How Twitter pushed RT to spend big on 2016 US election - <AUTHOR> https://www.rt.com/op-edge/407858-rt-twitter-us-election/ <comment><USER2> Russia rigged the election with a couple of hundred thousand dollars in propaganda. Clinton spent more than a million dollars on CTR alone. The Koch Brothers dumped over one billion dollars according to some articles I've seen.

Either the Russians have vastly superior propaganda and probably in control of global politics or their influence in the US election is overstated.

<comment><USER3> Or RIS broke into state election boards to get hyper accurate data on voter and voting patterns unavailable within legal means, broke into campaigns to find information they could construe as satanic (like child sex slave rings run out of pizzeria shops), and then colluded with Republicans to distribute their propaganda to the most low information voters they could find in swing states for maximum impact.

<comment><USER4> Can someone link some of these "fake news articles" from rt.com? That sounds crazy, heh.

<comment><USER3> Just look up any regarding Putin's slaughter of the passengers of MH17, they've been quite active in trying to spread disinformation there.

<comment><USER4> I mean regarding 2016 US election, sorry.

</comment></comment></comment></comment></comment><comment><USER5> Don't we have a bigger issue if ad money can swing an election? Where's the critical thought on the part of the electorate?

<comment> FLUX-YOU Critical thought doesn't make you immune to propaganda.

<comment><USER6> This is a really important point. Everyone thinks that they, personally, are immune to this sort of thing. Every scientific study suggests they're wrong.

The Mercers and Putins of the world do this because it's cost-effective.

<comment><USER7> > Every scientific study suggests they're wrong.

Which scientific studies? Interested.

</comment></comment></comment></comment><comment><USER8> Has anyone seen what the promoted tweets were? Would be interesting to see which tweets got promoted.

The twitter report says:

"Based on our findings thus far, RT spent $274,100 in U.S. ads in 2016. In that year, the @RT_com, @RT_America, and @ActualidadRT accounts promoted 1,823 Tweets that definitely or potentially targeted the U.S. market. These campaigns were directed at followers of mainstream media and primarily promoted RT Tweets regarding news stories."

Which doesn't seem particularly nefarious to me. Does RT have a political bend to their organization? Probably. What state funded news organization doesn't? It's 270k on stuff that "definitely or potentially" targeted Americans? What does potentially mean and what is the breakdown? What % actually had to do with the election?

Also if I have the timeline correct Twitter bans RT from advertising two hours after they publish their side of the events?

</comment><comment><USER9> That is more or less the main way the media in the US, the EU, and some other world regions, is operating right now.

For each major story, they remove all the real details, even the context, and just present you with a well crafted narrative which itself is mostly supported only by promises of inside-knowledge, secret/anon sources, and "proofs" that are never released.

Then after some time passes the details are re-introduced by the non-liars and the narrative collapses.

Except nothing changes because the general public has already been conditioned to want to be lied to daily and just moves on to the next fake-news story.

<comment><USER10> >They remove all the real details, even the context, and just present you a well crafted narrative that has no basis in reality.

I don't normally comment on political topics, but who are you talking about here? Is the "they" in this sentence RT or Twitter? Both have huge incentives to misrepresent facts to make themselves look good.

>Except nothing changes because the general public has already been conditioned to want to be lied to daily and just moves on to the next fake- news story.

Sounds about right. I just assume both parties are lying here.

<comment><USER11> They being the media. Journalistic integrity died years ago. We like to blame Russian for the last election outcome, but are quick to forget that mega corporations spent way more time and effort trying to sway the election. For some reason we are ok with Google trying to influence voters through recommends and search results, but aren't ok when Russian does the same thing using ads (on Google platforms). Google, Twitter, Facebook had no problem taking Russian money during the election.

<comment><USER12> _Are_ we ok with and/or easy to forget about mega corporations trying to sway the elections? Why do you think so?

<comment><USER13> If Hillary won, no one would care. If they cared, the whole process would be under review for obvious corruption.</comment></comment></comment></comment></comment>


Artichoke – A Ruby made with Rust - <AUTHOR> https://github.com/artichoke/artichoke <comment><USER2> This is a great idea but why would it be called anything other than Jasper: [https://en.wikipedia.org/wiki/Jasper](https://en.wikipedia.org/wiki/Jasper)

It doesn't get closer to a Ruby made with Rust than that...

<comment><USER3> That would literally make my year, as a Jasper.

</comment></comment><comment><USER4> While I think this is great, Ruby implementations are notorious for being tricky to implement 100%. Rewriting Ruby in Rust is great and all but even TruffleRuby isn't at the point where the authors recommend running a Rails app on it.

I wonder if there's a way to add some Rust into MRI. Perhaps someone could write a YARV VM or a version of the JIT in Rust. It'd complicate the build pipeline, but it'd be iterative and improve the main implementation of Ruby.

<comment><USER5> Hi, I'm the author of Artichoke.

Ruby has a great black box testing suite called ruby/spec [0] that is shared among multiple Ruby implementations. Artichoke has a custom runner [1] to track progress on implementation completeness.

If Artichoke passes ruby/spec and is not compatible with MRI, that's a bug in the specs.

re: adding Rust to MRI, I'm working on extracting the mruby backend from the core VM infra + core/stdlib impls [3] which would let us use MRI as the backing VM via rutie. When the Artichoke core and stdlib is complete, this would mean that the MRI runtime could be implemented entirely in Rust [2].

[0] [https://github.com/ruby/spec](https://github.com/ruby/spec) [1] [https://github.com/artichoke/artichoke/tree/master/spec- runn...](https://github.com/artichoke/artichoke/tree/master/spec-runner) [2] [https://github.com/artichoke/artichoke/issues/92](https://github.com/artichoke/artichoke/issues/92) [3] [https://artichoke.github.io/artichoke/artichoke_core/](https://artichoke.github.io/artichoke/artichoke_core/)

<comment><USER6> So what is the current pass rate for language and core specs? I didn't see a number in any of those links or did I miss it? Do I have to build and run it myself to find out?

If you can run mspec at all then that's pretty good to be honest.

<comment><USER5> I can run MSpec to completion for language, core, and library specs. Thank you for the encouragement :D.

I've implemented a runner that can skip known things that cause the spec to hang (e.g. Mutex specs since Artichoke has a single-threaded implementation of Mutex that deadlocks during the specs).

        $ pushd spec-runner/vendor/ruby/language
        $ cargo run --bin spec-runner **/*.rb
        Passed 1078, skipped 35, not implemented 2, failed 476 specs.
        $ popd; pushd spec-runner/vendor/ruby/core
        $ cargo run --bin spec-runner **/*.rb
        Passed 5412, skipped 998, not implemented 201, failed 8629 specs.
        $ popd; pushd spec-runner/vendor/ruby/library
        $ cargo run --bin spec-runner **/*.rb
        Passed 0, skipped 22, not implemented 16, failed 3276 specs.

The library specs pass number is a bug in my spec runner. All packages added to Artichoke pass ruby/spec. Those packages are : delegate, forwardable, json, monitor, ostruct, set, srscan, and uri.

</comment></comment></comment></comment><comment><USER7> A little oxidation and this would make the perfect logo:

[https://www.amazon.com/dp/B00IK9F9F4](https://www.amazon.com/dp/B00IK9F9F4)

</comment><comment><USER8> I love seeing more Ruby implementations! Looking forward to seeing how it will progress. Are there any details on how it's implemented? How does it execute Ruby? Does it have its own bytecode? Does it compile to machine code on the fly? What will make it faster than MRI?

<comment><USER5> Thank you for your kind words.

Growing pains of blowing up on HN lol, I do not have this written down yet, but I have a ticket to start documenting this [0].

The idea is to have a core set of traits [1] that when implemented allow an implementation to load an interpreter agnostic Ruby core and Ruby Standard Library.

There is currently only one interpreter that implements these traits, and it is backed by mruby. My ultimate goal is to move off of mruby to either an MRI- backed interpeter via rutie or a native Rust-implemented backend + VM + parser.

[0] [https://github.com/artichoke/artichoke/issues/102](https://github.com/artichoke/artichoke/issues/102) [1] [https://artichoke.github.io/artichoke/artichoke_core/](https://artichoke.github.io/artichoke/artichoke_core/)

</comment></comment><comment><USER9> No c extensions? So most popular gems won't work? Does that make this essentially an intellectual pursuit without practical application?

<comment><USER10> No reason it can't be added in the future.

<comment><USER11> Without a GIL it would be incredibly difficult, would it not? AFAIK C extensions to MRI are not thread safe.

This could, of course, expose a different C API that allows for thread safe extensions, but I think the original comment is complaining about lack of compatibility with all of the important gems that depend on the existing MRI C API.

This has always been an issue that held back JRuby.

<comment><USER12> JRuby does not have a GIL.

<comment><USER13> My personal experience with Ruby is extremely shallow, but a casual glance at the search results wrt the GIL in Ruby seems to say it actually does have one. I could be wrong, as I'm not an experienced Ruby developer, however.

I.e. [https://thoughtbot.com/blog/untangling-ruby- threads](https://thoughtbot.com/blog/untangling-ruby-threads)

<comment><USER14> From your link: "Note that this is not the case for JRuby or Rubinius which do not have a GIL and offer true multi-threading."

</comment></comment></comment></comment></comment></comment><comment><USER15> Once this language is more mature, comparing it with Crystal would be great. Artichoke will have the added benefit of having Ruby's entire ecosystem as its behest.

</comment><comment><USER16> I wonder how much this would change the performance of ruby... that's all kind of cool except no c extensions, that basically makes all the gems I use unusable.

<comment><USER17> They're going to have to spend an immense amount of time implementing all the performance optimizations present in mri/yarv bytecode engine before they achieve performance parity.

The amount of engineering effort to remove the GIL _and_ simultaniously make C extensions work is probably not worth simply choosing a multi-process w/ shared memory solution for true parallelism.

</comment></comment><comment><USER18> I actually like the idea, being a Rust illiterate i have way of reading it. I like the tone of it "No GIL". I hope it does come to fruition. But i would love ruby programs to eventually be able produce machine code, like tons of lisp and scheme implementations do. Even Smalltalk did. I hope with "No GIL" that should be somewhere in the pipeline.

</comment><comment><USER19> Is it possible to install ruby gems in the browser playground? So, Does ruby gem install via web assembly runtime work?

<comment><USER5> Not yet, but you can track progress here: [https://github.com/artichoke/artichoke/issues/105](https://github.com/artichoke/artichoke/issues/105)</comment></comment>


Meteor showers from space - <AUTHOR> https://www.meteorshowers.org/ <comment><USER2> Hi, I built this and want to share some background:

Each data point corresponds directly to a real meteor entry into the Earth's atmosphere recorded by NASA CAMS ([http://cams.seti.org](http://cams.seti.org)). Using this network of cameras, we can capture enough information about a meteor to compute its orbit around the sun. That means each particle has unique orbital parameters that accurately reflect a former meteorite in space.

In order to visualize the cloud, the epoch of these orbits is randomized. In other words, each particle begins at a random location in its orbit. This is done so the visualization can be continuous rather than only showing a clump of meteors from ~2012-2018.

Open source here: [https://github.com/typpo/showers](https://github.com/typpo/showers)

<comment><USER3> <pedantic> A meteorite is an object that hits the ground. A meteor burns up on the atmosphere. When they are still in space and only potential meteors/meteorites, they are called meteoroids. </pedantic>

<comment><USER2> Yup, I realized this mistake after I posted but the edit option was not available.

</comment></comment></comment><comment><USER4> We took a drive out to the Minninglow dark sky site in the Peak District ([https://en.wikipedia.org/wiki/Peak_District](https://en.wikipedia.org/wiki/Peak_District)) in the small hours of this morning. It was quite amazing to witness the streaks of the Perseid meteor shower! We counted 30 over the course of an hour. No telescope required. The peak is meant to be tomorrow night. I highly recommend trying to catch it if you can.

I found the "MeteorActive" and "Clear Outside" iOS apps quite useful for picking the right time for the best view.

<comment><USER5> > No telescope required.

In fact, you should not use a telescope even if you have one. Meteors move fast and cross a significant fraction of the sky.

</comment></comment><comment><USER6> I'm pretty impressed with how fast this renders on my iPad!

<comment><USER7> Also what impressed me, but on my Android phone.

<comment><USER8> Loaded near instantly and played smoothly on my cheap android phone. Very impressive.

</comment></comment></comment><comment><USER9> The zoom function zooms, but with unexpected delays and then gets stuck, but it might be something strange about my laptop.

Also, my first reaction to the title was "there are meteor showers that aren't from space?"

<comment><USER10> >Also, my first reaction to the title was "there are meteor showers that aren't from space?"

I was hoping it would be imagery capture from the ISS.

</comment></comment><comment><USER10> I've known that some meteor showers are better than others, but this makes it easy to tell visually with how dense/sparse each one appears.

This layout also made me wonder what would meteor showers look like from other planets. Mars has a thinner atmosphere, so maybe only larger debris would be visible?? But what about planets with thicker atmospheres?

<comment><USER4> Mars has a lot of dust in the atmopshere, which makes Martian astronomy more difficult. The Spirit rover did manage to capture an image of a comet though. There's some more detail on Wikipedia: [https://en.wikipedia.org/wiki/Astronomy_on_Mars#Comets_and_m...](https://en.wikipedia.org/wiki/Astronomy_on_Mars#Comets_and_meteors)

If you're interested in the concept of "alien astronomy" from other planets, I've used these "planetarium" style tools to play around with what it'd look like:

Light: [http://stellarium.org/](http://stellarium.org/) Medium: [https://celestia.space/](https://celestia.space/) Heavy: [http://spaceengine.org/](http://spaceengine.org/)

</comment></comment><comment><USER11> Why are all the meteors in this specific plane perpendicular to the planets' plane?

<comment><USER12> That was the direction the comet took when it first moved through. If you click on the dropdown menu in the top left, you can show all meteor showers at once. They are all in planes.

</comment></comment><comment><USER13> Insert MeteorActive" and "Clear Outside" into it. K tnx.

</comment><comment><USER14> I only see orbits and the milky way, and none of the planets and meteoroids. Firefox Linux. Probably missing some webgl feature (other webgl demos work).

</comment><comment> white-flame This is really nice looking, and I can only imagine it'd be even more amazing in VR.

</comment><comment><USER15> A meteor is defined as body entering the atmosphere from space. Therefore "meteor showers from space" is redundant, just like saying "ATM machine".

<comment><USER16> I assume it's meteor showers [as viewed] from space, not a reference to their origin.

<comment><USER15> Good point.</comment></comment></comment>


Things to Stop Doing on Facebook - <AUTHOR> http://finance.yahoo.com/family-home/article/109538/7-things-to-stop-doing-now-on-facebook

<comment><USER2> I was scared a few months ago when I joined my company network and they were automatically permitted to view everything. Even though all of my other settings are restricted to "Just Friends"

</comment><comment><USER3> Most of the points covered here are things that every kid or parent should know.

The two things I wouldn't expect a kid or parent to know is the "don't make yourself searchable", and the "don't overlook your privacy controls". The rest is information that's been thrown at us since before the internet.

<comment><USER4> Any idea why they don't want childrens' names in captions or tags?

<comment><USER5> Lots of vague and specific scary things that parents think about. It comes down to limiting information to reduce the risk of information combining into something dangerous where the parts weren't dangerous by themselves.

You have a picture of your kid. You have your kid's name, on the picture or in your profile. Other information in your facebook finally gives a clue about where your kid goes to school.

It's relatively easy to snatch any random kid, although they might kick and scream and call attention to the kidnapper during the act.

It's a little easier to trick a kid into "helping me find my lost puppy."

It's easier still to talk a kid into a car with "Hey Bobby, I'm a friend of your dad. Yeah, your dad Joe Smith. He asked me to come pick you up 'cause he's going to be late."

Just one example, hopefully that doesn't work with most kids but it might with some. The point isn't this specific scenario, it's that when information is combined it becomes completely new information usable in ways you may not have foreseen. Kid snatchers are thinking about it way more than we are. Identity snatchers are thinking about it way more than we are.

I took down all my kid's pictures (actually all my pictures) last week.

<comment><USER6> I can concoct a hundred different worst-case scenarios about how a bad guy can do exactly this. You can't protect against all of them.

<comment><USER5> "100% is impossible" is never a good argument.

</comment></comment></comment></comment></comment><comment><USER7> I just rechecked my settings and there were new things in there that were set to visible to "everyone".</comment>


How Guy Kawasaki Launched Truemors for $12,107.09 - <AUTHOR> http://blog.guykawasaki.com/2007/06/by_the_numbers_.html <comment><USER2> I don't understand why everyone is so critical of what Guy has done and the steps he has taken to accomplish it.

I am not a big fan of Truemors, but I really enjoyed reading about what he spent and the things he did to get it off of the ground.

<comment><USER3> _I don't understand why everyone is so critical of what Guy has done_

He seems patronizing: his entire post reads like a satire, i.e., " _Look, ma, I made a social networking site, too, just like the ones all the cool kids are visiting these days_ ".

Also, he seems to enjoy mocking the lower costs inherent in Web 2.0 by _exaggerating how cheaply_ he built the whole thing.

That may not be his intention, but that's certainly how it comes across.

<comment><USER4> Do you think he's being insincere or just a showman? My feeling is that Guy likes to exaggerate everything to make a point: in this case, it's getting really cheap to fail, so take more risks.

Thoughts?

<comment><USER3> It smacks of insincerity, especially because he seems to enjoy the part about "no business plan".

Any responsible investor, either angel or VC, will want to have some sense about that, even if revenues and profits "come later".

YC gets a lot of criticism in that regard, but to their credit, they _do_ ask applicants how they intend to make money with their project.

<comment><USER4> I totally agree that you need a business "model" - but do you really need a "plan" for a site that costs $12,000?

If he can get 260K page views, even a 0.5% clickthru @ only $0.10 an ad is $130. Not great, but if you can do it every day you've got a site that's pulling in $50K in revenue a year. Not bad, but could be something to explore.

I totally agree with you that you need to know where your business is going to go and if you want to get real funding you'd better have a business plan, but if you're running a $12K test, why not just make sure you think there's a model and then test it?

</comment></comment></comment></comment></comment><comment><USER5> Random question, when does one need to incorporate? I'm building an app slowly and only have a few $10s to spend every month. Clearly, I can not afford extra expenditures.

My friends will see a private beta, and then I'd like to start looking for some funding. Will I need to be incorporated before that point?

<comment><USER6> From what I understand, you don't necessarily have to be incorporated to seek funding. That would happen as a matter of course if you got a deal.

The main reason to incorporate or LLC is to protect yourself from legal liability. If someone sues you, you want to protect your personal assets from being part of that lawsuit. If you're not even going to be live, then you may not have anything to worry about.

<comment><USER7> Another reason to incorporate is so that, when you have multiple people working on something, there is an entity for the code to belong to.

<comment><USER8> I'm curious - if individual founders write a significant amount of code before incorporation, do they then have to legally sign over rights to the code to the corporation once it's been formed? Are there persistent legal problems that might arise from working first and incorporating later, or can everything be solved by a good lawyer? (Assuming a good working relationship between cofounders...if there's no legal framework and then things get sour, I'd imagine there're lots of problems that might arise...)

<comment><USER7> It's not so much legal problems you have to worry about. When the code belongs to a company the founders collectively own, they have more incentive to cooperate. Till you have such an agreement, any founder could bail and take his code with him, as supposedly happened with Facebook. Arguably any startup whose founders would do such a thing would be doomed anyway, but even in startups where the founders can trust one another, having the company own the code tends to make them cooperate more, as I've heard marriage does vs. just going out.

</comment></comment></comment></comment></comment><comment><USER9> Seems Guy played that hand perfectly. He bet that 'inquiry minds want to know.' named it Truemors, or as I usually mistaken and slur Tumors. I'm unable to hold on to 'true rumors'. However, I disagree with Guy, he did create a business plan ... not one that requires 20 slides, but one that suits his own 5 second elevator pitch evangelist style.

</comment><comment><USER10> Tips for outsourcing like Guy did: <http://news.ycombinator.com/comments?id=26310>

<comment><USER10> I'd love to see a follow up in 90 days to this story, maybe with how much money the site made, etc.

</comment></comment><comment><USER11> 400 dollars, for that logo?!

If anything, he could've saved an extra $1000 at least, giving me a bit more hope as I start my venture.

</comment><comment><USER12> I'm surprised he's proud of any one of those points, let alone all of them. But I think the true reason behind writing the article is to convince his readers, as well as himself, that he's doing this just to see what happens.

</comment><comment><USER13> I have nothing against GK but also can't understand this amount

</comment><comment><USER6> _$1,115.05. I spent $1,115.05 registering domains. I could have used GoDaddy and done it a lot cheaper, but I was too stupid and lazy._

I don't understand this part (either). First of all, 55 domains is way overkill. Maybe some of the country-coded TLDs are worth it if you're really going to do, say, a German-language Truemors.

Ok, so even then, 55 x $6.95 =~ $385. (GoDaddy does $6.95 domains with discount codes. There are scores of discount codes out there. Use CHILL3, for instance.) I can understand being a little lazy, but $700 lazy? Even if you're rich, 700 bucks is 700 bucks.

If it was me: F the country codes. Register .com, .org, .net, .us, .info, .biz. And you're done -- in fact, you're beyond done. You don't really need that crap at all. You need some SEO instead, perhaps.

</comment><comment><USER14> $4,824.14. The total cost of the legal fees was $4,824.14.

(???)

"The only reason Truemors is getting so much coverage is that it's Guy's site."

Too bad it's worthless. If he actually made something new and/or innovative, his celebrity would actually be put to good use.

<comment><USER15> Perhaps it's worthless in its current implementation or intended domain. I wouldn't write off the idea so quickly though. A lot of how humans get their news is through gossip from their trusted network of informants. Truemors did away with the trusted network to rely on global voting. I'm not sure this is the way to go.

Well, just because you're a celebrity doesn't mean you can't fail. You just fail bigger.

<comment><USER16> You hit my biggest problem with the idea: Gossip already spreads better among networks of people who care. It's not some concept I can just go to a page for. So the topic of the content is not a value add.

As for the technology, we've seen how cheap and reproducible that is. News.yc, Reddit, Digg, Netscape, and dozens of other sites have technology that probably beats that of Truemors. So the company isn't worth buying for that.

Some companies get bought for their employees. Well, Guy's "1.5" employees, if he's talking about a full-timer and part-timer other than himself, aren't visionaries, they're just people who can turn around one of Guy's ideas. Come to think of it, that makes them better potential hires for a big company than most headstrong, visionary startuppers.

So Guy just spent $12k making himself feel good. By doing so, he demonstrated how detached he is from the real world -- which, psychologically speaking, is a fine way to live. If you're like Guy and you can afford to blow $12,000 doing it.</comment></comment></comment>


Solving missing portion of Escher drawing - <AUTHOR> http://im-possible.info/english/articles/escher_printgallery/

<comment><USER2> You know, maybe it's just me, but the picture just doesn't look as good with that spot filled in. The the composition works better with a central empty point to balance around.

Escher may not be a mathematician, but this mathematician's no artist.

</comment><comment><USER3> What is all this about him not being a mathematician?

<comment><USER4> Not a formally trained mathematician, but I think this story is a stunning example of just how much innate mathematical ability the human brain contains. Also, it's noteworthy that the ability to describe complex mathematical concepts without being able to write them down formally seems to be a common thread in a certain kind of genius (e.g. Einstein).

</comment></comment><comment><USER5> this site contains animations about the droste effect.

[http://escherdroste.math.leidenuniv.nl/index.php?menu=animat...](http://escherdroste.math.leidenuniv.nl/index.php?menu=animation)</comment>


My Windows Live Mesh Cluster Fail - <AUTHOR> http://pantuso.com/2010/11/21/windows-live-mesh-cluster-fail/

<comment><USER2> This reads like it could be a good ad for Dropbox. That version would've been in the file's history. A 5 second repair-job.

<comment><USER3> My thoughts closely aligned to this, "What, Mesh doesn't provide access to the previous versions?" That is a huge part of the reason I trust Dropbox so completely. They've got my back in case they do screw up.

</comment></comment><comment><USER4> I use Live Mesh and this happened to me once but every time it syncs, it moves the "old" file to the recycle bin... It just doesn't deletes it! I have to manually delete it, so if shit happens, I can always just look in the recycle bin. Did you search there? =\

</comment><comment><USER5> That's pretty horrible. I must admit that I haven't "upgraded" to the new version of Mesh yet, due to concerns with it. First, it's not really Mesh -- it's Sync, with a name change. Second, the original Mesh was architected by Abolade Gbadegesin, probably one of the best architects in the industry you haven't heard of (and now an architect on WP7). I don't know who did Sync/Mesh.

I do wonder what would cause such an issue. You'd think that simple timestamps would catch this issue. I wonder if the original poster changed his clock to match the time for this Ignite conference and that screwed everythign up?

<comment><USER6> Comparing dates that aren't UTC is a pretty amateur mistake. Comparing timestamps alone is a mistake too.

It doesn't really matter why it broke to be honest, something like that has to be perfect or it's useless. After it breaks for someone it's impossible to trust the system again, negating any benefits. Once bitten twice shy.

They should have done their homework on distributed systems and used something like a vector clock. MS has lots of resources and absolutely no excuse for fucking this up. Especially since small startups have made similar services that actually work.

<comment><USER7> Re vector clocks, Microsoft even employs Leslie Lamport

<comment><USER5> He does work at MS, although I don't think vector clocks help here necessarily. I think a strict vector clock implementation _may_ simply tell you that there is no strict ordering in this case, as you had two independent events with no synchronization ocurring between the two (if we take the worst case scenario where they both go online to the service at the same time).

UTC timestamps would solve the issue, unless you lied about your UTC time (hence the time change question).

I must say, unlike the first respondant to my post, while I agree it should never happen -- I think understanding why it did is interesting in of itself. But I'm just one of those people who likes understanding how people make mistakes in software.

<comment><USER6> I don't know enough here to say anything definitively, but I think knowing there's a conflict is half the battle. UTC timestamps are great but clocks have to be perfectly in sync which is unlikely even w/ NTP. And as you mentioned doesn't withstand users changing their system time.

Sometimes bubbling conflict resolution up to the user is a good idea. It's preferable to data loss.

</comment></comment></comment></comment></comment><comment><USER8> I'll send this to the Live Mesh team

</comment><comment><USER9> > _Through the past three years of interminable beta, apparent lack of > resources from the Mesh team and/or indifference from management at > Microsoft. The complete failure to push forward a product that had huge > promise_

You're running a business and even after three years of heartbreak you don't have an emergency backup in place?

<comment><AUTHOR> Ignite is my hobby. My business stuff is all in a VCS which is in turn backed up in duplicate.

And again, in theory Mesh _is_ a backup because it is supposed to duplicate things across multiple machines. The heartbreak wasn't at it not working (in the past), it was at the total lack of apparent support by the powers that be at MS and understanding of what they had on their hands and its strategic importance in keeping the desktop relevant against the tide of 'in the cloud'.

<comment><USER10> I'm not a serious IT person, but I imagine a serious IT person would draw a distinction between synchronization systems (like Windows Mesh/Sync, database replication systems, RAID 1, source control systems etc) and true backup systems that create more-or-less non-editable snapshots of the data in question.

Simply because the sync systems can turn against you and amplify your own mistakes, deleting or altering all the copies of something, even when the deletion or alteration was in error. Real backup systems make that sort of mistake much more difficult or even impossible (in the case of write-once media). Certainly, both types of systems can save your bacon, but not in exactly the same situations.

In any case, though, thanks for sharing your experience.

</comment></comment></comment><comment><USER11> This is what happens when a PowerPoint presentation is your presentation. PowerPoint should be an aid to a presentation, not the whole shebang.

You should be prepared to give a presentation even if the power goes out and you have to go by candlelight. do not rely on visual aids and make your audience wait if they fail.

</comment><comment><USER12> The words duh, and backup both came to mind when reading this article. When I do computer repair, I always carry 2 verified copies of all my softwAre tools on two different mediums. With a file like this, why wouldn't you verify it before the event, and bring the file multiple ways- mesh, email, flash drive and cd?

<comment><USER13> While I understand something like real backups would have helped this guy, to someone not intimate with the technology, Live Mesh looks like something that replicates your files on many places, something that sounds similar to backups.

I keep my important stuff versioned on subversion, running off a ZFS RAID-Z with weekly snapshots and daily diffs shipped to a different machine on a different site. If something goes wrong with the backups, I get texted in minutes.

I hope to be able to migrate that to BtrFS someday. Will take some work.

</comment></comment><comment><USER14> Sounds horrible, for that exact reason I use SugarSync and Live Mesh together to have stuff on multiple platforms. And I email lots of things to gmail: very easy with the drag and drop support in Chrome.

</comment><comment><USER15> SugarSync is not bad either, 5GB for free compared to Dropbox's 2.

<comment><USER2> It _seriously_ dislikes my Truecrypted work file. Uploaded it once, won't touch it again, no matter how many changes I make. Emailed support, they said it wasn't uploading because Truecrypt was accessing it, but it ignores it even when it's not running.

Haven't tried it with Dropbox, though; maybe I should.</comment></comment>


The Python Arcade Library - <AUTHOR> https://pythonhosted.org/arcade/ <comment><USER2> cached:

[http://web.archive.org/web/20170629061140/https://pythonhost...](http://web.archive.org/web/20170629061140/https://pythonhosted.org/arcade/)

[http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://pythonhosted.org/arcade/)

</comment><comment><USER3> I'm not sure what to call this, but it's free, and uses Python Arcade to teach programming (in Python) in the context of game development:

[http://programarcadegames.com/](http://programarcadegames.com/)

It appears to be an online form of a book (which you can purchase too). The author makes the site and contents available for free, and uses it to teach introductory programming (so maybe not for everyone here - but some may find it useful). It also appears there is a MOOC-like aspect to it as well.

As an aside, often when the question comes up from someone wanting to learn to program, invariably the advice offered is to "program or develop something that interests you" \- that is, try to learn thru programming something related to your interests.

This is good advice, but for some though, that can be too abstract, or they might find that things related to what they like are actually boring to develop software for (contrived example: They like running against a stopwatch, but creating a stopwatch program isn't exactly exciting).

I personally think that game programming can bridge this gap; for instance, in my contrived example, the student could instead strive to create a "running simulation" (ie, part of a "track and field" style game, for instance). Even a side-scroller simple thing would be great fun (and have sufficient difficulty) for development and learning purposes. It could be extended, too (maybe take it both horizontal and vertical - 2d parkour platformer? Heck, that sounds like something -I- would like to develop!).

In reality, just about any interest can become a game, with just a little bit of imagination (plus fudging on things a bit or a lot - which is something you have to know and internalize as a game developer: Don't try to simulate the real world, you won't get very far unless you have a large development team, and even then you'll be fudging and simplifying things, if you know what's good for you).

</comment><comment><USER4> Original link down. Looks like more info can also be found here: [http://arcade.academy/](http://arcade.academy/)</comment>


Fun with the Great Firewall - <AUTHOR> https://idea.popcount.org/2013-07-11-fun-with-the-great-firewall/ <comment><USER2> Although dated, [http://www.cs.kau.se/philwint/pdf/foci2012.pdf](http://www.cs.kau.se/philwint/pdf/foci2012.pdf) is an interesting read.

</comment><comment><USER3> the article is from july 2013 and as such probably outdated already.</comment>


Rich Americans activate New Zealand pandemic escape plans - <AUTHOR> https://www.seattletimes.com/nation-world/rich-americans-activate-new-zealand-pandemic-escape-plans/ <comment><USER2> Yes. Peter Thiel has NZ citizenship and so may arrive into NZ at will. But he may not be able to leave as NZ has some of the strictest C-19 lockdown rules in the world.

It would be ironic if dickheads came to NZ to escape and get imprisoned due the lockdown rules.

</comment><comment><USER3> A 50% height scroll blocking signin panel, _and_ a scroll blocking location request with a nonfunctional block button on a news website? Terrible.

</comment><comment><USER4> Good luck getting in the country.... oh wait they're rich :-(</comment>


NSA Hacker Chief Explains How to Keep Him Out of Your System - <AUTHOR> http://www.wired.com/2016/01/nsa-hacker-chief-explains-how-to-keep-him-out-of-your-system/ <comment><USER2> eh skimpy article, plaintext passwords and packet injections

(tbh i always assumed packet injections were hard as fuck, but i guess when your office is in the telco its ez)

i figured out how to remove the nsa from the internet for those who care. its very low tech... we simply unplug their line, and we keep unplugging them. or more clearly we pressure other admins to unplug them from the network, and use our admins to actually work for us not the government. with resistance, we would probably have to unplug lines to companies with admins who refuse to unplug nsa lines. i think it could be done and i think its lovely if it is. i think the public would a) love the idea if they are knowledgeable and b) flip the fuck out when their internet goes off cuz the admin wouldnt unplug the nsa. all in all a fun shitstorm, and a decent technical problem when we have to route the entire internet somewhere other then a telco with nsa offices.

its interesting that it could have been done along, and could at any time be done. we just lack the will.</comment>


Your user agent - <AUTHOR> https://duckduckgo.com/?q=user+agent

<comment><USER2> And this is why I've grown to love DDG. My last "wow" moment was when I needed an ascii table two days ago. Searched for it and bam! it's right here in the front page.

To anyone skeptic about DuckDuckGo: I've been there. But I've decided to give it a week worth of a try some time ago (Google is just a !g away, anyway), and it's been my default search engine for months now. You might want to give it a try as well. Maybe you'll get hooked on the !bang syntax, maybe you'll get hooked to the 0-click information box, or maybe you'll just switch back to Google.

Some queries aren't always on par yet with Google, but I feel that it's getting here. It's mostly lacking on queries about specific errors, and local stuff. For everything else, I feel that I barely switch to Google anymore.

And, as a bonus, DDG works perfectly with Firefox Mobile. Google instead has some problems (probably caused by some webkit-specific code).

<comment><USER3> > Some queries aren't always on par yet with Google

I don't think google search is that great anymore. It's way too fuzzy of a match. If you're trying to remember an actor's name or find some reference with a vague query, it works ok. But google takes way too many liberties with search results and is super focused on showing maps, reviews, and youtube videos, and then results to alternate searches. Bing and DDG are better IMHO.

<comment><USER4> Google is useful to more people, which means it's less useful to people who are happy with things like the O Reilly Google Hacks.

There's some switch somewhere to force it into "Literal" or "verbatim" mode. [https://news.ycombinator.com/item?id=3239452](https://news.ycombinator.com/item?id=3239452) [http://insidesearch.blogspot.co.uk/2011/11/search-using- your...](http://insidesearch.blogspot.co.uk/2011/11/search-using-your-terms- verbatim.html) (These are the posts that give me the '1 in 600 searches used the + operator correctly' factoid.)

I think my current problems with Google are

1) Lack of predictability. I have no idea what terms might be substituted, or what they'll get subbed for. I don't know what terms get stemmed or not.

2) Recentism. Google is great at finding things from this year. Finding stuff from before 2000 is harder, and before 1990 is really tricky. (I don't have any examples! Normally I keep them.)[1]

3) Desire to return many hits. I'm happy if I enter a search term and don't get many hits. I'd rather have a few hits, rather than many hits that are less relevant. I'd rather have a few really bad hits, and thus know that I need to tweak my search terms, than get many sort of okay hits.

But for most people Google is great. Having said that, I switched to mostly DDG and I really like it, except I'd like to be able to force a more English (and not US) result cloud; and I'd like to be able to enter a term, have it translated into other languages, and search for those. This would be a way to break out of the English speaking bubble.

[1] I find it weirdly hard to find minor news events from before 2000, even though they're online and covered by newspapers, even if I use Google's time limit settings. I'll start to keep these difficult searches.

<comment><USER3> > I find it weirdly hard to find minor news events from before 2000, even > though they're online and covered by newspapers, even if I use Google's time > limit settings. I'll start to keep these difficult searches.

Might be because the pages are updated after the publication date. I don't know that google is able to find that type of structured info in each news page. Actually a specialized search engine which is focused on date functionality would be invaluable. Maybe someone like archive.org would tackle that. It would be great to search even pre-WWW results, such as historical archives or radio transcripts.

</comment></comment></comment></comment><comment><USER5> I wish that Duck Duck Go had more of these useful pop-ups.

I replaced Google with Duck Duck Go as my default search engine in Chrome a few weeks ago, and the switch as a whole has been positive. The only things I miss about Google are the instant suggestions for movies, timers, etc.

I still love Duck Duck Go, though (esp. the privacy benefits), and I'm sure that they'll broaden their offering of instant pop-up results as time goes on.

<comment><USER6> There's also [https://duckduckgo.com/?q=ascii+table](https://duckduckgo.com/?q=ascii+table) which I use so frequently that I should really just print it out and tape it to the wall.

<comment><USER7> $ man ascii

<comment><USER8> $ man ascii | cat | lp -

<comment><USER9> We have a nominee for the useless use of cat award.

<comment><USER8> Realized after I posted. Too late to fix it. The only reason I made the mistake in the first place is that I wasn't sure if the pager would mess up text output.

(What? You expect me to print three or so pages to test an assumption about how *nix utilities work?)

</comment></comment></comment></comment></comment></comment><comment><USER10> The thing I love about ddg is, it links to https versions of pages searched. For eg. Google will link to non https version of Wikipedia results, whereas DDG will link to the https version.

<comment><USER11> The thing I love about ddg is they don't seem to do that horrible redirect on some results that Google does.

I'll never understand why they do that; if you want to track links, send an async post when I click, don't add an occasional multi-second delay.

<comment><USER12> It's because browsers are unreliable about delivering async posts when the page navigates elsewhere. Some people proposed extending the web APIs to provide a reliable mechanism but it was shot down by complaints of "tracking". So now we're left with both tracking and horrible redirects.

</comment></comment></comment><comment><USER13> How many people here just realized their corporate proxy is adding unwanted headers in every request?

</comment><comment><USER14> Somewhat related.

[https://www.google.com/search?q=ip](https://www.google.com/search?q=ip)

<comment><USER15> Similar, but plain text and, thus, easier to parse, if necessary, e.g.:

        $ IP=`curl https://icanhazip.com/`
        $ echo $IP

<comment><USER16> There's also ifconfig.me, who returns either an HTML version or a plaintext version depending on the user-agent, so `curl ifconfig.me` returns just the plain IP. There's also a list of other URLs on the homepage (for the host, user agent and a bunch of other stuff).

<comment><USER17> I've found ifconfig.me to be excruciatingly when I actually need it. Like takes 10-30 seconds for a response just to get my IP. Sucks that someone got the vanity domain and put a shitty server behind it.

<comment><USER13> Is there a reason you can't retrieve it via uPNP or similar?

</comment></comment></comment></comment></comment><comment><USER18> On this note, is it possible to completely remove my user agent entirely from all my browsers?

I'd like to get to the point where the only identifying information my computer gives out about me is information I give out about myself.

At the end of the day I shouldn't even suffer as a user because of this because if sites are "doing things right" then they shouldn't be using the user agent for anything at all anymore. They should be using feature testing only.

Since it's been such a useless feature for so long, I'm surprised no browser makers have gone as far as removing it entirely (I'm looking at you chrome and firefox)

<comment><USER19> Disabling the useragent may break some stuff that many sites still do server- side.

Disabling referer may break downloads and images on many sites. You'd think they'd all be able to support blank or non-existent referrers, but many large CDNs only support whitelisting specific REFERER strings (not blank ones). We'll be turning referrer blocking back on for one of my big sites shortly because we have other sites linking directly to file downloads (of 60MB and up) and hotlinking images.

<comment><USER20> Yes. For example, it disables graphs in Google Analytics. They do not work, if your useragent is empty or if it is Googlebot 2.1 ;-)

</comment></comment></comment><comment><USER21> User agent headers always uneasily remind me of this: [https://panopticlick.eff.org/](https://panopticlick.eff.org/)

<comment><USER22> Is there no way of preventing your browser supplying enough information to uniquely identify your machine?

<comment><USER23> NoScript can prevent most information from being gathered, but unfortunately "no information" is actually pretty unique.

Using Chrome on Windows with Flash and Java installed is probably the best way to blend in the crowd and make yourself less unique.

</comment></comment></comment><comment><USER24> This made me to switch to DDG (for the second time) as default search engine. I'll give it more time now, I didn't know about all these "goodies". For instance, I just searched for a youtube link and it offered me a box with a link to the wanted video and also the possibility to play it right from there. This is so cool :)

</comment><comment><USER25> Love DDG but discovering your UA on SERP like that isn't very useful. If you're someone who needs to know your own UA, you`ll probably need it several times a day or more. Searching for "user agent" is the long way to do it, there are browser extension for that. Still, nice Easter Egg from the best Duck in town.

</comment><comment><USER26> I love the bangs on DDG.

arachnids !W (wikipedia)

a train !lyrics

jambi !grooveshark.com

northernlion !YT (youtube)

just shove it in the address bar. no waiting for tabbing or hoping google gets it right.

</comment><comment><USER27> Just want to share that VIM keys for up and down (j/k) work when selecting search results.

</comment><comment><USER28> What are we supposed to see here?</comment>


Duetto: A faster and smarter alternative to Emscripten. - <AUTHOR> http://allievi.sssup.it/techblog/?p=798

<comment><USER2> Here's to hoping more effort goes in this direction, and to improving the general cases of performance over special cases like ASM.js.

But I hesitate to get very excited over a few micro-benchmarks, particularly without a release.</comment>


Tencent open sourced its distributed graph computing framework: Plato - <AUTHOR> https://github.com/Tencent/plato <comment><USER2> I wonder how this will compare to JanusGraph or Neo4j?</comment>


Visualizing Your Commit History - <AUTHOR> http://www.kalzumeus.com/2010/01/10/visualizing-your-commit-history/

<comment><USER2> Patrick,

I really like the open business that you have been doing. What made you decide to do this? Is is because it's not your main source of income or would you have done it the same way if it was a startup and you were devoting your full time to it?

In any event thanks for sharing these posts.</comment>


ETHICAL HACKING WITH KALI LINUX [5] – ROGUE WIRELESS ACCESS POINTS - nhc-forum http://www.bijayacharya.com/2016/03/30/ethical-hacking-kali-linux-5-rogue-wireless-access-points/#more-94 <comment><AUTHOR> [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

>" _Please don 't do things to make titles stand out, like using uppercase or exclamation points, or adding a parenthetical remark saying how great an article is. It's implicit in submitting something that you think it's important._"</comment>


Ask HN: How to find a co-founder online? - <AUTHOR>

I'm currently located in China + studying + traveling every few months, making it extremely hard to find potential co-founders offline. I have a few technical friends from university and previous jobs but for various reasons, I consider none of them to be co-founder material.
The approach that works for me right now is to explore ideas (including ambitious ones), launch quick-and-dirty MVPs, and see what sticks. I do this approximately full time, albeit not on a typical work schedule.
In the process, I'd like to meet and collaborate with potential co-founders. I believe that passed a certain threshold of competence, the relationship you have with a co-founder is a lot more important than the co-founder itself: might as well build some solid relationships now for when the big opportunity comes knocking. In fact, I just realized that the term "co-founder" might not be appropriate here. Just like you don't go out meeting women and telling them you are looking for a wife, the word I should be using is "people that want to build MVPs and have a strong interest in startups", but it would be a bit long to type.
That being said, here are some problems I have encountered with regards to online interactions:
1) It's hard to judge one's personality (emotional stability, honesty, trustworthiness, maturity, etc.) without the cues one would get from offline interactions (i.e. nonverbal cues).
2) It's hard to judge one's level of interest and commitment without the costs involved in real life interactions. A two hour face to face meeting is much more costly than a two hour online conversation.
3) I admit I'm susceptible to some kind of "dating site" bias. I can't help thinking to myself: "If this person is trying to meet a co-founder online, they must be desperate and most likely for the bad reasons." Yet, I am in this exact position and don't consider myself to be an undesirable co-founder (I'm probably biased here as well, hopefully not!).
So, back to the original question.
What are ways to find potential co-founders online? How to avoid the above pitfalls? What are the key questions to ask a potential co-founder? How to quickly gauge someone's level of interest/commitment?
Try to keep your advice as actionable as possible. <comment><USER2> The honest truth is that it's not them, but it's you. Like you said, gauging a potential great technical co-founder is not hard if you have a chance to work with them on various projects. However, that is close to impossible if 1) You are located in China. 2) Going to school there full time. 3) Traveling every few months for fun.

As an entrepreneur, I would never seek out a co-founder who isn't local, isn't always available, and wouldn't sacrifice entertainment/travel/fun for some serious hard work. I have worked with those people in the past and none of them are co-founder material. Working 18 hours a day off of Ramen is simply not something they'd do to realize the bigger dream.

While you have ambition, you are definitely biased. If you want to create something great, you need to chase after your dream with reckless abandon. That could mean a number of things including moving, finishing school, networking, or picking something you can do from China that isn't necessarily coding related.

<comment><AUTHOR> First, thanks for your candor.

I share your feeling: if I had a clear startup idea in mind and the ability to go full time, I would be looking for a local co-founder that is willing to go full-time as well. Furthermore, I'd try my best to find someone I know _well_ and _trust_. I would never jump in full time and give my 200% with a co- founder that I have only met a few times over a cup of coffee. I made that mistake in the past and it resulted in a miserably failed venture (actually, that's what initially brought me to China).

I came up with the approach described in my post (collaborating online on small projects in order to identify potential co-founders) specifically to avoid that. Eventually, when I find a good co-founder match and a good startup idea, I'll move wherever makes most sense and give my 200%. In fact, I think more people ought give consideration to this strategy. Why risk everything (including choosing the wrong co-founder) on an hypothetical startup before validating your idea/market through an MVP that can in most cases be done "on the side"? A lot of famous startups were started that way.

On another note, why do you think it is necessarily a bad idea to do a software startup in China?

For the record, I study part-time in Hong Kong and the travelling bit refers to the fact that I've been alternating between living in Canada and China over the past few years.

In any case, thanks for sharing your advice.

<comment><USER2> I'm not saying doing a software related startup in China is necessarily a bad idea - but China does censor certain websites and that stifles creativity to some degree. China is also known for other strengths so if you're there, you may as well take advantage to your unique opportunities and play to those strengths.

</comment></comment></comment><comment><USER3> Perhaps speak more about the ideas that you want to work on, industries, types of customers etc. People can contact you because they then know they have something in common with you.

For example, I'm interested in designing, building and selling creative products. I'd rather build several small things that create regular income and then move onto a larger project full time.

Here are examples of things I'd like to create work on or have already started working on :-

A review site

A browser app/add-on

A clothing site

A range of notebooks

A site selling a product subscription

An iOS game for charity

A software application specific to personal trainers.

A Wedding Directory

From these things I can see that my best type of co-founder would be a graphic or web designer.

</comment><comment><USER4> You can try this <http://www.techcofounder.com/>

However, I don't this it would be easy to find someone online and build a startup as co-founders.

</comment><comment><USER5> Check out the slides here: <http://www.jenniferturliuk.com/?p=255></comment>


The WhatsApp Architecture Facebook Bought For $19 Billion - <AUTHOR> http://highscalability.com/blog/2014/2/26/the-whatsapp-architecture-facebook-bought-for-19-billion.html <comment><USER2> I know this whole "$19B for whatsapp" topic is getting old already but I really think they solved some _core_ problems that users had. Technically, those were probably not as challenging but functionally, this is what won me over :

\- No registration required. Yes and Yes. do you hear Skype ? All you need is your phone number. And let's not get started on the privacy thing because the benefits outweigh the cost. See more below

\- Easy to invite others. Just sends a simple SMS/text and wala, you are in.

\- In countries like the US, SMS/Texting is very expensive (yes, i know...). Specifically, if you want to talk to someone international. Whatsapp solved this problem with ease. There were others (viber etc) but they just don't have the easy interface at least in my experience. Sure, the caveat is that everyone needs to have wifi/data plans but those are getting much more easier than convincing your phone company to stop charging bullshit rates for a simple text.

\- Lets you create Groups. This sounds simple but imagine wanting to talk to your _core_ family members in 1 text ? Whatsapp lets you do that with no pain.

\- Share pictures/multimedia within groups. Again, very simple to use and comes included. I don't want to even explain what these cell phone companies charge for something they lable as MMS (not text).

Overall, when I came across Whatsapp, I was like "Finally, someone gets it and this should have been so duhhh but apparently, it wasn't". Very happy for the entire whatsapp team.

<comment><USER3> Sorry, I'm normally not one of those people who correct others on spelling/grammar, but this is a pet peeve of mine: it's "voila" (french), not "wala".

<comment><USER4> It almost makes sense if he meant "wallah"

"""Just sends a simple SMS/text and I promise by God, you are in."""

[http://en.wikipedia.org/wiki/Wallah_(Arabic)](http://en.wikipedia.org/wiki/Wallah_\(Arabic\))

He didn't mean that of course...

<comment> dorian-graph Another possible misunderstanding is that "wala" in Filipino means to be missing/absent.

I was confused for a moment before I thought of "voila".

</comment></comment></comment></comment><comment><USER5> "Erlang rocks! Erlang continues to prove its capability as a versatile, reliable, high-performance platform. Though personally all the tuning and patching that was required casts some doubt on this claim."

Really? Because I would trust their claims all the more; they've been in the trenches, they had expertise in other languages (from the article, "Having built a high performance messaging bus in C++ while at Yahoo, Rick Reed is not new to the world of high scalability architectures."), and then they became -intimate- with the language, in removing bottlenecks to their specific use case...and they still make the claim Erlang is great in this domain. Whose opinion are you going to credit more than theirs?

(Also, I bet many of the patches they made that weren't specific to their use cases were submitted as patches to the BEAM)

<comment><USER6> Yap some patches or suggestions made it in and the greater community benefited. Some lock contention points removed, memory management stuff etc.

Also remember this is just one visible project. Erlang VM is being developed actively and many other companies and people are contributing. For an almost 30 year old language it very active. Maps are coming in R17 so are dirty schedulers, {active,N} on sockets, lots of goodies.

<comment><USER5> I know; R17-rc1 was tagged a month ago.

This was more my being agog at the author viewing the work that was done to the BEAM as evidence -against- Erlang being great, rather than the fact that these people with that level of experience stayed with it, and still raved about it, as evidence in Erlang's favor. And that the issues they encountered are probably fixed any way, or apply only to their use case (and so may still exist, but have a tradeoff that is worth keeping in other use cases).

</comment></comment></comment><comment><USER7> The whole error handling philosophy of Erlang is extremely fascinating. The fact that it was born out of the telecommunication world makes it extremely fit for this kind of job. I've been reading "Programming Erlang" on and off for a few weeks now, and it's... eye opening. Erlang proves functional programming is for the real, real world. There isn't a language that's more down to earth, ready to "Get Shit Done" than Erlang.

Edit: When you learn Erlang you'll notice every design decision was made for performance or reliability (vs making the language "nice", think Ruby). I appreciate that.

<comment><USER8> I think the golden moment for me thinking about Erlang was when I started thinking that the actor model was made to support fault tolerance and concurrency was a nice bonus.

<comment><USER9> Indeed, for all the free wins you get from Erlang's actor model (e.g. easy just-add-cores parallelism), you also get losses (e.g. copy-based message- passing is pretty much the least performant signalling mechanism possible.) But when you look at it all through the lens of fault-tolerance, there's really nothing you can change about Erlang's semantics without throwing away some guarantee or another.

When I hear that other languages (e.g. Go) have "actors like Erlang", I have to laugh. Unless you're willing to eat all the disadvantages and performance losses that come with Erlang's approach, you don't really have "actors like Erlang"; you just have green threads.

<comment><USER10> It's downright _adorable_ when people compare a half-baked language like Go to Erlang/OTP

</comment></comment></comment></comment><comment><USER11> Something drôle I caught on Joe Armstrong's twitter feed: ``A machine learning researcher, a crypto-currency expert, and an Erlang programmer walk into a bar. Facebook buys the bar for $27 billion.''

<comment><USER12> What are the other acquisitions/hires referenced? :-)

</comment></comment><comment><USER13> But aren't most of those messages point-to-point? Not that I'm trivializing 70M/sec! But for the most part, it's pretty straightforward right? No multi- client support (so no desktop client that requires server sync). Most messages(?) are to one recipient only, right? So send the message, send an ACK, deliver message, deliver read ACK? It seems like the perfect thing for a scale-out architecture. Even group chat can probably just be split into multiple messages, one per recipient.

Not that it's not a lot of work, but isn't most of it just hard work engineering? Add hardware, deal with bottlenecks. Versus having to come up with some novel new datastructures and inter-server communications?

SMTP sends a ton of messages, too. I don't see why an IM system couldn't take essentially the same concept, where one small cluster of services is responsible for the mailboxes for certain individuals.

<comment><USER14> > SMTP sends a ton of messages, too. I don't see why an IM system couldn't > take essentially the same concept,

Hint's in the name: _instant_ messaging. For the most part, nobody stops using SMTP if it takes 2 minutes to deliver an e-mail

<comment><USER15> > _Hint 's in the name: instant messaging. For the most part, nobody stops > using SMTP if it takes 2 minutes to deliver an e-mail_

Well, I don't think anybody would stop using IM too, if it took say 10 or 20 seconds to deliver an IM.

<comment><USER16> Honestly, you might not immediately, but if it happened often enough, you probably would switch clients. Back in the day, if AIM managed to screw up enough of mine and my friend's conversations by not sending messages quickly enough (and then sending 30 all at the same time), we'd have moved off it if something better was found.

<comment><USER17> I think this was a big factor in why AIM trumped ICQ in America. ICQ had that "sending mail" icon that took a few seconds (or more) to "send" your message and it didn't quite feel instant.

<comment><USER18> It was also a ui issue. ICQ originally had an interface which didn't show a running log of the conversation. It was more like sending email with presence indicators and a 450 character limit. Though it also had an IRC-like mode that was rarely used. I remember finding AIM and MSN so different when they emerged as the 'instant' aspect, typing indicator, and running log encouraged rapid- fire short messages and gave a conversation-like feel.

<comment><USER17> > ICQ originally had an interface which didn't show a running log of the > conversation.

The earliest version I remember, before 98a, had a history button that would show the running log on the top of the message box window, which was nice.

The nicest thing about ICQ for me back then was the fact that the message disappeared when you sent it -- it wasn't there filling your taskbar or occupying your mindspace.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> > "Ejabberd is a famous open source Jabber server written in Erlang… The next > few years were spent re-writing and modifying quite a few parts of ejabberd, > including switching from XMPP"

Anyone looked at what WhatsApp sends over the wire these days? I wonder what it is? A binary protocol?

<comment><USER20> XMPP with a homegrown compression layer.

</comment></comment><comment><USER21> It's so awesome to see FreeBSD as the OS. Hard to learn in my opinion but worth it since it's so reliable.

<comment><USER22> My experience was it was a lot easier to learn than various linux distros, at least several years ago. It has great documentation in the form of the Handbook, and its directory structure & the ports system are rational & predictable.

[http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/](http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/)

</comment></comment><comment><USER23> Does anyone know what service WhatsApp used for SMS delivery for phone number verification? I wish I could get text messages into all parts of the world like they do.

<comment><USER24> At Bolt ([https://bolt.co](https://bolt.co)) we use Twilio for this, and I'm pretty sure WhatsApp does too along with other providers. With Twilio we also fall back to delivering access tokens with a phone call when the SMS fails.

(Full disclosure: I am a former Twilio employee.)

<comment><USER25> Fuller disclosure: you're just another spammer.

</comment></comment></comment><comment><USER26> _" And using your cell number as identity and your contacts list as a social graph is diabolically simple."_

Tthe linkage of phone number and identity seems to be the main reason why there are no tablet versions of the whatsapp client. I wonder how satisfied whatsapp/facebook are with this constraint, and whether they intent to address it? It is possible to imagine workarounds for devices that don't have a phone number, but they don't seem as friction-free as the current identity system.

<comment><USER27> You should have a look at how Line does it. You _can_ use a login and password, but you can also use Line on another device through some QR code scanning. No password required IIRC.

</comment></comment><comment><USER28> I wonder how Facebook will deal with integrating Erlang into their (afaik) PHP-based systems?

<comment><USER29> facebook chat was originally written in erlang.

[http://www.erlang- factory.com/upload/presentations/31/Eugene...](http://www.erlang- factory.com/upload/presentations/31/EugeneLetuchy-ErlangatFacebook.pdf)

I doubt they'll have any trouble at all integrating.

<comment><USER9> I believe that the reason they switched away from Erlang, though, was that nearly nobody in the company (besides the team that made the prototype) knew the language. In other words, they switched away _because_ they had trouble integrating Erlang into their processes, and instead chose to rewrite it using tools everyone else was more familiar with.

This, then, is basically recreating the same problem they had before, just with 40 or so more engineers who are on the "Erlang" side of the vote.

<comment><USER30> Yariv Sadan is already there, though. That plus the WhatsApp people makes for a pretty intimidating group of erlangers.

edit: Just found out Yariv left. Still, Facebook was using ejabberd, and WhatsApp built their business around ejabberd.

</comment></comment></comment></comment><comment><USER31> I read like 8 paragraphs of blather before I got to the first bit of useful technical information, a confirmation that they were using Erlang.

</comment><comment><USER32> "Desktop is dead and web is dying" is very pessimistic.

<comment><USER33> From a global perspective, is it?

>By the end of this year, 6% of the global population will own a tablet, 20% will own PCs, and 22% will own smartphones.

[http://www.businessinsider.com/smartphone-and-tablet- penetra...](http://www.businessinsider.com/smartphone-and-tablet- penetration-2013-10)

<comment> grey-area Smartphones and tablets have browsers too, and they are by far the most used app on any platform.

<comment><USER30> Unless the phone already has a facebook and an amazon app, in which case the browser drops to 15th most used.

<comment><USER34> Interesting. Source?

</comment></comment></comment></comment></comment><comment><USER35> Man, I burn with envy when read such stories of monumental technical achievements. For some reason have always been fascinated by scalability. But so far life has given me the opportunity in a very limited way.

Have been reasonably proud of scaling my own micro (in comparison) service. But right now feel very small and humbled.

edit: minor

</comment><comment><USER36> This article also mentions about whatsapp in business usages. Interestingly, all those points resonate with a messenger project that we are working on. [http://peer.im](http://peer.im)

</comment><comment><USER37> First 1/3 of the article is talking about background or $16B?!?... Much of the rest is a list of hardware. Be prepared to skim a ton to find the actual subject of the article.

</comment><comment><USER38> As Facebook transitions into the next decade, they must focus heavily on mobile. I see a lot of people mainly using Facebook for its messenger app, so it's very smart of Facebook to buy a competing messaging service that is gaining huge traction in the international market. If WhatsApp were to expand into the States, Facebook could be in trouble. Very smart investment by Zuckerberg but I can see why people are shocked it was dealt for such a huge amount.

</comment><comment><USER39> The performance levels they have achieved are impressive.

I think hot swapping code is a major factor in being able to quickly fix and develop a system like this.

I wonder how far one can go on another tech stack.

For example Akka is supposed to be able to handle up to 50m messages on a single box and there is some support for hot swapping in the Oracle and IBM runtime.

</comment><comment><USER40> Does anyone know whether their changes to the BEAM ever made into the official Erlang BEAM?

</comment><comment><USER41> Interesting enough to check into Erlang. Even though most of us won't approach the load Whatsapp has to handle, it is very useful to understand how to pack more work into smaller hw footprints for any size business.

</comment><comment><USER42> I think they owe the developers of ejabberd a few drinks

</comment><comment><USER43> WhatsApp = Email 2.0?

</comment><comment><USER44> No Linux? Am I dreaming?

</comment><comment><USER45> does anyone know where they were hosted? did they colo or use a msp?

<comment><USER46> They're hosted on SoftLayer [http://leanstack.io/cloud- stacks/whatsapp](http://leanstack.io/cloud-stacks/whatsapp). Source: [http://www.ip-adress.com/whois/whatsapp.com](http://www.ip- adress.com/whois/whatsapp.com)</comment></comment>


Intel's first graphics card prototype shows off 1.5B transistors - <AUTHOR> https://www.techradar.com/news/intels-first-graphics-card-prototype-shows-off-15-billion-transistors <comment><USER2> The referenced original article is quite detailed, but in Japanese.: [https://pc.watch.impress.co.jp/docs/column/kaigai/1107078.ht...](https://pc.watch.impress.co.jp/docs/column/kaigai/1107078.html)</comment>


German intelligence agencies can decrypt PGP? - <AUTHOR> http://translate.google.com/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.golem.de%2Fnews%2Fbundesregierung-deutsche-geheimdienste-koennen-pgp-entschluesseln-1205-92031.html <comment><USER3> The important sentence here is "Ja, die eingesetzte Technik ist grundsätzlich hierzu in der Lage, je nach Art und Qualität der Verschlüsselung.".

Means (answering the question if the technology can partially decrypt _or analyze_ SSH or PGP):

"Yes, the used technology is basically (or _in principle_ ) capable of doing that, _depending on the kind and quality of decryption_."

This sentence is so much generalized that the writer almost certainly meant "yes, we can bruteforce a weak encryption".

Also the question includes the capability of "analyzing" SSH or PGP. That would (imo) include reading meta-data. So, in fact, if they are capable of telling the encryption scheme used in a PGP message, they would qualify to answer "yes, we can" here.

So, that's not surprising and the article is kind of link-bait.

</comment><comment><USER4> This is a pointless article, and I'm going to be maintaining skepticism until there's some detail. For example:

Do they have an actual method for breaking PGP, or do they have some sort of backdoor they've planted? Or some sort of access to the keys through other means?

If they have an actual method to break PGP, does it work against all the algorithms, or just one or a few? Does it work against arbitrary key length, or is there a maximum they can break?

If it's general-purpose enough to be just "PGP" regardless of algorithm/key length, how quickly can they decrypt? Is this real time? Is it "we can decrypt in time to find out where next week's attack will be"? Is it "we can decrypt in time to present evidence at this guy's trial next year"?

Without that sort of information this reads like a scary mistranslation, and not the sort of thing a government would disclose anyway.

<comment><USER5> Correct. PGP mixes symmetric and public key encryption algorithms, letting you choose your favorite ciphers and key lengths. You can choose RSA, DSA, AES, CAST5, TripleDES, etc. To say you've "cracked PGP" is akin to saying you've cracked pretty much all of the widely-accepted ciphers out there. I don't buy it.

<comment><USER6> I'm looking for any algorithms among those you listed that is considered weak.

[http://en.wikipedia.org/wiki/Triple_DES#Security](http://en.wikipedia.org/wiki/Triple_DES#Security) \- ok, that has chosen plaintext weaknesses.

I don't see much information on CAST5 aka CAST128, can someone chime in with its current status?

I suppose you could encrypt an image using ECB. Would PGP allow this kind of broken configuration? [http://pthree.org/2012/02/17/ecb-vs-cbc- encryption/](http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/)

<comment><USER5> PGP uses CFB mode. To my knowledge there is no implementation that would let you use ECB.

[http://tools.ietf.org/html/rfc4880](http://tools.ietf.org/html/rfc4880)

</comment></comment></comment></comment><comment><USER7> The answer provided by the government does not make a specific claim they can decrypt PGP or SSH.

The question is quite vague - can the government decrypt, at least partially, encrypted communications (e.g. PGP or SSH)

The answer is even vaguer, something along the lines of 'The deployed technology is, in principle, capable of that, depending on the type and quality of encryption'.

Both the question and the answer are so woolly they can mean anything from 'German intelligence can partially decrypt ROT13' to 'German intelligence can read 4096 bit PGP encrypted messages like a morning newspaper'.

One can also be reasonably sure that in the extremely unlikely event some entity somewhere were capable of breaking PGP, they'd go to great lengths not to tell anyone about it - such a (again, wildly improbable) capability becomes a lot less valuable if it was common knowledge.

</comment><comment><USER8> The most important sentence is this:

"Eine starke Verschlüsselung mit PGP gilt als sicher, wenn es Angreifern nicht gelingt, den privaten geheimen Schlüssel, den nur der Empfänger besitzt, und sein Kennwort zu stehlen."

A strong encryption with PGP can be considered as secure, if attackers do not succeed in stealing the private secret key that only the recipient holds.

Basically, as long as they can't get your secret key and brute-force it because of a stupid password, you'll be fine.

Edit: fixed numerus

</comment><comment><USER9>
      Es würden Anwendungen der deutschen Firmen Utimaco,
      Ipoque oder Trovicor genutzt, um möglichst tief in die
      private Kommunikation einzudringen.

      They use applications of the German companies Utimaco
      Ipoque or Trovicor to penetrate as deeply as possible
      into the private communications.

The linked PDF doesn't support this claim. It contains a question about the companies involved, but all it says is that the answer is not public.

If true it might be interesting that former PGP lead developer Gerhard Eschelbeck is CTO of Sophos (owner of Utimaco).

</comment><comment><USER10> "It's all broken folks, you may as well not use anything at all!"

</comment><comment><USER11> I don't understand why some NSA leaks suddenly make people think the state of crypto is any different than it was two weeks ago. The Snowden leaks thusfar have ZERO relevance to what the collective crypto community considers good ways of securing data.

Nothing changed, technically speaking. The NSA merely broke _rules_. They didn't do anything technologically special.

<comment><USER12> It doesn't necessarily make people think the state of crypto has changed so much as suddenly take note of and wonder about the state of crypto. Many such people ignored it completely prior to this but are now interested in it.

</comment></comment><comment><USER9> Funny thing is that google translates ZKA as CCC in the linked PDF.

ZKA is Zollkriminalamt (customs police) and CCC is Chaos Computer Club - <USER2> different organisations.

</comment><comment><USER13> The actual document [1] is remarkably vague. ( And the answer states in the least charitable interpretation that the German intelligence agencies are capable of partially analyzing ROT13 or detecting traffic on port 443...)

But actually I did only comment to ask, if there is a way to switch from Google translate to the actual site, not the "original" button which still goes through Google servers. ( Especially since Google also renders PDF as HTML, when I click on a PDF link in the page.)

[1][http://www.andrej- hunko.de/start/download/doc_download/225-s...](http://www.andrej- hunko.de/start/download/doc_download/225-strategische-fernmeldeaufklaerung- durch-geheimdienste-des-bundes) (pdf, German)

</comment><comment><USER14> Could we please all relax a bit.

If the government tells you, they have a technology that can _in principle be used, depending on type and quality of encryption_ , history shows us that this either means they can decrypt almost everything, or, most likely, not much. Both ways, they are not telling the complete truth at all.

Especially the german government likes to tell us that they have something that can _in principle_ be used for _something_ , like using your issued ID for online activities, a nation wide health-card system, a _working_ toll collect system, etc., the list just goes on and on and on...

Anecdote: I remember, a couple of years ago, sitting in the audience of the yearly Chaos Communication Congress in Berlin in a talk by a pretty popular lawyer specializing in internet laws and regulation (IIRC the title was something like _You have the right to stay silent_ ; if you understand german, watch it, it's _hilarious_ ), where in the Q&A session somebody jumps up and tells the audience (paraphrased):

...the last time the police raided my home (much laughter from the audience) they took my encrypted disks with them (probably dmcrypt/luks or truecrypt) and after almost one year they still have not been able to decrypt a single bit of it...

I'm pretty sure not much has changed with ciphers becoming even stronger these days. I, at least, sleep well at night, trusting that my PGP2 encrypted mails are safe.

</comment><comment><USER15> the document and translations are all very unclear and unprecise.

Note that they would also claim that they can decode SSH, ie SSL.

<comment><USER16> The translation is not too bad in this case and the PDF looks legit. Btw this is from 2012.

The question was if the technology they have is capable of decoding encrypted transmissions (e.g. SSH or PGP).

The reply was that in general yes, depending on the type and quality of the encryption.

What I would note is that neither the question nor the reply are about a particular encryption technology. I would not take it to mean that they can decrypt PGP in general.

<comment><USER17> The answer is technically correct, if someone uses a weak enough cipher, they would be able to decode it. What else could they say? "We spend a lot of money on eavesdropping software, but really if people are encrypting their communication, it's all pretty useless."?

</comment></comment></comment><comment><USER18> I hope all they've discovered is a technicality allowing for partial decoding. If they can break PGP/SSL in a way that isn't just brute forcing the hashing algorithm, then we'll have a lot more trouble than just the government(s) spying on us.

</comment><comment><USER19> There is an asic bitcoin miner which can generate 500GH/s which retails for 22k$. What if you had a billion dollars to crack encryptions?

<comment><USER20> Let's assume one hash is exactly equivalent to one attempt at brute force and the keys are 256 bits. 5GH/s * ($5B / $22K) is about 10^17 GH/s. There are 2^256 possibilities, which is about 10^77. So to try them all you need about 10^60 seconds. Granted that is the worst case for the cracker, but the average case is also going to take quite a while.

<comment><USER21> > Granted that is the worst case for the cracker, but the average case is also > going to take quite a while.

The average case for finding something equaly distributed in a space is half the time, or about 5 * 10^59 seconds, what is about the same thing, because with numbers that big "about" usualy means anything from *10 to /10.

Of course, RSA keys aren't equaly distributed at the key space. That gives an speedup of sume number between 1 and 2 that I can remember (still about the same thing), and there are search algorithms that reduce the number of tries by some non-trivial amount. I'm not up-to-date on them.

</comment></comment></comment><comment><USER22> I guess pretty good wasn't quite good enough.

</comment><comment><USER23> ...what!?

edit: So this is from over a year ago. Probably safe to stop panicking.

<comment><USER24> Why is there a difference if this is old or news?

</comment></comment><comment><USER25> Special hardware can speed-up brute forcing.</comment>


AES on the iPhone is Broken by Default - <AUTHOR> http://log.nadim.cc/?p=58 <comment><USER2> Long story short: a crypto lib on the iPhone is among the many where the default is an all-zeroes IV. Does any application shipping with the iPhone use that default? The author doesn't know. I think it's unlikely.

How big a deal is CBC with an all-zeroes IV? Well, it's less of a big deal than ECB mode, which is the default in _even more AES libraries_. But ECB mode, is (inexplicably) an actual "mode". ECB is harder to single out as an error than an all-zeroes IV, which is explainable only as a mistake. Also, no library on the iPhone ships with a ECB default, unlike, say, OpenSSL, Cryptlib, the Java crypto extensions, &c.

In both ECB mode and CBC-with-predictable-IV mode, the problem is that the same 16 bytes of plaintext will (often, in CBC's case; always, in ECB) produce the same ciphertext. This increases malleability and allows attackers to easily rewrite messages. More importantly, if an attacker controls the size of any part of the input, they can arrange to create ciphertext blocks with only 1-2 unknown bytes, which are trivially brute forced.

 _By the way: here's more than you ever wanted to know about IVs in CBC mode:_

<http://news.ycombinator.com/item?id=2029640>

 _If you just want to know what "IV" means, it's "fictitious first ciphertext block in a block cipher mode that involves chaining ciphertext values"._

<comment><USER3> The big difference between the ECB and CBC block cipher modes is that in ECB identical blocks of plaintext will produce identical blocks of ciphertext, within the same communication. This will reveal something (at least that there's lots of identical blocks) about the content of the plaintext which may be used to device an attack.

In CBC (with known IV) you only get the same ciphertext for identical blocks in the beginning of different transmissions if you use the same key for both transmissions. As you're not supposed to use the same key twice for a stream cipher, it's not a really big issue.

<comment><USER4> The point of using an IV is that you _can_ use the same key for multiple messages. You're not supposed to repeat (key, nonce) pairs for a stream cipher, and CBC's IV is sort-of equivalent to the nonce. (AES-CBC is not technically a stream cipher. Not all stream ciphers have nonces.)

<comment><USER2> Using the same key+nonce pair in a stream cipher has the effect of generating an identical keystream. It's a much, much worse problem than repeating IVs; it makes decrypting the resulting ciphertext stream almost a pencil/paper exercise.

Sorry for the pedantry.

</comment></comment></comment></comment><comment><USER3> IANA Cryptographer but as far as I know, the initialization vector (IV) of a cryptographic protocol is usually public and an integral part of the protocol specification. Both parties must agree on the value of the IV so they can understand each other. If the IV were secret, some kind of handshake (similar to key agreement) should take place before the connection is initiated.

I don't know how using a block cipher in cipher block chaining (CBC) would be different here. In the article, OP suggests that it may be related to short messages. Indeed, if the plaintext is less than or equal to one block, _and_ you re-use the same key (which you should never do) it's possible to do replay attacks.

If anyone has deeper knowledge of cryptography and block cipher modes in particular, please explain to us how CBC is vulnerable if the IV is known by the attacker? Why are short messages more vulnerable and to which attack modes?

As I said, I'm not a cryptographer, only a uni student with an exam on crypto tomorrow. To me, it seems like the article had a linkbait title and it didn't describe a very big threat anyway (and it was only superficially related to AES). But if crypto class has taught me anything, it's that intuition often fails. So don't take my word for it, there may be a real threat behind this.

<comment><USER2> The article had a linkbait title, to be sure.

It is a significant problem to have deployed CBC with predictable IVs (all zeroes is no worse than any other predictable IV), for the very same reason it's bad to use ECB mode.

The IV does not need to be secret, but an attacker shouldn't be able to predict what the IV for a given piece of plaintext _will be_ before it's encrypted. If that makes sense.

</comment></comment><comment><USER5> Maybe they just wanted to be compatible with the PS3's version of AES?

</comment><comment><USER6> If you want the security guys at Apple to hear about the issue, you should file a bug directly with them: <http://developer.apple.com/bugreporter/>

Then add it in here for the benefit of others: <http://openradar.appspot.com>

<comment><USER2> This is kind of a silly thing to file a bug about.

The library design decision we don't like is that the IV isn't required; ie, an IV is not among the required arguments of some function in the argument.

There's no reasonable hot fix for this problem. It requires an API change to "fix".

Believe me, please believe me, there are much much worse things that developers will get wrong with AES on the iPhone than not remembering to set a random IV.

</comment></comment><comment><USER7>
      "a serious documentation flaw"

The all-zeroes IV is documented in the official CCCrypt(3cc) man page at:

[http://developer.apple.com/library/ios/#documentation/System...](http://developer.apple.com/library/ios/#documentation/System/Conceptual/ManPages_iPhoneOS/man3/CCCryptor.3cc.html)

this does not exonerate Apple having made a wrong choice of design.

<comment><USER8> Yes, it does. (IMHO)

A low-level API is not the thing to design your cryptographic protocol around.

A low-level crypto API is not prescriptive, it's documentation is merely descriptive. Apple devs were merely documenting and unit testing what happens when you pass in a certain combination of parameters.

</comment></comment><comment><USER9> This article is 100% wrong. The IV is not a secret, must be know for decryption. In-fact counter mode simply picks a starting IV and increments. Allowing the attacker to manipulate the IV or reuse of an IV can be problematic, but a guessable IV is of NO HELP to an attacker

</comment><comment><USER10> So from what I understand, the first block is encrypted in ECB mode, and any blocks there after are done in CBC mode. And that's if the IV is not set by being optional.</comment>


Simply beyond ridiculous (H265 proposal testing) - <AUTHOR> http://x264dev.multimedia.cx/?p=360

<comment><USER2> Just curious - did the same shenanigans get pulled with H.264?

<comment><USER3> Not to this extreme, as far as I can tell, though I wasn't in the industry during the period that got standardized. You can actually go and try out some of the proposals; one, for example, was called Nokia MVC (not to be confused with the much later H.264 MVC); see <http://wiki.multimedia.cx/index.php?title=Nokia_MVC> for more information. While it certainly was a kitchen-sink of "interesting" features (affine motion compensation, KLT, etc), it was not so slow as to be impossible to use.

But I can't say for sure that there weren't some totally insane encoders put forward by those involved.

What I suspect is going on is a case of exponents. That is, you have an algorithm that tries every possible A, an algorithm that tries every possible B, and an algorithm that tries every possible C. You optimize them independently, and then in the final encoder you submit, you run them all at the same time, optimizing every possible A, for every possible B, for every possible C, sending runtime sky-high.

I'd read the code, but it's nearly-undocumented C++, written by the kind of people who reimplemented their own option parser using C strings (in C++) in Visual Studio.

</comment></comment><comment><USER4> I had the impression that decoding is the time critical operation. Encoding is done once and decoding many time. Sure, it is better with fast encoding, but we won't get better compression for free.

The author didn't consider the use of GPU to perform the encoding. Kind of fishy. For my application (not video encoding) I managed to reduce the computation time from 5h to 15s (600x faster!) by using a GTX280 GPU card.

<comment><USER3> If you get a 600x speed increase, you did something wrong in your CPU application; there simply isn't 600x as much processing power on a GPU. Typical increases are about 5-10x, a bit more in applications with heavy floating-point math.

More importantly, regardless of how important you think encoding is, if I can't encode a 5 second test sequence in less than a day, I'm not going to be able to do much experimentation with the software. Sure, you can port it to a GPU, but right now it _isn't_ on a GPU, and right now, I'd like to experiment with it.

<comment><USER5> I am unfamiliar with the memory patterns in the application, but: 600x improvement in performance does not have to come from increase in processing power.

If the algorithms have a lot of data reuse in their matrix computations, I can see achieving 600x improvement when compared to a hardware cache based architecture. If the CPU implementation doesn't do tiling (<http://en.wikipedia.org/wiki/Loop_tiling>) effectively (or it can't) then it's going to shuttle a lot of data back and forth from cache to RAM.

The accepted term for this effect is super-linear speedup.

</comment></comment></comment><comment><USER6> > so I decided to try out the proposal that appeared the most interesting: the > Samsung+BBC proposal (A124), which claims compression improvements of around > 40%.

At first I read this and couldn't believe it. A 40% improvement! Wow!

But reading the rest of the article, it's disappointing to see that it's not a practical %40...

Makes me wonder if GPUs could be used to do the encode and speed it up enough to make it practical (maybe within a few generations of GPUs..). After all, you have to aim for where computers will be by the time this becomes a standard, not where they are now.

</comment><comment><USER7> I would like to see more information before reaching a conclusion.

Does using a GPU really help as much as chmike suggests?

What do the encoder's authors have to say?

</comment><comment><USER8> It is a form of content protection: accessibility to hw to deal with it will be much further down the road for _consumers_ than monopolies. Old format will be "good enough" for home video until the inevitable comes.

Would GOOG fast-track vp8 as an ISO standard, like MS did with OOXML? After all, it is ubiquitous in flash video, just as Word is -- a de facto standard needing rubber stamping.

<comment><USER9> I've also wondered if the needed hardware for H.264 was a form of dongle (<http://en.wikipedia.org/wiki/Dongle#Copy_protection> for youngsters who don't remember this early form of DRM) but have concluded it's just because they come from the hollywood and hardware world rather than being internet and software guys.

Also note that Microsoft only got to fast-track OOXML as an ISO standard because it had already been passed as a standard by ECMA, not because of anything inherent in OOXML (which wasn't even a de facto standard, the binary .doc was).</comment></comment>