Ask HN: Do computers and tablets really improve education at elementary level? - <AUTHOR> Some recent personal observations and tutoring led me to believe that schools introduced mandatory laptops and tablets simply to appear modern.
What I see is pre/teens spending most of their days (evenings and weekends) on social media using devices mandated by schools and purchased at great cost by parents. I see close to none usage of the same devices for improved learning/teaching.
Kids don't hang out on Wikipedia. They follow pop stars on Instagram. All day (and night if not restricted) using electronics that supposedly improves education.
Majority of 'educational' usage is along the lines of looking up class schedule online and doing homework on ebooks which could very well be paper based. For example what are the benefits of using drawing program vs paper, pencil, ruler for basic geometry? Is it worth spending money on iPad Air to facilitate this? Wouldn't be better to use these funds for better teacher pay and teacher/student ratios?
Are there any studies supporting or disproving my observations? What are your personal observations? <comment><USER3> A tablet (iPad or otherwise) much less so; tablets are very much "consumption" devices, which can consume packaged educational content and videos, but don't help with collaboration.

However, a two-way interactive device like a laptop or Chromebook? Typing homework instead of writing it? Having collaborative tools available to work with others, both in and out of school? Playing with preliminary programming environments? Trying experiments and visualizations? Yes, that can absolutely help.

Just handing a device to every student will _not_ automatically improve education, though; they're not magic. There need to be lesson plans, adapted materials, tools (e.g. for teachers to collaborate with students and students to collaborate with each other), and not just the same lessons ported to turn in homework on a computer. That takes time and effort, but the result will be students much more adapted to a highly tech-integrated society.

(Disclaimer: the above derives from professional experience and observations, but is not a comment made with my professional hat on; not speaking for anyone else here.)

As for the comments on social media: yes, and that's something many of them will do as adults too. Many people are highly social, and hang out with each other online. Some of what they do will be educational and productive, but having a computer doesn't mean it has to be used entirely for education and productivity. Even just posting online provides practice writing and typing, both of which benefit from practice. Some of their time might be spent on random Internet forum sites arguing with each other, which of course will never be a skill they'll make use of as well-adjusted adults like us. But it'll keep kids inside and thus off your lawn.

<comment><USER4> How is a Chromebook less of a consumption device than an iPad?

<comment><USER5> Chromebook allows you to type papers etc.

<comment><USER4> But Apple Pages is free for iPad, and so are Google Docs and Microsoft Word. And of course you can run all the same webapps as on the Chromebook.

<comment><USER3> You could supply hardware keyboard-cases that prop up the tablet at a usable angle. But otherwise, typing long documents on a tablet is a miserable experience.

<comment><USER4> This is more flexible. The iPad can gain a keyboard when you need one, but Chromebooks can't lose their keyboards when they get in the way.

<comment><USER6> They have convertible chromebooks.

<comment><USER7> This. As the owner of a full-body aluminium convertible chromebook, I'd concur: The point about "losing the keyboard" doesn't apply per se, if you're talking about the right Chromebook model. The Asus C100P for example makes a good tablet and its laptop-experience has never been matched with any iPad- keyboard I've seen so far.

On the other hand, a Chromebook's problem (for now) regarding the "tablet mode" lies in the ChromeOS GUI: It wasn't designed with touch screens in mind (especially the browser itself) and feels clunkier than other tablet controls. Google are on their way to remedy that through their integration of Android apps though. They're certainly not there yet, but I can imagine that changing in the forseeable future.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Here's a vested interest trying to cherry-pick studies to make tablets in the classroom seem useful, and it's pretty thin gruel:

[http://www.securedgenetworks.com/blog/8-Studies-Show- iPads-i...](http://www.securedgenetworks.com/blog/8-Studies-Show-iPads-in-the- Classroom-Improve-Education)

1\. A study showing that giving kindergartners short-term exposure to tablet learning programs caused a short-term increase in literacy scores (probably just novelty effect)

2\. A non-study anecdote from a med school

3\. A survey showing kids prefer being given iPads to not being given iPads

4\. The same kindergarten study again

5\. A probably real study showing that math apps improve algebra test scores (probably through increased practice)

6\. Another survey showing kids still want toys

7\. Anecdote that tablets can improve accessibility for disabled students

8\. Another legit-looking math study with a positive result

9\. Another give-us-toys survey

Assuming these guys have done a good job searching for evidence of value, the only decent result for mainstream K-12 education is that it maybe makes math practice more palatable which would definitely improve math scores.

<comment><USER9> "maybe makes math practice more palatable which would definitely improve math scores" \- I have this thought experiment where you drop off ipads in inner city Detroit. They are loaded with games, but the only way to unlock the games is to solve a certain number of math problems each day. My theory is that test scores far surpass the public schools.

</comment></comment><comment><USER10> I think it depends entirely how they are used.

CAD (Onshape), programming, digital arts/photography, making video, collaborating on writing and presentations for group projects, collaborating with your classmates, doing research -- all great uses.

In other words: classroom tech is probably best (IMHO) when used in nearly the same way you would use it in a job or a non-school project.

Replacing existing educational systems and tools (conventional textbooks, testing, etc.) ... probably less useful.

<comment><USER7> I'd both agree and disagree with that. I can imagine such technology being very useful for teaching if it is applied well, and - as you note - <USER2> current ways of teaching completely certainly won't help.

I'm not sure about the "using it as if for a Job" part though. It wouldn't surprise me if there were some good teaching techniques using such hardware in new ways - it's just that they haven't been tried yet.

If one could let kids explore some topic on their own (given certain boundaries) in fun ways, I could imagine that alone could have positive effects. Perhaps you meant that with your remark too (I'm not sure if I misread you there)?

Edit: I could, for example, also imagine a scenario where a traditional "text book scenario" is accompanied by some "sandbox" examples where kids could try different parameters in the style of Bret Victor's "Inventing on Principle" talk. I've generally thought that his demos, while being truly great, wouldn't help too much when it comes to actual work. For showcasing something and educating someone in a more explorational way, they seem to have a huge potential, though.

</comment></comment><comment><USER11> As an engineer who has pivoted toward education (I worked in the Obama administration on CS Ed and games for learning) I want to say "of course technology helps!" but what the drumbeat of research shows us is that it is no silver bullet -- what's important is the WAY technology is used. Think of the technology as a tool. If the educator knows how to utilize the tool to enhance learning, then it will help!

Blended learning and personalized learning are two methodologies in which technology is actively valuable. You can learn more about those on sites like Edutopia and EdWeek. Here's a great summary article from EdWeek looking at concepts for technology in education: [http://www.edweek.org/ew/issues/technology-in- education/](http://www.edweek.org/ew/issues/technology-in-education/)

I'm a big fan of using digital games as an engagement modality and curriculum augmentation. GlassLab and SRI did some work together a few years ago and their meta-analysis indicated that adding a digital game to a traditional curriculum could on average increase cognitive learning outcomes by 12%. Of course it varies wildly depending on the game and circumstance. [https://www.sri.com/sites/default/files/brochures/digital- ga...](https://www.sri.com/sites/default/files/brochures/digital-games-for- learning-brief.pdf)

</comment><comment><USER12> Personal observations:

Tablets/e-readers are great for schools. There are plenty of DRM-free e-books. Instead of buying crates of books, you can just buy some files and them copy them to all the e-readers on the school network.

I've never been able to manage physical flash-card decks, but once I got a smartphone I started using spaced repetition system (SRS) flash-card apps, which can organize (probably) millions of flash-cards and show them to you in the most optimal way for exploiting the long-term memory. I've learned over 3,000 Arabic, Japanese, and Korean words combined, thanks to SRS flash-card apps.

And in this day-and age where pretty much everyone is a network/system administrator (they just don't know it) it's important for kids to learn how to really use a real computer. The most useful thing I learned in my digital media class was how to organize files. I've never met an employer or coworker who could maintain a neat filesystem, even though an untamed Downloads directory would often be the source of their computer troubles.

There is a huge opportunity for these technologies to make schools better. But at the same time, that opportunity has been here for over a decade now.

One more observation: american public schools have horrible taste in software.

<comment><USER13> Do you know where to get DRM-free ebooks for elementary school children? Project Gutenberg is great for olde authors, not so much for fun simple stuff for kids.

<comment><USER12> There wasn't any copy protection in the e-books I bought from amazon. However, I haven't bought an e-book from amazon in 6 years. So that may no longer be the case, if more publishers have started using DRM.

<comment><USER14> Yes, Amazon now adds DRM to all their ebooks and often you don't even get the actual book file but just access to a cloud version.

</comment></comment></comment></comment><comment><USER15> No. It's meant to augment learning, but it's doing the exact opposite. Laptops/Tablets are redundant objects in the classroom, because instead of providing support to what's already good in the classroom, they're designed to replace them. Personally I'd choose paperback over ebook every single time.

</comment><comment><USER16> Before anything else, try asking yourself a slightly different question:

If you were given when you were a kid a laptop or tablet (and if internet existed at the time) would you have used it to study or to look around for (choose whatever fits better) music, movies, lolcats, funny videos, maybe some p0rn and the like?

<comment><AUTHOR> OP here... Exactly. My concern is that 11, 12, 13 year olds need a lot of editorial guidance, mentoring and teachers who are truly fluent with technology to do more useful activities and less useless or downright harmful on their devices.

18 year old can (usually) figure out how to use Internet and technology in general to improve themselves and advance their education. Small kids not so much...

<comment><USER16> Right.

The (wrong) idea is that the tool (tablet/laptop) by sheer magic can replace guidance, if you prefer it is a form of lazyness by the teachers and/or the parents that assume that the kids will not do what they are better at (which is of course playing) 80-90% of the time (and use it for school work for the bare minimum 10-20% actually needed to get a decent vote).

Under some guidance I find the tablet or laptop an exceptionally good tool, but it is just a tool, so in itself its usage without appropriate programs and mentoring it can become worse than useless, an additional means of distraction.

</comment></comment></comment><comment><USER9> Great question, great comments. Consensus seems to be that computers are tools and can be helpful if the learning model is right. Specifically, computers can allow for mastery (see Sal Khan on TED) and personalization (see Silicon Valley schools). I think the follow up question is: will the current system evolve to a 21st-century model, where computers can be effectively utilized?

(My answer is no, here's my proposal for a better model: [https://medium.com/@prendalearn/nanoschool-a-new-take-on- edu...](https://medium.com/@prendalearn/nanoschool-a-new-take-on- education-8610a46cb0ac))

<comment><USER17> Interesting idea. However your model - like all interest based learning models - fails because learning is hard. How will you force kids to memorize their multiplication tables, their spelling lists... These are things that are hard to do and interesting. (note once you get good things like spelling bees are fun, but until you are good it is not fun so few kids will cross that gap)

<comment><USER9> I agree, what if people decide not to learn. My two answers are 1) they wouldn't learn in a compulsory model anyway, not really ([https://medium.com/@prendalearn/teaching-is-impossible- what-...](https://medium.com/@prendalearn/teaching-is-impossible-what-to-do- instead-31b30924511d\);) and 2) gamification can go a long way.

Actually testing this next week with a summer camp where we bought a bunch of cool, fun toys and the kids can play all day once they get their work done (x% mastered on Khan Academy, y pages read, z words written). I'm making all this up - no academic background.

</comment></comment></comment><comment><USER18> It depends a lot on what you are learning. I think playing DreamBox significantly helped my daughter (1st grade) learn how to count. Simply because she likes playing with it so she got a lot of practice for no effort. The key is there: no effort, or an effort that is lower than the reward. But I don't think there are many things where this applies.

Reflecting on my personal experience: in junior high school and above I played a lot of video games available only in English, that truly helped with my learning of the language. And now that I'm studying kanji: spaced repetition on the iPhone...

</comment><comment><USER19> I'm sure it doesn't improve their education but I bet it helps soothe the ones who are bored out of their fucking minds. I had a ti-83 to occupy myself when I was a kid but a tablet would have been amazing!

<comment><USER20> The TI-83 had some pretty kickass games. I remember playing "Drugwars" on mine in High School.

</comment></comment><comment><USER21> Not a clear yes.

      less than 60% of teachers think that pupils' academic
      performance also improves, or in other words, the impact on their marks is seen to be lower than
      on their learning

[https://phys.org/news/2013-06-digital-tablets- classroom.html](https://phys.org/news/2013-06-digital-tablets-classroom.html) and [http://files.eric.ed.gov/fulltext/ED541157.pdf](http://files.eric.ed.gov/fulltext/ED541157.pdf)

</comment><comment> barry-cotter No.

Readable academic blog post

[https://fredrikdeboer.com/2017/04/12/study-of-the-week- compu...](https://fredrikdeboer.com/2017/04/12/study-of-the-week-computers-in- the-home/)

[http://www.nber.org/papers/w19060](http://www.nber.org/papers/w19060)

Experimental Evidence on the Effects of Home Computers on Academic Achievement among Schoolchildren Robert W. Fairlie, Jonathan Robinson

Computers are an important part of modern education, yet many schoolchildren lack access to a computer at home. We test whether this impedes educational achievement by conducting the largest-ever field experiment that randomly provides free home computers to students. Although computer ownership and use increased substantially, we find no effects on any educational outcomes, including grades, test scores, credits earned, attendance and disciplinary actions. Our estimates are precise enough to rule out even modestly-sized positive or negative impacts. The estimated null effect is consistent with survey evidence showing no change in homework time or other "intermediate" inputs in education.

</comment><comment><USER22> Depends on how it's used. You can use any tool poorly. Even large businesses do not always use their computers in the best way.

1.) I grew up in a poor area. For high school they introduced an alternative school where you could come in whenever-- basically just rooms full of computers, you would take the whole lesson on the computer. They were able to use only a few teachers for a lot of students this way. While the courses themselves could use a little more work, overall it allowed people to finish high school that otherwise wouldn't have. I think the "let the computer do a lot of the teaching" method is a great one. Lets people work at their own pace and takes some pressure off the teachers.

2.) In an ideal world I would think you could buy a laptop and then save money on books, but at least here in the USA I don't usually see it done that way.

3.) Even if they're doing totally irrelevant stuff, knowing how to use a computer to search for answers and filter out bad information is a great skill to have. So while yes, they need to do their homework, I don't think it's awful if they also use it for playing on.

<comment><USER17> > In an ideal world I would think you could buy a laptop and then save money > on books,

School books are normally overpriced, but they are expected to last 5 years. A laptop will not survive 5 years in the hands of a kid, and even if it does it is so obsolete that you wouldn't want to use it.

<comment><USER22> In my area, and I think it's like this in much of the USA, they come out with a new "edition" of books every year and require you to get the latest for class in college. Even in high school I remember they kept having to buy new books quite a lot. Also keep in mind 1 laptop = all your books for all your classes + the whole internet. In my high school we took 7 classes per day per semester, so that's 7 books = 1 laptop.

Every school I've went to growing up had cheap usually out of date desktop computers bought in bulk. They were old and ugly. But they were fine, most of the time it was just used for reading or word processing. Sometimes google or an e-course. You don't need a lot of power for that. They kept those computers for ages, I am pretty sure way past 5 years.

When my younger brother went through high school they gave everyone cheap laptops and if you broke it you paid for it, that seemed to work fine. Lots of really young kids are getting cell phones these days and managing to take care of them. I think that's probably helping teach them to be careful with electronics.

</comment></comment></comment><comment><USER23> You mention geometry. There are some excellent apps like [https://www.euclidea.xyz/](https://www.euclidea.xyz/) for that, much better than pencil and paper. (I don't know about any outcomes with kids, just my own experience. But if I had kids I would totally want to see what they made of it.)

But in general, when I got an iPad Pro this year and looked for science/math toys to run on it, I was disappointed. There are a lot more didactic educational apps than more imaginative uses of the new medium. Some worth mentioning:

* Earth: a primer * Several apps and games to learn basic programming Scratch-style * Khan Academy * Desmos * Some interactive books from e.g. the Exploratorium * XSection from the same company as Euclidea * A digital-logic game whose name I forget * Kaleidopaint * EveryCircuit * An audio spectrum viewer

I'd like to hear of more to try.

</comment><comment><USER24> This has become a huge fad in countries like India of late (seen this first hand). Rather than aiding the learning experience, these are used by institutions to brand themselves as "smart schools" and in turn charge higher fees for providing so called "smart e-education".

Then there are xyz companies capitalizing on this by building custom tablets/ipads with their own educational content ripping off both schools and the parents by selling "premium" content that helps students have an "edge" among their peers.

But then, for most parents this is also a matter of pride - "my kids attend a smart school! What about your kids?" which is fueling this pathetic trend.

Almost all of my cousins are enrolled in these smart schools and they don't care much since they now have device to play games on in lieu of learning something meaningful.

I feel sad to see these in a country where there aren't proper schools in thousands of villages.

EDIT: fixed typos

</comment><comment><USER25> I actually wrote a post about the benefits of ed tech in education for grad school several years ago, which addresses this issue: [http://blog.wsd.net/jreeve/the-case-for-ed- tech/](http://blog.wsd.net/jreeve/the-case-for-ed-tech/)

The TL;DR is: Yes, they undeniably improve academic performance, and studies have shown this repeatedly. However, keep in mind the studies demonstrating this are done with teachers who actually knew how to use the technology, were trained to do so, and had specific instructional goals in mind for using the tech to benefit their students. If schools/districts just throw this technology at teachers without proper training and academic objectives, it will do nothing. Computers and tablets are useful in the hands of a good teacher, but they are tools. They cannot turn bad instructional practices into good instructional practices.

</comment><comment><USER26> A bicycle for the mind doesn't make the mind stronger. To learn requires focused effort, and having the computer do the work for you means the effort doesn't happen.

If there was solid evidence it worked, you'd see that evidence cited everywhere.

There is evidence, however, that it helps kids with learning disabilities.

</comment><comment><USER27> No, and it has been known for 20 years that they don't [https://www.amazon.co.uk/Silicon-Snake-Oil-Cliff- Stoll/dp/03...](https://www.amazon.co.uk/Silicon-Snake-Oil-Cliff- Stoll/dp/0333647874/ref=sr_1_1?ie=UTF8&qid=1495825412&sr=8-1)

<comment><USER28> This is spam. If you have an argument for or against and want to provide data you link to said data. This is a link to a hardback book for purchase.

I'm not saying you're right or wrong I just find this the opposite of effective for conveying your point.

<comment><USER27> For purchase for 1p, and containing all the research. What exact point are you trying to make?

<comment><USER28> My point was very clear. I suggest reading my original comment again.

<comment><USER27> Perhaps you don't know what the word "spam" means? Perhaps you are a "troll"?

</comment></comment></comment></comment></comment><comment><USER29> I haven't seen good evidence for most computers and related devices improving learning and that's part of the reason I ban them: [https://jakeseliger.com/2008/12/28/laptops-students- distract...](https://jakeseliger.com/2008/12/28/laptops-students-distraction- hardly-a-surprise/) .

I have seen good evidence that computers do the opposite, in the form of Toyama's book _Geek Heresy_ : [https://jakeseliger.com/2015/11/17/geek-heresy- rescuing-soci...](https://jakeseliger.com/2015/11/17/geek-heresy-rescuing- social-change-from-the-cult-of-technology-kentaro-toyama/) .

</comment><comment><USER30> A lot of the move to requiring laptops, particularly district-supplied Chromebooks, is not driven by an effort to improve education per-se, but to improve the education workflow for teachers, and to go paperless.

Students are given a Chromebook and a G Suite for Education account, and all papers/homework is required to be submitted in Google Doc format. The accounts and the Chromebooks are, of course, centrally managed.

Because all students receive these devices (and in our case have to pay a $20/yr. insurance fee to cover any potential damage) any objection from poor or under-priviledged families is eliminated.

It is _sold to parents_ as a way to improve education? Of course. But in reality it's not for the benefit of the students. It's for the teachers.

</comment><comment><USER31> It likely makes the scores higher on tests, though not necessarily because they've learned the material better.

Anecdotally, I've seen recent immigrant children struggling to understand user interfaces (that I would argue were poorly designed, not that it matters to anyone caught in the bureaucracy) that more computer literate kids "get" immediately. The struggles with UI, such as kids literally spending dozens of minutes trying to get to the next question, undoubtedly exhaust and frustrate them. One can only guesstimate the effect on test scores but it can't be positive.

More exposure to a variety of software/UIs seems to matter.

</comment><comment><USER13> 3rd graders in my state take the PARCC exam which is done on a laptop or chromebook. So there is a push to make sure children at elementary school are familiar with such computers including typing practice. This makes sense.

At home I think Khan Academy is a great learning resource. Also even Youtube can be handy for doing research for young kids on history/animals/facts where reference books can be a little boring.

Aside from that I think its largely for show. No one wants to be left behind or seen to be.

</comment><comment><USER17> Computers are a tool. Because they are the new things it is hard to see that they are just tools, so I like to start with this related question: do hammers improve education? Lets look at that question first.

I have never seen a math teacher who I would trust with a hammer. English (language) classes might have a paper mache hammer - one student made as a prop for a play and it has been hanging on the wall since. Physics teachers need a cartoon oversized sized rubber hammer. Shop class will have 60 different hammers, for some types there will be one for each student. Art class will have a couple, and once in a while borrow a bunch from the shop class...

Now that our mindset is correct we can re-ask the question: are computers useful? The answer is what are you going to do with them.

Part of modern English (language) class is typing. Starting perhaps 3rd grade there should be regular streams of reports handed in electronically. As students get older much of the literature they need to read is available free on a computer and hard to find in paper form. Other than a caution about handwriting and spelling still being useful skills I expect to see a lot of computers in language classrooms. As the kids get older things like web pages will be added to English class. (web pages have more in common with journalism than computer science!)

When the kids get older I expect art to be done on a computer, but for elementary aged kids art with messy paints is better than the computer. (some professional artists find painting on a computer is better than real paint: it works the same way until you want to hit undo or need the paint to dry at a different speed - but that is for older kids)

Math is about reasoning through a problem. Computers running flashcards can be useful at times (single digit addition, subtraction, multiplication should be memorized), but ultimately computers are easily harmful to the goal of teaching reasoning. In fact real math problems the arithmetic is easy enough that not being able to do it is a sign you made a mistake.

Science is like math, except the real world is messy and so an equation solver is helpful. Most of the learning is actually before the point or writing up your report though, and not using a computer is an advantage as it forces you to think about how you will measure something.

Shop class (though this barely exists anymore - I think this is a great loss) should cover CNC and 3d printing.

</comment><comment><USER32> I do think its mostly just business. Both schools and device manufacturers can make a lot of money by making such tools mandatory. But there is no doubt that tablets and laptop application can help improve learning in students, but if used effectively

</comment><comment><USER33> It's a tool. It depends on what you do with it.

</comment><comment><USER34> >Kids don't hang out on Wikipedia

Hey! I did that..

<comment><AUTHOR> OK, but starting at what age?

<comment><USER34> ~9. Would not have gained an interest in CS or politics otherwise.

</comment></comment></comment><comment><USER35> N O</comment>


Voting machines pose a greater threat to our elections than foreign agents - <AUTHOR> https://thehill.com/opinion/technology/464065-voting-machines-pose-a-greater-threat-to-our-elections-than-foreign-agents <comment><USER2> Election and voting security is a phenomenally difficult problem space. Much harder than it seems at first.

The National Academies wrote a report not long ago that gives a nice overview, has lots of detail, and makes specific policy recommendations to Congress: [https://www.carnegie.org/media/filer_public/34/9d/349d3207-d...](https://www.carnegie.org/media/filer_public/34/9d/349d3207-d994-4838-8b79-5f8d88e0e412/nas_report.pdf)

<comment><USER3> Have you heard about the STAR-Vote system? What do you think about it: [https://www.youtube.com/watch?v=Cl8q_356zZs](https://www.youtube.com/watch?v=Cl8q_356zZs) [https://en.wikipedia.org/wiki/End-to- end_auditable_voting_sy...](https://en.wikipedia.org/wiki/End-to- end_auditable_voting_systems#Use_in_elections)

<comment><USER2> Looks genuinely interesting. But also looks complicated and hard to explain.

</comment></comment></comment><comment><USER4> Of course they do. Voting machines can be rigged by domestic agents to subvert democracy.

Honestly, it's actually kind of hilarious that some people think Russian trolls and Facebook ads somehow turned the election and not socio-economic factors (for example, those outlined in the Paul Krugman article and thread).

<comment><USER5> And its an age old problem. We have expressions for it, ballot stuffing, and quips about it, vote early and often. We even had a partisan judiciary decide an election since the machines failed to fully punch cards.

</comment></comment><comment><USER6> Having watched this[1] talk concerning how they secured the Xbox One to the degree that it's in millions of peoples homes but it's not been hacked onced in 6 years, it's pretty disappointing they've not just lifted nearly exactly the same tech for voting.

1: [https://www.platformsecuritysummit.com/2019/speaker/chen/](https://www.platformsecuritysummit.com/2019/speaker/chen/)

<comment><USER7> Cool, though hacking Xbox is probably less valuable to would-be attackers than hacking US elections.

</comment></comment><comment><USER8> I find this topic fascinating. Here in Brazil, anyone that dared to oppose voting machines was called anti-democratic and conspiracy-theorist by the mainstream media and public officials.

<comment><USER9> Not even oppose really, the mere act of questioning how secure they are given their track record of being prohibited in Germany, Holland, and India would attract not opposing arguments but name-calling. We are supposed to just trust that everything is well and good.

<comment><USER10> Germany's stance on voting machines is not in a small part due to the history of the CCC and their expertise. Without the CCC it might be much different, but they recognized and spoke about the risks years ago.

</comment></comment></comment><comment><USER11> > Nevertheless, Democratic chair Damon Circosta reached across the aisle to > join two Republican commissioners in opening the North Carolina market to a > barcode ballot-marking system. The vote presents a setback to a multi-year > effort to provide secure, accurate elections for North Carolina voters.

nice to see that this is a bipartisan issue.

<comment><USER12> I'm confused. They're actively fighting secure elections?

</comment></comment><comment><USER13> Paper and pencil should be good enough for every election.

<comment><USER14> Well, just to be fair, paper and pencil are not good enough _any_ election.

I mean, what about elections that you want to steal?

It's a whole lot harder to steal an election without an electronic voting scheme in place.

/sarcasm

<comment><USER13> No no, there's several ways to help you steal the election:

Control who counts the votes and report it the way you want.

Stuff the ballots with more votes than people.

Still, with good faith all around, oversight, and decent security that won't happen.

<comment><USER14> I don't know man?

Just hacking the machines seems a lot easier than hiring an army of vote counters or ballot stuffers.

<comment><USER13> And we've come full circle.

High five!

</comment></comment></comment></comment></comment><comment><USER15> "Right now there are no mandatory federal cybersecurity standards for elections..."

And that's a good thing. Each state/county/city can implement the election however they want which makes it practically impossible to rig the vote. If we all used the same system/procedures/process then hacking the election could scale much more easily as the same tricks that works in Manhattan would work in Montana.

<comment><USER16> That would only makes sense to me if rigging only one state was near useless. It's very much not. If you rig say, Florida, there's a fairly high chance of deciding the election.

<comment><USER17> I don't think the machines matter as long as the vote can be replayed/recounted without ambiguity.

An idea: [https://medium.com/@dotnetmike/touch-screen-voting-should- be...](https://medium.com/@dotnetmike/touch-screen-voting-should-be- illegal-59295dbabc27)

<comment><USER18> It needs a paper record, this needs to be the source of truth.

<comment><USER19> Not just a paper record. A hand marked paper record. If it doesn't go through a computer first it can't be altered. There are several states that do it this way. It's a "Scantron" style ballot. Fill in the vote, run it through a tally machine and save the ballot. The tally machines could be messed with, but if there is evidence of tampering with the tally there is always the authentic original ballot.

<comment><USER18> Yes!

</comment></comment></comment></comment></comment></comment><comment><USER20> Hasn't this always been the case?

Without a verifiable paper trail, why would anyone trust a voting machine?

</comment><comment><USER21> I think the key issue is that these machines are internet or network connected.

If we're really concerned about this - get rid of the network connectivity.

Obviously this is over simplified, but just make a simple locally ran app or web application that refreshes once a vote has been cast. Store the vote in a simple SQLite database and at the end of the day, have a voting official go to the machine, and unlock the case, press a button on the back, which prints out or shows vote counts on the back on a small screen or something. They then can report that to whatever commission, committee, or otherwise is monitoring the election.

It's all locally stored, maintained, and under lock and key.

Why does this seem so difficult? We don't need democracy hindered by "network connectivity", just make it more environmentally friendly so however millions of people times the size of the paper ballot isn't wasted needlessly.

<comment><USER22> How does the voter verify that their vote was counted correctly?

All electronic voting machines should output a paper human readable 'scantron' type ballot that is safely stored for verifying the internal digital tally.

<comment><USER23> >All electronic voting machines should output a paper human readable 'scantron' type ballot that is safely stored for verifying the internal digital tally.

We should just have paper scantron style ballots that people fill out. Then have scantron counting machines to tally them up after all voting nationwide has closed.

All the other issues people are trying to do to "fix" some aspect of voting are fundamentally flawed and those who are advocating for them are either desiring the ability to violate election integrity or don't understand the requirements of voting. Or trying to get money because someone in power sits in one of the two prior camps.

<comment><USER24> _" We should just have paper scantron style ballots that people fill out. Then have scantron counting machines to tally them up after all voting nationwide has closed."_

Vote counting machines are just as problematic as voting machines. We should just get rid of all of the machines and both vote and count by hand.

</comment></comment></comment></comment><comment><USER25> Why can't we just have block-chain based voting where the vote is secret, but you get a paper receipt, and you can run open-source code (like scan a QR code) to check the blockchain if your vote was counted the way you expected. Everything is immutable, and cryptographically verified.

Block-chain seems to be a failure for money so far, but voting seems like the killer application. The technology is there, well understood, there are even companies that offer a solution along those lines. Why don't we use them? Isn't it so much better than electronic voting machines in every way?

<comment><USER26> Because if you can check how your vote was counted, you may be coerced to check it with, say, your boss standing behind your back - so, your vote is no longer secret.

But, of course, voting by mail is even worse, and most of the US seems to not care about it a slightest bit.

<comment><USER25> Or sell your vote, that'd be a way for the wealthy to more directly take control of society.

I'm sure there's solutions to that though, either technical or legal.

</comment></comment></comment><comment><USER27> It's almost like foreign threats are discussed to avoid us looking inside.

</comment><comment><USER28> Since it is software, there's virtually no chance it will be implemented in a bug-free way, so even leaving out malice, things are liable to go horribly wrong at some point.

</comment><comment><USER29> I'm going to disagree. We have evidence of foreign agents interfering in US elections and no evidence of actual attacks on US elections carried out via voting machines.

<comment><USER30> Maybe the old saying "Absence of evidence is not evidence of absence" applies.

<comment><USER31> I don't see how, honestly. That's a saying that is almost always misapplied.

</comment></comment></comment><comment><USER32> Any voting progress can be manipulated. Imagine trying to do it in the early 1800s. Thus the inevitable necessity of the electoral college...

</comment><comment><USER33> Gerrymanders by both Democrats and Republicans an order of magnitude or two bigger threat than voting machines and foreign agents put together.

How many states matter in the presidential election? It's insane disgrace that number is not always exactly 50.

Every other threat is trivial in comparison.

</comment><comment><USER34> Foreign agents are always discussed because frankly, they are almost completely outside of the law. But what about non-foreign agents? Surely, they exist, and the ones that break the laws to get their way should be thrown in jail, but when do you ever see that?

<comment><USER35> North Carolina, Congressional District 9 - [https://www.theatlantic.com/ideas/archive/2019/09/north- caro...](https://www.theatlantic.com/ideas/archive/2019/09/north-carolina- ninth-district-fraud-mccready-bishop/597412/)

It sounds like there was a more-or-less professional election rigger involved:

"According to prosecutors, McCrae Dowless, a contractor for the Harris campaign, oversaw extensive election fraud in Bladen County, in the district's rural east, affecting potentially hundreds of votes."

Details about McCrae Dowless: [https://www.charlotteobserver.com/news/politics- government/a...](https://www.charlotteobserver.com/news/politics- government/article226864674.html)

He sounds extra sketchy.

</comment></comment><comment><USER36> In a perfect world, I want to be able vote from my phone/online.

<comment><USER36> OK, so if that's an unpopular opinion, then lets at least make voting a national holiday, move it to a weekend day, or make it last more than one day?

A single Tuesday in November seems like an awfully thin window to measure the sentiments of a nation of ~350MM, no?

Why are we married to such an archaic idea of what is a reasonable time to cast a vote?

</comment></comment><comment><USER37> For something as important and simple as voting, I'd think we could develop an unhackable, fully open-source, formally verified voting system...?

<comment><USER38> I think this is a hopeless goal, sort of related to Reflections on Trusting Trust.

Even the most basic version of this, a ballot-marking system, is pretty much infeasible unless you have formally verified hardware as well, which is not even possible even for commercial vendors. At least for them, selling sealed units that are somewhat resistant to physical modification is possible, but even there physical compromises have been demonstrated.

Ballot scanning machines (for hand-marked ballots) are a pretty good balance of time/accuracy/simplicity, with the auditability being a big bonus for both random checks and for disputed elections.

To take New York state as an example, it has manually marked ballots now with ballot scanners for tabulation, and I'm reasonably comfortable with the tabulation and placement aspects; where NY fails is largely in usability -- ballot design is worse than terrible, and borders on misleading. That plus the inscrutibility of NY's ballot initiative system (trying to find the actual text of the ballot measures is nearly impossible) makes the whole system a little shakey. And part of that as well is the scope of elected positions for minor things (what the hell is a Comptroller and why are we voting for one); they basically are a power transfer from the executives to the party machine to allow them to essentially give positions to people favored by the (unelected) party apparatus, which give toeholds to higher positions.

<comment><USER37> > is pretty much infeasible unless you have formally verified hardware as > well, which is not even possible even for commercial vendors

Why is it not possible? Formal hardware verification is probably more common than formal software verification.

</comment></comment></comment><comment><USER38> I'm of the opinion that the headline is true, but only vacuously -- foreign agents are not a threat to our elections (except where they attempt to directly compromise voting infrastructure), and similarly the threat from bad voting machines is extremely small.

There are enough checks in the system (bipartisan counting and validation committees) that a pure digital compromise of an election that would not be flagged and detected is very small.

There are much more pressing matters, like access to voting stations (both distance and time), voter roll purging, ballot design flaws that make voting fundamentally error prone, and (controversially) a lack of identification requirements for elections that make certain classes of fraud difficult to detect.

I think on balance, all-remote elections, like Oregon has had for a while, and I think Washington now too, are the best balance here. There are certain vulnerabilities around buying, compelling, and selectively harvesting votes, but with universal cell phones, "proof of vote" is too easy to obtain anyway so those ships have mostly sailed, and it seems like a reasonable tradeoff to make.

<comment><USER39> How do you do "bipartisan counting" and validation in an all digital voting system? Reading the same digital information twice, doesn't verify it.

If you have paper ballots, sure, but the US does not have paper ballots in some states and won't by the next national election. And even if they did (as many do), few states have a uniform system of random vote audits.

So I'm not sure what you're referring to with this:

> There are enough checks in the system (bipartisan counting and validation > committees) that a pure digital compromise of an election that would not be > flagged and detected is very small.

I literally read the Diebold Voting machine source code (and tabulator) that was leaked (twice). There's nothing remotely like that in there. There's no facility to do that. And while most of those are now retired, there's similar machines that work exactly the same way still in usage.

<comment><USER38> > US does not have paper ballots and won't by the next national election

This isn't true universally, in fact, fair to say it is rarely true [1]. Often the vote is tabulated electronically, but there is always a bipartisan committee overseeing random re-tabulations and recounts as a matter of course. In the process of rolling up results, there are cross-checks with voter rolls that make certain types of ballot stuffing infeasible (that is, an attack would have to be a read/modify/write).

There are also state departments that are tasked with overseeing the general quality of elections that will spot outliers and investigate. It's always possible that corruption or partisan efforts will bypass scrutiny (and there have been several iffy cases of precincts in previous election cycles) but that has been a problem even pre-electronic equipment.

[1] [https://ballotpedia.org/Voting_methods_and_equipment_by_stat...](https://ballotpedia.org/Voting_methods_and_equipment_by_state)

EDIT: the parent post has been modified to be slightly less aggressive in its claims, including limiting the scope to "some states". Also added "And even if they did (as many do), few states have a uniform system of random vote audits", but can easily be refuted [2].

[2] [http://www.ncsl.org/research/elections-and-campaigns/post- el...](http://www.ncsl.org/research/elections-and-campaigns/post-election- audits635926066.aspx)

<comment><USER40> I would really appreciate if my county actually did random re-tabulation or integrity checks on my electronic/paper record ballot.

<comment><USER2> I'm a fan of "Risk Limiting Audits" which is a type of post-election integrity check. It's required by law in a few states.

<comment><USER41> Washington state does this. Random precincts are post-election audited by matching the electronic count with hand counted ballots, this is done before the counts can be certified.</comment></comment></comment></comment></comment></comment>


Alibaba Weex Ui -  A rich interaction, lightweight, high performance UI library - <AUTHOR> https://github.com/alibaba/weex-ui <comment><AUTHOR> You can find more examples [here]([https://github.com/alibaba/weex- ui/tree/master/example](https://github.com/alibaba/weex- ui/tree/master/example)). Write once and support iOS / Android / Html5 right now!

</comment><comment><USER2> Is the Taobao app fully rebuild in Weex? or part of it?

<comment><AUTHOR> part of it</comment></comment>


History of Search Engines - <AUTHOR> http://www.technology-facts.com/2007/10/10/history-of-search-engines/

<comment><USER2> To sum this up into a sentence:

There were a whole bunch of solutions that sucked, then Google came along.</comment>


AI|Writer: AI experiment to create correspondence with famous personalities - <AUTHOR> https://aiwriter.app <comment><AUTHOR> A couple of letters of interest

1) "Professor Richard Feynman explaining a quantum computer in great detail"

[https://aiwriter.app/sample/08ad9901f5422a7e65](https://aiwriter.app/sample/08ad9901f5422a7e65)

2) "Ada Lovelace explaining the difference between the Analytical and Difference engines"

[https://aiwriter.app/sample/43ffa2aeb4253fdadc](https://aiwriter.app/sample/43ffa2aeb4253fdadc)

Although both read like a student bluffing their way through an exam.</comment>


In Japan's Slow Economy, Rare Price Rise Prompts Surplus of Remorse - <AUTHOR> http://www.nytimes.com/2016/05/19/business/international/japan-economy-deflation-prices.html?_r=0 <comment><USER2> When I first saw this ad I really enjoyed the concept of it (work in video production.) Not something you see often. Maybe that will change. To me, it's interesting because [1] the consumer has to be familiar enough with the product so much that even its price is memorized, and [2] just seeing a company apologize for a price increase is rare in American culture.

<comment><USER3> I'm looking forward to the Volkswagon version, complete with spanking paddles. (And I shouldn't be surprised anymore, but, these are sold on Amazon.)

<comment><USER4> I did see Volkswagen's "sorry" ad on Japanese TV about a month ago!

</comment></comment></comment><comment><USER5> If there is any person who finds this funny - and it is funny - know that is this is where the WORLD economy is heading.

Europe is already half-way there, america is stalling it due to immigration, China is going to be there once it hits the demographic cliff.

<comment><USER6> Very true. These countries are all showing syptoms of first-world economy disease; low-birth rate, government budget deficit, high healthcare expenditure, bureaucracy, gutting of manufacturing jobs, and local labor market and education systems that fail to recognize that not everybody has IQ of 120+ and benefit from getting bachelors and masters degrees.

America can thank its dollar as world reserve currency. Billions it spends on military bases around the world and foreign aids is part of its effort to keep its reserve currency status. But at some point, the party is going to be over. American labor force is already very uncompetitive and overpaid compared to its European and Asian counterparts. Yet we enjoy one of the highest standards of living. That gravy train won't last forever.

The only thing that will get the developed countries out of their impending doldrums is 10/100x energy and technological breakthrough.

Until then, we'll get our own version of 60 yen Garagari-kun.

And don't think deflation hasn't been happening already in the U.S. The only difference is, unlike Japan, unscrupulous U.S. food companies have been cutting ingredient quality and content size, rather than raising price for the past 10 years.

Check out Breyer's fake ice cream, Haagen Daaz, McCormick pepper content size, Mars shrinking chocolate bar sizes.

[https://consumerist.com/category/grocery-shrink- ray/](https://consumerist.com/category/grocery-shrink-ray/)

[http://www.dailymail.co.uk/femail/article-3037688/Shrinkflat...](http://www.dailymail.co.uk/femail/article-3037688/Shrinkflation- sneaky-firms-making-favourite-products-smaller-NOT-shrinking-price.html)

<comment><USER7> > Yet we enjoy one of the highest standards of living

The US ranks 16th on the Where-to-be-born Index.[1]

1\. [https://en.wikipedia.org/wiki/Where-to-be- born_Index](https://en.wikipedia.org/wiki/Where-to-be-born_Index)

<comment><USER8> The index seems to conflate countries to be born in and countries to be raised in. For example, if there is one country in the world to be born in, I would absolutely pick the US, if only for the ease of travel/migration to many desired countries in the world. For countries to be raised in, the index seems to be more relevant, at least judging by the metrics used.

<comment><USER9> There are many countries with more visa free travel than the US. And these countries don't have international income tax.

<comment><USER10> US seems to be quite close to the top with 154 visa-free countries, while the top spot is held by Germany and Sweden with 157 countries.

[https://www.passportindex.org/byRank.php](https://www.passportindex.org/byRank.php)

</comment></comment></comment></comment></comment></comment><comment> norea-armozel I just wonder if they can ever get out of this death spiral for their country. I remember watching a bit of an documentary of men (young and old) who literally live out of net cafes in Japan. It was disturbing to since the same documentary mentioned that it's the norm now for people to be working just temp work (I use to do the same in manufacturing years ago) which can go away at a moment's notice. At some point this has to change, if there's X percent of wealth being generated in a country (and Japan has to be making some gains in that regard) but Y percent of the population that's un/under-employed then I wonder if the question shouldn't be about how we get these people to work but rather how we distribute the wealth to ensure everyone has their necessities met (housing, healthcare, food, education, etc)? I'm not proposing UBI, social democracy, or anything. I'm just posing this as a question because honestly I can't see this situation lasting for long unless there's a massive die off of the population (possibly literally).

</comment><comment><USER11> Was not aware the Japan's economy is slowing down, i would totally be down to boost their economy by importing Nissan Skylines into the US. Damn Dept. of Transportation and their safety laws ;(

<comment><USER12> I've seen at least two Nissan GTR Skylines here in Minnesota. Don't know if they're detuned or otherwise modified. First one I saw was at a gas station last year and I was so astounded I had to ask the owner if it was really what I thought it was.

Crawled back into my 350Z still drooling :-)

<comment><USER11> was it an R32? I think the law has slightly laxed on them due to being 25yr now. i see R35's here in the bay area every now and then.

<comment><USER12> They were both current model year or at most a year old. Well, I use the term "Skyline" loosely. I don't think Nissan actually calls them that anymore.

</comment></comment></comment></comment><comment><USER13>
      > Japanese policy makers have long identified
      > deflation as enemy No. 1 for the economy.

It is crazy when policy makers try to make prices increase, prices DO increase, and everyone complains after the fact, including the people who wrote that article and commenters here.

<comment><USER14> Prices increasing without increase in economic output though, stagflation becomes a danger. Deflation is very dangerous, stagflation is dangerous, runaway inflation is dangerous. Monetary policy isn't easy.

<comment><USER15> Just set a level target (eg 5% increase in NGDP each year), and follow it. Very easy.

If market forecasts are below target, do QE (= print money), if above, slow or stop the creation of extra money.

(One can target the market forecast of ngpd in a years time or two, instead of current ngdp.)

<comment><USER16> If only it was that easy. On the broadest strokes monetary policy effects tend to be delayed and do minor changes until you hit a tipping point then effects rocket on a direction. No-one really knows where the tipping points are as there a bunch of variables and unknowns in every scenario so you dont really know until you 'found it'. The old quote something like "economics is someone looking backwards telling us why stuff happened".

Secondly, policy makers should manage monetary policy in conjugation with fiscal policy. But fiscal policy can a much harder political fight or have different groups/ideologies controlling it. So monetary policy often runs as a solus activity making its effectiveness limited.

<comment><USER15> If long lags where a thing, wouldn't that lead to major arbitrage opportunities?

See [http://www.themoneyillusion.com/?p=6197](http://www.themoneyillusion.com/?p=6197)

Monetary policy can always produce inflation, if the central banks wants it badly enough.

You are right that better fiscal policy can be useful for the economy, too. (I'd like to see Georgism given an honest try again. Funny enough, that's a very orthodox economic suggestion. Just like free trade and free movement of labour.)

</comment></comment></comment></comment></comment><comment><USER13> 25 years of governments pumping money into the economy to see if it "grows" again. When will they recognize the policy is failing and the solution is not "more of the same"?

Give me a date.

<comment><USER17> They kept the monetary base pretty steady for a while in the mid 2000's. It ended up hurting their ability to export and made it easier to import. They were unhappy with the slightly higher unemployment, the slight and constant price deflation, and the lack of GDP growth. Otherwise, things actually weren't that bad.

</comment></comment><comment><USER18> This article is painting the wrong picture, exaggerating this paltry 10 yen rise.

At least from a normal household point of view living in Tokyo, I see rising prices all around - rent getting more expensive, the same type of fish (as an example) I've been buying in supermarket getting more expensive.

Recently I was shopping for a bicycle bag. I saw some blog reviews from 2 years ago stating the price was around 5000 yen; But I see all the shops are now selling it for over 7000 yen!

</comment><comment><USER19> > But in Japan, businesses that face rising costs feel they have less ability > to do so because wages are flat. Instead, they take a hit to their profits > or cut back rather than alienate consumers.

Won't that just flatten out wages even more? There's no money to give out raises if nobody's making any money.

</comment><comment><USER20> Hm. Well the bottled drinks in vending machines was 100yen back in the 90's when I was a child, and is now 120 yen, so many things have increased in price or have followed the American CPG way of maintaining sticker prices but decreasing the payload in the package.

<comment><USER21> You have to factor in an 8% consumption tax (~4 point increase over late 1990s) on that (meager) price increase.

</comment></comment><comment><USER13> So prices are sticky upwards now?</comment>


Downloaded my Facebook data as a ZIP file - <AUTHOR> https://twitter.com/dylanmckaynz/status/976368845635035138/photo/1 <comment><USER2> This is simultaneously appalling and unsurprising. It's the unsurprising part though that's the trap because people use that to paper over their disgust and replace it with resignation.

Buried in that Twitter thread is some ruby code for collecting statistic from the FB data dump. [https://gist.github.com/dylanmckay/2b191a10068bd87d0fffba242...](https://gist.github.com/dylanmckay/2b191a10068bd87d0fffba242db44b52)

</comment><comment><USER3> You really should be able to control apps/cloud providers retention of your data plus be able to delete it.

for each of the types of data( location, images, click history, etc):

1\. none

2\. prompt

3\. 1 day

4\. 30 days

5\. until deleted

or something similar

and maybe some of the service need to go to a pay model.

you were charged $XX for service

you were credit $XYZ for sharing personal data for XYZ time frame

you were credited $ABC for ordering ABC products and services.</comment>


Boston VC who passed on Facebook trashes the Valley - <AUTHOR> http://valleywag.com/tech/east-vs%27-west/boston-vc-who-passed-on-facebook-trashes-the-valley-298346.php <comment><USER2> The guy's just upset because he didn't have the foresight to see that Facebook would make it big.</comment>


Systemd Forward Secure Sealing of System Logs Makes Little Sense - <AUTHOR> http://louwrentius.com/systemd-forward-secure-sealing-of-system-logs-makes-little-sense.html <comment><USER2> This article is predicated on the assumption that an attacker goes from zero access to full root within 10 seconds. While there are vectors which have allowed such rapid escalation, they're less common now than historically thanks to Linux's security looking more like an onion rather than just a binary state (root or user).

Also the author picks apart a quote, but if the assumptions in the previous paragraph is taken at face value (that an attack can have sup-10 second root with automated attacks on the logs), then even remote logging isn't a secure vector as they often aren't sent instantly so an attacker could intercept or alter them.

However I suggest that such a scenario is uncommon. Most attackers have to start outside and fight their way in which will generate plenty of logs for either external logging or FSS.

> It seems to me that systemd now also wants to play the role as some crude > intrusion detection system.

FSS isn't a "intrusion detection system." It is an attempt to make logs immutable, nothing more. The nice thing about FSS is that it can be coupled with an actual IDS and the IDS can look for attempts at altering the FSS.

> If the systemd author would just have implemented sending log events to an > external log server, that would have been way more useful security-wise, I > think.

It isn't a binary choice. They can implement FSS and remote logging. Also it is open source so you yourself can contribute external logging.

<comment><USER3> >they're less common now

Source?

>arent sent instantly so an attacker could intercept or alter them

intercept where?

>Most attackers ... generate plenty of logs

Source?

>They can implement FSS and remote logging.

Point is, thus far they have not, and their first choice was not what the author views as more secure.

<comment><USER2> > Source?

Experience. I've set up SELinux, AppArmor, etc. For example back near 2000 a lot of Apache servers I worked on were running as root, now few are, and better still many have limited permissions even as their user/group.

The same can be said for many Linux services today. And better still the few that HAVE to run as root often come shipped with some level of permission controls to limit exposure.

I can link you to a random book on Linux access controls and security if you want an actual third party source. Or be a total dick and link to a man-page.

> intercept where?

It depends which system you're using to send logs remotely (and how it is configured). Sometimes the filesystem, sometimes IPC, etc.

e.g. [http://www.rsyslog.com/doc/queues.html](http://www.rsyslog.com/doc/queues.html)

>> Most attackers have to start outside and fight their way in which will generate plenty of logs for either external logging or FSS.

> Source?

Source on, what? That attackers who break into systems generate logs? You REALLY need a source on that, REALLY? Come on now.

> Point is, thus far they have not, and their first choice was not what the > author views as more secure.

Alright, and then criticise them for that. If the article had been about systemd's lack of remote logging that would have been one thing, but it was complaining that FSS was bad because systemd lacked remote logging. FSS existing is irrelevant.

Also, again, open source. Go implement shit.

</comment></comment></comment><comment><USER4> This starts off looking like a reasonable criticism of systemd, or rather that systemd claims to do more that it (or any alternative) actually can guarantee. It quotes the author of systemd to prove that the claim is made, but it does not give a link or say from where the quote was taken (so we don't know the context or age of it, i.e. we don't know it is still relevant).

But then it veers off: " _This whole observation is not original, in the comments of the systemd author 's blogpost, the same argument is made by Andrew Wyatt (two years earlier). The response from the systemd author was to block him._" No links are provided, so we can't know what any of them actually said or did.

This smells like deliberate character assassination. Especially the fact that no references are provided seems fishy to me.

<comment><USER5> I found the comments from Andrew Wyatt - They're on the same G+ page linked in the article actually (Though it would be nice if the article pointed this out). Here's a full copy of the relevant comments:

Andrew Wyatt:

> Sigh.

Lennart Poettering:

> +Andrew Wyatt Sigh?

Andrew Wyatt:

> +Lennart Poettering I'm not going to waste my time explaining why.

Lennart Poettering:

> +Andrew Wyatt cool, then what you doing is not helpful, and just noise, and > hence waste of time, and hence why do you post this at all? You are > contradicting yourself there...

Andrew Wyatt:

> +Lennart Poettering I forgot that this wasn't a free internet, forgive me > for sighing in public about something that doesn't really solve the problem > that it aims to solve.

> One of the principle reasons to ship logs is not just to protect and > preserve them, but to remove the control of the logs from the administrators > of the systems - as sometimes the attack happens from the inside.

Lennart Poettering:

> +Andrew Wyatt Cool, I'll translate this for everybody else: +Andrew Wyatt > has no clue what he is talking of, but is full of negativity, hence tries to > spread FUD, and be as unspecific as possible, making wild claims he makes up > of thin air, to just make this negativity stick.

Lennart Poettering:

> +Andrew Wyatt I never claimed that FSS tries to solve the problem of attacks > from the inside. That is a fundamentally hard problem, since it is entirely > against the protection model of Unix: the admin is in power, and this gives > him the power to stay in power. If you want to fix that problem then an > external log server won't help you at all. You need to change Unix from the > ground up, and not just that as the untrusted admin problem is primarily a > social problem that you can only do so much about solving technically.

Andrew Wyatt:

> +Lennart Poettering it is actually a pretty easy problem to solve, I should > know as someone who has solved it. Log syslogd events including starts and > stops, and ship every log message to a server or cluster of servers that > administrators don't control. A good forensics auditor would know who was on > the server when the syslog kill event occured, and if the nodes are > configured right - at least some of the steps executed prior to.

Lennart Poettering:

> In case anybody wonders, I have blocked +Andrew Wyatt now. If people get > personal I am more than happy to remove their comments, and ultimately block > them.

<comment><USER6> So, in one fell swoop, Poettring demonstrates both his own immaturity as well as a practical example of not having an external log server--had that been the case, the comments couldnt've been deleted by a "disgruntled admin" (Poettering). :)

Why the hell would you trust a software community with this guy? He doesn't seem reasonable at all.

<comment><USER5> Granted, Andrew Wyatt was acting immature as well, but his last response was decently reasonable and seemed like a fair point. I could have understood ignoring him, but the fact that Lennart was clearly provoking him isn't what I'd want to see from a project leader. That's simply not a way to treat people who seem to have legitimate gripes. I could understanding calling him out for his 'Sigh' comment, but I don't understand claiming he has no idea what he's talking about and is just spreading FUD and 'making wild claims up out of thin air' after he explains his point. That comment was simply _completely_ unnecessary and just Lennart being angry.

If Andrew did keep acting like he was at the beginning and Lennart answered all his questions/complaints, then I could understand either blocking him or discontinuing the conversation. But the fact that Lennart either never responded or removed all the responses after that is disconcerting, and honestly just annoying. If he had just answered it and left the responses up then most complaints would be gone and this article wouldn't even exist.

</comment></comment></comment></comment><comment> vezzy-fnord An interesting thing to note is that systemd's FSS feature is based on a FSPRG [1] (forward-secure pseudorandom number generator) contributed by Lennart's brother Bertram Poettering, based on the latter's research paper entitled _Practical Secure Logging: Seekable Sequential Key Generators_ [2].

[1] [http://cgit.freedesktop.org/systemd/systemd/tree/src/journal...](http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/fsprg.c)

[2] [https://eprint.iacr.org/2013/397.pdf](https://eprint.iacr.org/2013/397.pdf)

<comment><USER6> Oh, goody, so it's homebrew crypto as well?

</comment></comment><comment><USER7> I think the systemd complaints really boil down to two very real problems:

1\. The authors of systemd aren't dealing with criticism well. They've allowed it to turn into a PR nightmare. Agree or disagree with them on specific issues, but they've allowed this to grow out of hand. There are nearly daily popular posts on HN, Reddit, etc. Most of these are bikeshed arguments, but if you have so many bikesheds that it becomes a daily issue on news aggregators, then you have yourself a culture problem.

2\. Perhaps as a result of the above, there haven't been any limitations of the scope of systemd. This means that there is a lot of feature creep as stuff gets added in, and criticism gets swept away without considering it.

Unfortunately, I don't see an easy way to fix the culture problem. But it needs to be addressed.

EDIT: formatting

<comment><USER8> Posts like yours are one of the first steps. At this point we need to address the culture problem and the people contributing to it instead of focusing on the distracting fallout.

I've tried to keep an open mind about all things systemd but after finally reading some of the exchanges people have with the systemd folks, I'm surprised systemd isn't more widely rejected as a viable alternative simply because of the attitude of some of the people currently maintaining it. You can't be an butthole to folks trying to offer valid criticisms and expect those same people take your project seriously. That just does not inspire confidence, it inspires skepticism and distrust.

I wonder if it's simply a critical mass problem, if once enough devs get peeved they will fork systemd and lead it the way they see fit sans any caustic contributions or contributors.

<comment><USER9> It has been forked [1].

> uselessd (the useless daemon, or the daemon that uses less... depending on > your viewpoint) is a project to reduce systemd to a base initd, process > supervisor and transactional dependency system, while minimizing > intrusiveness and isolationism. Basically, it's systemd with the superfluous > stuff cut out, a (relatively) coherent idea of what it wants to be, support > for non-glibc platforms and an approach that aims to minimize complicated > design

He could use better marketing, but I think removing the kitchen sink aspect of systemd and keeping the service file syntax is a step in the right direction.

[1] [http://uselessd.darknedgy.net](http://uselessd.darknedgy.net)

</comment></comment></comment><comment><USER10> No security professional will be bothered to critique "FSS" because anybody worth their salt know that any log _ON_ a server is, by definition, not trustworthy. They've known this for at least 20 years (if not longer), and everyone uses syslogd or some variant thereof.

So, in that sense, there is no controversy here, and this feature is, for the most part, completely useless.

In the comments below, Andrew Wyatt is absolutely correct and this, "Lennart Poettering" individual doesn't know what they are talking about.

</comment><comment><USER11> This is a neat feature, which I didn't know systemd had, and which I recall having wanted in other contexts. The criticism about the 15-minute interval is valid, but that's an implementation detail which, from the sound of it, can be fixed if someone puts in the effort. So while the author may have intended this as a pure criticism, it didn't really come off that way.

</comment><comment><USER12> So the argument is: it's not good enough, so we need to throw it away?

<comment><USER8> No, I think the author's point was that people shouldn't misrepresent FSS as equivalent to logging to a remote server. They can compliment each other, but they are not the same, and thinking they are can lead to serious security snafus.

<comment><AUTHOR> Exactly.

</comment></comment></comment><comment><USER13> What I find troublesome with journald is that they ignored everything that was done before in the log signing space. There has been some research done, even an RFC published. They implemented their own solution incompatible with everything else. Any questions about their design was met with, at best, indifference.

Since then rsyslog gained a log signing solution, sadly incompatible, but which at least to my eyes look a bit more conservative in design. We don't really have any second opinions on journald. That would be fine if it was just a hobby project, but I find it problematic to include by default in stable enterprise distributions.

</comment><comment><USER14> Systemd is starting to show the signs of feature creep which IMHO is good. Failing early means the ship can be turned around if there's enough will, or at least (newer) replacements of systemd(in case it goes really off the rails) will learn from others' experience.

<comment><USER2> This was added in 2012.

<comment><USER14> You mean the article or the feature? The article is dated by 22/11/2014\. The feature may have been added a few months/years ago, but the point still stands about systemd showing signs of feature creep. Note also the DNS resolver issue[0]

[0] - [http://seclists.org/oss-sec/2014/q4/592](http://seclists.org/oss- sec/2014/q4/592)

<comment><USER12> The feature was added in 2012 or something, whenever the log support came.

The DNS issue affects not just systemd but any stub resolver.

<comment><USER15> The DNS issue is worth in systemd's resolver because it is _NOT_ merely a "stub resolver" \- it implements a cache. From the same thread:

"The DNS specification does not require rewriting of upstream responses to filter out parts for which the queried server is not authoritative. This means that a downstream caching resolver will tend to poison its cache if it adds data from such responses that are not directly in response to the QNAME."

[http://seclists.org/oss-sec/2014/q4/602](http://seclists.org/oss- sec/2014/q4/602)

Adding entries (including additional records, which are common in DNS) without validation is just _asking_ for a DNS poisoning attack.

</comment></comment></comment></comment></comment><comment><USER16> Log signing is nice to have, but ultimately not that reliable. Systemd has quite a broad attack surface __, and if the attacker has root, you 're fucked anyway. It might be a useful tool for poking local sysadmins.

 __compromising systemd, forcing it to re-sign the logs (assuming that practicable.)

Potentially you can have an alert that checks the signature, which might be useful. However you can do something similar now, but comparing log files (local vs remote) although its not that easy or elegant.

I've yet to use systemd in anger. I'm sure when we update all 25k machines to it next year we'll become intimately familiar with all its pains.

<comment> Tuna-Fish > compromising systemd, forcing it to re-sign the logs (assuming that > practicable.)

This is completely unfeasible. The point of FSS is that you sign the logs, create a new key using your old one, and then permanently throw away the old key. Once this is done, no matter what control you have on the system, you cannot re-sign the logs without the tampering being obvious.</comment></comment>


Bitcoin is the 'mother of all scams' and blockchain is most hyped tech ever - <AUTHOR> https://www.cnbc.com/2018/10/11/roubini-bitcoin-is-mother-of-all-scams.html <comment><USER2> (Back story: This guy is famous for in "2005 Roubini said home prices were riding a speculative wave that would soon sink the economy." Giving people loans they can't afford is obviously a bad idea.)

He said "literally every human being I met between Thanksgiving and Christmas of 2017" asked him if they should buy cryptocurrency.

Literally? Including babies and people who don't know you?

And that it's a bust "like you have not seen in any history of financial bubbles."

An asset going from $1,000 to $6,000 in year has never been seen?

And that "blockchain is the most over-hyped — and least useful — technology in human history".

Huh?

And blockchain "is nothing better than a glorified spreadsheet or database".

OK, kind of, but now I know he clearly has no idea how a trustless, decentralized network works.</comment>


The best solution to daylight savings time: dump time zones - <AUTHOR> http://www.nytimes.com/2016/11/06/opinion/sunday/time-to-dump-time-zones.html <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=12887007](https://news.ycombinator.com/item?id=12887007).</comment>


Ask HN: Have you created alternate accounts to post questionable responses? - <AUTHOR>

Obviously I'm unable to post a poll at -8 karma. Karma is precious on it's own of course but what about your image? The accounts you use to post comments or articles that are genuinely good are precious. The image associated with your online persona is more pervasive and timeless than person to person connections. Everything we type is documented for easy access in the future. When you have an idea that isn't normal to your status quo have you ever created an account to post a article or comment? If so, how many alternate accounts do you have and what prompted you to create an alternate one? <comment><USER3> I have one other account here. I started this account one day when I wanted to express a controversial idea I felt I couldn't articulate well enough to warrant associating my real name with it for the rest of my life. Sometimes my positions aren't P.C. enough to associate with my family name and sometimes I just want to explore my opinions in discussion form even though I haven't got the time to express myself with exacting clarity. I'm afraid if I use my real name (a unique name for sure) I will either make a mistake I might later regret or I will be tempted to wordsmith my comment for longer than I should.

Anonymity can sometimes be very liberating. Maybe when I become a better writer or my startup is wildly successful I will reveal my identity. Until then I don't see why I should silence my most authentic voice by closing this account or use my real name on every comment that I write. What's wrong with using a pseudonym once in awhile? Some people _only_ use a pseudonym - is that so wrong?

I treat this account more like a diary. I take more risks under this account. It grants me creative license to be myself but not the self I want shown when someone googles me.

What if my startup doesn't work out? I'm going to need a "real job" and if the economic environment gets much worse I might find myself interviewing with a conservative pointy-haired boss. This is a real life possibility and if it turns out that is what happens I'm better off if my interviewer hasn't read my honest ramblings on corporate life, sex, philosophy, politics - all of which I feel free to discuss under a pseudonym. Look at it another way: in a worst- case-scenario, let's assume one day I am wrongly accused of a terrible crime - do I want the prosecutor to take out of context my most controversial, intimate musings? There are after all some things you can't say. I haven't exposed much under this account - I just started it a few weeks ago - <USER2> <edit>my reaction to the negativity in this thread</edit> is What is wrong with someone detaching themselves a bit from their ego? <edit>Downmodders,</edit> how am I hurting the community?

</comment><comment><USER4> I have just one account.

For me, it boils down to this: a goal of the site is to improve quality of discussion.

There are two main parties to discussion: "you", and "everyone else".

When "you" post: if you already suspect that your topic will earn down-votes, then why post it (from any account)? Apparently the topic is not something interesting to this group.

When "everyone else" down-votes: they have a responsibility to be smart, and not childish. It's shallow to click the down-arrow simply for disagreeing with somebody or not liking them personally. If there is a general feeling that down-votes are always for legitimate reason, I think people would be less likely to "hide" behind anonymous accounts.

</comment><comment><USER5> No based on how the question was framed. If a response is "questionable" then I have to question whether or not I should make that questionable response.

Most of the time I post under my real name (actually, I don't know why I'm using a pseudonym on HN, frankly, just reflex when I first joined).

The exceptions are: Discussions on Politics or Religion. I don't want my name associated with any religious (or atheist) group nor do I want it associated with any particular political party. I have worked for people that once they discovered my political views, I was treated differently because we either agreed or disagreed. I know that my name is going to be googled the next time I apply for a job and could run into someone who will toss out my resume simply because I'm conservative, liberal or other.

If a site is overly political, or it's associated with a political cause, I will always keep only one ID on that site. If the site allows anonymous posting, I'll use my real name and post anonymously when broaching a subject that is controversial. If the site does not allow anonymous posting, I'll keep two IDs handy for when I want to join into discussions that would identify my political or (non/religious) affiliation.

</comment><comment><USER6> No, never. On most online communities I use my real name. On one very useful online community, the community rule is that no one uses a real name, so I came up with my current screen name. As I join other communities where the use of a screen name is the norm, I use the SAME screen name, so that people can tell who I am. I let my reputation build from the content and appropriateness of what I post. So far HN and Newmogul are the only sites I am active on with an explicit karma system, but on two other sites where I use this screen name I have been tapped to be a moderator by the forum owners, because they recognize how I interact with the community. Anyone can do this.

</comment><comment><USER7> No.

Everything I post, I'd be OK seeing it on the 6 o'clock news. But then, I'd expect that as I ran for election last November.

</comment><comment><USER8> Short answer: no

Why would you go through the trouble? Why not refrain from posting it when you think it is questionable?

<comment><AUTHOR> If you want to start a genuine conversation or discussion on hot topics is a valid reason for alternate accounts.

</comment></comment><comment><USER9> Somewhat OT -- how do you have negative karma? I thought you can only vote up on hacker news.</comment>


JavaScript UI framework Kendo UI releases Beta 2 - <AUTHOR> http://www.kendoui.com/blogs/teamblog/posts/11-10-07/kendo_ui_beta_2_now_available.aspx

<comment><USER2> Do we need another js/html framework?

Well, I've spent the last few days coding with Twitter's Bootstrap and the Dojo toolkit and both are a pain to use. Bootstrap is too controlling, only supports the latest browsers, and has a very non-intuitive grid system. Dojo takes the kitchen sink approach yet doesn't offer a lightweight grid system so you're forced to look for alternatives.

So yeah, we need another js/html framework, maybe this time it actually delivers on its promises. I'm intrigued by the focus on jQuery, HTML 5 and supporting mobile devices, but I'm not going to start using this framework as of yet.</comment>


Ask HackerNews: How do I delete my HackerNews account? - <AUTHOR>

So how do I delete this thing? It's been great y'all but the submissions leave something to be desired. <comment><USER2> Just leave.

Why do you want to delete it? Just leave, don't use your account anymore, and don't ever come back.

(Not telling you to leave, I would love for you to stay, but there's really no reason to 'officialy' delete your account)

</comment><comment><USER3> Change your email to something fake, randomly bang on the keyboard to create a password you don't know, and logout.

<comment><AUTHOR> That's not a solution, that's a hacky workaround.</comment></comment>