Kazakhstan to MitM all HTTPS traffic starting Jan 1 - <AUTHOR> http://telecom.kz/en/news/view/18729 <comment><USER2> Kazakh here. Fuck, what do we do? Any suggestions other than trying to raise awareness?

To give some context, the reason why they are getting away with such brute methods is that the most people wouldn't understand the full implication. I would be surprised if this would prove difficult to enforce - the first thing an ordinary person would do when, say, Facebook wouldn't load is to call up the Kazakhtelecom's support and the support guy would tell them to "press that button that says 'I trust this certificate'" and they would comply. There also hasn't been an uproar re government snooping into private citizens' communication, the kind that US had with Snowden etc., so a lot of people are likely to accept the "for your own security" talk at face value without much skepticism. It's also unlikely that even heightened awareness will inspire much backlash, as there is no real track record of grassroots organizing, even when the government tightens the screws. To its credit, the government has been quite skillful at balancing at just below the limit of pissing people off enough to make them go to the streets for the last twenty years (soaring oil prices in the last decade helped as well).

<comment><USER3> What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impact to citizens who will then hopefully wake up and pressure the government to roll-back the program or at least put exceptions in place. You continue this strategy with banks, etc., until it becomes clear to the government that this plan will not work. Note that cert pinning for mobile and desktop apps should have happened long ago & this might be the perfect opportunity to drive it to happen.

<comment><USER4> Down-right demand? With what authority? It sounds like you're confusing these corporations for governments, as if they had to enforce your human rights..

<comment><USER3> The authority of the free market. Did web PKI develop because of governments? No. In fact, quite the contrary. Similarly, if consumers are educated and aware of the weaknesses of current cryptography controls in light of new threats such as governments requiring the installation of their own root CA so they can middle the connection, maybe they'll drive demand for better controls, controls which already exist.

<comment><USER5> > The authority of the free market

That only works in some areas of the world, where a, there is a somewhat free market; b, the free market idea exists in the first place.

As always, like in Perl, there are other ways of doing things; free market is not a universal law.

</comment></comment></comment></comment></comment><comment><USER6> I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert.

Sure, it's going to be difficult to enforce, but it should also be quite cheap.

<comment><USER7> Chinese govt is also capable of doing this. Best part? We even have our trusted* root certificate!

Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS

* Recently un-trusted by Apple and Mozilla. [https://support.apple.com/en-us/HT204938](https://support.apple.com/en-us/HT204938)

<comment><USER8> I really don't understand how that sort of behaviour doesn't constitute an act of war.

Imagine if China sent saboteurs in-country to physically destroy infrastructure being used by American businesses. That would Not Be Taken Lightly.

<comment><USER9> The same way that Stuxnet destroying Iranian centrifuges was an act of war ?

<comment><USER8> Yes. Although I'd have thought _that_ particular war would have started back with the hostage-taking in, what, 1979?

I really don't understand relationships between States.

<comment><USER10> I'm not a West Hater by any means, but I'd say the war started when the US and the UK engineered a coup in Iran because Iran nationalized their oil industry (after the British oil company running it refused to be audited or to renegotiate terms).

[https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat](https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat)

<comment><USER8> Whereas I'd say the problem was forced nationalisation.

<comment><USER11> A foreign coup is a valid response to nationalisation?

<comment><USER8> I'm not sure. But nationalisation is certainly a violation of rights.

Of course, I'd be interested to see how those assets were set up in the first place - my bet would be during a non-rights-respecting period of colonialism.

How far back do you go? (Serious question).

<comment><USER11> You go to when the country got a democratically elected government.

As for nationalisation is certainly a violation of rights do you hold that all eminent domain is a violation of rights? IE if the government wants to build a road and uses compulsory purchase orders it's a violation of rights?

<comment><USER8> Yes. It's possible to do such things in non rights violating ways. For example, buying options on properties and exercising them when a route is made.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Love the Orwellian Newspeak: a "National Security Certificate" to protect people accessing "foreign resources"... If you don't know anything about the subject it really sounds like they're doing you a favor.

<comment><USER13> When you replace Certificate with Letter we understand how dedicated our governments are to our well being.

</comment></comment><comment><USER14> Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way.

The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented.

The people of Kazakhstan can achieve the same outcome.

<comment><USER15> > The people of Kazakhstan can achieve the same outcome.

Highly unlikely. From Wikipedia: In April 2015, Nazarbayev was re-elected with almost 98% of the vote.

That kind of tells the whole story - people are "behind" this (or rather no- one dares contradict the authorities). That country is basically owned by the Family and resistance is pretty much futile.

<comment><USER16> In other words: it doesn't matter who is voting, what matters is who is counting the votes.

<comment><USER17> Given the highly volatile ethnic mix of Kazakhstan and the lurking destabilizing effect of foreign interests longing for abundant mineral resources, a strong majority for stability over freedom is hardly surprising. Nonetheless, 98% seems very much out of this world. But with the "right" mix of fearmongering and early divide-and-conquer intervention when a moderate opposition ist starting to organize? Certainly not unthinkable. There's so much more to a healthy democracy than not miscounting the votes.

<comment><USER18> I don't know why you're downvoted.

I agree a hundred percent. People from stable democracies tends to underestimate how afraid people can be of chaos and how easy it is for some goverment to associate democracy with chaos.

When a moderate opposition starts to organize, a non-moderate one (or one that takes advantage of ethnic fault lines) does too.

</comment></comment></comment></comment></comment><comment><USER19> "telecom.kz wants to use your location."

NOPE

<comment><USER20> I wonder why that website needs your location... After all it's just a news article / press release.

<comment><USER21> I suspect although this might have some minor use to track users outside Kazakhstan, it's real use is to track web site visitors from _within_ Kazakhstan.

</comment></comment></comment><comment><USER22> Wow, I feel really sorry for all Kzakhstan citizens. Also, this is a great example of 'rubber-hose cryptoanalysis' \- who cares about 4096 RSA or whatnot if the government can just beat you until you oblige...

<comment><USER23> Kneecaps are always the easiest things to break.

<comment><USER24> Imagining this in heavy Russian accent: "Security as good as veekest link. And veekest link... is kneecaps. Har har har."

</comment></comment></comment><comment><USER25> And everyone made fun of Netflix for implementing a secure protocol on top of http. Suddenly that seems really useful for people in Kazakhstan.

[http://techblog.netflix.com/2014/10/message-security- layer-m...](http://techblog.netflix.com/2014/10/message-security-layer-modern- take-on.html)

[https://github.com/Netflix/msl](https://github.com/Netflix/msl)

<comment><USER26> If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.

<comment><USER27> Curious. How do you go about (trivially) defeating asymmetric encryption?

EDIT: or do you mean to replace "all" (content + js)?

<comment><USER28> No, just inject some JS that reads the required keys.

<comment><USER27> Okay, so it's (just) for reading the delivered data. Somehow I keep considering MitM a harmful attack (i.e. manipulating the data before it hits the user). My bad :)

<comment><USER29> Given that you're relying on server-provided JS to verify the integrity of the data in the first place, a MITM could replace the verification function with return(true) and then inject whatever data they want.

</comment></comment></comment></comment></comment></comment><comment><USER30> Woah, it can't be stressed how bad this is. If this succeeds, other countries will definitely follow! If it can be shown to work, it will be demanded that this be implemented by pretty much everyone for difficult to deny political reasons (terrorists, children, crime, etc)

This feels like the first bullet in a new war that will occur in every parliament world wide.

<comment><USER31> It is already par for the course in the enterprise world (both public and private sector), for difficult to deny political/economic reasons.

<comment><USER32> Which is quite another thing, after all you are using somebody else network, just as you have every right to hear Adeles new album in your home, but not in mine.

Besides these days you can use your own phone and mobile data, at which point you should be safe.

</comment></comment></comment><comment><USER33> While there are probably 100 different ways to avoid this and retain secure traffic, I would venture to guess that the average Internet savvy-ness of Kazakhstan is pretty low, so using any of them would single you out for additional government attention (whether you're actually doing anything illegal or not).

That said, there's a remarkable tendency in countries as corrupt as Kazakhstan for a "shadow" telecom network to pop up. Just run in some fiber from a neighboring country on the down-low and distribute locally via microwave dish. Yeah, it's not exactly difficult to locate a powerful dish, but it's also not glaringly obvious so you can usually pay someone to look the other way. After all, the government officials want to look into everyone's communication, but if their own communication was ever intercepted, they would be the target of blackmail! They want to use the information they gather to blackmail citizens like the Stasi, not the other way around.

Of course, the flip side of that are the mobile phone networks operated by the Mexican drug cartels and ISIS. But the only surefire way to avoid government surveillance of this sort is to bypass government regulated telecoms entirely.

<comment><USER34> Kazakhstan is possibly more democratic than all its neighbours save maybe Kirghizstan (I'm not up do date on the current government position). More democratic as in I can't make up who's more of a despot between Putin and Nazarbayev, after all they both win open elections, albeit with an iron grip on medias... But then Kirghizstan is likely depending on its neighbours for connectivity (also landlocked).

The other neighbours are shining beacons of democracy such as Russia, China and Uzbekistan...

<comment><USER35> While Russia does encroach on various Internet liberties, it does so quite lazily so far. It does not have a great firewall, it does not have force-fed SSL certs, it does not crack down on the widespread VPN usage. When Roskomnadzor blacklists certain resources, Internet providers enforce it at their leisure, it seems, because different users report a resource either be blocked or not.

"The strictness of Russian laws is compensated by their optional enforcement", as they say.

In a smaller country like Kazakhstan such things are easier to enforce, probably.

</comment></comment></comment><comment><USER36> Makes me wonder how long such policy would last if Google, Facebook, and Microsoft would ignore traffic from Kazakhtelecom MITM server (or just drop the whole Kazakhtelecom IP address space). Of course I'm not saying that they should do that.

<comment><USER37> Actually they really should. As soon as major networks start saying NO is when governments change, I think this is one of the few times where this kind of pressure would be mostly good.

<comment><USER38> And it wouldn't work. You've apparently have never been stuck inside China. I was there for a few years and it was brutal, network wise. Local companies just replace what can't be accessed from the outside.

<comment><USER39> China had a large domestic Internet industry, though. KZ doesn't.

<comment><USER40> RU does though.

<comment> guard-of-terra After Donbass Kazakhstan will think thrice before lending their fate to Russia.

</comment></comment></comment></comment></comment></comment><comment><USER41> Google and Mozilla should blacklist the certificate once it's made public.

<comment><USER42> That would just stop their browsers from working in Kazakhstan on HTTPS sites, who would most likely respond by issuing a new certificate and/or recommending IE. It may also discourage websites from implementing HTTPS.

Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?

<comment><USER26> No, because locally-installed certificates override pins.

<comment><USER43> Depends on how the app is implemented. Doesn't have to be that way at all, and shouldn't if properly pinned.

<comment><USER26> Individual applications (not browsers) can of course hardcode pins that aren't overridden. Those applications will simply stop working in Kazakhstan.

</comment></comment></comment></comment></comment><comment><USER44> Why is Kazakhstan's cert any different than the hundreds of "trusted" root certificates that came preinstalled on my mac?

Looking at my mac's cert keychain, there are 185 trusted root certs. I don't know what any of them are or who has the private key to them.

My ISP could MITM my traffic whenever it wants to, if it has the private key of one of the _hundreds_ of trusted root certs on my device.

<comment><USER45> These CAs have to follow specific rules and have external audit. MITM is prohibited by these rules: certificate authorities that participate or enable MITM are removed from root stores (example: [https://en.wikipedia.org/wiki/DigiNotar](https://en.wikipedia.org/wiki/DigiNotar)).

<comment><USER46> And sometimes the CAs might receive National Security Letters insisting on National Securtiy Certificates.

<comment><USER47> A National Security Letter will not prevent the certificate authority from being blacklisted when detected, and there are at least some legal precedents for warrants (though not necessarily for NSLs) that could challenge a warrant if complying with it would effectively destroy the business (given that the business itself is not the subject of the warrant). If that isn't the definition of an "unreasonable burden", nothing is.

<comment><USER46> "A National Security Letter will not prevent the certificate authority from being blacklisted " Sure it will, just send another NSL to the blacklisting instance.

And I do not understand that going to jail instantly is a smaller burden for you than living with the small risk getting caught.

Do you really believe the NSA or any of those other patriots do not have a few of the private keys for the certificates you trust?

<comment><USER47> > Sure it will, just send another NSL to the blacklisting instance.

Instances, plural, including both browsers and various cross-check mechanisms (pinning, certificate transparency, etc). Likely too many people required for operational security.

Not saying it couldn't be done, but it certainly couldn't be done lightly or often, and even then it would produce significant risk of exposure. It certainly couldn't be effectively used for widespread traffic interception.

> And I do not understand that going to jail instantly is a smaller burden for > you than living with the small risk getting caught.

As mentioned, there exists legal precedent that a warrant/subpoena for information from a third party can't compel that third-party to provide arbitrarily large amounts of aid or to impose an undue burden. Findings of "undue burden" have been upheld for burdens far smaller than "this has a risk of destroying the entire business".

<comment><USER46> warrant/subpoena != NSL

<comment><USER47> Yes, as I said in my original response, "not necessarily for NSLs".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER48> If we could rebuild the internet from scratch knowing that someone would try to do this, what measures could be put in place to make it impossible to MITM traffic (in other words, make it so the only option is to install monitoring software directly on the user's machine)? Is this something which even _can_ be defeated with current cryptographic theory?

<comment><USER49> No, it can't be defeated. If the government says "you can't use encryption on the internet" then it's game over, simple as that. The only thing that stops western countries doing this is the fact that politicians don't realise it's possible (and the horrible UX/deployment issues involved with attempting to install a new root cert on every device your customers may have).

</comment></comment><comment><USER50> This is what HTTP Public Key Pinning (HPKP) protects against.

It allows a server to specify the only set of certificates that a browser should accept. Meaning that MITM'ing is impossible, without a valid cert in the chain of one of the advertised trusted certificates from the server.

Chrome, Firefox, Opera, Chrome for Android, and the Android stock browser all support it.

I'm not sure how they intend to circumvent this problem, apart from perhaps just instructing users to not use those browsers? That's quite difficult to put into practice.

<comment><USER26> No, it isn't. Locally installed certificates override pins; if they didn't, HPKP browsers wouldn't be deployable inside large companies that have regulatory requirements to monitor traffic from their own desktops, and there would be no benefit, because an adversary who can install software or reconfigure your machine can defeat pins in a variety of other less transparent ways.

HPKP is great, but it doesn't address this problem.

<comment><USER14> As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates."

After that, IE and Firefox will follow and crypto will no longer be so trivially subverted by enterprise organizations.

<comment><USER26> That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser.

I disagree with you.

<comment><USER51> Or someone just forks Chromium and releases Chromium For Enterprise.

<comment><USER26> Which again helps nobody, because forks of Chromium will inevitably lag on security fixes.

<comment><USER52> At my last job, my manager tasked me with finding a way to defeat Chrome's update mechanism for all of our employees because a new version had introduced a bug that broke our internal web applications. I disregarded his plan and just introduced a workaround for the bug, but the point remains that enterprise customers already consider it a value-add to freeze their software in time for perpetuity. Hell, my workstation was running XP until I needled IT to grant me a "premature" upgrade to Win 7.

<comment><USER26> Sorry, I meant that from the perspective of the Chromium team.

<comment><USER52> Indeed, I agree with the policy that if someone can control what's installed locally, they've already won.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER53> Idiocy such as this is a strong argument for the use of PAKE rather than CA- based authentication. No need to trust anyone other than the site you're trying to connect to: [https://en.wikipedia.org/wiki/Password- authenticated_key_agr...](https://en.wikipedia.org/wiki/Password- authenticated_key_agreement)

TLDR: Basically, you prove to the website/mail server/sshd that you know your password, while the site simultaneously proves to you that they also know your password (and hence are actually the site you're trying to connect to), all without actually sending the password in either direction. The password is then used to bootstrap symmetric encryption keys.

</comment><comment><USER54> For those of you looking for a mirror (copy) of the page before it was taken down, here it is:

[https://web.archive.org/web/20151202203337/http://telecom.kz...](https://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729)

</comment><comment><USER55> TIL: "Kazakhstan is currently our 76th largest goods trading partner with $2.5 billion in total (two way) goods trade during 2013. Goods exports totaled $1.1 billion; Goods imports totaled $1.4 billion. The U.S. goods trade deficit with Kazakhstan was $295 million in 2013." - [https://ustr.gov/countries- regions/south-central-asia/kazakh...](https://ustr.gov/countries- regions/south-central-asia/kazakhstan)

</comment><comment><USER56> So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?

<comment><USER57> They're likely only intercepting known https traffic (port 443). If you use a VPN and tunnel all traffic you probably won't have any issues.

If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.

<comment><USER58> I lived in Kazakhstan for a few months, and I think they're already blocking VPN traffic with deep packet inspection. I tried a number of different services, including setting up my own on Digital Ocean.

<comment><USER59> I use my OpenVPN VPS without any troubles.

</comment></comment></comment></comment><comment><USER60> So, the next step is encrypting the content before sending it through TLS...TLS over TLS

<comment><USER26> If they can unwrap the first layer of encryption, and most normal traffic inside isn't encrypted, people tunneling through MITM'd TLS are playing a game of cat and mouse with a very well-funded adversary that can imprison, torture, or kill them.

Obviously, a lot of people do this kind of thing in China, and from what we know, circumventing the "Great Firewall" isn't routinely getting people killed. But people should know what they're doing before they try it in Kazakhstan.

<comment><USER61> Next step: steganography

<comment><USER62> Steganography needs vast quantities of cover data. You're increasing the bandwidth costs dramatically when you recommend steganography for everything.

<comment><USER63> _Steganography needs vast quantities of cover data._

Porn? Perhaps the world's smut peddlers will become beacons of freedom and civil disobedience? (Sounds like a Neal Stephenson book.)

<comment><USER64> That's a terrible TX/RX ratio. Unless you encode data in each request and receive small pictures only, it would take ages to send any real information. Good for receiving though.

</comment></comment></comment></comment></comment></comment><comment><USER65> wait till private keys for the cert are leaked by some disgruntled telecom company employee.. Puts the whole country internet at risk.

<comment><USER66> Unfortunately that might be the most effective way to fight this type of thing. Massive incident that would show the foolishness of the move.

</comment></comment><comment><USER67> This sounds pretty bad and we can just hope that this doesn't become the new norm.

What makes me kinda angry is however where this originates from: There are countless so-called "IT security" products that had this idea of MitM-ing all traffic before. Basically it's just the same idea on a bigger level.

<comment><USER31> Indeed. This is already the norm in the Western world, as long as we're talking about the workplace.

</comment></comment><comment><USER68> Link is 404'd

Here is the text of what was there.

ENG ALMATY

Press center Company News Internet news TV News Publishing Video Archive Photo archives Operators Main page Press center Company News Kazakhtelecom JSC notifies on introduction of National security certificate from 1 January 2016 Kazakhtelecom JSC notifies on introduction of National security certificate from 1 January 2016 From 1 January 2016 pursuant to the Law of the Republic of Kazakhstan «On communication» Committee on Communication, Informatization and Information, Ministry for investments and development of the Republic of Kazakhstan introduces the national security certificate for Internet users.

According to the Law telecom operators are obliged to perform traffic pass with using protocols, that support coding using security certificate, except traffic, coded by means of cryptographic information protection on the territory of the Republic of Kazakhstan.

The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources.

By words of Nurlan Meirmanov, Managing director on innovations of Kazakhtelecom JSC, Internet users shall install national security certificate, which will be available through Kazakhtelecom JSC internet resources. «User shall enter the site www.telecom.kz and install this certificate following step by step installation instructions"- underlined N.Meirmanov.

Kazakhtelecom JSC pays special attention that installation of security certificate can be performed from each device of a subscriber, from which Internet access will be performed (mobile telephones and tabs on base of iOS/Android, PC and notebooks on base of Windows/MacOS).

Detailed instructions for installation of security certificate will be placed in December 2015 on site www.telecom.kz.

PR department Kazakhtelecom JSC

30.11.2015

Academy of Public Administration under the President of the Republic of Kazakhstan

Official site of the President of the Republic of Kazakhstan

Информационно-аналитический портал Write to us FAQ Site map Report an error Career with Us Procurement Аукционы Reference book Help © 2010-2015, АО «Қазақтелеком»

<comment><USER69> For an easier to link source:

[http://seclists.org/funsec/2015/q4/30](http://seclists.org/funsec/2015/q4/30)

</comment></comment><comment><USER70> I think I found the law, anyone read Kazakh[1] or Russian[2]?

[1] [http://egov.kz/wps/poc?uri=mjnpa:document&language=kk&docume...](http://egov.kz/wps/poc?uri=mjnpa:document&language=kk&documentId=Z1500000418) [2] [http://egov.kz/wps/poc?uri=mjnpa:document&language=ru&docume...](http://egov.kz/wps/poc?uri=mjnpa:document&language=ru&documentId=Z1500000418)

Edit: I think I got them this time. They seem to be ministerial orders under Kazakhstan's 2004 telecoms law:

In Kazakh: [http://info- con.mid.gov.kz/sites/default/files/pages/2_kaz.d...](http://info- con.mid.gov.kz/sites/default/files/pages/2_kaz.doc) [http://info- con.mid.gov.kz/sites/default/files/pages/6_kaz.d...](http://info- con.mid.gov.kz/sites/default/files/pages/6_kaz.doc)

And Russian: [http://info- con.mid.gov.kz/sites/default/files/pages/2_rus.d...](http://info- con.mid.gov.kz/sites/default/files/pages/2_rus.doc) [http://info- con.mid.gov.kz/sites/default/files/pages/6_rus.d...](http://info- con.mid.gov.kz/sites/default/files/pages/6_rus.doc)

<comment><USER71> Interesting. In 6_*.doc I can read this: "Long-distance and international operators perform transmission of traffic that uses protocols with encryption support using security certificate, except traffic encrypted by means of cryptographic protection on the territory of the Republic of Kazakhstan."

So, if encrypted by such means on the country's territory, shouldn't be intercepted? Ha!

</comment></comment><comment><USER72> Wondering about a turtles-all-the-way solution:

A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates.

So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs.

(some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP

<comment><USER49> You can't solve political problems with cryptography, much though the software engineering industry may wish it were so.

Ultimately, though it will be very hard to accept, crypto may be on the way out as a technology with any political impact. Governments currently accept the rapid increase in SSL because none of the politicians or regulators understand that it's possible to disable it at a country level, and nobody with any technical clue has been willing to point it out to them. But that situation isn't sustainable, as the Kazakh example shows. A sufficiently determined government won't care about minor details like user convenience. They'll just say "you either install our root cert, or you don't get to use the internet" and that's it. Game over. If even just one western country does it, the rest will all follow within a few years.

<comment><USER73> Use a crypto that doesn't rely on authority.

</comment></comment></comment><comment><USER74> > The national security certificate will secure protection of Kazakhstan users > when using coded access protocols to foreign Internet resources.

How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location?

[http://i.imgur.com/fYKHRK1.png](http://i.imgur.com/fYKHRK1.png)

<comment><USER75> Remember they have your location anyway from your IP address.

<comment><USER74> That makes it only more interesting. However, I assume, IP-based location isn't that granular?

<comment><USER57> It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.

<comment><USER76> The actual data source will provide a country, state or sometimes even city and zipcode. Then whatever tool you're using to map drops a pin in the middle of that region. If you zoom in, you get whatever happens to be at the geographic center of whatever the mapping tool (probably Google Maps) thinks is the center. eg if it says "United States" and no other data, you get some random ass place in the middle of Kansas. Sometimes there can be more specific data, but just because you can keep zooming in doesn't mean that that's actually where it is

<comment><USER77> You're describing GeoIP derived from "public" information sources such as the physical address of the assigned entity or the location information provided to the registrar by the block owner.

However, there is a different kind of GeoIP that has the potential to be much more specific as to the location, based on a join between Internet traffic and transactions that target a specific location. e.g. when you purchase a physical item from an online vendor, with your house as the delivery address, they now have both your IP and location. Obviously for this to work it depends on a) the IP address remaining the same for some period of time and b) sharing of the necessary information to allow the join. afaik both are often true.

</comment></comment></comment></comment></comment></comment><comment><USER78> I once looked into getting a .kz domain. (I wanted to host comics on a site named "comi.kz".) It turns out that one of the requirements for getting a .kz is that the website be physically hosted inside Kazakhstan. (And yes, Kazakhstani hosting providers that do business with foreigners are expensive.)

Right now, I am very glad that I did not go down this route.

</comment><comment><USER79> This is lame news. But what I'm curious about is: What are they going to do (if anything) to validate the upstream certificates?

\- What will their upstream root certificate policy be?

\- If they MITM any old upstream certificate, how will they mitigate the huge target they are painting on Kazakh Internet users?

<comment><USER80> I would assume their root trust store could be similar to what your browser would use. i.e. a curated set of root CAs with CRL subscription.

</comment></comment><comment><USER81> FWIW there are 9.49 million Internet users in Kazakhstan according to wolframalpha.com

[http://www.wolframalpha.com/input/?i=number+of+internet+user...](http://www.wolframalpha.com/input/?i=number+of+internet+users+in+khazikstan)

</comment><comment><USER82> This is extremely relevant to my interests but I don't actually understand what's happening here. Part of that is the awkward translation. Can I get a more detailed description and/or some links to help me understand? Thanks!

<comment><USER83> I'm sure someone else can explain it better than me, but they want all of their citizens to install a certificate on all of their internet capable devices that will route all their traffic through the government so they can see all of it. It's a man in the middle attack on the entire population.

</comment></comment><comment><USER84> I wish somebody could tell me what this means half technically. My mind is wavering between this is a good thing because everyone's connection is becoming secure to not a good thing for reasons unknown.

<comment><USER85> It seems like you've got it backward. Kazakhstan is not making the internet more secure. They're requiring citizens to install something (their own root security certificate) that compromises the security of https. The result is that their government can eavesdrop on all traffic, encrypted or unencrypted. That's the story anyway.

</comment></comment><comment><USER86> Why can't Internet companies simply block the entire backward country? I can't imagine Borat's motherland traffic monitizes well anyway. You want to MITM? Fine, build your own Kazakh Google.

<comment><USER87> That would actually be a huge win for Kazakhstan. Much like China pushing people to use Baidu and other state friendly services instead of Western owned services.

</comment></comment><comment><USER88> While I applaud the privacy advocates, we knew this was coming when HTTP/2 (RFC 4750-4751) because an official standard in May 2015. The only way a country with limited bandwidth can operate a transparent proxy is to stick a new certificate in the root chain so that it can decode, cache and re-encode the traffic.

I don't like it anymore than anyone else, but I see a non-malicious purpose here.

</comment><comment><USER89> Could this be used by the Kazakh government to sign malware/spying packages and install them on their citizens' machines? Sounds like a super easy way to open that backdoor.

Or is this a different type of cert? I'm thinking along the lines of what Dell and Lenovo were yelled at for (although those were easy to rip off, but the government could possibly serve as the malicious actor here).

<comment><USER71> Only if the cert also has code signing EKU. Then, in case of code signing trust bit not disabled in the cert manager, signed EXEs will appear with "verified publisher".

</comment></comment><comment><USER90> Google should come up with cheap satellite internet. This is the only way to bypass unruly governments.

But then you're on a mercy of Google Republic.

<comment><USER91> Google already has your data anyway

</comment></comment><comment><USER92> Kyrgyz here. An evil lesson is soon learnt. It's highly possible that our regulators will try to push similar bill.

</comment><comment><USER93> Does it mean that using SSL the normal way will become impossible? I can't imagine this. How this can be enforced?

<comment><USER94> 1) The only TLS connections that are let through are all MITM'd.

2) Every other TCP/UDP flow is checked for conformance with plain-text protocols (like HTTP), or far worse, simply for the level of entropy in the data.

3) A threat of legal action is made against anyone caught using secure crypto.

Good luck beating that. The key here is that the "entropy detector" doesn't "really" need to work. It only needs to work well enough to scare people into submission.

<comment><USER93> Here steganography comes into play - very easily implementable in the form of webcam streams bugged with usable data.

</comment></comment></comment><comment><USER95> If all of their https traffic is compromised, would we not be able to break all of their financial traffic remotely?

<comment><USER96> Not necessarily, it just means that Kazakh citizens will have a root cert installed on their machine that will allow the government to MITM their https connections. The connection between the MITM and the client will be encrypted (just with the government-controlled cert instead of the server's cert), and the MITM will have an encrypted connection to the server. I suppose it is possible that the MITM could make an unencrypted connection to the server, but I don't know a good reason for the government to do that.

</comment></comment><comment><USER97> To what degree has the U.S. government, through the NSA _et al_ , provided moral cover for this sort of thing?

</comment><comment><USER98> Correct me if I'm wrong, but doesn't android display a rather ennerving "someone might be spying on you" warning when custom root certs are installed? I'm looking forward to the reactions when every (android-using) citizen of the country student gets that warning.

<comment><USER49> Why? They would have already installed the root cert themselves and they'd know perfectly well that they are being spied on. It'd just be another annoying warning bar for them.

<comment><USER98> They installed the cert because they've been told to and because likely "the internet doesn't work" when they don't. But that doesn't imply they know what a root certificate actually does or what the consequences of adding new root certs are.

</comment></comment></comment><comment><USER99> > secure protection of Kazakhstan users when using coded access protocols to > foreign Internet resources.

I guess "coded" here means VPN as well...

Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.

<comment><USER51> They're unlikely using plain HTTPS for sensitive traffic, as that still divulges what sites you're visiting.

<comment><USER100> Technically it only divulges which IP addresses you're accessing. The URL, including domain name, in the request is encrypted.

<comment><USER101> Server Name Identification divulges the hostname (in the clear) during the key exchange.

</comment></comment></comment></comment><comment><USER102> My first thought, any tech company to setup offices in this country are probably out the window. However, more importantly, they just made it really easy for other governments to spy on them. In their zeal to protect national security, they have done just the opposite.

<comment><USER103> Not really - to anyone who doesn't possess the certificates used in MITM, the SSL traffic is just as impossible to decrypt as before.

</comment></comment><comment><USER104> And this, dear fellows, shows how effective it is to fight politics with technical solutions.

</comment><comment><USER105> It seems they removed the page

<comment><USER106> Indeed. Even more strange is that they are handling it with a (temporary) redirect on that specific article.

      $ http --print h http://telecom.kz/en/news/view/18729
      HTTP/1.1 302 Moved Temporarily
      Connection: keep-alive
      Content-Length: 154
      Content-Type: text/html
      Date: Thu, 03 Dec 2015 08:41:31 GMT
      Location: http://telecom.kz/en
      Server: nginx

</comment></comment><comment><USER107> "from which Internet access will be performed (mobile telephones and tabs on base of iOS/Android, PC and notebooks on base of Windows/MacOS)"

So use Linux and you will be fine?

</comment><comment><USER108> Slightly OT - if the bad guy can't fiddle with the trust store of your computer, whats his another methods of analysing a users traffic? Is https breakable by other means?

<comment><USER109> They don't really have to force you to install that root cert. Every https connection will be signed with it, so you either trust that cert and can actually view the site (and gov can read it all) or you don't and just get error in your browser.

Everything is breakable, but some things take a really looong time to break. Governments might be able to break some weak https encryption, but not all.

</comment></comment><comment><USER110> I wonder if non-TLS based VPNs could be used around that? And if those are blocked, how hard would it be to build a SSL over HTTP proxy outside the country?

</comment><comment><USER69> Is this different than the DoD having a root certificate in iOS (and I think Windows, too)? Couldn't the DoD also MITM the traffic any time they wish?

<comment><USER111> Yes and no.

At a basic level, yes, any CA can issue a certificate which can be used to launch a MITM attack. We trust that the CAs don't do this. If they're caught, the browser industry tends to revoke their CA status -- which is pretty bad for the CA's business model.

That said, the CAs have been under increased scrutiny lately, and browsers are starting to build additional protections against this kind of thing:

\- Certificate pinning (HPKP) allows sites to restrict which certificates can be used for a specific host, even if the certificate is signed by a trusted system root. (Caveat: HPKP isn't enforced for local roots, installed by an admin. That's how Kazakhstan is able to get away with this, because they're asking users to install a new root manually.)

\- Certificate Transparency is supposed to provide an audit log for CAs, so that any maliciously issued certificates can be detected and acted on.

That said, these features are new and not universally supported by all browsers. And neither would help in a case like Kazakhstan, where users are being asked to bypass security features and there's no system root to revoke.

</comment></comment><comment><USER112> So how about hacking and leaking their certificate and then making all Kazak government traffic vulnerable to public posting all over the internet?

</comment><comment><USER113> That's just wrong and a really unpleasant slippery slope. I hope this causes a huge backlash from users and the internet at large.

<comment><USER114> Kazakhstan is authoritarian state that censors. This is in no way or form slippery.

</comment></comment><comment><USER115> My prediction : Indian government takes up this idea in the next 12 months. If this works this idea will spread.

<comment><USER116> I doubt it - the outsourcing industry would cry foul a million times over.

</comment></comment><comment><USER117> Maybe this will be what the UK government do as a 'relaxed' version of 'ban all crypto'.

</comment><comment><USER118> They lack resources to crack it or otherwise do it in secrecy so they're demanding cooperation. Slick.

</comment><comment><USER119> Did they just delete those news? Can't find the link on the telecom.kz website any more?

</comment><comment><USER120> "SSL Added and Removed Here"

Kazakhstan?!

</comment><comment><USER121> Would it affect vpn services as well? Sad to see more outrage here than in Kazakhstan

</comment><comment><USER122> I think this would break, for example, mobile apps which use certificate pinning.

</comment><comment><USER123> Any proof for that?

Anyone has a copy of original article?

Link redirects to the main page of the website.

<comment><USER124> They deleted the press release.

It's available on the Web archive: [http://web.archive.org/web/20151202203337/http://telecom.kz/...](http://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729)

</comment></comment><comment><USER125> I wonder if they'll be checking the validity of the upstream cert?

</comment><comment><USER126> How would this affect access to bitcoin/blockchains in Kazakhstan?

<comment><USER127> It won't. Bitcoin p2p traffic is unencrypted and does not use TLS.

</comment></comment><comment><USER128> Kazakh here as well.

Don't bother. Nothing will happen. It's just talk as always.

</comment><comment><USER129> Aww but there's a kitten. This _must_ be innocent.

</comment><comment><USER130> Time for httpss:// (HTTP over TLS over TLS)!

</comment><comment><USER127> All other countries have inferior surveillance.

</comment><comment><USER131> This is _such_ a bad idea!

</comment><comment><USER132> At least they're fucking telling people they're doing it.

</comment><comment><USER133> When I watched Borat I felt a little bad for the Kazakhstan government getting singled out like that for seemingly no reason. Now it feels incredibly satisfying.

</comment><comment><USER134> I don't agree with all the comments here. A sovereign state decided to ensure all outgoing traffic is protected by a secure signature that is not possessed by foreign intelligence agencies or hackers (well, that's the idea).

It is a very cheap and effective way to achieve this.

Spying on the population is not prevented by GeoTrust and Cie's loosy certificates, a lot of literature and real life examples already show that. This is a tragedy of the commons, until everybody has access to REAL security, then no country has interest in having foreign powers spying them while not even being to do what everybody else does.

In France, Germany, Italy, Japan, Korea, Australia, etc, all of your data is already analyzed and deciphered, they freaking work together to make it less obvious than Kazakhstan. Don't make any mistake and don't call for overthrowing the regime there, it makes no sense.

From a citizen PoV, they became almost as watched over as we are for WWW traffic, but their lives are still not as much tracked as ours since they do not have the means of our agencies. They are still better off than us.

<comment><USER135> It doesn't protect from a foreign intelligence agencies or hackers because connection is only encrypted by Kazakhstan's certificate to the point where MitM is performed by the government of Kazakhstan from that point connection to the website is encrypted with a valid certificate.

Even if what you said is true and western countries have private encryption keys of all websites I think that citizens of Kazakhstan would rather be spied by foreign governments than by their own government.</comment></comment>


Lessons from Our First $15M - <AUTHOR> https://nathanbarry.com/15-lessons-15-million/ <comment><USER2> Everything old is new again. Hard to believe you can start an email marketing company now and still be successful. Just goes to show old, boring markets have room for new players.</comment>


Moore's Law Dead by 2022, Expert Says - <AUTHOR> http://www.eetimes.com/document.asp?doc_id=1319330&

<comment><USER2> Moore's law only states that the number of transistors doubles for a specific size of silicon every 1.5 years.

When it does end, we will move onto other forms of computing, memristor based, graphene, photonic/optical, quantum (only really useful for some classes of problems), spintronics and such. Might have a bit of a dip off during the change over but then it will be business as usual.

We could start to see computers with more and more processors in them. The cost of producing a processor should continue to drop. Energy efficiency, (reduced heat) and cooling improved systems will keep being developed. So maybe we will end up with computers that are almost a solid mass of processors. That scalability isn't fantastic though, but it would work for maybe 10 years. Things like FPGA coprocessors could also help.

Finally we can look at breaking away from the current paradigms of computer science into esoteric things like biological/dna computing.

Most desktop systems are as fast as most people will ever need them. Remember now days all they are doing is opening a webbrowser and going to Facebook. The UI's keep getting more and more simplified.

Graphics in games is about the most demanding thing that happens on a desktop, which will likely keep going for some time until we have photo-realistic, realtime raytracing at retina DPIs on large screens, in 3D (maybe with voxels for some kind of future volumetric display).

</comment><comment><USER3> As a student of analytic philosophy, this has always caused much confusion when talking to students of logic without a philosophical background. Gordon Earle Moore, of Moore's law, is incredibly frequently confused with George Edward Moore, of the "here is one hand" proof of an external world.

Part of me will be happy when G.E. Moore (George) get's a little more attention.

</comment><comment><USER4> Of course Moore's Law will end eventually, but that doesn't mean that improvements in processor technology won't come from somewhere other than transistor density. Most likely, we'll see 2x+ improvements from one or more of graphene transistors, 3D chips, optical circuits, quantum computing...

</comment><comment><AUTHOR> The five performance bottlenecks: algorithms, programming language or compiler, operating system, processor, I/O system and devices.

One almost down I'm sure the I/O system will reach a wall soon as well. Only thing left is to optimize the software.

</comment><comment><USER5> While Moore's Law clearly cannot go on forever, everyone in this trade should remember its end was prophesized many times before, every time backed up by good science.

Time will tell.

</comment><comment><USER6> Ten years ago I was hearing that it was going to be dead before 2010, I think I'll continue to take these types of claims with a grain of salt.

<comment><USER7> Exactly.

I went to a talk by an Intel engineer saying this very thing. Fortunately it's not dead, and Intel has done more than anyone else to keep it from dying!!!

OTOH back about three decades ago I attended a talk by a Verbatim marketing guy (they built floppy disks) that predicted that magnetic bubble memories would soon kill floppies.

Well, he was right that floppies would die. But so did bubble memory.

</comment></comment><comment><USER8> Again?</comment>


Ask HN: In CS, is it better to be highly specialized or generalized? - <AUTHOR> As a programmer, is it better for long-term career growth to hone in on one single skill (i.e., systems programming, or high-performance computing, or webdev) or is it better to be more of a generalist - to be able to write iOS apps, but also know a bit of assembly, but also be familiar with .NET and React, etc.?<p>To rephrase: should a software dev be a jack of all trades, or a master of one? <comment><USER2> A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship, design a building, write a sonnet, balance accounts, build a wall, set a bone, comfort the dying, take orders, give orders, cooperate, act alone, solve equations, analyse a new problem, pitch manure, program a computer, cook a tasty meal, fight efficiently, die gallantly. Specialization is for insects.

— Robert Heinlein, Time Enough for Love

<comment><USER3> That has become one of my favourite quotes - thanks for sharing. Reminds me of my grandad, who used to tell me "Study like a scholar. Play like a champion." before he dropped me at school!

<comment><USER2> It's one of my favorite as well! And that's an awesome little saying from your grandad too!

</comment></comment></comment><comment><USER4> Become a T-shaped developer. Have a broad range of skills with a deep expertise in one.

</comment><comment><USER5> Depends on your natural ability as well. Scott Adams outlined an interesting heuristic, which is that for some/many people being the 80th percentile in five fields can give you the same value as being, say, the .999th percentile in one.

In addition, in some sense it can be easier to be the 80th percentile in five fields with hard work. Whereas being the .999th percentile in one can also require God given talent.

I work as a data scientist who can do some development, stats, ML, design, writing, communication, econ. In any one of those I'm not a specialist.

</comment><comment><USER6> It depends on your goals in life (if you have thought of them yet). Specialized means that you are can solve one specific problem really well and you can be relied upon to do that. But in that case, you may not be running a team or an entire company. So if you goal is to be really good at being an individual contributor, I would say go Specialized.

If your goals in life are to manage a team, company, do more high level strategic or visionary things, then you need to acquire all round knowledge and skills.

Both of their pros and cons. So there is no right or wrong answer. It comes down to who _you_ want to be ultimately. It is always about you.

</comment><comment><USER7> tldr: jack off all trades and master of ONE at the beginning, master more as time goes by. Fields are highly correlated.

In my opinion, i'd take the 'be a jack of many trades and a master of some' route.

CS fields are very correlated and being a master in at least __something__ will boost your overall mastery of many other subfields.

At the start of your career, exposure to a lot of fields goes a long way while simultaneously going deeper in one field. Doing this opens a lot of doors and CS changes too fast for you to know what the future holds.

Being a master in at least one field will greatly improve your income potential and help you position yourself professionally. Being familiar with other technologies will help you if you ever need to pivot so you're not too clueless. It also opens you up to what tools are out there so you can choose the right tools for a specific problem (at which point you'll dive deeper into it).

</comment><comment><USER8> Do you want to become a consultant or a team leader?</comment>


The Unix Time Sharing System (1974) [pdf] - <AUTHOR> https://www.cs.berkeley.edu/~brewer/cs262/UNIX-annotated.pdf <comment><USER2> I think I was most surprised to see that fork used to take a label. How did that work?

<comment><USER3> From the article: _" The new processes differ only in that one is considered the parent process: in the parent, control returns directly from the fork, while in the child, control is passed to location label"_

</comment></comment><comment><USER4> Looks like it could be good.

</comment><comment><USER5> Annotated by whom?</comment>


Gaspard, the anti-assault accessory: never be alone again - <AUTHOR> http://mygaspard.com/index.php?lang=en <comment><USER2> >> Strangers that rescue you are rewarded.

IANAL, and everything I'm about to say varies with location - I'm in the US and it even varies by state. People using this need to understand self-defense laws very well because the way you defend yourself may give the attacker the legal right to press charges against _you_. If you are licensed to carry a concealed firearm, you may need to take a course where they teach you stuff like this, but you can buy knives and batons that have the same legal implications and no one warns you. If someone attacks you, and the attacker can prove that you escalated the situation, or put them in danger, you may be the one facing criminal charges. This device opens up a dimension I'm not familiar with and I doubt has much case law behind it. If someone shows up and injures the attacker and the attacker makes the case that it was all just a misunderstanding or that it was an overreaction, where does that leave you and your rescuer? I'm not saying it's a bad idea or trying to start FUD, but the fact is self-defense is a very complex issue and you need to understand the implications of your actions very well before you're in a position to have to take them.

<comment><USER3> The general principle is that the first person to escalate to force, and the first to escalate to lethal force, is in the wrong, which can cause the situation to shift.

Although some states don't recognize the latter, but pretty much everyone recognizes the principle of proportionality.

There is plenty of case law about people intervening in situations where they don't know what happened before that point, and it's frequently not pretty. I would expect it to be worse if they responded to such a call.

</comment></comment><comment><USER4> _> 'Anti-assault accessory...Strangers that rescue you are rewarded.'_

This is begging for disaster.

I've personally witnessed the ugly mess of an overzealous rescue, a rescuer labeled assailant when the victim changes their mind or late responders are simply confused and of course violent wisdom of gathering mobs.

Digitally amplifying a scream this way is serious business. Assault and attacker, words the site uses freely, are _dead_ serious yet being applied to an easily activated 'bunny' pin with implied 'rewards'.

I hope these folks think heavily about the potential implications - not just intent of what they're doing here.

<comment><USER3> One of the things we're taught in lethal force (gun) self-defense classes is to be _extremely_ careful about intervening in situations we know nothing about, it can be very hard to figure them out.

Which is critical not only as a matter of morals, but because it's illegal to intervene on the side of an aggressor. And there can be two stages of that, the first to threaten or use physical force, and the first to threaten or use lethal force. The definition of the latter is complicated, not to mention controversial and subject to second guessing etc., especially when the other person doesn't have a weapon.

The general advice is don't, or as Massad Ayoob puts it, if you were in a hospital and saw a random person needing low 6 figures of medical care, would you give him a check for it? Because that's what it takes to adequately defend yourself against a serious criminal charge.

<comment><USER5> > Which is critical not only as a matter of morals, but because it's illegal > to intervene on the side of an aggressor.

Which includes intervening, in many ways, where there is no aggressor (as then you become the aggressor, not merely someone intervening on the side of the aggressor) -- a possibility which it is quite likely that the would-be vigilantes who would have the greatest inclination to sign-on to such a system are likely to not consider when responding to a call.

</comment></comment></comment><comment><USER6> It's somewhat unfortunate that as part of their advertise they perpetuate the myth that violence has been growing over any recent period of time: [http://content.gallup.com/origin/gallupinc/GallupSpaces/Prod...](http://content.gallup.com/origin/gallupinc/GallupSpaces/Production/Cms/POLL/ldah6rdp6ukvngoyqi1fcg.gif)

</comment><comment><USER7> It would be exciting to be wandering the streets at night, waiting for a distress call to come in. The moment the bat signal -- ahem, the Gaspard -- lights up, you sweep in and rescue the damsel in distress from her assailant (naturally he collapses like a throwaway movie ninja), and you earn her undying respect and loyalty.

This could work excellently in a comic. I'm not sure how well it can work in the real world. Maybe if they make it really clear the focus is not on racing into battle with the evil assailant, but on just heading over to ask if everything's okay, that could be more useful.

In real life, I can imagine so many disasters unfolding -- like, you sprint into an alleyway in response to a call, and see a bleeding woman on the ground with a burly man crouching over her. Q1: His back is to you -- can you take him out before he realizes you're there? Q2: he's actually a passerby, and the actual assailant fled a minute ago. How long will it take you to figure that out?

Or just -- escalating violence would be fairly common when totally untrained people race in to deal with violence, but (as other commenters are pointing out) the "good guy" and "bad guy" roles in people's heads don't correspond with the legal outcomes of it all.

<comment><USER8> Having someone there to call 911 if the victim is unable would be a HUGE win.

</comment></comment><comment><USER9> The idea is simple, but it doesn't make it any less ingenious.

A hardware token that transmits its location on demand, so obvious and so immediately useful. I think the question of adoption will boil down to whether this can be used in a completely private mode. That is if notification can be routed to a specified list of people only. If this is doable, it can easily become a must-have accessory for children and elderly, but _especially_ for children.

<comment><USER10> It already exists for the elderly (Life Alert bracelets.)

</comment></comment><comment><USER11> This is as useless as calling 911. Your only options during an actual attack are either disabling the attacker or escaping, and you have about two seconds to accomplish either one. Anyone who eventually arrives to assist you will only be there to help identify your body, gather forensic evidence, or load you into an ambulance. This site flashes images of self defense weapons and refers to them as joining the violence. They are peddling a dangerous fantasy. I suggest Sam Harris' excellent essay on the reality of violence: [http://www.samharris.org/blog/item/the-truth-about- violence](http://www.samharris.org/blog/item/the-truth-about-violence)

<comment><USER3> Some caveats to that advice:

 _Thus, if someone sticks a gun in your face and demands your wallet, you should hand it over without hesitation—and run._

That depends; statistics say those who resist violent crime have better outcomes. It's something you should play by ear rather than blindly follow the above advice, the statistics are undoubtedly biased by people resisting when it makes sense.

 _Even if you are at home, in possession of a firearm, and well trained to use it, when confronted by an intruder your best defense is to get out of the house as quickly as possible. In such a circumstance, a gun is a means of ensuring that no one can block your exit._

This above is very iffy advice. Not only do you have much stronger legal protections inside your house, you're likely to have much greater control over the situation, and control is perhaps his main message. You know your house, can benefit from concealment and maybe even cover (that which a bullet cannot penetrate), you don't know the situation outside the house. You might escape only to be surprised by an armed accomplice. Or suppose you do this just as the police arrive; more than a few armed homeowners have gotten shot by police mistaking them for criminals.

You also need to balance this advice about decreasing the risk to your physical skin with the psychological toll fleeing takes.

 _Nothing good ever comes to people who allow themselves to be moved to a remote location at the mercy of a violent predator._

In my Missouri concealed carry class they ran us through a simulator with police "shoot/don't shoot" scenarios. For mine, I would have been a lot more aggressive and would have tried to shoot at various times if I'd know the terrible statistics of the above which the instructor mentioned after it.

As for his advice to flee and leave your spouse or children to the tender mercies of someone who, as he notes, has demonstrated he wants more than your property, _if you have any other option I don 't want to know you_. That includes your being in such a situation because you decided not to procure one or more firearms prior to the incident.

After I left home, I only procured firearms after I had a significant other to protect, or vice versa. At that point it was an obligation, no matter what obstacles Massachusetts put in place (which aren't really that bad for long guns, although that may be changing depending on the city you live in).

On the other hand, I picked up a very hard rule about hostages from Jerry Pournelle in _The Mote in God 's Eye_: at that point, you mentally treat the situation as if the criminal has killed the hostages, even if you then try to rescue them. In this situation, as the author says, you don't increase the toll by submitting yourself as well. The odds are _very_ high that will make the situation worse.

Final note, underlying a lot of what he says: if someone unknown knocks on the door, I don't answer without having a gun in my hand. If I'm expecting someone, I confirm it's them before opening the door. Or per a rule of Marine general James Mattis WRT to being in Iraq or Afghanistan during our recent unpleasantness, which addresses even more points the author made: " _Be polite, be professional, but have a plan to kill everybody you meet._ "

<comment><USER12> "...if someone unknown knocks on the door, I don't answer without having a gun in my hand."

Holy crap. Do we live on the same planet? Being murdered by an unknown assailant who knocks on my door is so far down my list of risks and fears that it doesn't even register. I'm far more worried about being hit by a bus as I cross the street, or my car spontaneously catching fire in my garage. Sure, it _could_ happen, but so could a meteor that obliterates my house, and it hardly seems worth any effort.

<comment><USER3> It's a casual yet deadly serious precaution, much like looking both ways and listening before crossing the street, or being careful whenever I smell smoke.

"Any" effort? You admit the risk is non-zero (and it's certainly a lot greater than that meteor), for me the effort is rather low, since I keep that gun handy for whenever I go outside and carry it concealed.

Let's add an additional dimension: this precaution is so easy it would be downright _embarrassing_ to not take it and then get bushwacked.

<comment><USER12> Do you keep it by the door, or just wear it all the time? What's the risk of killing an innocent, either because of a misunderstanding or a mistake?

<comment><USER3> Neither, I keep it in a handy, hidden location, where if I'm not at it, is close to my path to the door. It is however traditional in this area to keep one or more guns by your door.

I'd like to think the risk of killing an innocent is negligible. I'm neither morally or legally allowed to use lethal force unless I (technically a "reasonable person" [https://en.wikipedia.org/wiki/Reasonable_person](https://en.wikipedia.org/wiki/Reasonable_person)) believe I'm being threatened with lethal force and that's the best option.

My above testimony should be ample evidence that I realize the terrible responsibilities and consequences of using lethal force; I am therefore necessarily hesitant to do so, specifically my threshold is set high to avoid ambiguity. In my case, not having any dependents, and living with someone who's also capable of defending himself, I'm willing to take a certain degree of risk to avoid using lethal force on an innocent.

In this vague hypothetical, I might instead retreat into my house, perhaps warning the possible assailant that I'm armed and don't want to have to shoot him. Someone who (continues to) advance in the face of that (not to mention entering a dwelling with a strong anti-invitation) could be judged a threat.

Although not necessarily a lethal one, but if someone continues to advance on a visibly armed man, the man can at some point presume the one advancing intends to take the gun away, thereby posing a lethal threat. And all this leaves out whatever that person is saying, all part of his demeanor which one uses in judging his intent.

</comment></comment></comment></comment></comment></comment><comment><USER13> It sounds like a very interesting project, but I think the reward system is unnecessary.

A special "helper list" (one or two people from friends and family) should be mandatory, because sending the signal to everyone around you might not result in any help due to the Bystander Effect (Darley, Latané).

For more information -> [http://en.wikipedia.org/wiki/Bystander_effect](http://en.wikipedia.org/wiki/Bystander_effect)

<comment><USER14> I don't think the bystander effect is nearly as significant as common wisdom would imply. People don't respond not because they think someone else will, but because they don't understand what's going on. I live in an urban area, and I pay attention to noises, but almost every time I hear a scream and investigate it's some boisterous teenagers or some similar phenomena. If I knew the person was requesting help – even if I don't know WHY they are requesting help – I would respond.

The wiki page largely confirms this as well: [https://en.wikipedia.org/wiki/Bystander_effect#Emergency_ver...](https://en.wikipedia.org/wiki/Bystander_effect#Emergency_versus_non- emergency_situations) – most of the factors which encourage response by bystanders would be satisfied by this system.

<comment><USER15> > People don't respond not because they think someone else will, but because > they don't understand what's going on.

Well yes, but the _reason_ people don't understand the seriousness is generally thought to be that when in groups people will see the inaction of the group and conclude that if it was something serious, someone else would have responded and/or assume they _have_ intervened (e.g. by calling an ambulance).

In groups people will pretty consistently take longer and be less likely to even notice what is going on, and then take longer and be less likely to respond, even when the situations are otherwise identical, because people are inhibited by social conventions and "social proof".

There are factors that may reduce that difference. E.g. the more clearly it is an emergency. But even situations where people are very obviously in distress can result in inaction - the Wikipedia page has several examples.

Cialdini (in Influence) notes that even specific cries for help in obvious emergencies are often ignored by groups. He himself was actually in a car crash, and realised people were just driving by and ignoring them, until he realised and made use of his own advice: Make yourself noticed, be specific about what help you need, and be specific about _who_ you want to provide it. That is, screaming "help" gets you ignored. Screaming "you in the blue jacket, call an ambulance" gets people to respond. Once you first get a response, you get more response - the bystander effect works to your benefit: people see other people acting, and suddenly everyone accepts it's an emergency and helps.

> If I knew the person was requesting help – even if I don't know WHY they are > requesting help – I would respond.

That may be true for you, _especially_ if you are alone. But the moment group dynamics are triggered, the odds starts dropping that you will intervene with each extra person involved up until some fairly low limit (at which point the chance of intervention is quite small).

</comment></comment></comment><comment><USER16> I am not sure it could work, people probably won't bother reacting to the help call or at the other extreme, a mob without control will form, but it is interesting because it is capturing both the gamification and isolation trends of our current time.

In an Ingress word, they should create leader boards to find out who is the best vigilante in a given city.

To their benefit I should add they are trying to tackle, maybe awkwardly, a complex issue.

</comment><comment><USER17> Is it me or this feels terribly wrong?

<comment><USER18> The only part that I didn't like was the "rewards for strangers for rescuing you". Not that there is anything inherently wrong with rewarding people who help you,but I feel like it's kind of wrong to have it advertised as a feature.

<comment><AUTHOR> The fact is people dont react when someone need help in the street/metro. With this kind of reward incensitive, it give a "bonus" to make people move.

<comment><USER19> Is that a fact? I don't think that's a fact.

<comment><USER2> They're probably referring to this: [http://en.wikipedia.org/wiki/Murder_of_Kitty_Genovese#Psycho...](http://en.wikipedia.org/wiki/Murder_of_Kitty_Genovese#Psychological_research). It's not a fact that no one helps, but it is a fact that there are psychological issues at play that mean people are less likely to help in those situations.

<comment><USER19> [http://en.wikipedia.org/wiki/Murder_of_Kitty_Genovese#Public...](http://en.wikipedia.org/wiki/Murder_of_Kitty_Genovese#Public_reaction)

You should read the 5th paragraph down.

<comment><USER2> And you should read all the peer-reviewed papers in published psychology journals below that document other examples of this and the factors that affect it?

<comment><USER19> I'm not saying such an effect doesn't exist. I'm saying the statement "The fact is people dont react when someone need help in the street/metro. " is patently false. There are many many more anecdotes where people do help. In fact, I havent read one anecdote where this device would have changed _anything_. It seems to me that most of the deadly delay is caused by shock and fear more than anything else.

Feel free to provide me a study where they actually conducted scientifically rigorous tests in public and not just a few guys in a test room. I'd like to see the actual percentage of failures to assist and I'd like to see evidence where this device helps at all. For all we know it could hinder matters, though I would suspect not.

<comment><USER2> Then perhaps you need only read my comment. I typed the exact words "It's not a fact that no one helps". I have no interest in providing scientifically rigorous studies for you, I was only helping you see where the GP was probably coming from.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Swating-as-a-service

</comment><comment><USER21> Here's the link to their YouTube video since the site seems to be down: [https://www.youtube.com/watch?v=YuaCBK1spjU](https://www.youtube.com/watch?v=YuaCBK1spjU)</comment>


Ask HN: How many trees do I need to plant to balance my existence? - <AUTHOR> How many trees do I need to plant to negate my entire carbon footprint? <comment><USER2> Depends on where you live, and what sort of lifestyle. Americans make up ~4% of the world population, yet generate ~25% of the world's waste. One American consumes as much energy as ~370 Ethiopians. If every human on the planet lived like Americans, we would need over 4 Earths to sustain us. The generally accepted number you are looking for (for the average American) is about 40. I'm American, and I plant trees whenever I can.

</comment><comment><USER3> According to: The University of Michigan and NC state

The average American's footprint is 21 metric tons a year. The average tree absorbs 21 kg a year.

That makes it a ball park of 1000 trees.

</comment><comment><USER4> If you mean your existence as a living creature, I believe that you are already as carbon neutral as a tree is.</comment>


Procedural Heightmap Terrain Generation - <AUTHOR> https://www.seedofandromeda.com/blogs/58-procedural-heightmap-terrain-generation

<comment><USER2> This looks very good on the micro level, but not so much on the macro level ("blobby", in the author's own words). Part of what's needed is something that at least somewhat emulates plate tectonics and other real geological processes - not well enough for simulation purposes, but well enough to get things to look right to a human viewer.

This is a nice description of the manual version of the process (in the context of RPG setting design): [http://www.giantitp.com/articles/xO3dVM8EDKJPlKxmVoG.html](http://www.giantitp.com/articles/xO3dVM8EDKJPlKxmVoG.html)

<comment><USER3> To add to that list of references[1]. This example is particularly good in terms of believability - it does a good job at hiding the procedural origins and is really believable.

[1]: [http://experilous.com/1/blog/post/procedural-planet- generati...](http://experilous.com/1/blog/post/procedural-planet-generation)

</comment></comment><comment><USER4> There are a lot of helpful blogs / pages to get started, but non (that I could find) teach about perfecting the result. Are there any? From the end result here to a real scenery like [https://www.seedofandromeda.com/assets/images/blogs/rockies....](https://www.seedofandromeda.com/assets/images/blogs/rockies.jpg) seems quite far off.

</comment><comment><USER5> Nice detailed article.

There is also some interesting information about making quadtree-based quad spheres ([https://en.wikipedia.org/wiki/Quadrilateralized_spherical_cu...](https://en.wikipedia.org/wiki/Quadrilateralized_spherical_cube)) in this presentation about the making of Kerbal Space Program, at 30min 40s: [https://www.youtube.com/watch?v=mXTxQko- JH0](https://www.youtube.com/watch?v=mXTxQko-JH0) (the whole thing is worth the watch).

</comment><comment><USER6> This is a great introduction to procedural planet generation.

There's only so far you can go with this tactic. Instead of a high-res LOD height-map built with the same old functions, I'd really love to see a low-res off-line calculated world with overhangs, erosion effects, impact crater, and other crazy structures.

</comment><comment><USER7> I've been working on a version of this (almost the same techniques described in this post) for a game I'm working on. The internets has loads of tutorials on how to do this sort of thing - there was a paper published describing these techniques from 2011). Pretty cool stuff.</comment>


Have people started receiving their YC invitations for S15? - <AUTHOR>

<comment><USER2> Not yet. So nervous!

</comment><comment><AUTHOR> On twitter they told 6 pm PDT

<comment><USER3> gotta link for that by chance? I dont see anything since April 6th. or was it direct to you?

</comment></comment><comment><AUTHOR> Does anyone get any letter from ycombinator?Today is 10.04

</comment><comment><USER3> not yet</comment>


Finding freelance work the brute force way - <AUTHOR> http://happykoalas.com/blog/2012/03/finding-freelance-work-the-brute-force-way/

<comment><USER2> After having one of those down times a few months ago I've decided to make sure I did at least some new leads searching every day.

I also make sure I do at least 4 billable hours a day of work.

It helped and I now have at least 2 months work of work already lined up.

</comment><comment><USER3> Great stuff. I always wonder what it's like when freelancers do this.</comment>


In medicine, the good old days had their dark side too - <AUTHOR> https://www.theguardian.com/commentisfree/2017/nov/24/prescription-dejected-doctors-stop-hark-back-to-golden-age?CMP=Share_iOSApp_Other <comment><USER2> > Meanwhile, in 1869 an American medical publication called medicine "the most > despised of all the professions" and advised undergraduates: "Don't study > medicine: anyone can be a doctor." In 1913 the American Medical Association > estimated that no more than 10% of physicians were able to earn a > comfortable living.

1869... 1913... These years were not high-points in the development of medicine. Bloodletting was a standard treatment until at least 1850. The first wonder-drug, Asprin, was over-used in 1913.

<comment><AUTHOR> I'd argue modern medicine started with a) hygiene and b) vaccination and c) penicillin/antibiotics. So somewhere in the 1930/40s. From this time on going to a hospital/doctor was not significantly increasing your mortality chance anymore, which you would only do if you'd die anyway.</comment></comment>


Internal USPS Documents Outline Plans to Hobble Mail Sorting - <AUTHOR> https://www.vice.com/en_us/article/pkyv4k/internal-usps-documents-outline-plans-to-hobble-mail-sorting <comment><USER2> Even if this is not about the elections it is straight out of the "how to privatise public services" playbook. Gut and underfund public services, once people start getting annoyed, point to the service and say "the government can't run services well, private companies are much more efficient." open the market for private corporations, that often don't have to fulfil the same requirements (e.g. deliveries in rural areas...). The private corporations will quickly increase prices while reducing services.

<comment><USER3> I mean, "government can't run services well" is probably overly simplistic and incorrect.

But what if we replaced it with the following: "an extremely politicized government can't run services well".

Is that a controversial statement? And if it isn't, doesn't that suggest that you don't want an extremely polarized/politicized government running extremely critical infrastructure?

> The private corporations will quickly increase prices while reducing > services.

This is fairly simplistic, as we know that not to be the case for the vast majority of private services we use today. Yes, there exists conditions where this is true (monopolies), but it's true less often than the above statement that "politicized government can't run services well".

<comment><USER4> The postal service predates the US government and has been running since 1775 (Benjamin Franklin first postmaster general). It was cash-flow positive until it was sabotaged by Republicans, who banned it from raising prices above inflation ([https://en.wikipedia.org/wiki/Postal_Accountability_and_Enha...](https://en.wikipedia.org/wiki/Postal_Accountability_and_Enhancement_Act)) while simultaneously requiring it to spend $54 billion to prefund pension benefits for the next 50 years.

So if you want to know why they're having monetary problems, look no further.

>"an extremely politicized government can't run services well"

The Republicans normally make this a truism by sabotaging government programs. With the exception of the military, everything else gets squeezed and forced to justify their budget requests, but hardly anyone ever says "you want to raise the DoD budget by $100 billion? HOW ARE WE GONNA PAY FOR THAT?" Notice how if you propose $75 billion for tuition free college, GOP spokespeople are all over the media raising questions about funding mechanisms.

The USPS has been a reliable actor for 245 years. Its infrastructure, like electricity, or roads, and should not be subject to "we should run this like a for profit business" concerns.

<comment><USER3> > The Republicans normally make this a truism by sabotaging government > programs

Yes, but you have to contend with the reality that you are participating in the same government as they are. It's like constantly insisting on sharing a pool with a kid that constantly insists on peeing in it, with no real way to kick that kid out. It's a byproduct of the polity in which we are participating, and as long as a democratically elected government consists of people who don't agree with you (read: polarized / corrupt), the services they run will have problems, as we are seeing.

> The USPS has been a reliable actor for 245 years. Its infrastructure, like > electricity, or roads, and should not be subject to "we should run this like > a for profit business" concerns.

Just because the USPS has been reliable in the past, doesn't mean that it's structurally set up to be reliable forever. It could also just mean that we weren't as polarized about how the USPS should function in the past, and we are now. As long as that continues to be the case, the USPS will be a sub- optimal agency. In contrast, how many goods & services provided by the private sector have this problem? If a corporation is self-sabotaging, it will die, and be replaced by another corporation. That doesn't appear to be the case with a polarized government.

Also, the allergic reaction to privatization / profits strikes me as just as (if not more) reactionary than the right-wing allergic reaction to public services. The private sector is involved in reliably providing us with critical goods & services like food, clothing, furniture, housing (in markets without onerous zoning), transportation, information technology, e-mail, cloud computing, electronics, etc etc etc. All of those things gotten cheaper over time (even relative to inflation), have seen an increase in investment over time, and an increase in quality over time. The profit motive is just the incentive for people to provide goods & services for others, as efficiently as possible. It's not a silver bullet, as monopolies can lead to rent seeking, but to suggest that the private sector is always and unquestionably "bad" is not a serious opinion worth engaging with. Importantly, the public sector is also not a silver bullet, as we are seeing.

Also, privatized postal services aren't novel either. Singapore's postal service, SingPost, is a publicly traded company. The UK's postal service, Royal Mail, is a publicly traded limited company. Germany's postal service, Deutsche Post AG, is a publicly traded company. Japan's postal service, Japan Post, is a publicly traded company.

Your issue is that you participate in a government where your fellow citizens are voting to sabotage the public services. From where I sit, the private sector strikes me as _strictly_ better than a self-sabotaging public sector that's governed by Republican politicians every 4-8 years. Either we continue to swim in a pee-filled pool, or we figure out another swimming arrangement.

<comment><USER5> What specific problems will privatization solve? Profitability? Efficiency? Something else? Which of your problems cannot be fixed by changes to the current system?

I'm asking this seriously. I'm just trying to understand what problems you believe privatization will fix.

<comment><USER3> Easy: privatization of a thing almost always decouples its administration and operation from politics. Private corporations are almost never self-sabotaging because they can't afford to be, and when they are, they quickly die and get replaced. OTOH having a representative democracy appoint and appropriate the governance of our services is well and good when people actually _want_ that. Unfortunately, whoever is in power has reliably flip flopped back and forth every 4-8 years, and as you might have noticed, people don't always vote for the "best" people. Privatization allows the postal service to run and be funded totally independent of partisan politics. Amazon provides its services cheaply and reliably _because_ it doesn't have to worry about who is in power every 8 years.

And privatization isn't some new scary boogeyman, it's been implemented in a handful of healthy and prosperous nations (Germany, Japan, Singapore, the UK).

> Which of your problems cannot be fixed by changes to the current system?

I'd ask you how you'd even go about "changing the system" when you're participating in that system with people that violently disagree with you. This is the logical endpoint of "democratic planning", where people that disagree with you vote for a self-sabotaging system. Nobody wins, everyone is equally unhappy.

<comment><USER5> I asked for specific problems and you provided none other than a vague statement about politics. What _specific_ problems do you believe privatization would solve? Would delivery costs go down? Would speed increase? Why? Would a private corporation held to the same rules and standards (e.g. the same pension obligations, contracts, etc.) function better? Why? If what you're saying (as I believe) that the new corporation would run under different rules and standards, then why could those same changes not be made to the current system?

> I'd ask you how you'd even go about "changing the system" when you're > participating in that system with people that violently disagree with you.

What does this statement even mean? Literally every law passed, ever action taken by the government, etc. changes the current system. You're acting like "changing the system" is impossible when it's clearly not. Hell, _privatization_ is even a "change of the system". Just like partial privatization is. Just like changes the the postal system are.

Please help me understand your thinking.

<comment><USER3> > What _specific_ problems do you believe privatization would solve?

For starters, unlike what we're seeing today, mail-in ballots would be processed without issue because there isn't a political incentive to hobble it. As long as there is a market need to reliably deliver ballots, privatized carriers will process them.

> Would delivery costs go down? Why?

They certainly could. The private sector is often better at allocating resources than the public sector, because of the superior efficiency of competition and the pricing system as compared to central planning.

I can give you a couple concrete examples.

NASA's planned SLS moon mission is a bit of a disaster — way over budget and way behind schedule. Because the boosters aren't reusable, each launch is expected to cost $1B (with a B) dollars — EACH launch! Meanwhile SpaceX's target cost-per-launch is $50M.

In Washington DC, the average government school spending per student is $31,280. The average private school tuition in DC is $23,959.

Finally, privatization would allow for greater funding (through greater investment). Today, the funding of USPS is limited by the political process.

> Literally every law passed, every action taken by the government, etc > changes the current system

That's not what I mean by "changing the system". What I'm saying is that as long as the postal service is tightly coupled to the political process by being "government run", and the government in question is polarized as to whether it should even exist, then it will produce sub-par outcomes relative to its private counterparts. There is literally no law you can pass to change this save for changing who is allowed to vote/participate in the government, or by decreasing a public agency's democratic accountability. Those all require Constitutional changes ("changes to the system") which are almost impossible in the current climate.

<comment><USER4> Delivery costs might go down at the expense of a large number of rural Americans unable to get mail at all.

Universal service has a cost and like roads, those costs may not be economical everywhere but none the less necessary (eg clean water, electricity, education, etc for all Americans regardless of which town they live in)

<comment><USER3> > Delivery costs might go down at the expense of a large number of rural > Americans unable to get mail at all

This is conjecture, at best. If there's a market need for something, it will be met at the fair market value for that thing — provided there are no exogenic barriers like regulation or endogenic barriers like monopolies/cartels.

At best, you can probably make the case that rural areas will no longer receive _subsidized_ mail service, but it's worth asking ourselves if that's even a desirable goal. And even if it is, it's worth considering if nationalization is the best way to achieve subsidized rural delivery, or if direct subsidy or a UBI is the better way to achieve that, or perhaps even regulating the private carriers just like for eg food quality is regulated by the FDA.

I'll also add that the rural population is overwhelmingly the set of people who are aggressively voting for privatization.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> How are there no protests about this? Why are people not scared of the threat to democracy? Sure I am drawing a line from hobbling USPS to democracy, but it seems like a very clear one.

Sorry for bringing something political in nature to HN. Before this I would never think of it. But all tech progress relies on a sound democracy.

<comment><USER7> Most are mis or uninformed on the impact this will have or simply support the current administration regardless. Trump has held about 40% approval even under impeachment.</comment></comment>


Eternal September - <AUTHOR> http://en.wikipedia.org/wiki/Eternal_September <comment><AUTHOR> I find that this phenomenon hits every online community I have been a part of sooner or later, and HN does not seem to be immune to it. Every community that forms online becomes enamored with the idea of growth. After all, the larger the community, the more an individual's voice can carry. The core users love seeing more and more people reading what they have to say.

However, at some point the core of the community can no longer maintain the values. The site operators have to decide between micro-managing by creating new rules for every social situation and keeping to the old standards that everyone is supposed to know. The core users then move on, since their view of the community is tainted, and eventually the influx of new users swallows the community.

In the end the remaining members of the community recognize that it has become an echo chamber and no longer fosters good discussion. This is when the community implodes.</comment>


Why Won't My Child Show Any Work? - <AUTHOR> https://artofproblemsolving.com/news/articles/why-wont-my-child-show-any-work <comment><USER2> I agree with the general point of this article. But it's interesting that it seems to leave out one of the main reasons to show your work when in SCHOOL -- partial credit. If a student goes off course during an early step in a multi- step problem, the teacher will often give credit for steps performed correctly after the incorrect step (in the US--not sure about other countries). If the student doesn't shown their work, they will receive 0/40 points for a wrong answer, instead of, say, 30/40.

</comment><comment><USER3> Just re-compile the child with -O0, and step through it in gdb.

<comment><USER4> What if he lost the source?

</comment></comment><comment><USER5> Weird. The reason Britain moved heavily away from trying to teach kids to "quickly" do mental arithmetic without workings is that that's almost completely useless. A machine will always be faster, more reliable and readily available. "Teach children to be good at mental arithmetic" is a non-goal in the 21st century.

The goal instead is to get them to understand what's actually going on - why 7 x 9 = 63 rather than merely the fact that it is, and the workings help assess that's achieved.

This really annoys parents, a parent who has maybe a B in GCSE maths from 1990 looks at their kid's homework and is appalled, why is my capable eight year old not jumping from 17 x 9 straight to 153 without all this nonsense?

Well, because we taught them to think about the number line, which means whereas for you exponentiation was a struggle and the hyper operators a mystery it will all make sense to these kids later because it's the same trick they already learned only more so.

</comment><comment><USER6> as a student who didn't understand why I was getting it right more often when I wasn't showing my work, the assignment of credit based on this frustrated my education immensely.

figured out, a decade later, doing remedial math to get into calculus, that i was just a touch dyslexic. it had made me vulnerable to some seemingly algorithmic multiple-choice test trickery in their remedial math program, and explained where the requirements to show work had helped me to develop the wrong answer, so many times in high school.

understanding this and being able to give myself a pass where i could expect to transpose some variables .. i was actually sort-of talented and more importantly, i actually enjoyed it ..</comment>