not so keen on surviving by running up debt.</comment>


Marvelous, Bad Ideas That Are Worth Billions - <AUTHOR> http://nautil.us/blog/the-marvelous-bad-ideas-that-are-worth-billions

<comment><USER2> I enjoyed this article a lot, and find the stats behind YC companies success to be fascinating. Besides the obvious Dropbox AirBnB examples, does anyone know of other similar stories of ideas that people saw as bad that turned out to be successful? Doesn't have to be at that scale but I enjoy reading about these.

<comment><USER3> Spongebob Squarepants?</comment></comment>


Wikileaks published AWS DC addresses - <AUTHOR> https://www.datacenterknowledge.com/amazon/wikileaks-publishes-what-it-says-list-amazon-data-centers?NL=DCK-01&Issue=DCK-01_20181011_DCK-01_227&sfvc4enews=42&cl=article_1_b&utm_rid=CPNET000006994081&utm_campaign=7577&utm_medium=email&elq2=1c306ea439d74de6a4ec5ff6c077aa84 <comment><USER2> while this is not public knowledge, i don't think it is difficult to find out.

And i don't see how big a security risk is for people to know the addresses.</comment>


Firefox v46+ Security Hardening - <AUTHOR> https://github.com/w00w/security/blob/master/firefox.md <comment><USER2> Some observations:

* Disabling all referers everywhere will cause difficulties accessing sites that use it to prevent hotlinking (usually image/video hosts, many blogs)

* Enabling "Do not track" concedes a lot of trust to the advertisers, and also serves to differentiate you as most people have it turned off.

* Disabling Javascript will break mostly everything, everywhere, and also serves to differentiate you. It's also of questionable use since we're already installing noscript.

* I'm not sure what color profile support has to do with security hardening

* Disabling IPV6? Really?

<comment><USER3> > * Disabling IPV6? Really?

From what I have read about the slow roll-out of IPv6 is because network operators just don't know how people are going to exploit the expanded address space.

Email spam is a good example. With a server on IPv6 I get a block of addresses which means I can email out from any of a literally thousands of addresses. Email servers need to be coded to be able to blacklist that block rather than a single address.

Where ever blacklists are used they've really got to be adapted for groups of addresses. The question is can you be sure Firefox has catered for all security concerns surrounding a new technology?

If you are producing a security product, you don't use the latest and greatest technology.

</comment></comment><comment><USER4> I don't like all the features you turn off, and most seem to offer no security benefit.

Turning off pdf.js is arguably a security downgrade, since it is a sandboxed javascript reader and any other means of reading pdfs will not be sandboxed.

As for additions, CanvasBlocker is important to prevent browser fingerprinting and doesn't interfere with your browsing experience once you turn off notifications.

Ideally, Firefox's password management ought to be turned off and you should instead use KeePass (and the PassIFox firefox addon).

I would also recommend turning on e10s since it sandboxes a lot of stuff in processes, and is fairly stable now.

</comment><comment><USER4> Safe Browsing, even with the 2.0 API, might compromise your privacy.

[http://www.sitepronews.com/2014/10/01/googles-safe- browsing-...](http://www.sitepronews.com/2014/10/01/googles-safe-browsing- service-killing-privacy/)</comment>


Sex in the Bathroom and the Problem of Offline Data - <AUTHOR> http://blog.joingrouper.com/sex-in-the-bathroom-and-the-problem-of-data-g

<comment><USER2> Hoping that someone from Grouper happens to be reading this: The unsubscribe link in your emails is broken. I got so tired of unsubscribing unsuccessfully that I've now been marking you as spam every time I get an email.

Obviously, this is bad for your deliverability. You should fix your unsub links.

<comment><AUTHOR> I just unsubscribed you. Sorry for the hassle.

If anyone else is having problems, we send all of our e-mails from addresses that you can respond to. The one-click unsubscribe links seem to be working fine, but if they're not, you can just respond to the e-mail and we'll take care of it.

</comment></comment><comment><USER3> Maybe they could partner with Target [1] to see if someone gets pregnant after their meetup.

[1] [http://www.nytimes.com/2012/02/19/magazine/shopping- habits.h...](http://www.nytimes.com/2012/02/19/magazine/shopping- habits.html?_r=2&pagewanted=1&hp)

</comment><comment><USER4> You know, back in my day, sharp signs preceded channel names, and at signs let you know who the channel ops were.

The encroachment of Twitterspeak and Twittersigils into everyday English is a bad moon rising.

<comment><USER5> At some point in the past someone said "the encroachment of IRCspeak into everyday English is a bad moon rising" :)

I kinda agree. But then again I do find it has utility; people can use it to express emotion, which previously has been a sticking point for purely textual communications. Consider:

 _And then they all died! #upset #crying_

versus:

 _And then they call died! #hellyeah_

I quite like this sort of hacking.

<comment><USER6> I am always disheartened by the notion that anything beyond text is needed to express emotion or sarcasm. That's what writing _is_. By properly combining words, good writers can express almost anything, and more fully than with emoticons or tags.

However, the example you give is dark humor, so you win me over there.

<comment><USER7> I like this interview with Nabokov in 1969.

Q: How do you rank yourself among writers (living) and of the immediate past?

Nabokov: I often think there should exist a special typographical sign for a smile – some sort of concave mark, a supine round bracket, which I would now like to trace in reply to your question.

</comment></comment></comment></comment><comment><USER8> > I don't care if a user says they like a feature; I care if they actually use > it

That's a mildly dangerous position for a product owner to take (though I accept in the particular scenario described it makes sense). In a customer's mind, having a facility available - even if never used - may be a key feature of the service.

<comment><USER9> One example that comes up now and then in the offline world is late-night public transit. If you go by measured ridership, it's a no-brainer to cut most trips, because empirically people rarely actually ride late at night (in most U.S. cities, anyway). But when you do, in most cases ridership at _other_ times of day falls also, because people suddenly are worried about the possibility of getting stranded. Even if 98% of the time they never actually use the 2am bus, they like knowing that it's available just in case.

</comment></comment><comment><USER10> I was expecting this to be about tapping on your phone's accelerometer to gather the data.

</comment><comment><USER11> Great hook but then...

"Apply Privately with Facebook"

Instafail. That's never gonna happen. Ever. Please take a read of <http://dickbrouwer.com/post/16748664071/facebook-perils>

<comment><USER12> That's not really relevant here because this is a rare site that actually needs facebook data like the friend graph. They're not using it as a lazy login mechanism.

<comment><USER11> Even so that facebook button is sitting there acting as the gateway to investigating further, with very little information provided so far. To me it's almost like a site that says "Give us your credit card information now. We promise only to do nice things with it. Later we'll tell you what we did"

<comment><USER5> The process is really simple; and they explain it with a nice graphical flow if you click the "how does it work" link (prior to signing in).

Did you see/click that and still have the same concern? And if you did see it, what sort of assurances/explanations would you want to see?

(I'm not being facetious, I'm genuinely curious :)).

</comment></comment></comment></comment><comment><USER13> "Also, while I can't promise you sex in the bathroom (if that's what you're looking for), I can say that it happens. We just don't know how often."

Haha, nice pitch - wonder if VCs would buy it! ;)

Hilarious story btw. :)

</comment><comment><USER14> Theres this trendy little bar/lounge in philadelphia's old city section called paradigm which has these unisex bathrooms with doors that are clear when unlocked and fog up as soon as you lock them[1]. Once in a while it makes for a usually not quite desirable show when some one(or two) is drunk enough to shut the door without locking it and not notice the opacity.

[1] [http://s3-media3.ak.yelpcdn.com/bphoto/I7ICPsQ45YVbLzKEBiHND...](http://s3-media3.ak.yelpcdn.com/bphoto/I7ICPsQ45YVbLzKEBiHNDQ/l.jpg) left locked, right unlocked

<comment> a-priori In downtown Lausanne, Switzerland (in this plaza, if you're in the area: <http://g.co/maps/tupbn>), there's an outdoor washroom that's enclosed in that sort of glass. When you walk up to it, all the walls are clear. When you lock the door, the walls go opaque.

Not really sure how it works, to be honest...

Edit: This is the stuff: <http://en.wikipedia.org/wiki/Smart_glass>

</comment></comment><comment><USER15> This is such an awesome problem. Have you made any changes based on the FB friends data? Do you feel like the data has been more valuable than personal experience?

</comment><comment><USER16> You can solve the problem easily if you get hold of the cellphone data of the involved parties. If cellphones get together after date, it was successful. If cellphones spend the night in the same location, I'll call it a 5 star. The cherry on top would be that if you have GPS on both phones you can also get the bathroom moment.

Say hello to the new age of not so much privacy.

</comment><comment><USER17> ha! a Groupon for bathroom hookups... should have called it...Grope-On

<comment><USER18> Just put the stress on the O rather than the U in Grouper.

</comment></comment><comment><USER19> Not surprised and the lesson here is actually something very important and common: user surveys aren't always accurate. Ask a bunch of people if they're interested in learning new things and almost every one is going to say yes, but that doesn't mean they'll actually put in the work, however minimal, to do so.

</comment><comment><USER20> Good way to get new members Grouper. :)

</comment><comment><USER21> This seems deeply fictional to me: a group of adults appear in a bar. Why would a manager ever contact a matching agency? Maybe the internet has made me too cynical, but the bar for truthiness has fallen rather low.

That seems bizarre, but of course is to imply a certain opportunity and efficacy in the product in a very salacious, shareable fashion.

I don't buy it.

<comment><USER22> They prepay for their first round of drinks through Grouper. It's on the "how it works" section: <https://www.joingrouper.com/>

<comment><USER21> Okay I suppose that makes sense. I've been with groups where some of the more brash have gone off and covorted in the bathrooms, and when the establishment has a problem it has never been a big deal. I still can't envision managers actually calling the parents on them.

<comment><USER23> That's because if you guys just show up at the establishment, they have no idea who your "parents" are or where to contact them. If, however, your group arrived there through some arrangement (between grouper and the establishment in this case), they do have a place to complain if you do something they don't approve of.

<comment><USER24> The managers are probably assuming that this 'Grouper' may be a prostitution front, and naturally would prefer it not be using _their_ premises.

</comment></comment></comment></comment></comment><comment><USER25> Put 2 rats of the opposite sex in a cage and chances are they're gonna get it on. Same can be said for for humans. We just animals!</comment>


Has anyone on Hacker News made any money with affiliate marketing? - <AUTHOR>

I am interested in affiliate marketing, and was wondering if anyone on this site has made any money posting affiliate links on their websites. If so, how did you do it, and how much money have you made? <comment><USER2> a) Some folks on HN have made a lot of money with affiliate marketing.

b) Rather than asking people "Hey, please identify a niche in which I could very profitably compete with you. kthxbye" you'd probably get a better response with something like "Hiya guys, I'm interested in getting into affiliate marketing. I currently have this source of traffic: [fill in blank] and/or this asset which could be marketed by affiliates: [fill in blank]. I have investigated these approaches: [fill in blank, fill in blank, fill in blank]. I am currently leaning towards [fill in blank] but would appreciate your thoughts. Given that some of you are experienced with affiliate marketing, my vertical, and the like, what would you suggest that I do?"

P.S. If your answers are "I have this source of traffic: nothing, I have this asset: nothing, and I have investigated these approaches: read a few blogs by affiliates attempting to sell me their info products" you may wish to hold off a bit. It's not a magic money tree.

<comment><AUTHOR> Thanks for your response Patrick, I guess I could have worded that better! I understand it's not a magic money tree, and I understand it will take real work. It's just that I just wanted to read some stories of how people got successful with affiliate marketing. But I guess that does sound like I am trying to copy other people's ideas. The only asset I have is a real in depth knowledge about this thing I have been doing since I was in middle school, and a lot of experience in copywriting. I want to combine these two skills together to make a blog that hopefully I can get a lot of traffic, and maybe monetize.

Oh, and my traffic: none, and approaches: getting some ideas now, from hacker news.

<comment><USER2> _real in depth knowledge about this thing I have been doing since I was in middle school_

Well, that gets us somewhere. Here's some questions you could ask to see if this likely has viable affiliate options. Let's call it "trout fishing" for the sake of the example. "Yes" answers are good for your prospects, "No" answers are bad.

1) Is trout fishing a commercial activity?

2) Do people spend a lot of money on trout fishing?

3) Are there brands available in trout fishing? Ideally, are there multiple competing brands?

4) Think of an economic activity associated with trout fishing. Does that economic activity have high margins associated with it? (Is there at least one activity which does?)

5) Are people really interested in learning how to trout fish better? Are they so interested they would pay cash money for the option? Do people do that currently? For example, are there magazines about trout fishing? Books about trout fishing? University courses about trout fishing? Conferences you could go to about trout fishing?

6) Think of the people who trout fish. Do they spend time online at all? The best answer here is "They know how to use Google but don't live online."

7) Is trout fishing a screamingly obvious affiliate market such that it is overfished, to pardon the pun, by every person who has ever bought some sleezebag's Totally Guaranteed System For Making Money Online? (Ideal answers here are "No." or a "No but it shares some characteristics with those.")

8) Are the people who trout fish either a) spending other people's money, because they have corporate budgets to fish trout b) spending other people's money, because the government heavily subsidizes fishing trout c) spending their future self's money, because trout fishing structurally does not require you to commit money right now, it only costs you money in the future or d) upper middle class or wealthier than that? All of these things suggest low aversion to paying money for trout fishing, which is magic to the affiliates' ears.

9) Does trout fishing generate a lot of transactional revenue online specifically, as opposed to requiring substantial offline components?

10) Is there an active lead gen market for trout fishing? For example, could I call up a business affiliated with trout fishing today and say "I have ten people who expressed interest in trout fishing in the last 2 hours. Is that worth cash money to you?" and have them scream "YES!" and immediately have a number ready for me when I say "How much?"

11) Is trout fishing a really wide field of human endeavor, such that there are many, many variations on a particular need someone could have in the trout fishing space?

12) Is trout fishing a really deep field of human endeavor, such that if you told me "Patrick, a site about trout fishing made me a bajillion dollars" I couldn't reproduce it even if I wanted to, despite being a smart cookie with access to Google, capital, and processes designed to make copying successful affiliate sites easy?

</comment></comment></comment><comment><USER3> Check out affbuzz.com and wickedfire.com if your new to affiliate marketing.</comment>


Pastebin for debugging javascript / html / css - <AUTHOR> http://pastebin.me/

<comment><AUTHOR> I put this up a while ago but recently did an update so you can live preview your code.

people have been posting some really cool things in it recently

<http://pastebin.me/8c1380ade220896f88387af0dcc588c2> (you have to wait a while, its pretty resource intensive)</comment>


US looks at ways to prevent spying on its spying of 3rd party Data - <AUTHOR> http://apnews.myway.com//article/20140128/DABJG0G80.html

<comment><USER2> How about a cessation of spying on everyone and a return to the use of bench warrants for legal spying?

"Tapping" a phone would return to it's previous usage primarily as a lineman's diagnostic tool and the occasional legal phone tap (after a warrant is obtained).

How hard can that be?</comment>


Show HN: Black candy – A self hosted music streaming server - <AUTHOR> https://github.com/aidewoode/black_candy <comment><USER2> Cool, I've been into this sort of project recently.

Similar project: [https://funkwhale.audio/en_US/](https://funkwhale.audio/en_US/)

Also Streamaserver for video [https://github.com/streamaserver/streama](https://github.com/streamaserver/streama)

</comment><comment><USER3> This looks great! I hope in the future you can integrate into home assistants, especially the ones coming around that are open source [https://getleon.ai/](https://getleon.ai/).

</comment><comment><USER4> It is nostalgic to see good old Rails asset pipeline in the reigning world of React/Vue. You have done a pretty good job there, good sir!

<comment><AUTHOR> Thanks, actually I use webpacker instead of asset pipeline.</comment></comment>


Worlds Without End - <AUTHOR> http://publicdomainreview.org/2015/12/09/worlds-without-end/ <comment><USER2> If anybody hasn't checked it out, this site is great. It uses several different PD sources, but mostly the fabulous Internet Archive as a source for primary information. It's a highly curated site and IA is basically the backbone of the information it uses.

This is a beautiful marriage.

</comment><comment><USER3> The site reminds me BiblioOdyssey

[http://bibliodyssey.blogspot.com/](http://bibliodyssey.blogspot.com/)</comment>


A Note to My Readers - <AUTHOR> http://dish.andrewsullivan.com/2015/01/28/a-note-to-my-readers/ <comment><USER2> That is a bummer, makes me wish I hadn't let the unread count from The Dish grow so large in recent months. Not too many writers who can argue so eloquently and respectfully on politics.

When I didn't agree with his perspective I always found it extremely useful to read an honest and solid argument against my own position. I think you can ask no more from a writer than to challenge your assumptions, improve your reasoning skills and help foster empathy for those with whom you disagree.

<comment><USER3> Honest and solid aren't reasonably used to characterize Andrew's writing.

One could start with his obsession with whether Sarah Palin's son Trig was Sarah's son or grandson.

Or the McCaughey piece widely believed to have helped tank Clinton's health care reform. An article that later had to be retracted because it was written by a republican operative and wildly deceptive. But hey, mission accomplished: health care reform dead for a generation. And the fact that it was completely incorrect, and contributed to an excess of 45k deaths per year, is just another trophy in Andrew's case.

Andrew is similarly famous for "are blacks genetically inferior? Let's discuss! I bet these nazis over here have some insightful opinions on this question!"

And who can forget the way he treated people opposing the Iraq war -- people far smarter than Andrew, who grudgingly was forced to admit his stupidity. Here's a quote for you:

       "The middle part of the country - the great red zone that voted for Bush - is
       clearly ready for war. The decadent Left in its enclaves on the coasts is
       not dead — and may well mount what amounts to a fifth column." [1]

Yup, I see what you mean by arguing eloquently (yet respectfully!) Americans who oppose the war in Iraq are traitors!

Finally, read anything Sullivan writes on taxes, and you'll quickly discover he's an innumerate idiot.

edit: I knew I'd seen these arguments all in one place before; read Mark Ames's article here [https://www.nsfwcorp.com/dispatch/andrew- sullivan/](https://www.nsfwcorp.com/dispatch/andrew-sullivan/)

[1] copied here [http://www.slate.com/articles/news_and_politics/chatterbox/2...](http://www.slate.com/articles/news_and_politics/chatterbox/2002/12/al_gore_andrew_sullivan_and_fifth_column.htmlhttp://www.slate.com/articles/news_and_politics/chatterbox/2002/12/al_gore_andrew_sullivan_and_fifth_column.html)

</comment></comment><comment><USER4> > The second is that I am saturated in digital life and I want to return to > the actual world again.

A very familiar sentiment shared by myself and many of my peers who are in the technical field. Nostalgic feelings are clearly on the rise, and in fact I think this might be a good thing... and it reinforces my own feeling that "The Internet" might one day be regarded as nothing more than a phase that simply faded in and out of our human evolution.

<comment><USER5> I spend 12 hours a day before screens. I'm sick of it. I want to work in the sun and be around people again. But this Tyranny of Screens is hard to escape.

<comment><USER6> Just to continue on this riff:

Outside, with other people building some tangible thing together. Something that years later we can point to and say yep, it was tough, but we did that.

Not only are we stuck with our heads stuck up computers, in 50 years everything we've done will be superceded by something vastly more cool and interesting. Within 100 years it'll all be gone.

There was an article on HN recently about video game addiction. You don't have to be addicted to video games to spend your entire life in front of a screen, being a slave to IM and email, and miss out on all of the important things.

ADD: Instead of 50 and 100 years, make that 20 and 40 years. We'll still be here when it all vanishes.

<comment><USER7> > 50 years everything we've done will be superceded by something vastly more > cool and interesting. Within 100 years it'll all be gone.

Which professions don't have that property? Not many. Science and writing/art give you a chance for that kind of longevity, I suppose -- although even then, doing something that has any real impact 50+ years later is difficult and very rare.

<comment><USER8> Architecture and Civil Ingeniery. Try to stick to cathedrals and transoceanic channels (like the Panama channel). They tend to last for centuries and get well maintained. Just try to avoid the places where a big war is likely.

If you choose for example math, if you are very lucky you will get your own course in a math degree, like Fourier or Galois. The problem is that "your" course will cover not only your work but also the improvements of the next generations, and your exact work will be only a small part. Another problem is that there are only about 10 places for a full math course with a mathematician name, so it's a very difficult to enter this club. (It's easier than building a transoceanic channel, but much difficult than building a cathedral.)

</comment></comment></comment></comment></comment><comment><USER9> Oh this makes me sad. There are very few modern American voices on politics that usually make as much sense and are as well thought out as Andrew Sullivan's. It will be a loss not to hear his opinion everyday. His reasons for leaving are, of course, understandable.

I feel like Ta-Nehisi Coates Matthew Yglesias, and Johnathan Chait are the only other voices that come close.

<comment><USER10> Matt Taibbi comes to mind.

<comment><USER11> Matt Taibbi is fun to read, but also shrill, predictable, and at times pretty clearly underinformed. I really like his political writing, though I don't always agree with his conclusions, but his writing on finance has often been just one or two notches more credible than ZeroHedge.

I generally always feel like Taibbi is deliberately writing to get a rise out of people. I didn't particularly like Sullivan --- my opinions of him hardened during the first term of Bush II --- but I did feel like he was trying to be careful.

I dispute the idea that it's hard to find similarly careful journalists today. What's perhaps hard is to find blogospheric gravity wells like Sullivan. This thread compared him to Ta-Nahisi Coates and Matt Yglesias, but neither perfectly fit Sullivan's mold. Coates doesn't cover politics, and Yglesias is an econ reporter. You have to assemble a Sullivan out of parts now, but I think those parts are of higher quality than Sullivan's (say) 2005 competition.

</comment></comment></comment><comment><USER12> I've seen several other journalists/bloggers/media-people react to this news as if Andrew's decision was clearly driven by structural economic factors rather than a more benign desire to step away from blogging as his primary form of writing. Ben Smith--of, yes, Buzzfeed--seemed to interpret this as the death knell of independent internet commentary.

What's going on here? I think we can agree we're all sad Andrew Sullivan is quitting The Dish, but are we symbolically sad over what that blog represented which will now never exist again, or are we just sad that a pretty great blogger won't be blogging any more?

<comment><USER13> I think twitter shows us that independent internet commentary is fine and well.

Long-form blogs are perhaps less suited to the mobile era, but who can say for sure?

<comment><USER14> People read entire _books_ on their phone - I don't think the "mobile era" means the death of long-form blogs.

</comment></comment></comment><comment><USER15> I've been a reader of the Dish for 15 years. I've always been astounded at both the quality and quantity of writing Andrew produces. I wouldn't be surprised if wrote more than any other blogger (among those who are actually read).

One thing I've admired him for was he was one of the few high profile supporters of the Iraq war who changed his mind and publicly announced it.

I can't say I'm surprised, his announcement is perfectly understandable!

</comment><comment><USER16> One of the biggest values I got from the Dish was as a news aggregation service that I _trust_ , and that is the thing that might put me in the wind looking for a replacement for some time.

Andrew identifies as a conservative of some flavor, which I certainly am not. As a result, on the days that I only have 20 minutes to spend on current events, getting the news from his site made me feel like I am doing something right.

What other comparable resources exist?

</comment><comment><USER17> Man, this sucks. I'm hoping, out of loyalty to his staff and readers, he'll keep the thing going but maybe take a back seat. When he took a month off a while back, his guest bloggers did a pretty good job and his full-time staff does a great job of finding interesting content. This is a model of journalism that I can really get behind and it would be such a waste to let the whole thing just fade away.

</comment><comment><USER18> _"... I am saturated in digital life and I want to return to the actual world again. ..."_

Is this an increasing trend?

<comment><USER19> No. It's something people do as they get old, so when you look at your own peer group it _looks_ like an increasing trend, because your friends are getting older.

</comment></comment><comment><USER20> Knowing nothing about this person I thought It was a woman: "I want to spend some real time with my parents, while I still have them, with my husband ...".

He/She wants to write a book and has time for his family and take care of his health.

The writer seems to be very good: A world of mass intimacy with their reader, he loves them, he cares and that is the reason I find so hard to go away.

</comment><comment><USER21> Could we get a more informative title?</comment>


Aardvark – Real-time graphics and visualization in F# - <AUTHOR> https://github.com/aardvark-platform/aardvark.docs/wiki <comment><USER2> I was just trying to create generative graphics in Corman Lisp [1], since it creates Windows executables, and then I stumble upon this. The Game of Life demo in the examples directory is fun. I have been playing with F# a few times a year, waiting for something like this to come along. Very exciting. I started using Julia, but several years ago Jon Harrop had a book out "F# for Scientists" a rework of his "OCaml for Scientists" book. That was 2008.

[1] [https://github.com/sharplispers/cormanlisp/releases/tag/v3.1...](https://github.com/sharplispers/cormanlisp/releases/tag/v3.1.2b)

</comment><comment><USER3> This is really cool and encouraging for someone getting started in F#.

</comment><comment><USER4> How I miss the days when cool new things like this built on alt languages or alt platforms was the norm for HN.

</comment><comment><USER5> The incremental bit was recently refactored out into its own library ([https://github.com/fsprojects/FSharp.Data.Adaptive](https://github.com/fsprojects/FSharp.Data.Adaptive)) which should open up some interesting uses going forward.

There's all kinds of cool crazy stuff this is being used for:

[https://github.com/fsprojects/FSharp.Data.Adaptive/wiki](https://github.com/fsprojects/FSharp.Data.Adaptive/wiki)

[https://rawgit.com/wiki/aardvark- platform/aardvark.docs/docs...](https://rawgit.com/wiki/aardvark- platform/aardvark.docs/docs/media/Elmish.html)

</comment><comment><USER6> Aaah I got reminded of aardvark - qa startup built on top the gtalk. I saw super sad when Google killed that product

<comment><USER7> As did I. I used this a lot at university and learned a lot from its solid network of users.

</comment></comment><comment><USER8> Tip, when posting about graphics and visualisation tooling, the first thing I want to see are screenshots and videos, not a wall of text.

<comment><USER9> The screenshots are in the Gallery link: [https://github.com/aardvark- platform/aardvark.docs/wiki/Gall...](https://github.com/aardvark- platform/aardvark.docs/wiki/Gallery)

<comment><USER8> Thanks, naturally I have found them before writing my comment.

The point was that on any project related to graphics programming those screenshots should be on the landing page, not necessarily all of them.

It is a question of UX, the first thing everyone usually wants to see is how it looks like, not trying to find out where is the link for examples, if it exists at all.

As for the work itself, it is a great piece of work.

</comment></comment></comment><comment><USER10> F# is great, but MS has decided to kill it through neglect. And the few people paid to work on it spend their time trying to keep it working with the 9000 other changes done to the rest of the tooling.

<comment><USER11> I think that's not entirely fair. While MS could definitely invest more resources in F#, I wouldn't say it's been neglected (or dying). Just to mention a few developments in recent years: 1) IDE support via Ionide in VS Code 2) Easy install with NuGet 3) cross-platform FSI supported via NET Core 4) some pretty cool updates recently around anonymous records, optional yields, nameof (just to mention a few) 5) no breaking changes (I'm aware of, anyway)

I'd say the future looks pretty bright for F#. It's really resonating with an audience that wants "functional where I want, but practical where I need".

<comment><USER12> > _3) cross-platform FSI supported via NET Core_

Last time I tried, I couldn't get FSI working on Linux without Mono. Did something change recently?

<comment><USER11> Yes, this is a recent-ish change. FSI is available under .NET Core 3 Preview, and someone recently mentioned that it's working under 2.2 too.</comment></comment></comment></comment>


Scott Kelly's DNA shows unexpected telomere lengthening after year in space - <AUTHOR> http://www.nature.com/news/astronaut-twin-study-hints-at-stress-of-space-travel-1.21380 <comment><USER2> From what I've heard/read telomere length as the anti-aging curing may be a bit overrated, because we actually want to prevent cognitive degeneration (who cares if you live longer if you can't think as well). There's a very interesting ongoing study called the Lothian Birth Cohort Study, where they tested cognitive functioning in 11 year olds born in Edinburgh in the years 1921 and 1936. In the late 1990s/early 2000s the individuals were tracked down (now in their 70-80s) and researchers did extensive, extensive testing to try to explain variances in cognitive functioning between their scores at age 11 and now (why did some people lose ability/others gain?)

I talked to the director of this massive study and he said there was no correlation with cognitive functioning and telomere length [1] and the entire thing may be a bit overrated. Interestingly enough though, he said there there was a strong correlation with DNA methylation[2] with increased methylation associated with worse cognitive aging.

Very interestingly, DNA methylation decreased for Scott after his time in space...

[1] [https://www.ncbi.nlm.nih.gov/pubmed/21194798](https://www.ncbi.nlm.nih.gov/pubmed/21194798) [2] [https://www.ncbi.nlm.nih.gov/projects/gap/cgi- bin/study.cgi?...](https://www.ncbi.nlm.nih.gov/projects/gap/cgi- bin/study.cgi?study_id=phs000821.v1.p1)

<comment><USER3> Regarding longevity, it's also worth noting that telomere shortening are a very effective anti cancer mechanism.

Cancer is the runway division of cells. Preventing cell division when the telomeres are too short ensures there is a finite number of times a cell can divide, meaning there is a finite number of times a cancer cell can divide. This helps prevent cancer from dividing indefinitely. Especially in older folks, we see how terrible cancer can be when those cells mutate and can regenerate telomere length, giving themselves unlimited division.

It's the physical trade-off we have with lengthening or preserving telomere length. They give _all_ of our cells more divisions, good and bad. Since cancer is an exercise in the law of large numbers (how many random mutations will it take for it to hit a critical point in your DNA?), Longer lifespans with longer telomeres will inevitable also mean more aggressive cancers.

</comment></comment><comment><USER4> Scott and Mark are great. Interesting note:

"Once Scott returned to the ground, the length of his telomeres returned to his pre-flight levels relatively quickly. "

<comment><USER5> So if my intuition is applicable (which it's probably not)- it's longer because it stretches out, not because it's accumulating material? I assume that's not really possible though...

<comment><USER6> Telomere length is not measured by physical length. It is measured by the actual number of repeats of the sequence.

<comment><USER7> well, isn't the telomere sequence just some sequence of base pairs, and all base pairs are the same length ?

from [https://en.wikipedia.org/wiki/Base_pair](https://en.wikipedia.org/wiki/Base_pair) :

> one bp corresponds to approximately 3.4 Å (340 pm) of length along the > strand

so physical length and number of repeats of the sequence are the same, by some factor.

<comment><USER6> Sure. But the question assumed that the physical length can be variable depending on the environment. Even if that was the case, measurement of telomeres by the sequence themselves will be independent of environmental factor.

Maybe this is not the perfect analogy, but the character 'a' and the character 'A' might have different heights, but they still represent the same letter of the alphabet.

</comment></comment></comment></comment></comment><comment><USER8> Off the top of my head: I wonder if astronauts are on lower calorie diets than usual.

Lowering calorie intake is one of the few well known ways that lifespan can be increased. Will have to see if there's any research correlating low calorie diets and telomere length.

<comment><USER9> There is also one sure-fire way to increase telomere length : get cancer.

So these people were in a thin metal cube, exposed to abnormal levels of ionizing radiation, ... and after that there was telomere lengthening ? I always heard that astronauts, given the groups they're selected from, have suspiciously short lifespans. Still somewhat above average, but these guys got selected from the creme de la creme. Half of them should live to 120, and that is definitely not happening. I've never seen a good study actually comparing it though.

[http://dailycaller.com/2016/02/06/apollo-14-astronaut- dies-o...](http://dailycaller.com/2016/02/06/apollo-14-astronaut-dies- only-7-moonwalkers-still-alive/)

According to several doctor friends of mine, balance is the best way to go for a long life. Being too thin will kill you, because once you're 65 or 70 or so you will lose the ability to quickly gain weight. A significant number of people dying from "natural causes" die as follows : they get infected with something stupid, like a flu virus. Or they break a hip or something. Either way, they get really under the weather. Result: they lose weight, a lot of weight, rapidly. If your weight falls under about 35 kg, odds of survival drop dramatically, and they die from "complications" (in practice: secondary infections resulting in metabolic exhaustion: your body simply cannot maintain the minimum energy level to keep you alive. On the plus side: very peaceful way to go, and likely quite comfortable too). Keep in mind it will take a year to work your way back from 40kg to 50kg at such an age, so the higher you go the more likely you'll drop back down due to another incident before recovering.

And of course, exercise only helps up to a normal level. If you spend 2 hours every day running, that is definitely in the "shortens lifespan" area. 10 minutes, probably very good for you. And of course, the obvious : exercise increases the odds of accidents happening. Accidents, even stupid ones, can kill.

<comment><USER10> > _There is also one sure-fire way to increase telomere length : get cancer._

This badly needs a source.

This article from 2013 [1] says the opposite, that shorter telomeres are associated with cancer:

 _In recent years, shorter telomeres have become associated with a broad range of aging-related diseases, including many forms of cancer, stroke, vascular dementia, cardiovascular disease, obesity, osteoporosis and diabetes._

And another [2]:

 _" Telomere shortening is common in cancer, but the degree of shortening varies from one cancer cell to another within each patient, and this variability may give us a better idea of how prostate cancers behave."_

[1]: [https://www.ucsf.edu/news/2013/09/108886/lifestyle- changes-m...](https://www.ucsf.edu/news/2013/09/108886/lifestyle-changes-may- lengthen-telomeres-measure-cell-aging)

[2]: [http://www.hopkinsmedicine.org/news/media/releases/in_prosta...](http://www.hopkinsmedicine.org/news/media/releases/in_prostate_cancer_prognosis_telomere_length_may_matter)

<comment><USER11> Edit: At the top since I think it may qualify my comments: I think there's a causation/correlation incongruity in this, the parent, and the grandparent posts. Telomere lengthening can lead to cancer; getting cancer is not necessarily a "sure-fire way to increase telomere length"

"Cancer" is an unbelievably broad term. Generally speaking, expression of telomerase and maintenance of telomeres is seen in (many) cancers. The background behind this is that as telomeres shorten with each cell replication, they get to a point where they are too short, and the cell stops dividing. Cancer occurs when cells that are not supposed to divide keep dividing.

</comment></comment></comment></comment><comment><USER12> This would bring another reason for the billionaire in the 1997 movie Contact, to go to space to live just a little longer :P

<comment><USER13> A bit more like Elysium[1], I'd say...

1: [https://en.wikipedia.org/wiki/Elysium_(film)](https://en.wikipedia.org/wiki/Elysium_\(film\))

That said, being exposed to a lot of high-energy ionizing radiation and lengthening one's teleomeres doesn't sound like a good combination...

<comment><USER14> In Elysium, living in space wasn't directly connected to a longer lifespan. It just so happened that the elite segment of the population was able to afford both.

Arthur C. Clarke's short story "The Secret" is a bit more directly relevant: [https://en.wikipedia.org/wiki/The_Secret_(short_story)](https://en.wikipedia.org/wiki/The_Secret_\(short_story\))

</comment></comment></comment><comment><USER15> Surprised the article didn't bring up radiation hormesis as a plausible explanation. Maybe I'm misunderstanding the observed effects?

<comment><USER16> The NASA article [1] gives a little more background, and offers another explanation:

      Bailey found Scott's telomeres on the ends of chromosomes in his
      white blood cells increased in length while in space.

      This could be linked to increased exercise and reduced caloric
      intake during the mission.

[1] [https://www.nasa.gov/feature/how-stressful-will-a-trip-to- ma...](https://www.nasa.gov/feature/how-stressful-will-a-trip-to-mars-be-on- the-human-body-we-now-have-a-peek-into-what-the-nasa)

</comment></comment><comment><USER17> I have no idea what the significance of telomere is (googled it but really want a TL;DR version). Can someone explain this preliminary result in layman's terms?

<comment><USER18> Telomeres protect your DNA from degeneration during cell division. As you age, your telomeres get shorter and shorter, and ultimately lead to cell division not producing viable cells anymore.

Quoting wikipedia:

> During chromosome replication, the enzymes that duplicate DNA cannot > continue their duplication all the way to the end of a chromosome, so in > each duplication the end of the chromosome is shortened [...] The telomeres > are disposable buffers at the ends of chromosomes which are truncated during > cell division; their presence protects the genes before them on the > chromosome from being truncated instead.

> Telomere shortening is associated with aging, mortality and aging-related > diseases. In 2003, Richard Cawthon discovered that those with longer > telomeres lead longer lives than those with short telomeres. However, it is > not known whether short telomeres are just a sign of cellular age or > actually contribute to the aging process.

<comment><USER19> > As you age, your telomeres get shorter

The human body has a mechanism to reset telomere length during reproduction; i.e., babies are born with "full length" telomeres.

Can anyone shed light on why this mechanism is so hard to trigger in an adult? What are the technical difficulties in artifically lengthening telomeres?

<comment><USER20> I'm no biologist, but from what I understand the body actually does maintain telomeres over time, it just doesn't keep up with the loss from cell division over a lifetime.

Purely speculating, death to "old age" is rare in nature so the process merely has to be "good enough" for our genes to compete rather than perfect enough for immortality.

</comment></comment></comment></comment><comment><USER21> Interesting results. But were twins needed for this discovery? I would imagine the the telomere length change could have been discovered by pre-mission, in- mission, and post-mission sampling. I'm guessing this was discovered in this study because of the in-depth DNA sampling, not due to having a twin to compare to.

<comment><USER22> The twins were used because they are doing a wide variety of genomic testing. One serves as a baseline. So twins will give a low variance between candidates.

</comment></comment><comment><USER23> Maybe we will determine in the distant future that aging is related to gravity? :)

<comment><USER24> I'm excited to ask Mazer Rackham when he returns.

</comment></comment><comment><USER25> Could it be radiation hormesis?

</comment><comment><USER26> Could this be as simple as, gravity has an effect on telomeres length?

</comment><comment><USER27> Yesterday's discussion: [https://news.ycombinator.com/item?id=13530595](https://news.ycombinator.com/item?id=13530595)

<comment><AUTHOR> As the original submitter: it seems like this post, although a duplicate, was generating further engaging and informative discussion beyond that discussed in the previous post, arguably more than the previous post (on the basis of number of comments within the first hour being equivalent to number of comments over the course of the 24 hour lifetime of the previous post). Not sure if this was you, but marking as duplicate has effectively killed that discussion by making the post disappear.

As the HN policy around reposts is somewhat subjective "If a story has had significant attention in the last year or so, we kill reposts as duplicates. If not, a small number of reposts is ok," I'd contend that marking as dupe in this case wasn't the right move. While the post from yesterday did get significant attention, that post moved past the front page, and today's repost resulted in meaningful and engaging further discussion. Unfortunately now that discussion is most probably dead, as is the discussion on yesterday's post, where new comment activity has stalled.

<comment><AUTHOR> Furthermore, my intent with this submission was to highlight a specific finding of the research that is not the emphasis of the previous post (namely, the unexpected result involving telomere length). The discussion on this post generally focused on that result, whereas the discussion on the previous post did not.

<comment><USER27> OK, we've unmarked this one as a dupe and restored it.</comment></comment></comment></comment>


Cisco switches to weaker hashing scheme, passwords cracked wide open - <AUTHOR> http://arstechnica.com/security/2013/03/cisco-switches-to-weaker-hashing-scheme-passwords-cracked-wide-open/ <comment><USER2> Any other actual router jockeys out there, aside from the folks just talking about it? I used to do BGP support at a regional ISP but I got out of that game almost a decade ago. Dead end job, dead end company, dead end industry, low pay, and 24x7 on call. Of course it doesn't have to be that bad.

Anyway, the doctrine pushed at the time by cisco was embedding a password into a router was only for home or VERY small business users. Anyone with more than, say, 4 routers or so should be using some form of network authentication.

We had network auth in the very early 00s although all our routers had an emergency console password configured in (had to use it once, looked like 80 characters of line noise, maybe it was). That was in a sealed envelop in a lockbox. Because he had to update every router manually if that envelope opened, our one security guy got pretty annoyed if anyone ripped the envelope open.

Anyway the point that might be missed is in a carrot and stick method, this might be a very extreme application of the stick to get people to use network AAA systems instead of configuring their console and enable passwords in each router.

I guess modern cisco routers/IOS can do LDAP and KERBEROS its not all RADIUS from 1993, although old stuff does work.

I will say that in the dark days before we went network AAA it was an absolute nightmare when someone on the team quit and someone had to go manually thru every router on the network and change the passwords and distribute the new one to us all.

This will negatively impact people with 1990s architecture, but to the extent that they're already in a living hell anyway it won't be much worse.

Unfortunately I've worked at a few places with non-internet connected routers (or so they thought, anyway) where documentation was so poor you basically had to break in each time you needed access. Physical access to do hard recovery via a reboot was a PITA. Making it "easier to break in" would be seen as a feature not a bug in those locations.

<comment><USER3> This is true - RADIUS and TACACS are the most secure way to access routers. I've found that nearly all routers in nearly all environments still have a local authentication. If you were to remove all network connections (or just the right one) you no longer have access to the authentication server and you would be totally locked out of the box since it doesn't cache any of the authentication. The running configuration of the router IS what you have to secure, and it needs to be stored under lock and key (SFTP, authenticated file share, etc). If you're sending it to non-shared parties you should remove the authentication from the configuration either manually or with 'show run brief'.

</comment></comment><comment><USER4> The amount of routers still using 'cisco/cisco' as a default password for full access is astonishing. Years ago, I saw backbones and OC3/12 cores using these passwords.

I know botnets are now considered the DDOS standard, but there are plenty of remotely controlled Cisco routers that can pump out more data than hundreds of thousands of bots.

My favorite is outer nodes that can get user access with "cisco", then, full access to an inner node using "cisco", then, reconnect to the outer node (from inside), and have full access. Vicious circle.

[1] <http://packetstormsecurity.com/cisco/ciscos.c>

<comment><USER5> _but there are plenty of remotely controlled Cisco routers that can pump out more data than hundreds of thousands of bots_

Have any examples? I would think that a router is less than ideal here, as most forms of traffic generation would involve the anemic CPU and control/mgmt plane.

<comment><USER4> I'm just speaking from experience from a few of the older IRC botnets I analyzed for a few years. Nearly 200,000 of the 750,000 (+-150,000) bots were on dial-up connections in developing countries.

Now, 200,000 packets coming in at 2.8KB/s is nothing to joke about(500MB/s). Yet, 500 packets coming in at 8MB/s, well, on top of the arsenal of random connections.

I sometimes forget I'm a dinosaur now when it comes to this sphere of knowledge! I'm sure these days its less one sided. It used to be dialup and windows 95/98 RPC vulnerabilities spreading in the wild using IRC as a middleman.

With tor, torrents, etc, I imagine the game has drastically changed in the past 6 years. It is too bad there are not many jobs in this field, I would gladly make a lifetime out of it.

I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machine. We determined that it could prove to be more destructive than the original botnet, because it wastes resources, while we could actually impact the way a machine behaved for the owner. This could also lead to legacy machines failing due to windows updates or firewall rules.

<comment><USER6> > I was on a team that created an anti-bot-net which would reinfect, secure, > and alert of the already infected machin

While I'm sure your intention was benevolent, I'm pretty sure that's illegal under current laws. There's probably a reason that reputable AV vendors don't use that practice; I would hate to have unknown entities helpfully "patch" my machine.

<comment><USER4> Exactly, which was the reason we retracted the project. It was truly the greatest learning experience of my life.

</comment></comment></comment></comment></comment><comment><USER7> Wow that is beyond inept, that is flat out reckless.

<comment><USER8> Actually, it's the optimal choice as long as people use strong passwords.

<comment><USER9> If everyone uses long random passwords and never reuses them elsewhere, maybe it's optimal for simplicity and server-side cpu usage. There's no difference (edit: should say _advantage_ rather than _difference_ ) in salted passwords (salt + shorter-randompassword) compared to (longer-random-password); salts become unnecessary since you can effectively guarantee that two users won't share the same password if they're all random and separately chosen.

However, the real world called and it wants "suboptimal" choices back, for when users don't use good password hygiene.

<comment><USER10> Sure there is a difference. If there is another exploit that gets you hashed passwords from many thousand different routers you would be quite happy knowing that none of them were salted.

Also there is a huge difference between (salt + short-random-password) and (long-random-password) because the salt isn't nearly as confidential as the password and knowing it reduces the attack vector to (short-random-password), which is trivial to break for such poor (in this context) hash algorithm.

</comment></comment></comment></comment><comment><USER3> It's not a 'switch' but rather failed implementation.

As well, this is only protecting people that would have otherwise put their saved passwords into insecure locations - like posting to the internet or insecure internal file shares.

For public posting the command 'show run brief' will take out all certificate and password information, at least for IOS-XE. NX-OS, IOS, and security IOS have options as well, use 'show run ?' to confirm.

<comment><USER5> Define 'insecure locations'.

Some orgs go to great lengths to segment access to their networking core and establish separation of privileges using AAA, etc. As well, configs can leak out through other means (TAC case, submission to auditors, etc).

Someone who has access to config backups shouldn't be able to bootstrap their privileges by cracking passwords.

In theory "audit our config backups, and fix them up" is a task you can assign to a junior network engineer with a limited account and a copy of RANCID.

Role separation, defense in depth, and all that...</comment></comment>