Android account passwords are stored on disk in plain text - <AUTHOR> http://code.google.com/p/android/issues/detail?id=10809 <comment><USER2> Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security.

This bug report was filed by someone who doesn't understand that _obfuscating_ a password is different from _encrypting_ it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device.

For a longer explanation: <http://developer.pidgin.im/wiki/PlainTextPasswords>

That said, one defense-in-depth mechanism that I would like to see on portable devices like phones would be to have an encrypted storage area that is only accessible after typing a passphrase at boot time (the key derived from this passphrase should be stored in volatile memory only). That way if the device is shut down, this secure area would _not_ be decryptable.

Edit: I am defending the mail _application_ because from its viewpoint it is fine to use cleartext passwords. On the other hand the _OS_ should provide a secure storage area as described in my previous paragraph.

<comment><USER3> Actually, they are _not_ perfectly fine in this case. They should take the Apple approach and use PBKDF2 to derive a key from the PIN/passphrase, if one is set, then use that to encrypt the database. Anything less is simply not OK.

Edit: You should also use some sort of hardware ID in addition to the PIN/passphrase, otherwise it's trivial to distribute a database of, say, all the <=7-digit PINs.

<comment><USER2> I guess we agree (see my edit).

By "hardware ID", you mean a unique salt.

Unfortunately even with a unique salt, 7-digit PINs are not strong enough if, from a theoretical viewpoint, we assume they can be bruteforced at a few thousand per second.

Does Apple IOS really use PBKDF2? The Fraunhofer paper does not mention it. [http://sit.sit.fraunhofer.de/studies/en/sc-iphone- passwords....](http://sit.sit.fraunhofer.de/studies/en/sc-iphone- passwords.pdf)

<comment><USER4> If you use a TPM to store your device encryption key, a PIN combination should be fine. Of course, by definition that requires hardware support.

I work in Android security in particular for a manufacturer. We came across the unencrypted email pass ourselves, but decided it was fine for two reasons:

1) If you don't get rooted, there should be no way to pull from /data/data/* in the first place.

2) With filesystem encryption turned on, you essentially get the benefit of encrypting that pass along with everything else.

<comment><USER3> A TPM is obviously the best solution here, on all counts, but it's not possible to put one into every phone that's already been sold, so clearly we need a software mechanism that at least _helps_.

As it stands, if an attacker gains root on your device (which could be locally, via a malicious app running a local root, or via a malicious page exploiting a browser bug and then escalating with a local root), they have the keys to the castle. This is true whether you have filesystem encryption on or not.

Leaving these in plaintext is equivalent to storing plaintext passwords in /etc/shadow; yes, only root can access it, but getting root is by no means impossible. If an attacker does get access to it, it shouldn't be an immediate game-over for your passwords.

<comment><AUTHOR> To amplify that a bit, in terms of accessing the file system, it's a pretty common security assumption that physical access and root access are equivalent. Since my phone is the system where I trust physical access the _least_ , by extension it's the one where I'd most want a security model that doesn't assume that one can't read the file system the most.

For my purposes, the chances of an attacker having physical access to my systems in a rack in a major data center approaches 0%, whereas the chances of an an unauthorized party at some point having access to my phone approaches 100%.

<comment><USER5> There is certainly some benefit to encrypting removable flash. However, for non-removable flash, the speed at which normal attackers could pull items off of internal flash without the device running should be relatively long. I'm not totally sure what the limitations are with adb but if it's using Honeycomb style encryption, if you have permission to read the file it's going to be automatically decrypted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> It's nice to bring interesting bugs to light, but I hate how posting links to bugs always results in a pile on of useless comments. It evens says "Each comment triggers notification emails. So, please do not post "+1 Me too!". Instead, click the star icon." next to the comment box, but people apparently think things like "please try to fix it , security on mobile devices need to be more powerful" are worth emailing 500+ people about.

In a sense, it may be Google Code's fault; they shouldn't call them "comments". It's the same terminology that is used on YouTube, HN, and other such sites where people who aren't involved are free to weigh in with whatever they say (albeit with moderation and voting). It should probably be called a "Status update" or some such, as that would give a more accurate impression of what that box is for.

<comment><USER7> I completely don't understand these public bug tracking systems that turn into YouTube threads, for all intents and purposes. How does any working engineer get anything done like that?

<comment><USER8> They don't.

Issue 7589: Android dev team ignores its own bugtracker <http://code.google.com/p/android/issues/detail?id=7589>

</comment></comment></comment><comment><AUTHOR> I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored.

It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since I carry my phone around everywhere (and have a bad habit of losing them – hence waiting for ages to get a smart phone until they dropped below the price of "this won't hurt too much if I lose it"). My assumption had been that since I set a password to unlock the screen (and have a SIM card password) that it'd be tied into a keychain mechanism that unlocked access to an encrypted password store.

While normal apps can't read said file (unless the phone is rooted), it's still a pretty huge vector for identity theft making it rather trivial to extract passwords from a lost / stolen phone.

<comment><USER9> No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not)

additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

<comment><USER3> > No. No it's not. please tell me how someone is going to get those passwords > without root. (hint, they're not)

By running an exploit to get up to root, or by attacking it physically. Neither of these are particularly difficult or unlikely.

> additionally, how is this different than NY laptop with Pidgin accounts, my > IMAP client, Firefox's stored passwords, etc.

It's not, if you're saving passwords without a master key. If you're using, say, 1Password, then your master key has to be compromised to get the passwords.

<comment><USER9> >By running an exploit to get up to root, or by attacking it physically. Neither of these are particularly difficult or unlikely.

Keeping in mind that root-escalation bugs are back ported and shipped to consumers quickly and often silently, I find that claim to be a bit bold. In fact, the popular root escalation of choice these days is very specific and must be used in conjuncture with ADB. Rogue software is going to have a hellofa time just accessing this file.

>If you're using, say, 1Password, then your master key has to be compromised to get the passwords.

I'm not sure we're talking about the same thing, or you missed my point: if I teach Pidgin how to login to my IM accounts (or Thunderbird, IMAP; Email.apk, my POP server; my Facebook notifier, my FB account credentials)... then those applications HAVE to cache those passwords in plaintext. Unless you're so security conscious that you type them in every time you launch your IM client. (Props if you do, but that's the scenario I'm discussing. I'm just taken aback by the pure ignorance exuded in the linked bug report)

Basically, even with this "vulnerability" that absolutely can't be avoided in many cases... Android is still better off than your laptop, barring an unlikely root escalation bug (remembering of course Google's stewardship of the Market and them taking down applications using such exploits)

edit: I have no problem with the notion of using oAuth to mitigate or eliminate this problem. Unfortunately, as a user or even a third party developer, that's not really a decision I get to make.

</comment></comment></comment></comment><comment><USER10> Well, what's the right way to encrypt this kind of stuff?

Even if you're doing some kind of public-key cryptography, you're still going to have to store the private key at some location on the device, to decrypt the password for IMAP/SMTP/whatever authentication.

Is there some foolproof way to do this that I'm not aware of? How are you supposed to store a password for future retrieval, not in plain text or basically plain text (encrypted but with the key on the device)?

<comment><USER3> You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.

<comment><USER10> Right, but even if you did that, wouldn't you still have to store that key somewhere?

Also, hi from downstairs!

<comment><USER11> Couldn't you have something like:

key = hash(hardware serial number, user password)

And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?

<comment><USER12> If you do that, I'd imagine that the phone would not be able to pull updates from those services while the phone is locked.

<comment><USER5> If you're a registered Apple developer, it's worth watching how they're dealing with this in iOS 5.

</comment></comment></comment></comment></comment></comment><comment><USER13> The comments on this page are pure gold. So many people jumping on the bandwagon without a clue as to the actual security issues/solutions. Like this one:

      I personally think that delivering a quick update with MD5 encryption would be a fast patch for the moment.

<comment><USER14> This is another epic thread (dated and not as relevant now) that may be entertaining to you...

"Issue 6914: Make android use the GPU (if available) for UI and browsing."

"I agree with the common opinion here... It is very hard to pitch Android to someone who is not tech savy, simply because of the choppy and sluggish UI. This has also become the talk of the masses, most people who haven't even used Android say the following: "I've seen Android, its cool, but its not as smooth and stable as the iPhone." The iPhone's hardware fails a lot (I've exchanged my 3Gs twice in less than a year), it also freezes at times and drops calls, but what do people see and remember!? UI!! If android wishes to ever compete seriously with iOS, GPU acceleration is a must!

On a side note, who cares about the older phones!? they can keep being sluggish... There's less than a handful of Android phones that won't support GPU acceleration, there's more than 30 that do...

Conclusion: MAKE THIS A PRIORITY, its time to put the choppy UI days behind us, this year is going to bring amazing hardware to the table, and the new iPhone is good, but not THAT good... As it stands, all iOS has on Android is a "smoother experience", why hesitate to fix it!?"

<http://code.google.com/p/android/issues/detail?id=6914>

</comment></comment><comment><USER15> The title should probably mention that it only effects email. Comment #48 explains the reasoning behind it, and frankly seems perfectly reasonable.

<comment><USER16> The problem there is email is generally used as an authentication authority for most online services, and a stolen phone hands over exactly what organised criminal outfits need to begin start real indentity theft.

Having done some work with financial services this was a huge problem, as soon as an email acocunt is compromised hackers used automatic services to reset every password they can find... because the email was the point of authority.

Because of this the product we designed had a two point authority process. But alas the second point was a text message sent to the stored cellphone number, which would mean in this case all your data is pwned.

I see most banks I deal with now have moved to phone call only authority checks. But in all honest once you have access to a decent a email account you can harvest the needed information quickly. My current banks just wants name, access code (printed on my card FFS), birthday, mailing address and bingo I'm in.

</comment></comment><comment><USER17> I am reminded of the Android "reboot" bug where _every_ keystroke was sent to the foreground application _and_ an invisible terminal running as root. Try sending a text message with the word "reboot" and your phone would instantly reboot!

<http://www.zdnet.com/blog/burnette/worst-bug-ever/680>

<comment><USER18> That was a bug, this is a design decision.

</comment></comment><comment><USER19> This only affects email accounts as far as i can see. It does not affect gmail accounts though. Only emails where you have to use other protocols like POP3. Although i still believe it shouldn't be plaintext, but it's not nearly as bad as it seems.

</comment><comment><USER20> I'm not security expert at all, so I have a question.

If I lock my phone using pin does it mean that my passwords and keys (mentioned in comment #48) are _not_ encrypted using pin+some phone HW ID?

Also does encrypting my passwords and keys using pin+some phone HW ID really solves the problem?

<comment><USER3> > If I lock my phone using pin does it mean that my passwords and keys > (mentioned in comment #48) are not encrypted using pin+some phone HW ID?

Yes.

> Also does encrypting my passwords and keys using pin+some phone HW ID really > solves the problem?

Yes. No. Sort of. It really depends on what you're trying to protect against. It's absolutely not a panacea, but it will certainly make most attacks against it, where you solely have the DB and any relevant IDs, _significantly_ more expensive. However, it won't help if, say, you can escalate to root from an app (or remotely!) and backdoor the PIN entry.

<comment><USER21> A PIN short enough for almost any user to be bothered entering it to unlock the phone is not going to be long enough to resist brute force attacks, even with a 10,000x PBKDF2 work factor.

</comment></comment></comment><comment><USER22> This issue should have been closed with the release of Android 3.0, which introduced full disk encryption. It is no longer an issue on the latest Android devices (albeit being limited to tablets), and will soon b available on phones with the release of Android 4.0.

</comment><comment><USER23> How long until a former SNL comedian is holding Senate hearings about this major violation of privacy?

</comment><comment><USER24> this seems like a very good reason for Google to adopt application-specific passwords. Oh, wait...

</comment><comment><USER25> Its changed in Android 3.0..

Basically they use dm_crypt from Linux Kernel..everything gets encrypted..

see: [http://source.android.com/tech/encryption/android_crypto_imp...](http://source.android.com/tech/encryption/android_crypto_implementation.html)

Very interesting..full file system encryption

</comment><comment><USER26> A general question about Sqlite databases in Android and iPhones... since an application can read and write to it.. can't they read records written by other applications as well? Isn't this a security risk if you install an app that tries to look for passwords in your Sqlite DB?

</comment><comment><USER27> Use appropriate security.

</comment><comment><USER28> please fix! </me ducks>

<comment><USER29> No doubt you'll get the standard reply "Its open source the community should fix this".

<comment><USER30> The person who wants the software fixed should fix it. This isn't a cop-out, it's simple economics. If you want a pony, go buy a pony. Otherwise, STFU.

<comment><USER29> If I buy a pony I expect to be a pony, not to be a donkey.

Its definitely a total cop out because no one is taking responsibility on the matter, bugs are being ignored, and Google has made a history so far of passing blame and not addressing issues with Android.

Lastly thats a moronic statement "The person who wants the software fixed should fix it". Android tends to attract lower income people who tend not to be IT orientated. If you told any of these peoples the dangers of identity theft they would want this changed, but its out of there capability to address. TBH I don't know how you can even have such a stupid stance.

<comment><USER30> Sure, Google should fix it. But they're not. So now what?

One of my main problems with people in general is that they want to assign blame, not solve problems. So, okay, blame Google. But that's not getting you closer to a solution. Typing in code to fix the problem is the solution.

Finally, to address one point:

 _If I buy a pony I expect to be a pony, not to be a donkey._

That's reasonable, but this is software. You know all those CAPITAL LETTERS rambling on about NO WARRANTY. That's what this is. There's a defect and they don't have to fix it because you signed away all your rights to get the software. Vote with your wallet: only buy software that's proved correct.

<comment><USER31> > Vote with your wallet: only buy software that's proved correct.

For all intents and purposes, people in last 50 years proved, that they do not want correct software. In many cases, they can't even describe what correct software should do. They want cheap (= keyword!) software, that kinda-sorta is fit for intended purpose.</comment></comment></comment></comment></comment></comment>


How to Name your Web App - <AUTHOR> http://www.contrast.ie/blog/great-rules-for-choosing-a-name/

<comment><USER2> My reply Eoghan :) <http://www.toddle.com/stuff/rules-for-choosing-a-name/>

</comment><comment><USER3> 7?</comment>


Tidal Cycles: A Haskell DSL for Live Coding with SuperCollider - <AUTHOR> https://tidalcycles.org/index.php/Welcome <comment><USER2> For folks w/ ruby experience, or little programming experience all together, Sonic Pi is a really nice program to learn w/.</comment>


A simple idea: strip CO2 from the air and use it to produce fuel - <AUTHOR> https://www.theguardian.com/environment/2018/feb/04/carbon-emissions-negative-emissions-technologies-capture-storage-bill-gates <comment><USER2> Dupe [https://news.ycombinator.com/item?id=16302416](https://news.ycombinator.com/item?id=16302416)</comment>


We built a giant pixel wall for fun, but what we learnt went a lot further - <AUTHOR> https://www.solidstategroup.com/2017/03/03/2017/we-built-a-giant-pixel-wall-for-fun-but-what-we-learnt-went-a-lot-further/ <comment><USER2> neat!</comment>


Ask HN: What are the best blogs to read for growing a startup/company? - <AUTHOR> <comment><USER2> I find Paul Graham's essays & Brian Balfour's essays very insightful.

PG --> [http://paulgraham.com/articles.html](http://paulgraham.com/articles.html) BB --> [https://brianbalfour.com/essays/](https://brianbalfour.com/essays/)

I also follow YCombinator's podcast & Startup School Videos to glean what anecdotes I can find on getting users & finding product-market fit. [[https://www.youtube.com/channel/UCcefcZRL2oaA_uBNeo5UOWg](https://www.youtube.com/channel/UCcefcZRL2oaA_uBNeo5UOWg)]

<comment><AUTHOR> Thanks so much

</comment></comment><comment><USER3> In context, does not answer question. You might be interested in: IndieHackers [[https://www.indiehackers.com](https://www.indiehackers.com)]

</comment><comment> github-cat [https://www.pxlet.com](https://www.pxlet.com) might be one option to get updated.</comment>


Why Gowalla Tools Has Gone on Indefinite Hiatus - <AUTHOR> http://gowallatools.com/api/

<comment><USER2> tldr: gowalla changes api too much, should implement api versioning</comment>


CS231n: 2017 Stanford lecture videos released - <AUTHOR> https://www.youtube.com/playlist?list=PL3FW7Lu3i5JvHM8ljYj-zLfQRF3EO8sYv <comment><AUTHOR> syllabus, notes, schedule, etc can be found here [http://cs231n.stanford.edu/index.html](http://cs231n.stanford.edu/index.html)</comment>


A Bigger Danger: Scientists Build Case for Undersea Plumes - <AUTHOR> http://www.nytimes.com/2010/05/29/science/earth/29plume.html?hp

<comment><USER2> Wow, thanks for this. I'll see if I can figure this out.

</comment><comment><USER3> Interesting... <http://en.wikipedia.org/wiki/Microemulsion></comment>


The Nobel Prize in Physics 2011 - <AUTHOR> http://www.nobelprize.org/nobel_prizes/physics/laureates/2011/ <comment><USER3> This is an excellent choice, and (of course) congratulations to the recipients. Their work really did add an extremely significant chunk to our understanding of the universe. And I think it has now been long enough to confirm that their observations really were accurate.

It was also, I think, the first scientific paper I actually read -- I did an assignment on it as a callow young undergraduate, and I still remember sitting in Fisher library poring through the text copy of the journal and trying to figure out what was going on.

Since the page doesn't actually explain the work, I'll have a go. I'm doing this from memory, so someone correct me if I get something wrong. Basically, they set out to study how the distance of a receding galaxy relates to its redshift (ie the speed at which it's receding). Up to this point we could easily measure the redshift of a galaxy, but not its actual distance.

How do you measure the distance to a galaxy? What they did was to look for Type 1a supernovae. This is a particular subclass of supernovae which always have the same luminosity, because they occur when a previously-stable neutron star goes _just_ over the mass limit and becomes unstable. There's a sufficient number of these going off in the universe in any given week that they make a good "standard candle", so by measuring their brightness you can estimate their distance.

What these guys found was extremely surprising: the relationship between distance and speed was _not_ what we would have expected based on a universe which has been evolving only under the influence of gravity since its birth -- there was an extra term which appears to be accelerating the expansion of the universe over time.

And that, right there, is an amazing fact about the universe which nobody knew fifteen years ago.

<comment><USER4> Hugh is right. A few more details:

SNIa are not _quite_ standard candles, not good enough to by themselves make this measurement. However, experimentally it has been observed that their brightness correlates with how fast they brighten and then fade. This relationship, which is not well understood theoretically, makes it possible to measure how fast they brighten and fade and use this to know how bright they are. The difference between an accelerating and a decelerating universe is too small to be seen without this correction.

Second, what these guys did that no one had done before was to figure out how to _find_ the supernovae. Up until then, the way it was generally done was that someone (generally an amateur astronomer) would notice a bright dot in some galaxy and report it. Then the professional astronomers would use large telescopes to observe it in detail and follow it as it brightened and faded. However, this only works for nearby galaxies that amateurs look at.

The problem is that professional telescopes are scheduled months in advance, but you of course can't _know_ that there will be a SN in a few months time so you can apply for telescope time. What they did was sort of the opposite - <USER2> surveying a large number of galaxies with a smallish telescope they would be guaranteed to find a number of actual supernovae. They wouldn't know exactly where, of course, but with a large enough number of surveyed galaxies there would always be a few in _some_ galaxies. They managed to convince the time allocation committees on the large telescopes that it was not a waste of telescope time to give them the time just based on the expectation that they would have something to look at. (I think this was the first time where telescope time was awarded to look at something that would happen in the future... ;-) With this method in place, the number of observed high-redshift supernovae skyrocketed.

</comment></comment><comment><USER5> Robert Kirshner advised both Schmidt and Riess at Harvard and was an integral member of the High-Z Search Team. His book The Extravagant Universe is worth reading if you are interested in the topic. [http://www.amazon.com/dp/069111742X/?tag=googhydr-20&hva...](http://www.amazon.com/dp/069111742X/?tag=googhydr-20&hvadid=8524560924&ref=pd_sl_9fhdfr287q_b) Many thought that Kirshner himself would get the Nobel for his work in the field, and I am sure it is a little bitter-sweet (if mostly sweet) for his team members to be among the winners.

</comment><comment><USER6> Up until the '50s, there were mostly single winners; now, there hasn't been a single winner since 1992.

<comment><USER7> Martin Rees just commented on that: "I think, however, that this is one of the increasingly frequent instances when the Nobel Committee is damagingly constrained by its tradition that a prize can't be shared between more than three individuals. The key papers recognised by this award were authored by two groups, each containing a dozen or so scientists. It would have been fairer, and would send a less distorted message about how this kind of science is actually done, if the award had been made collectively to all members of the two groups."

More here: [http://www.guardian.co.uk/science/blog/2011/oct/04/nobel- pri...](http://www.guardian.co.uk/science/blog/2011/oct/04/nobel-prize- physics)

<comment><USER3> Yeah, but once you relax that rule you'll wind up devaluing, pretty quickly, the Nobel Prize. If every one of those 24 authors can equally claim to be a Nobel Prize winner on their CVs, then you've just significantly increased the number of living Nobel laureates in physics.

The real problem would arise a few years down the road, though, next time the Nobel gets awarded for some high-energy experimental work (discovery of the Higgs boson?). Those papers can typically have _hundreds_ of authors, listing everyone involved with the project (the most extreme example I've seen has 2512 authors). Now all of a sudden pretty much _everyone_ in high-energy physics is a Nobel laureate, and the _proper_ Nobel laureates are a tiny minority.

I think the constraint that no more than three people can share it is fair. It just means the committee needs to look into it and find out who the _real_ brains behind the operation were.

<comment><USER4> _It just means the committee needs to look into it and find out who the real brains behind the operation were._

But the problem is that this is _impossible_. Who are the real brains? The person who had the idea, but didn't do anything about it? The person who organized the project and got funding for it but didn't do any real science? The person who build the hardware without which nothing would have been possible? The person who wrote the software, without which nothing would have been possible? The person who wrote the paper that explained the results? The grad student who found a crucial error in the analysis without which the results would have been wrong?

In many (most?) fields of science these days, progress is made by huge projects. Clearly there are wide differences between how crucial different people are to the success of the project, but to cut it down to 1-3 "winners" to the detriment of everyone else hardly seems fair. It seems more reasonable to say that if there are 200 people on the paper that's awarded the prize, everyone is a 0.5% Nobel Laureate....

</comment></comment></comment></comment><comment> A-K Adam Riess! One of my friends took "Stars and the Universe" with him last semester here at Hopkins and really enjoyed the class (perhaps corroborating the claim that the most capable researchers tend to also be great educators).

<comment><USER8> Erm, at the risk of being (equally) trite, one data point doesn't corroborate anything except for the somewhat fluffy claim that some good researchers are also good educators.

</comment></comment><comment><USER9> So, can we put the oscillating universe theory to rest now?

<comment><USER3> Well, we can never fully bury a theory like that, but it's looking pretty unlikely.

</comment></comment><comment><USER10> The Nobel committee is awesome, since they can split a prize in three and still give one half to each winner. :)

<comment><USER11> "The Nobel Prize in Physics 2011 was awarded "for the discovery of the accelerating expansion of the Universe through observations of distant supernovae" with one half to Saul Perlmutter and the other half jointly to Brian P. Schmidt and Adam G. Riess."

Seems clear to me. Perlmutter gets 50%, Schmidt and Riess each get 25%.</comment></comment>


Jennifer Pawluck convicted in police graffiti case - <AUTHOR> http://www.cbc.ca/news/canada/montreal/jennifer-pawluck-convicted-in-police-graffiti-case-gets-suspended-sentence-1.3075207 <comment><USER2> Canada's free speech laws apparently aren't stellar. I guess cbc.ca should be given 18 months probation while prohibited from using Facebook or writing anything about the police, since they share the same image in the article.

<comment><USER3> Better lock up OP while you're at it.

<comment><AUTHOR> Don't I at least get a trial first?

</comment></comment></comment><comment><USER4> Article omits the fact that she added a caption to the photograph she shared that could easily be construed as a threat.

Peculiar that the article whitewashes this, where that same outlet routinely (as recently as this week) props up specious claims of harassment as a tactic to silence their political opponents.

<comment><AUTHOR> I was wondering what the untold story was. Do you have a reference on that?

It's _quite_ peculiar that CBC would exclude such a detail.

<comment><USER5> [http://montrealgazette.com/news/local-news/probation- communi...](http://montrealgazette.com/news/local-news/probation-community- service-for-woman-convicted-of-criminally-harassing-police-officer)

</comment></comment></comment><comment><AUTHOR> A _National Post_ (Canadian national conservative daily paper) article offers more context:

"'One cop, one bullet': Quebec woman convicted not for the graffiti she instagrammed, but the hashtag attached"

[http://news.nationalpost.com/news/canada/one-cop-one- bullet-...](http://news.nationalpost.com/news/canada/one-cop-one-bullet- quebec-woman-convicted-not-for-the-graffiti-she-instagrammed-but-the-hashtag- attached)

 _While critics in Quebec have charged she was arrested merely because of "a picture," the case hinged largely on the notes she attached to the posted image._

 _"On the photo there were links, or hashtags, with Ian Lafrenière's name written in different ways and allusions like ('All cops are bastards') and ('One cop, one bullet') to the point where, given the context, there was criminal harassment," prosecutor Josie Laplante said after the conviction._

</comment><comment><USER6> Scary to see how this is just a small step away from prohibiting any criticism of the police. I feel sorry for Canadians now, and hope that one day they can recover their freedoms.

<comment><USER7> This person has in fact been prohibited from criticizing the police.

<comment><USER8> Is tacitly calling for a specific persons murder "criticism"?

<comment><USER9> Regardless of what you feel about the original upload, the article does in fact claim that she is barred from criticism:

"Pawluck is also prohibited from posting anything about police or anyone associated with the judicial system."

<comment><USER8> Right, but isn't there precedent here wherein people guilty of a crime were forbidden from communicating with, or posting about their victim on social media? Just that in this case, the victim is the police force, and not some random individual.

<comment><USER7> No, I literally just meant: this person was forbidden by the government of Canada from criticizing the police. Apparently in any direct fashion, violent or not.

We don't even reach the question of whether the original imagery qualifies as "criticism".

<comment><USER8> Yes, and my point is that this is very similar to how, for example, convicted harassers aren't allowed to talk about their victims on social media, even if it isn't in a manner associated with their crime?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The most fascist part, out of a bunch of fascist parts:

> Pawluck is also prohibited from posting anything about police or anyone > associated with the judicial system.

<comment><USER11> My opinion of Canada just dropped a few points.

<comment><USER12> Start by reducing your opinion of Quebec where this case took place. It has a legal system inspired more by French law than by the English law used in other provinces.

French law permits such things as prosecution of libel of dead people which English law does not. There is really no concept like free expression in the English law sense (and most certainly not in the US constitutional sense).

I doubt this case would have played out the same way in any other province. No other province operates enforcement units to trap businesses using English in order to fine them for not using French or having French words smaller than English ones. (for a recap of that nonsense, start with [http://world.time.com/2013/04/08/quebecs-war-on-english- lang...](http://world.time.com/2013/04/08/quebecs-war-on-english-language- politics-intensify-in-canadian-province/))

<comment><USER13> _I doubt this case would have played out the same way in any other province._

That's because you don't know much about Canadian law. Pawluck was found guilty of Criminal Harassment, which is the same offence _ad mare usque ad mare_ , ou _d 'une mare à l'autre_, as we say over here. Criminal Code, section 264.

<comment><USER14> Google translate converts, "ad mare usque ad mare, ou d'une mare à l'autre," to "usque ad ad mare mare or a mare to another"

I'm wondering if someone could help us out a bit.

<comment><USER15> The first phrase is Latin. "From sea to sea." [https://en.wikipedia.org/wiki/A_Mari_Usque_Ad_Mare](https://en.wikipedia.org/wiki/A_Mari_Usque_Ad_Mare) The second is a (funny?) half-Latin half-French way of saying "From one sea to the other".

<comment><USER13> Explanation: [http://en.wikipedia.org/wiki/Rhinoceros_Party_of_Canada_(196...](http://en.wikipedia.org/wiki/Rhinoceros_Party_of_Canada_\(1963%E2%80%9393\))

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> One of the comments says

> _she wasnt convicted because she posted the picture. she was convincted > because she posted the picture, with hash tags like "one bullet one cop" and > all cops are bastards"._

If true, it sounds a bit more plausible to call it criminal harassment. I haven't followed up, though.

<comment><USER17> Those aren't even specific threats. I'm not yet convinced this is less than state overreach.

<comment><USER18> Apparently the graffiti was a portrait of a particular police officer.

</comment></comment></comment><comment><USER19> [http://en.wikipedia.org/wiki/Freedom_of_speech_in_Canada](http://en.wikipedia.org/wiki/Freedom_of_speech_in_Canada)

<comment><USER20> I thought this link was going to be a 404 as a social comment.

</comment></comment><comment><USER21> _Jennifer Pawluck, 22, was found guilty in April of criminal harassment for snapping a photo of the street art and uploading it to Instagram in 2013._

Looking at the title I was expecting her to be the graffiti artist, but the fact that she isn't is what I find most shocking.

<comment><USER5> Not sure why you find it shocking. The only shocking thing here is that the CBC article is misleading in that it doesn't explain that she adding hashtags saying "one cop, one bullet" and "All Cops Are Bastards"

</comment></comment><comment><USER22> They can't stop her from posting on social media for a year.. that's baloney.

<comment><USER23> No they can't but if she does her sentence won't be suspended anymore.

</comment></comment><comment><USER8> How did she tag the police officers name in her instagram post if she didn't know who he was?

</comment><comment><USER24> Don't they understand the [Streisand effect]([https://en.wikipedia.org/wiki/Streisand_effect](https://en.wikipedia.org/wiki/Streisand_effect))?

<comment><USER5> I don't see how the Streisand effect would apply here. Posting a photo of the graffiti and adding the captions "one cop, one bullet" and "All Cops Are Bastards" is pretty clearly harassment.

</comment></comment><comment><USER25> In 2006, Christopher Hitchens participated in a debate at the University of Toronto. The topic: Does freedom of speech include the freedom to hate? The entire debate isn't available on YouTube, but the segment with Hitchens is.[1]

Hitchens makes three excellent points in defense of free speech, including hate speech. The bits I've transcribed are in italics.

First, freedom of speech is really more about freedom of hearing:

 _...it's not just the right of the person who speaks to be heard. It is the right of everyone in the audience to listen, and to hear. And every time you silence someone you make yourself a prisoner of your own action, because you deny yourself the right to hear something. In other words: Your own right to hear and be exposed is as much involved in all these cases as is the right of the other to voice his or her view._

Second, if you restrict speech then you must designate a censor. Is there any person or group you are willing to trust with the power to determine what you can read or hear?

 _Who 's going to decide? To whom do you award the right to decide which speech is harmful or who is the harmful speaker, or to determine in advance what are the harmful consequences going to be, that we know enough about in advance to prevent? To whom would you give this job? To whom are you going to award the task of being the censor?_

 _Did you hear any speaker in opposition to this motion (eloquent as... one of them was) to whom you would delegate the task of deciding for you, what you could read? To whom you 'd give the job of deciding for you, relieve you of the responsibility of hearing what you might have to hear? Do you know anyone- hands up- to whom you would give this job? Does anyone have a nominee? You mean there's no one in Canada good enough to decide what I can read? Or hear? I had no idea... but there's a law that says there must be such a person. Or there's a subsection of some piddling law that says it. Well to hell with that law then. It's inviting you to be liars and hypocrites and to deny what you evidently already know already._

And finally, if you censor hate speech, you must censor many religious texts:

 _Look anywhere you like for the warrant for slavery, for the subjugation of women as chattel, for the burning and flogging of homosexuals, for ethnic cleansing, for antisemitism, for all this you look no further than a famous book that 's on every pulpit in this city and in every synagogue and in every mosque. And then just see whether you can square the fact that the force that is the main source of hatred is also the main caller for censorship. And when you've realized this you'll therefore this evening be faced with a gigantic false antithesis. I hope that still won't stop you from giving the motion before you the resounding endorsement that it deserves. Thanks awfully. Night- night. Stay cool!_

If you're interested in that sort of thing, I highly recommend watching the whole speech. It's quite possibly the best oration by Christopher Hitchens.

1\. [https://www.youtube.com/watch?v=jyoOfRog1EM](https://www.youtube.com/watch?v=jyoOfRog1EM) Unfortunately, the whole debate is only viewable with a flash player at [http://tvo.org/video/188405/christopher-hitchens-freedom- spe...](http://tvo.org/video/188405/christopher-hitchens-freedom-speech)

Note: I transcribed this about 6 months ago, but it seemed relevant enough for me to mention it again.

<comment><USER26> Of course freedom of speech includes the freedom to hate, otherwise it isn't exactly free speech.

</comment></comment><comment><USER27> Does anyone have a link to the image she posted?

Edit: found it I think. [https://postmediamontrealgazette2.files.wordpress.com/2015/0...](https://postmediamontrealgazette2.files.wordpress.com/2015/04/0422-city- graffiti.jpg)

<comment><USER28> Vice's article shows it: [http://www.vice.com/read/why-did-a-student-in- montreal-get-a...](http://www.vice.com/read/why-did-a-student-in-montreal-get- arrested-for-an-instagram-post)

</comment></comment><comment><USER29> Maybe a more just response would be for the police to post a cartoon picture of Jennifer Pawluck in jail.

Eye for an eye and all...

</comment><comment><USER30> I wonder what will happened if 100,000 people shared the photos?

</comment><comment><USER31> It seems the word "harassment" completely lost its meaning these days.

<comment><USER5> Nope. Just good reporting. See my other comments here.

</comment></comment><comment><USER32> In case you thought the United States lacks this kind of prosecution, an American student was charged with "one count of conspiring to violate civil rights and another count of using a threat of force to intimidate African American students due to their race."[0] after allegedly putting a noose around the statue of a famous Black civil rights figure at the University of Mississippi.

[0] [http://www.washingtonpost.com/news/post- nation/wp/2015/03/27...](http://www.washingtonpost.com/news/post- nation/wp/2015/03/27/civil-rights-charges-filed-against-ole-miss-student- accused-of-putting-noose-on-james-meredith-statue/)</comment>


Clear Desk, Clear Mind - <AUTHOR> http://doorty.com/clear-desk-clear-mind

<comment><USER2> Apparently having a clear desk opens up a lot of time and energy to indulge in on-line self-praise.

If you need to clean your desk to think straight, go do it, but it doesn't follow that everyone needs to clean their desk to have a clear mind while working; Einstein being the most famous counterexample.

As long as we're making wild generalizations, perhaps needing a clean desk to achieve focus is a sign of a basic weakness in the power of concentration?

</comment><comment><USER3> No desk = no mess!

<http://www.tagbento.com/243/dereks-desk>

:-)

<comment><USER4> My problem isn't a reliance on tools, it's being forced to use tools. IDEs, job queues, things that make me wait a thousand times a day. I wish I could drop java and eclipse down a deep deep well.

It's just a different kind of excuse.

</comment></comment><comment><USER5> Ah, the refrain of the neat freaks who feel a desperate need to trumpet their position (and obliquely judge all dissenters), justifying with simplistic metaphors that have no scientific basis...

How quickly we fall off the bus!

</comment><comment><USER6> I think it's worth posting the original here; <http://www.zurb.com/article/623/clear-desk-clear-mind>

</comment><comment><USER7> I honestly don't think this works for everybody, as long as my mind is clear on what I have to do, it doesn't matter how messy my desk is. I used to be obsessed with everything being "minimalistic" clean and I figured it was because I wasn't working on the right jobs. As soon as I found my place, it didn't matter how my desk was.

</comment><comment><USER8> Great until: _Stay minimal, my people!_ It's good that it works for him but it's different strokes for different folks. I'd previously assumed the sterile environments you often see in "my desk" photos were staged for the photo but clearly not.

I know more creative and productive people with a little clutter than none at all. That said, Al Gore's desk sets my teeth on edge ;-) [http://www.dailygalaxy.com/photos/uncategorized/2007/11/25/a...](http://www.dailygalaxy.com/photos/uncategorized/2007/11/25/al_gores_desk_2.jpg) .. I find having my _computer_ organized cleanly to be far more beneficial because that's where I spend more of my productive time.

<comment><USER9> Al knows exactly where everything is in that pile :) There is a subset of the population that has both very good spatial memory, and has the ability to "tune out" messes that they create -- they become part of the landscape.

I'm in this subset, and I'm count myself lucky that my girlfriend understands that even though my place looks messy to her, I can find anything in a heartbeat so long as no-one has moved it since I last placed it somewhere. She has an innate urge to organize so I don't know how she resists :)

</comment></comment><comment><USER10> I usually keep my area looking much like the photo, but when I'm rushing to meet a deadline, the tiny amount of operational overhead it takes to stay neat seems to slip enough that clutter starts. Especially when working on little embedded dohickeys that need cables and connectors etc.

What I _adore_ is that little space "in between" when the deadline has been met and I decompress by putting things away, setting things back into their right order, and getting ready for the next big push.

</comment><comment><USER11> You know what? Mine looks exactly like that too. Except for the giant pile of crap off the left side of the picture. Does that mean I'm not zen-like?

</comment><comment><USER12> Clear desk, clear mind but also fresh layout, fresh mind...

I find that after changing an office layout (moving desks and changing things around) it results in a nice benefit of a slightly altered perspective that can be a good healthy boost of added productivity.

<comment><AUTHOR> So true. A clear mind is a creative mind.

</comment></comment><comment><USER13> Empty desk, empty mind?

</comment><comment><USER14> note to self: clear up the desk now!</comment>


Using Common Crawl to play Family Feud - <AUTHOR> https://fulmicoton.com/posts/commoncrawl/ <comment><USER2> In my work with the Common Crawl, I agree with one thing the author states uncertainly: just download it.

Everyone tells you that you should compute statistics on the Common Crawl by running a distributed task across a lot of AWS machines, leaving the data out there on S3 and moving your code to it. But this only seems to be cost- effective if your development time is worth nothing and if you get it right the first time (hahaha of course you won't).

As long as you pay a reasonable rate for bandwidth, you should just buy a 5TB hard drive and download it. Now you have a lot less system-wrangling to do and you don't have to pay Amazon for your mistakes.

</comment><comment><USER3> 147,640,618 domain names can be downloaded from [https://www.verisign.com/en_US/channel-resources/domain- regi...](https://www.verisign.com/en_US/channel-resources/domain-registry- products/zone-file/index.xhtml)

</comment><comment><USER4> > The web contains hundreds of trillions of webpages, and most of it is > unindexed.

any reference to this number?

<comment><AUTHOR> Google's "howsearchworks" : [https://www.google.com/intl/gl/insidesearch/howsearchworks/t...](https://www.google.com/intl/gl/insidesearch/howsearchworks/thestory/index.html)</comment></comment>


LED bulbs are about to be everywhere - <AUTHOR> http://www.slate.com/articles/business/the_juice/2016/02/led_bulbs_are_about_to_be_everywhere.html <comment><USER2> We have a ceiling fan that has a dimmer switch. It can't use CFL bulbs or LED bulbs but incandescent bulbs so that they dim. The CFL or LED bulbs that do dim cost more money.

I tried LED bulbs and they didn't emit as much light as the incandescent bulbs they replaced, I found that you have to find bulbs with the right amount of lumens [https://www.earthled.com/pages/lumens-watts-and-buying- light...](https://www.earthled.com/pages/lumens-watts-and-buying-lightbulbs- in-the-21st-century)

Watts don't mean anything anymore it is lumens that count.

CFL bulbs burn out on me, and you have to twist them by the base or it breaks the glass.

I imagine that the LED technology has advanced now that it can use more lumens and a brighter light. The LED bulbs that I tried were expensive and didn't emit enough light.

Some children's toys like the EZ-Bake Oven or Popcorn Maker uses incandescent bulbs to use their heat to cook things. The heat from the bulb bakes cakes or pops popcorn. But I guess with LED bulbs replacing them these toys won't work anymore.

</comment><comment><USER3> One wonders if they'll have the same carefully-baked MTBF that the old bulbs had.</comment>


Can I encrypt data in a way that it can't be copied or edited? - Super User - <AUTHOR> http://superuser.com/questions/391876/can-i-encrypt-data-in-a-way-that-it-cant-be-copied-or-edited <comment><USER2> As an attempt to make this interesting (by completely ignoring it):

It turns out that, by employing quantum mechanics, it's possible to encode data and then later answer the question "has anyone looked at the data yet"?

Let's say you're a secret agent. You get your instructions from shadowy figures in paranoid places. And, being a _secret_ agent, it would obviously be a problem if anyone were to eavesdrop on the instructions sent by your employers. Quantum entanglement allows you to check: has anyone already looked at this message?

Pretty neat!

</comment><comment><USER3> Why's this on HN? We all know the answer to this.</comment>


Why do 64 bit binary downloads tend to be larger than 32 bit downloads? - <AUTHOR> <comment><USER2> Well, for one thing, all the address constants (e.g., the address of a function that another function calls) in the 64-bit code are twice as big as those in the 32-bit code (64 bits instead of 32 bits).</comment>


British Airways Googling its Passengers - <AUTHOR> http://www.slate.com/blogs/future_tense/2012/07/06/british_airways_to_google_image_search_passengers_privacy_invasion_or_good_service_.html

<comment><USER2> I think this is a great idea, but Googling seems like such an inefficient method.

Using the email address to grab avatars from Gravatar, Facebook, LinkedIn and Twitter is a much better idea. Those customers have already publicly identified the picture and it would be much more efficient.

As a frequent flyer, the airlines often greet me by name in my seat, but that is because they have the seating roster.

</comment><comment><USER3> "Since when has buying a flight ticket meant giving your airline permission to start hunting for information about you on the Internet?"

What a joke. If your information is over the Internet, e.g. it's public, what privacy are you talking about? People really don't understand.</comment>


It's Time for a New Old Language – Guy Steele [video] - <AUTHOR> https://www.youtube.com/watch?v=dCuZkaaou0Q <comment><USER2> Wow, this is a very nice talk. I particularly liked the Q&A, where Guy Steele went back and explained the type checker shown earlier. And I also loved the LISP macro backtick-comma inspiration for using underline to "escape" overline. Brilliant!

</comment><comment><USER3> Reminds me of Donald Knuth's talk at MSRI in 2004 on "Mathematical Notation" and the choices he made for TAOCP:

[https://archive.org/details/lecture10604#reviews](https://archive.org/details/lecture10604#reviews)

"The speaker presents numerous examples of situations where good notations enhance mathematical problem solving, as well as a few that have been less helpful."

</comment><comment><USER4> I've finished watching the talk, and I'm not sure if this is serious, or is Guy Steele just trolling people in a sophisticated way. The TL;DR as I understand is:

\- Computer science papers have this ad-hoc, ever evolving notation that started out in mathematics, that is not well defined (every paper ends up using a different flavour, sometimes even a bunch of mutually contradicting flavours at the same time), and that is subject to weird evolutionary pressures (like page limit of CS papers leading to extreme conciseness).

\- Particularly interesting is the evolution of overline notation, and the ubiquitous but never defined use of ellipsis.

\- Guy thinks this is a mess and should be cleaned up. His first contribution is solving overline notation abuse by introducing _underlines_ , which cancel out overlines, thus implementing quasiquoting in mathematical notation. His second contribution is formalizing the meaning of ellipsis by defining a transformation from ellipsis form into over/underline form.

Maybe it's because of the way he presented it, or maybe because of my unfamiliarity with the space, but overall this talk really felt like a one- hour long practical joke aimed at CS academics.

<comment><USER5> I have not watched the talk in-depth so I can't tell whether it's trolling, but I have worked with academic CS papers. I would agree with an attempt to develop a new symbolism for describing CS theory, that was closer to modern programming languages, or at least to a LISP-like Domain Specific Language.

It's true that the language of mathematics was optimized for a different medium: written formulas on paper. Algorithms are better expressed in pseudo- code, but to describe the exact effects of a language instructions we have to resort to formal semantics (whether denotational, operational or axiomatic), which basically describe the workings of a virtual machine in terms of a temporal logic expressed with mathematical symbols.

The ellipsis in maths is usually an ambiguous symbol whose meaning changes depending on context. In CS, it typically represents either vectors in memory or successive recursive calls. Trying to provide a precise meaning for its usage is a legitimate endeavor; it appears that Steele is using symbols from vector maths to achieve it. What I get from skimming the video is that the combination of overlines and underlines would be a way to represent how you would combine your nested loops in imperative programming to traverse the data structure.

<comment><USER6> I'm guessing Ken Iverson's APL wouldn't work here? It can show algorithms just fine. I'm not sure about type theory though.

</comment></comment></comment><comment><USER7> Extending the old adage "the best programming language is the one you know the best" to "the best programming language is the one you created the best".

<comment><USER8> Reminds me of the "no free lunch" theorem from ML. To paraphrase, there is no language that is better than every other language on all tasks.

[https://en.wikipedia.org/wiki/No_free_lunch_theorem](https://en.wikipedia.org/wiki/No_free_lunch_theorem)

<comment><USER4> I view this as shifting complexity around.

All Turing-complete languages are essentially equivalent, and there is some essential minimum complexity in any computation you'd like to describe. Any given language we use makes trade-offs, which cause some programs to be expressed simply in it, but the cost is that some other programs will become much more complex to express in it.

<comment><USER5> Maybe, but comp-sci does not study all possible programs with equal probability. A notation should be optimized for the kind of problems that are more often studied, and make expressing those easier.

If this pushes complexity towards the expression of randomly generated programs, that's a good thing (except for the few guys that study randomly generated programs, that is).

<comment><USER4> Yes. This is the general mental model I use when explaining that the design goal of a good general-purpose language is to shift the complexity to the areas almost no one will care about. Also your corollary from a sibling comment can be restated as saying that you can get extra simplicity for a particular task by designing DSL that will shift complexity to outside of its domain.</comment></comment></comment></comment></comment>


Security researchers face wrath of spy agencies - <AUTHOR> https://www.theregister.co.uk/2015/10/22/behind_the_headlines_apt_researchers_face_wrath_of_spy_agencies/ <comment><AUTHOR> saw on [http://it.slashdot.org/story/15/10/22/195207/security- resear...](http://it.slashdot.org/story/15/10/22/195207/security-researchers- face-revenge-of-spy-agencies)</comment>


Ask HN: Open source tools for monitoring webapps and APIs - <AUTHOR> What is the best open source tool for monitoring multiple web applications and APIs, and displaying the result on a dashboard? <comment><USER2> Cachet is mature, self hosted and open source. [https://cachethq.io/](https://cachethq.io/)</comment>


Chime.TV (My tv/joost-like video startup just launched) - <AUTHOR> http://chime.tv <comment><AUTHOR> I've been hiding on News.YC for a few weeks now, and have been loving the content and feedback this community has. I'd like to submit my latest startup that a friend and I created over 6 months in our spare time.

Any feedback/critiques/ideas very, very welcome!

Here's the quick summary: Chime.TV aggregates millions of videos from across the web (from blip.tv, Break.com, DailyMotion, Google Videos, Kewego, MetaCafe, MySpace, Veoh.com, YouTube) to create a tv-like experience within your browser. With over 20 editorially-programmed channels, you can get started right away watching everything from documentaries to music videos. Or, you can do a search to find what you are looking for. You can save favorites, create your own channels to share and even send video-mail to friends. With a fullscreen, non-stop playing experience that is always on-demand, Chime.TV is truly lean back internet TV.

<comment><USER2> Congratulations on a very well done site. I don't personally have the desire to have content "pushed" to me, but you certainly have done a very nice job of making it work well.

Maybe you could add Top 10 Digg videos as a channel, that's a very heavily filtered list of almost all interesting stuff.

</comment></comment><comment><USER3> Really nice execution on an idea so boring and obvious that everybody goes "of course there's a site that does that", which is probably the very best kind of idea. Great intro video, too. Everybody on the internet likes cute girls talking to them.

If you manage to get some traction before a dozen imitators spring up, you'll be golden.

</comment><comment><USER4> Just a suggestion: I reinstalled my machine and didn't install Flash yet. The site just brings up the alert box telling me I should go to www.flash.com to download it. I expected the site to provide a direct link to the flash download, but instead all I got after the alert box was a blank page.

Granted, many users will have flash installed, but if my mom didn't and and she tried using your site with the current configuration, she wouldn't bother after getting just a blank page. (Granted, I don't think mom will be browsing YouTube and MySpace videos...at least I hope not).

</comment><comment><AUTHOR> Jaed: Great suggestion, I think we will implement that idea, thanks

Zach: It's actually just an issue with flash on OSX i believe, but we're looking into how to fix that now, thanks :D

Vuknje: If you grab the blue bar just above the playlist, you can resize the playlist to your liking :)

Staunch: Actually if you check out our Net100 Channel ( <http://chime.tv/#net100/> ) it combines the top videos from digg, mefi, youtube etc all in one place!

Thanks for the kind words Mkull and Mdolon

</comment><comment><USER5> very nice site. congrats on the launch.

played with it a bit and it was very addictive, enjoyed the intro video as well haha

</comment><comment><USER6> first impression is good. nice looking, easy to use, great ui.

only thing i don't like is playlist.. it's height is too small and it is too wide.. and i would like to see title of next video somewhere when playlist is hidden

</comment><comment><USER7> great job with the site guys, very impressed.</comment>