Bitfinex Interim Update - <AUTHOR> http://blog.bitfinex.com/uncategorized/bitfinex-interim-update/ <comment><USER2> The founder of BitFinex, Raphael Nicolle, seems to have disappeared.[1] It also turns out that he previously tried to start a Ponzi scheme. His previous job was working the help desk at Gutenberg Networks, according to LinkedIn.

BitFinex has been in previous trouble with the CFTC over customer account custody issues.[2] Having multi-sig keys doesn't help if the exchange has the keys.

Inside job?

[1] [https://www.cryptocoinsnews.com/bitfinexs-ceo-seemingly- trie...](https://www.cryptocoinsnews.com/bitfinexs-ceo-seemingly-tried-start- ponzi-scheme/) [2] [http://www.cftc.gov/idc/groups/public/@lrenforcementactions/...](http://www.cftc.gov/idc/groups/public/@lrenforcementactions/documents/legalpleading/enfbfxnaorder060216.pdf)

<comment><USER3> I am not familiar with the early days of BitFinex, and I hope the conclusion the two articles point to may not be true.

How come so many people managed to trust BitFinex that appears to have such opaque management?

If it's an insider job by the founder, why did (s)he not withdraw 100% of the assets in the exchange? Probably to make it look more likely to be done by an outsider(s)?

<comment><USER4> If I recall correctly 100% of the assets that were withdrawable were actually withdrawed.

edit: Well regardless of that being the case, why would an attacker not withdraw all the funds they can lay their hands on?

Many people seem to believe the bitcoin-exchange-as-a-scam thing is worthwile, but I don't think it really is. Karpeles is in jail, and will be for a very long time, and I've heard he doesn't enjoy his jail time much.

The identities of these people are known, their spending can be tracked. I can't see how the life of a exchange scammer is in anyway more attractive than that of a straightforward exchange runner. What are they going to do, cash out a couple of million somewhere and emigrate to South America? They could do the same simply by selling their exchange. Besides, Dread Pirate Roberts showed that emigrating is not really attractive to many people, even when not doing so is a terrible idea.

<comment><USER5> Mark Karpeles is not currently incarcerated and is busying himself by taunting the twitterverse.

[https://news.bitcoin.com/inside-scoop-mark-karpeles- release/](https://news.bitcoin.com/inside-scoop-mark-karpeles-release/)

[https://twitter.com/magicaltux?lang=en](https://twitter.com/magicaltux?lang=en)

<comment><USER4> Oh wow, that news totally passed me by. The knowledge that he was in jail had a definite positive impact on my quality of life.

</comment></comment></comment></comment></comment><comment><USER6> It seems like a pattern with Bitcoin platforms: 1\. Start an exchange 2\. Get millions in assets 3\. Claim a hack 4\. Profit

I'm surprised the Nigerian prince didn't jump on this one.

<comment><USER7> I wonder if this was actually a sophisticated trade to profit from shaking up the market - claiming a substantial hack to make the market panic, then buy back the "lost" coins for way lower prices. If you control this kind of assets you can easily corner the market and participate from the emotional reactions. The lost coins can either not be lost at all or sold off way before that in small chunks, netting a profit after all is over.

</comment></comment><comment><USER8> Still no word on what happened.

How did the heist happen? Why did BitGo sign the transactions?

My expectation: It will throw a very bad light on BitFinex and BitGo when the nature of the breach is revealed.

<comment><USER2> BitGo announced two days ago that their insurance policy was discontinued in January 2016. They claim their customers were informed of this.[1] Customers are claiming they were not.

[1] [https://blog.bitgo.com/bitgo-secures-first-ever- comprehensiv...](https://blog.bitgo.com/bitgo-secures-first-ever- comprehensive-bitcoin-theft-insurance-xl-group-insurance-companies/)

</comment></comment><comment><USER9> That Bitfinex was not legit was predicted: [http://btcbase.org/log/2013-05-16#34498](http://btcbase.org/log/2013-05-16#34498)

</comment><comment><USER10> So... just pretending not to be insolvent and hope nobody goes to court to force them into insolvency?

<comment><USER11> Their argument is that this haircut is pretty much what would happen if they went into insolvency voluntarily. But now they are opening an avenue to redeem themselves and stay operating.

It makes some sense. I don't know whether I think it is a good idea, but it isn't without sense.

<comment><USER10> Except of course with insolvency an independent 3rd party is put in charge and the board power's removed and a court overseas any liquidation of assets and repayment of creditors.

Here on the other hand... the existing players all remain in place and whether or not there's any liquidation occurring is unknown. If auctioned I wonder what bitfinex as an entity would be worth? Or even just it's assets (like a functioning, somewhat, crypto-currency exchange application)?

Frankly I'm a bit surprised. There can be significant legal risks involved in operating a business that you know is insolvent.

</comment></comment></comment><comment><USER12> So everyone loses 36% of their account value?

<comment><USER13> Seems like it... this can't possibly be legal, right? Surely the company should be forced to liquidate to make customers whole again, or issue debt/equity to get the money. I'd love to read a take on this from someone with a better understanding of the regulatory environment Bitfinex is subject to.

<comment><USER2> From a CFTC action: "BFXNA Inc. d/b/a Bitfinex is a corporation formed and existing under the laws of the British Virgin Islands, and has its principal place of business at suite 13/F, 1308 Bank of America Tower, 12 Harcourt Road, Central, Hong Kong, China."</comment></comment></comment>


Run ARM Apps on the Android Emulator - <AUTHOR> https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html <comment><USER2> > Note that the ARM to x86 translation technology enables the execution of > intellectual property owned by Arm Limited. It will only be available on > Google APIs and Play Store system images, and can only be used for > application development and debug purposes on x86 desktop, laptop, customer > on-premises servers, and customer-procured cloud-based environments.

Wait, really? You need ARM's permission to make an ARM emulator?</comment>


Findima: The first Iranian "crowdfunded" gadget - <AUTHOR> By lifting the sanctions against Iran, this question came to the minds of the technology lovers that what is going on the Iranian technology market? Which kind of facilities exists that could provide a good groundwork for cooperation/investment? Hearing this news that a creative project has managed to provide his required capital in Kickstarter may not look so bizarre. But in a country like Iran that crowdfunding is only a three-year-old subject and has started from donation and charity projects, the fact that a project on the domain of Internet of things absorbs his capital in this way and thinks about mass production simultaneously is a big achievement. Findima is a gadget that helps people to not lose their belongings simply by sending alarms to their cell phones. The young generation in Iran is remarkably creative. Nowadays, the disappearing of the borders as a result of the global village has enabled few Iranian to stand out at management level among tech giants. Due to the imposed economic sanctions on Iran, the young generation inside Iran faced with many restrictions which did not give the opportunity to mobilize their ideas. Along all these years, only a few projects from Iran had this opportunity to be supported by gigantic companies. Findima is one of these pioneer projects with a restrictive access to devices and foreign platforms, which the completion of their entire project is their own work; however, their access may seem so simple for you. What distinguishes Findima from similar projects in Iran is providing its required budget through an Iranian platform called 2nate by crowdfunding (http://2n8.ir/Zd). The story of Findima, has inspired this hope in Iranian technology market that not only their creativeness, knowledge and expertise of the Iranian young generation in international firms can be used but also if they would be given a chance, they are capable of presenting their products with remarkable qualities to compete in international markets. <comment><AUTHOR> U can see Findima fundraising page here: [http://2n8.ir/Zd](http://2n8.ir/Zd)

or visit 2nate.com (The crowdfunding platform)

<comment><USER2> I can't help but think that a blog post about crowdfunding in Iran and how it differs from what is typical in other places might make interesting reading. I mean for US residents [and perhaps those of other countries], there may be legal complications when sending money to Iran [which is not to imply anything about whether there should be complications].

Anyway, Good luck.</comment></comment>


MacOS command line version of the WireGuard VPN is now available for testing - <AUTHOR> http://latacora.singles/2018/05/16/there-will-be.html <comment><USER2> > It's a little hard to overstate how big a deal this is. [...] Nobody trusts > either codebase, or, for that matter, either crypto protocol. Both are > nightmares to configure and manage.

Those seem quite the overstatements. I don't remember having any particular distrust in OpenVPN's codebase or protocol. I also didn't have that much trouble configuring neither the server nor the clients. I particularly liked how OpenVPN's configuration is basically putting command line arguments in a file. I could test configurations by simply changing invocations of openvpn, and when I found something I liked, I just put the options in a file and enabled the service to use that configuration file. Compared to the configuration of other kinds of services, OpenVPN is pretty simple.

EDIT: This is my first time hearing of WireGuard. I can't say how it compares, but the way this reads like a sales pitch and is so dismissive of SSH and OpenVPN, both of which I've had nothing but good experiences from, doesn't leave a good impression on me. I mean:

> Death to SSH over the public Internet. Death to OpenVPN. Death to IPSEC. > Long live WireGuard!

Really?

This page would've been more effective on me if it objectively described how WireGuard was better than these technologies.

<comment><USER3> It's just pure marketing - create a problem where it doesn't exist, and sell the solution.

<comment><USER4> Would you care to rebut the arguments the blog post puts forth, such as argue that wireguard is actually harder to configure than IPSec or that the protocol is actually less trustworthy?

IPsec's design era, implementation size... really nothing about the thing is even vaguely comparable.

Also: wireguard is free and open source software. So what precisely are we (people advocating for it) selling? We paid a hell of a lot more than the cost of an OpenVPN AS license so that everyone could get a macOS client, for free. I don't make a dime off of you using wireguard.

So far 100% of the deployed OpenVPN I've seen has had bad crypto. Wireguard just categorically doesn't have that problem.

</comment></comment></comment><comment><USER5> What's the worry about SSH over the public internet? Possibly influenced by my college's network setup, I've always been on team BeyondCorp even before BeyondCorp was a thing. Just use some auth mechanism like SSH keys that prevents brute-force attacks, and disable password auth.

Do pre-authentication OpenSSH vulnerabilities happen a lot, or something?

<comment><USER6> Can't speak about security aspects, but:

If you ever use SSH to tunnel/forward TCP traffic, you should be aware of certain performance issues [1], due to TCP's re-transmit mis-behaving (stacking) in a TCP-in-TCP scenario. Expect seemingly random delays, followed by bursts of transmission even well below the nominal capacity of the connection. This also causes overall increase in amount of data sent.

The same caveat applies to any other TCP-in-TCP tunnel (as opposed to the usual TCP-in-UDP setup), unless one or both tunnel endpoints specifically handle re-transmits properly.

[1] [http://sites.inka.de/bigred/devel/tcp- tcp.html](http://sites.inka.de/bigred/devel/tcp-tcp.html)

<comment><USER7> SSH tunnels do not do TCP-in-TCP. They just take the content of a tcp stream (not the packets) and forward them over an ssh channel.

<comment><USER6> You are partially wrong.

OpenSSH, and the SSH standard in general, support "multiplexing SSH connections", where several remote shell sessions share single TCP connection. This is unaffected, as there's only one TCP layer in play. For OpenSSH this is options "-M" and possibly "-J" (not sure).

Another, unrelated functionality is a straight-up TCP tunneling over the SSH connection. This is an actual TCP tunnel, with all the advantages and warts of the setup. With OpenSSH, it's options "-L" and "-R". Those options take host:port arguments, and do proper TCP-level forwarding, encrypted and compressed like any other SSH stream, layered over any transport your SSH happens to be using. Which typically is also TCP, thus creating a TCP-in-TCP scenario.

There's also "-w" which tunnels tun(4) connection, over which you could end up sending TCP traffic.

Note that neither 'authentication agent forwarding' nor 'X11 forwarding' have anything to do with any network tunneling; those just pass small chunks of meta-data out-of-band.

<comment><USER5> > _With OpenSSH, it 's options "-L" and "-R". Those options take host:port > arguments, and do proper TCP-level forwarding, encrypted and compressed like > any other SSH stream, layered over any transport your SSH happens to be > using. Which typically is also TCP, thus creating a TCP-in-TCP scenario._

I don't believe this is right - the thing tunneled over SSH is the data flowing within the TCP connection, not the TCP connection itself. If I do `ssh -L8080:foo:8080 bar.example.com` and then connect to [http://localhost:8080/](http://localhost:8080/), then my browser's TCP connection terminates at my _local_ SSH process, which decapsulates the TCP stream and sends it over SSH. Then the SSH server on bar creates a new TCP connection to foo.

Therefore there isn't TCP inside TCP. There are three TCP connections connected in series: my browser to ssh on localhost (HTTP inside TCP, ssh to foo (HTTP inside SSH inside TCP), and sshd on foo to web server on bar (HTTP inside TCP).

Therefore the "TCP-in-TCP" problem, where a delayed/dropped packet creates backoff in both the inner and outer TCP connections, doesn't apply. When my browser sends a packet, it is immediately and reliably ACKed by the ssh process running on my local machine. That ssh process might fail to get the resulting encrypted packet to foo, but that only affects a single TCP connection, the one from my laptop to foo:22. The browser sees a slow connection, but it sees it being slow at the application layer, not at the TCP layer.

So I think 'sneak is mostly right with the exception of ssh -w, which is a relatively new feature (and not what I was asking about at the top of the thread, in any case).

<comment><USER7> Yes, thank you for typing that out so that I don't have to.

Also, -w is some new nonsense that nobody should really be using except in some super dumb and hacky situations where there is no other option.

</comment></comment></comment></comment></comment></comment><comment><USER8> FYI AlgoVPN has Wireguard support in a PR right now. It should get merged within a week once it gets more testing: [https://github.com/trailofbits/algo/pull/910](https://github.com/trailofbits/algo/pull/910)

<comment><USER9> This is super cool. So if I understand right, I can:

1\. Use Algo CLI to spin up a server on DO, AWS, etc specifically to pass through traffic.

2\. Use `wg` CLI to connect to that server and pass my MacBook traffic to that new server

3\. Dispose the server when I'm done using Algo.

<comment><AUTHOR> Yep! Usually all you need is `wg-quick up myserver` and `wg-quick down myserver` -- the wg-quick(8) command wraps all the others for the most common trivial use cases.

By the way, I believe [https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand) has support for WireGuard (in addition to a billion other things...).

<comment><USER9> Just set up, this is amazing. Thanks for sharing.

</comment></comment></comment></comment><comment><USER10> In my experience, people use VPNs as an excuse to push weak host security through review. Eventually, everyone dismisses all security concerns with "it's behind VPN". And then they connect to the VPN with their malware-ridden computers. People are also surprised that whatever they run inside supposedly sandboxed VM actually gets full access to the VPN. And then there are configuration errors that can lead to surprising effects like forwarding all traffic from one's home computer through company's network filter/sniffer.

For these reasons, I always recommend running everything with public IP address. No more excuses. It's public, so security is a must. No more surprising network flows. Cloud-based monitoring tools can access the servers. Limited access can be granted to non-core team members and computer-illiterate staff.

<comment><USER11> For organizations with extremely sophisticated security teams, pretty far beyond the industry norm for "unicorn" startups (which themselves tend to have security teams with 10+ people on them, meaning millions of dollars of annual spend on security), this makes sense.

But for other companies, _when they haven 't been architected from the beginning to carefully support this access model_, this is terrible advice. Just awful. Converting a company with a VPN/private deployment environment model directly to a "YOLO BeyondCorp" model will get that company owned up.

Further: if the primary things people need to get into private IP space for are (1) developer access and (2) access for non-technical staff to admin interfaces, the win just isn't there, even if done correctly, for most companies with the BeyondCorp model. It costs more to keep that model secure than it does to set up a system of VPNs for private access.

<comment><USER12> I'm certainly comfortable with WireGuard for machine to machine connections, but I don't see how it would replace traditional VPN w/ 2FA (e.g OVPN w/ Duo) for non-technical staff to access internal apps (at least without something similar to PAM)

<comment><USER11> When non-technical people get VPN access, it's almost always to access a small selection of specific applications. Lock their VPN connections down and implement 2FA (or, more realistically, 2FA-enabled SSO) for the applications rather than the VPN connection.

The 2FA VPN thing is, I think, a consequence of how hard it is to set up VPNs. Companies share VPN infrastructure between developers (who need relatively unfettered access) and non-technical staff, because maintaining multiple VPN configurations is so painful. WireGuard fixes that problem.

This is what I'm talking about when I say that WireGuard is a big deal. The current situation, with 2FA logins to very powerful VPN connections, is deeply suboptimal, and is what BeyondCorp was a response to in the first place.

If I was asked by a client today to design a remote access solution for customer support people to access an internal admin app, I might try to devise a site-to-site system (in which case I'd happily use WireGuard) --- deploying host-based VPN for support staff seems like a nightmare. But even if I couldn't, what I could do now that WireGuard is available is retain OpenVPN but drastically ratchet down what it has access to, SAML-ize the admin applications, and migrate developers to WireGuard environments.

</comment></comment></comment></comment><comment><USER13> > TODO: this should use scutil and be slightly more clever. But for now we > simply overwrite any _manually set_ DNS servers for all network services. > This means we get into trouble if the user doesn't actually want DNS via > DHCP when setting this back to "empty". Because macOS is so horrible to deal > with here, we'll simply wait for irate users to provide a patch themselves. > [1]

So the setup script completely deletes all your manual DNS settings without warning you.

[1] [https://git.zx2c4.com/WireGuard/tree/src/tools/wg- quick/darw...](https://git.zx2c4.com/WireGuard/tree/src/tools/wg- quick/darwin.bash?id=a0d5736e11e1e70189393fc8803c2c1500c87d3e)

<comment><AUTHOR> Pointed out on the mailing list, too.

Did you make a concerted effort to link to the file revision that doesn't contain the fix for that?

Anyway, this is taken care of now, and will be released with the next snapshot.

[https://git.zx2c4.com/WireGuard/commit/?id=b39298dfb540ad9c7...](https://git.zx2c4.com/WireGuard/commit/?id=b39298dfb540ad9c751e15585f4b95acb071ca84)

<comment><USER13> Sorry I wasn't trying to be a dick, all software has bugs, just thought people might want to know before they try it. Thanks for fixing it.

</comment></comment></comment><comment><USER14> Is this a kernel implementation of WireGuard for MacOS, or is it one of the two ongoing userspace implementations? I probably missed it, but I didn't see a separate repo for it at [https://git.zx2c4.com/](https://git.zx2c4.com/) .

On that note, can anybody say how far along the userspace rust implementation is? How hard it'd be to port the MacOS version to FreeBSD?

<comment><AUTHOR> The macOS client mentioned in the article uses the Go implementation:

[https://git.zx2c4.com/wireguard-go/about/](https://git.zx2c4.com/wireguard- go/about/)

It should be very easy to port to FreeBSD, and I'd like to make this happen. Care to help?

<comment><USER15> Hey! I was just sitting here grumbling to myself:"I whish they'd prioritise a solid portable user-space version" \- and it turns out you did!

How realistic is it to get this running on Windows 10?

<comment><USER16> Maybe try running it under subsystem for Linux!

</comment></comment></comment></comment><comment><USER7> Not to diminish this important work at all, just a question for HN: do I have a minority viewpoint in thinking key-based SSH to a bastion host and forwarding traffic via SOCKS (ssh -D) or ProxyCommands serves 99% of the use cases for a sysadmin's need for a VPN? (Corp networks and L2 privacy needs notwithstanding.)

Edit: If so, why?

<comment><USER17> I think the answer is mostly that it's hard to route most traffic over SOCKS, most applications don't obey the system-wide proxy settings, you might be leaking DNS queries, things like that.

<comment><USER18> Still not as thorough as a full-fledged "real" VPN, but for most ad-hoc purposes, something like sshuttle [0] works well and doesn't require application-specific configuration.

[0] [https://github.com/sshuttle/sshuttle](https://github.com/sshuttle/sshuttle)

<comment><USER19> I am very excited about sshuttle (and in fact, rsync.net has sponsored work on it).

The most compelling aspect of sshuttle, in my opinion, is that _any host running sshd_ can be an endpoint - no software is required. As long as the sshd in question has python available, you can use it as an endpoint.

</comment></comment></comment></comment><comment><USER20> @lvh

What are your thoughts on the wireguard homepage effectively saying it's not ready for production use?

I've looked at using wireguard on a few occasions, but it's always sounded not ready for production usage reading through it. Looking forward to the point where I can though.

<comment><AUTHOR> We're just conservative. At some point we'll change the webpage.

<comment><USER4> (Since GP asked me specifically: I completely agree with Jason here.)

</comment></comment></comment><comment><USER21> I have not tried WireGuard yet. Is it more reliable than existing methods over "bad Wi-Fi"?

I find that one of the best ways to make bad hotel or plane Wi-Fi completely unusable is to use a VPN, and having something more reliable on bad links would be great.

<comment><USER22> WireGuard uses UDP and is effectively "connectionless" meaning there is no persistent connection to be maintained. It also allows for seamless IP address roaming (your peer doesn't care if two messages come from two different IPs so long as they are signed with the right key).

In short, I expect it to have no meaningful degradation when on a bad network (so long as they don't block the traffic or have overly hostile NAT).

<comment><USER21> That is exactly what I was hoping for.

Too bad it'll take forever before iOS can use it, because the current state of VPN on Wi-Fi is terrible (I understand that is not the first thing WireGuard is looking to solve, but it'll be great when it gets there).

<comment><USER23> ZeoTier, which also uses UDP, has an iOS app. So it is possible if the dev team wants to prioritize it.

<comment><USER24> It wasn't a whole lot of fun trying to connect code designed to operate at L2 (ZeroTier) with the L3 tun adapter they give you in iOS and Android. Fortunately that code doesn't have to be touched too often though :)

<comment><USER22> Fortunately WireGuard only encapsulates at L3, if I'm not mistaken :)

</comment></comment></comment></comment></comment></comment><comment><USER25> The real competitor, which the article doesn't talk about is [https://www.zerotier.com/](https://www.zerotier.com/) . Is is also open- source and have been available on macOS, iPhone, Android, Windows on top of Linux for many months now. It is easy to install and use. Deals with punching NAT and does smart routing when both devices are on the same network.

I don't know how well it compares in terms of performance and crypto, it would be nice to know.

<comment><USER11> Where is ZeroTier's protocol documented? All I could find was a document that said it was custom, and "like IPSEC". What could ZeroTier do _as a VPN protocol_ that would make it better than WireGuard, which has a pedigreed protocol that, in its WireGuard incarnation, has had multiple rounds of formal validation?

I wrote the article we're commenting on. Why would I take the time to talk about something like ZeroTier? WireGuard solves the problem I'm talking about decisively.

I'm prepared to hear something about ZeroTier that makes it interesting in the WireGuard setting, but I am not interested in a long list of non-VPN non- access-tunnel features that ZeroTier might have that WireGuard lacks, because lacking random features is exactly the point of WireGuard.

<comment><USER26> No RFC-type document yet but quite a bit of commenting here:

[https://github.com/zerotier/ZeroTierOne/blob/master/node/Pac...](https://github.com/zerotier/ZeroTierOne/blob/master/node/Packet.hpp)

There is also a higher-level description of the entire system here:

[https://www.zerotier.com/manual.shtml](https://www.zerotier.com/manual.shtml)

ZeroTier solves a broader set of problems than WireGuard and has SDN-type network flow rules, security tap capability, and is a full L2 emulation layer with support for multicast.

From what I've seen the WireGuard protocols are excellent and the implementation is very nice and clean. A core ZeroTier implementation to support a simple L3 VPN use case could be as short as WireGuard but that would be without all the rules engine, multicast, etc. stuff.

<comment><USER11> Just the .cpp code, not counting the .hpp code (which is full of code, including lots of memcpy's) in the node/ subdirectory of this repo is something like 4x the entire size of Linux WireGuard. The crypto protocol is undocumented, but the maintainer is playing games with things like the Salsa round count (which is fine, but I mean, speaks to a mindset). I might poke at it for sport at some point, but I don't see how I could ever recommend it.

<comment><USER26> I am the primary maintainer. :)

A minimal implementation could be much shorter, but the ref implementation is not minimal and includes a lot of features that go far beyond the scope of WireGuard.

Salsa20/12 is standard and according to the docs is considered secure. I recall that DJB initially specified the cipher with 12 rounds but added 8 more for margin. There are Salsa20/12 implementations in many crypto libraries. The best public cryptanalysis on Salsa breaks 8/20 rounds with a time difficulty of 2^251.

Personally I think concern over algorithm strength is usually misplaced as long as you're using an algorithm that is not known to be very weak (e.g. DES, RC4). Halfway decent cryptographic algorithms are almost never broken. Implementations and protocols are broken all the time.

One thing we did to guard against protocol issues was to implement what DJB calls "boring crypto." The cryptographic encapsulation is dirt simple Salsa20+Poly1305 constructed exactly as in the NaCl secret box functions, and nothing more. We've resisted adding more advanced features to the cryptographic layer because so far they haven't really been necessary and the risk is not worth the small benefit they may have.

At the time this was designed (started in 2010) Salsa20/12 was the best option to achieve high performance across a variety of devices including ARM phones and slow VMs with a clean and small code base. If it were written today it would probably use ChaCha20 (faster) or AES-GCM since almost everything worth mentioning has hardware AES now. We will likely rev the crypto at some point but would also like to upgrade the asymmetric cipher as well. Waiting to see if the Goldilocks curves (curve448) get added to the NIST standard. They are proposed but not yet approved. If they are we'd probably go to curve448+AES256-GCM with a longer IV.

That being said we're not solely oriented toward crypto and generally tell our users not to rely on network crypto as their only line of defense. Network crypto is sort of analogous to hard drive encryption. It protects you from people who don't have access to anything, but won't save you once someone gets any access beyond the perimeter. We advocate the use of encryption and authentication within networks as well if you care about security. This also guards against the discovery of a bug in any layer-- if someone breaks one layer they are confronted by another layer.

An RFC-style write-up has been on the to-do list forever, but the to-do list is very long.

<comment><USER11> None of this is wrong (avoid GCM).

I've been poking around for about 30 minutes and I'm still not sure I understand what the key agreement protocol is. I'm trying to follow starting from _doHELLO and you're losing me somewhere amidst the moons and worlds and stuff.

<comment><USER26> An identity is a public key. An address is a hash of that public key. Key agreement is just SHA512(Curve25519(my secret + your public)). Public keys are looked up from addresses via "upstream" nodes by the sender. An upstream node is typically one of our root servers unless someone has added their own.

Crypto here is fairly dirt simple as I said. It's just ECDH with two Curve25519 keys and then go.

The moons/worlds stuff is just some odd terminology for how to define upstream nodes. We are dumping that in favor of something more straightforward in the future. Most users don't need to care about it.

I'd like to avoid GCM but we also may have a need for FIPS compliance in the future. Yes I know that FIPS basically mandates weaker crypto... or at least crypto that is easier to implement wrong... but if it's not FIPS it isn't "enterprise" to some (clueless) people. Then you have organizations mandated to use FIPS crypto by forces beyond their control.

<comment><USER11> There are no ephemeral keys at all? It's just static-static DH?

<comment><USER26> Not in 1.2. This is planned for 1.4. It's fairly prominent in the manual.

It was left out of the original design since ephemeral negotiation means state and therefore latency and stalls if packets are dropped. The present design leaves it out as part of a design that prioritizes instantaneous connectivity.

When we do add it we will probably add a network level config option to select whether forward secrecy is required. If it's off it will work instantly and then lazily upgrade. If this option is on it will wait.

As I said though I don't see network level (L2/L3) encryption as being worth much more than whole disk encryption. Each really secure thing should have it's own secure authenticated session that would be secure enough over the open Internet. That way a network compromise or trojan is not instantly fatal. We pretty much tell everyone this.

<comment><USER11> Have you considered just, you know, adopting the WireGuard protocol and then building something on top of it to coordinate connections?

I built something like this (in C++, no less!) back in 2000. After the company failed, I always felt like we had made a mistake not just shipping the absolute simplest possible message forwarder, and then implementing the control plane for it in a reasonable high-level language. (In fact: an early team member pushed us to do that, and I shot them down.)

<comment><USER27> This may come off as rude ... but tptacek there is a fine line between being enthusiastic and aggressively dickish. All over this thread you have been PUSHING hard... way harder than you should have to if your product is as good as you are touting. It's one thing to promote, but what I've read all over this post (not just this thread) is someone whose personality REFUSES to allow them to even give a small inch in a debate -- feels a drive to be right no matter the cost. That makes me question how likely you are to take input from people who can / want to help ...

Friendly advice -- roll yourself back down to an 8 or 9.

<comment><USER11> WireGuard isn't "my" project. I have no formal relationship with the developer, other than that we like his work so much we've contributed a bit to its development (less than others).

You're not being rude. But I have no plans to give an inch on this discussion. If that's problematic for you, you're welcome to use the HN votey-buttons as you see fit.

<comment><USER27> Just letting you know that your comments/attitude/etc are likely hurting the cause you are championing. Your volume of replies, the tone you take in them, and the way you react makes it seem like you ARE deeply part of the project... Thus I (and likely many others) associate you with it. I don't care what you comment - be a dick to the fullest if that's your thing - I was simply letting you know the impression you are leaving out there.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Is there any info on how many concurrent clients the WireGuard server can handle? I'd be interested in hearing if anyone has used this for management traffic to a large (>100) number of devices

Edit: ..and if so, how they handled IP assignment and key distribution.

<comment><AUTHOR> Linux kernel module supports 2^20 (1048576) peers per interface. Go userspace version supports 2^16 (65536) peers per interface. Both limits can quite easily be raised if necessary.

<comment><USER12> Edited my question above for clarity. Any info on performance, key management, and managing peer address assignment in larger deployments?

</comment></comment></comment><comment><USER28> > But the most important use case for VPNs for startups is to get developers > access to cloud deployment environments, and developers use MacOS, which > made it hard to recommend.

What's that?

> … developers use MacOS …

Not all developers! I'll believe that _many_ developers use macOS. It's even possible that _most_ developers conducting certain kinds of development use macOS. But not all developers do. I don't. Noöne on my last team did (we were Linux-only). Several folks on my current team don't.

<comment><USER11> If your developers use Linux, they've already had a mature WireGuard implementation for months. It may even land in the mainline Linux kernel (I hope it does).

I don't have advice for developers on Windows right now, but we haven't run into any of those at Latacora; you can assume we're broadly writing for an audience of the kinds of startups we serve.

<comment><AUTHOR> We'll have a Windows client in due time.

</comment></comment></comment><comment><USER29> Is support for this in the Linux kernel yet? The lack of acceptance there is a major reason why I haven't tried this out yet.

<comment><USER22> But why? Its still very easy to install. Is it just a matter of not trusting kernel extensions?

<comment><USER29> > But why?

Principle. I strongly believe that software which runs in kernel space must adhere to the same standards (for better or worse) as the kernel. For Linux kernel modules, this means being accepted into the upstream kernel, and demonstrating a history of maintaining compatibility with the mainline kernel.

I've been burned a lot in the past by companies releasing their own modules, and quickly failing to keep up compatibility with the mainline kernel versions. Not going to make that mistake again.

<comment><AUTHOR> That's a fine and fair principle. I understand where you're coming from, and getting this mainlined is important to me too.

But for the record, we're maintaining meticulous compatibility with all kernel.org kernels back to 3.10 and up to whatever the most recent RCs are (at the moment, 4.17-rc5). We also support the frankenkernels from ubuntu, redhat, and suse. We have a build and run-in-a-vm CI box testing all these kernels for every commit and on a bunch of architectures: [https://www.wireguard.com/build-status/](https://www.wireguard.com/build- status/) And because we're actively working on upstreaming this, you can be sure that this is going to continue working with upstream.

Also, this isn't a "company releasing their own modules" situation, providing some kind of throw-it-over-the-fence corporate crap code. I'm a kernel developer with a decent amount of upstream code, and the work I do is nearly always for upstream kernels.

<comment><USER29> Sure. But I am still looking forward to seeing it in the kernel tree before trying it out.

</comment></comment></comment></comment></comment><comment><USER30> > Death to OpenVPN.

> ...nightmares to configure and manage.

This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience.

If you've had issues with OpenVPN, there are simpler options like Angristan's OpenVPN script [0] on GitHub to get you started.

I'm not arguing against WireGuard's use case as it's a nifty tool and viable option. While it's codebase is indeed smaller in size, denigrating a proven tool like OpenVPN or assuming that everyone is incapable of managing it because it's "complex" is both unnecessary and incorrect.

[0] [https://github.com/Angristan/OpenVPN- install](https://github.com/Angristan/OpenVPN-install)

<comment><USER11> WireGuard is simpler to set up (it's hard to imagine something being simpler to set up than WireGuard, since its configuration is literally the minimum amount of information you'd need to build an encrypted tunnel), should be more robust in practice because of its transport model, is much faster, and is _optimally secure by default_.

I understand why people like OpenVPN --- their alternative before OpenVPN was IPSEC, which is a nightmare. What we're telling you is that there's something even simpler than OpenVPN, and it has the virtue of being materially more secure.

People should stop using OpenVPN as soon as they can.

<comment><USER31> WireGuard is easy to setup for particular use cases. A small number of dedicated links or a small number of mobile users.

WireGuard provides the foundation of a complete VPN service. It doesn't provide features such as user management and authentication, key management, ip address assignment, client configuration distribution, end-user friendly VPN clients, support for easily implementing complex split-routing and dns configurations for VPN end users. And most of those things aren't in progress. And it is likely there will be multiple solutions competing to provide these on top of WireGuard, so there may never be on true flavor WireGuard solution. Also once these are in place the overall attack surface expands to be closer to OpenVPN and IPsec.

Other issues include lack of support for multicast which means IPv6 which requires multicast is mostly supported but not completely which can cause issues in some circumstances.

Accomplishing some simple tasks like using a floating route to provide failover across two WireGuard links isn't possible. WireGuard interfaces don't go down unless you manually tear them down, so you either have to run another tunneling protocol over the WireGuard links and assign your routes to those interfaces which can go down or use a dynamic routing protocol. And WireGuard has a few caveats when being used with certain dynamic routing protocols which starts to make it as complicated as OpenVPN or IPsec at scale.

Currently there is an issue being discussed on the WireGuard mailing list regarding there currently being a requirement for time to be set on devices before establishing a first connection to a peer. This is because of an anti- replay requirement WireGuard has for initial packets which IPsec and OpenVPN don't. This is impacting a group that was hoping to use WireGuard to encrypt the traffic across a community wireless mesh network. The devices used in such networks often don't have a realtime clock. There are potential workarounds but again suddenly the simplicity advantage starts to slip away.

I think Jason has done great work, I like WireGuard and I use WireGuard, but it is not near ready to replace OpenVPN or IPsec in most circumstances.

<comment><USER11> I was careful when I wrote this to talk about who this is important to: startups that use VPN technology as part of their remote access strategy. Community wireless mesh networks might need to keep using OpenVPN, or whatever. But none of the problems you're discussing impact the core use case startups have for VPNs, which is getting support people to admin apps and developers to deployment environments.

</comment></comment></comment></comment><comment><USER32> Why death to SSH though?

<comment><USER33> It's not "death to SSH", it's "death to SSH over public Internet".

Instead, what you'll want to be doing is SSH over WireGuard.

<comment><USER34> But my SSH already uses Public Keys and ChaCha20/Poly1305 so that's really the last protocol I worry about sending through hostile territory

<comment><USER35> With Wireguard I believe you can go further and your servers can have only private IPs. And it's all seamless.

<comment><USER36> But the servers have to have a public IP to terminate the wireguard link, or be connectable from a machine that does. Exactly like SSH, be it via a bastion host or direct.

</comment></comment></comment></comment></comment><comment><USER37> I'm not as well versed as many here (I'm an advanced amateur) but have some understanding of networks and crypto and am trying to wrap my head around this.

Can Wireguard be described as an encrypted, stateless, roaming, keypair based UDP tunnel?

<comment><USER11> It's a routed tunnel, which is what distinguishes VPNs from encrypted tunnels.

</comment></comment><comment><USER38> A benefit unmentioned in this article is full IP roaming on both ends. That is good on its own but combined with the Android support has some very interesting possibilities.

<comment><USER39> Yes! Like `mosh` for your VPN. Pretty cool.

</comment></comment><comment><USER40> Hopefully this means its coming to FreeBSD/pfSense also.

</comment><comment><USER17> Does anyone have detailed instructions/guide on how to set Wireguard up to allow my laptop to VPN back to my house through an always-on host there (basically two Ubuntu machines)? I'm not great at networking and I'd rather not spend hours breaking my entire network trying to set this up.

The "getting started" guide on the website already assumes you can set up your own routing across the different subnets.

<comment><USER41> Just follow the instruction on the video. That's all there is to get it running.

The archlinux wiki also give some tips but it is really simple

<comment><USER22> The video merely connects two hosts (IIRC). If you want what you expect from a normal client-server VPN acting as a gateway to a private network, you'll need to enable IP forwarding on the "server" and ensure routes are correctly configured on the "client".

<comment><USER41> Here is a blog post on this topic:

[https://vincent.bernat.im/en/blog/2018-route-based-vpn- wireg...](https://vincent.bernat.im/en/blog/2018-route-based-vpn-wireguard)

Didn't tried it myself but it looks solid

</comment></comment></comment></comment><comment><USER42> Is there any hope for an implementation that can be run on a Windows/macOS machine as an unprivileged user, and exposed as a SOCKS5 proxy? I often find myself wishing for an isolated VPN experience which applies only to a particular browser, but to all traffic in that browser. Something like Tor browser, but with my VPN instead of Tor.

</comment><comment><USER43> [https://en.wikipedia.org/wiki/Back_to_My_Mac](https://en.wikipedia.org/wiki/Back_to_My_Mac)

For comment/discussion.

Not a "recommendation", nor a positive/negative opinion.

Believe it has never been discussed on HN before.

</comment><comment><USER44> And for a VPN with multipath support, check out Glorytun: [https://github.com/angt/glorytun](https://github.com/angt/glorytun)

Used by OVH routers to efficiently aggregate multiple physical links.

</comment><comment><USER45> Most of the time I do not need my whole ip stack to be forwarded over a secure channel but simply HTTP/s .. here is where SSH/socks proxying suits well for me in hotels etc..

<comment><USER4> Have you tried both? Particularly on bad hotel WiFi and roaming, wireguard perf is not comparable to SSH proxying.

<comment><USER45> ah gotcha.. ok I'll setup wreguard tonight as there is really no need to route everything via a "tun0" if I don't need to anyway, when I think about it.

</comment></comment></comment><comment><USER46> it'll be very useful if they build user-facing enterprise security from the get-go.

How do you build SAML, Oauth/Google-Auth, 2-factor support into a VPN from the ground up ?

</comment><comment><USER47> Elsewhere in the Latacora blog, Threat Modeling is said to be bad. I'm interested in a succinct explanation why it's not a useful activity.

</comment><comment><USER48> Any experience with this in an enterprise / DoD domain? ChaCha-Poly algorithm is not FIPS-140-2 validated from what I understand.

</comment><comment><USER16> Great news! I wish more smart people would put more effort to technically stop repressive regimes from blocking VPNs like WG.

</comment><comment><USER49> So can we get WireGuard as a commercial service? Will anyone roll it out that way?

<comment><AUTHOR> Yes.

[https://mullvad.net/en/blog/2017/9/27/wireguard- future/](https://mullvad.net/en/blog/2017/9/27/wireguard-future/)

[https://www.azirevpn.com/wireguard](https://www.azirevpn.com/wireguard)

[https://www.privateinternetaccess.com/blog/2018/01/private-i...](https://www.privateinternetaccess.com/blog/2018/01/private- internet-access-proud-supporting-wireguard-project/)

[http://blackholecloud.com](http://blackholecloud.com)

And more on their way.

</comment></comment><comment><USER50> macOS _

</comment><comment><USER51> If WireGuard is so great (rethorical position, not actually doubting it is) why isn't there a Kickstart effort or some angel funding to speed up its development to all platforms ?

<comment><USER4> Wireguard has taken third party funds to expedite development, but as far as I know the author is pretty adamant all the implementations are freely available and open source, so maybe angel funds aren't the best direct way forward.

Disclaimer: I'm a principal at Latacora and we paid the author some money to make native Mac clients happen. There's also a VPN provider who paid money toward development.

I'd rather they did it right than rush it to meet a kickstarter date.

<comment><USER52> Private Internet Access was one of the vpn providers. [https://www.privateinternetaccess.com/blog/2018/01/private-i...](https://www.privateinternetaccess.com/blog/2018/01/private- internet-access-proud-supporting-wireguard-project/)</comment></comment></comment>


A peek inside Edward Gorey's modern Gothic world - how-about-this https://www.washingtonpost.com/entertainment/books/a-peek-inside-edward-goreys-modern-gothic-world/2018/11/20/29028b50-e83f-11e8-bbdb-72fdbf9d4fed_story.html <comment><AUTHOR> In one of his drawings, Edward Gorey once inserted the quip, "Edward Gorey. The man who digs engraves of the past." (Was it written on a tombstone? It was decades ago.)

</comment><comment><USER2> > _He began drawing before age 2_

What does this mean? The 2-year-olds I know don't have the dexterity yet to draw zigzags or circles. Presumably his drawing consisted of colorful blobs?

<comment><USER3> My almost 2 year old is capable of drawing circles. Zigzags just happen. But you can ask for a circle and mostly get one.

</comment></comment><comment><USER4> Paywalled.</comment>


Making Blurry Faces Photorealistic Goes Only So Far - <AUTHOR> https://spectrum.ieee.org/tech-talk/computing/software/making-blurry-faces-photorealistic-goes-only-so-far <comment><USER2> Everyone in the ML field understands that ML-assisted upscaling doesn't produce output that accurately represents the original full-resolution image. It produces output that humans perceive to be realistic-looking, or free of traditional upscaling artifacts.

While this is obvious to anyone familiar with the technology, it's difficult to explain to casual observers. The image output looks real. It feels like it could be real. It's free of traditional scaling artifacts that would trigger suspicion. Without additional explanation, it's easy to see why casual observers would assume the hallucinated upscaled version is an accurate representation of the original image.

Historically, police sketches and blurry surveillance images are obviously low quality enough that people inherently know they're approximations. The problem with these ML hallucinated upscaled images is that they look and feel real enough that they bypass people's suspicions. We can try to present them as "Here's what the suspect might look like", but when they look like a full- resolution photograph, people will simply assume that it's _exactly_ what the suspect looks like.

<comment><USER3> One obvious problem is creating only one output face when there are many possible faces that match the low-res version. A tool that turns a low-res face into, say, 16 maximally-different upscaled versions doesn't suffer from the same level of false certainty.

<comment><USER4> Doesn't it?

You arbitrarily picked 16 possible photorealistic faces out of a total solution space of what? Millions?

Wouldn't the balance of probability be on someone in the general population of humans more closely resembling one of your 16 candidate images than any of your candidates resembling the Ground Truth image?

Doesn't the problem get both better and worse as you scale your N up from 16? That is, it would be better because _one of your candidates_ is more likely to match the Ground Truth, but it would be worse because you've also widened your net for catching false positives?

<comment><USER5> I saw the blurry picture of Obama and my brain thought "I think that's Obama". When it was 'enhanced' it became a (white) person that I would never recognize as Obama. In fact I did not recognize them at all. The image may have been a more probable person overall, but clearly not a more probably famous person.

Which makes me wonder, can we train a model on only famous people, weighted by their relative famousness?

<comment><USER6> > can we train a model on only famous people, weighted by their relative > famousness?

Well, yes, but why would you want to?

<comment><USER5> So that we can take a picture of ourselves and have it tell us which famous person we most look like when blurry?

<comment><USER7> The hit kids app of the summer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I would say the technology has some issues. For example when you don't include enough black people in your training dataset, probably by simply not thinking about it, it can make the algorithm a bit racist. Example : [https://twitter.com/Chicken3gg/status/1274314622447820801](https://twitter.com/Chicken3gg/status/1274314622447820801)

<comment><USER9> The Oprah one is probably worse:

[https://twitter.com/Truttle1/status/1274361095285886982](https://twitter.com/Truttle1/status/1274361095285886982)

<comment><USER10> I mean, it's amusing, but the face is not aligned the same as the training data so what would you expect?

<comment><USER11> As a computer scientist? Garbage.

As a layperson? Magic, because that's how these things are marketed by startups and journalists.

</comment></comment></comment></comment><comment><USER12> Inverting a non-invertible operator impossible, study finds.

<comment><USER13> Sure the theory is nice, but can I see some empirical evidence? :)

</comment></comment><comment><USER14> With a large enough database of potential faces (see VKontakte), you might be able to use this tool to upscale blurry images and match them to a short list of candidates. Other intelligence could then lead you to the actual person in the blurred image. Scary implications.

</comment><comment><USER15> It might be less true for pixeled videos. I know from some IR camera companys, they use very small movements from the camera to calculate the picture in a higher resolution. And I think, the first picture from a black hole use also a kind of this technologie

</comment><comment><USER16> This seems pretty reasonable; I don't know if anyone was claiming otherwise throughout these upsampling results?

<comment><USER17> this is not upsampling

<comment><USER16> That's true; I was too loose with my terms.

</comment></comment></comment><comment><USER18> > For starters, Rudin said, "We kind of proved that you can't do facial > recognition from blurry images because there are so many possibilities. So > zoom and enhance, beyond a certain threshold level, cannot possibly exist."

Least needed "proof" ever.

<comment><USER19> It's also not a proof.

</comment></comment><comment><USER20> Instead of blurring faces in photos of protests, Google Street View, etc., blur them and then upscale them, so they don't have the jarring blur effect but still anonymize.

</comment><comment><USER21> Try a grid of 2x2. Is called ambiguity the more you hide it. The idea is so simple on why it wouldn't work even on trained models.

</comment><comment><USER22> Waiting for the CSI episode:

"Ok, zoom in... alright, now enhance that... now upsample using AI trained on criminal database... "

<comment><USER23> They already did that in _No Way Out_ , way back in 1987:

[https://youtu.be/0zLL_XdqxmQ](https://youtu.be/0zLL_XdqxmQ)

</comment></comment><comment><USER24> Depends on the blur used, right? Straight pixelation is very lossy, but gaussian is less so.

<comment><USER25> Right. As long as the number of pixels remains the same it should be possible to remove gaussian blur almost completely. The information isn't lost, it is still there, but smeared out over a larger area.

Also I don't understand why the first Mona Lisa results in a picture that when pixelated again, wouldn't produce the original pixelated picture. It is as if the create a face inspirated by the original, but not one that could ever be the original.

<comment><USER26> You actually do lose quite a lot of information, particularly so if you have a limited bit depth/other quantization noise.

</comment></comment></comment><comment><USER27> Slightly offtopic - who has the best video upscaling algorithm out there?

</comment><comment><USER28> So since this algorithm can't be used to reliably recover faces from blurry photos, it won't be.

It can still be useful for entertainment purposes.

</comment><comment><USER29> Can such a model be used to compare a real picture of a suspect with a low res picture and produce an objective measure of similarity (i.e. not only raw pixel similarity but a similarity measure that actually takes into account how actual human faces downscale, possibly resilient to minor rotations?)

</comment><comment><USER30> The increasing politicization of the machine learning field makes me grow tired. It makes me want to work on things without political implications. Something like electrical engineering. Does anyone else feel this way?</comment>


Maybe I shouldn't have looked at Elm. Now I cannot "unsee" it - <AUTHOR> https://twitter.com/hugoccampos/status/763380249325346816 <comment><AUTHOR> Thought we could maybe get a bit of a discussion started here. I have been struck by the simplicity and beauty of Elm and now looking back at JS with all the Redux boilerplate just kind of makes me cringe. What do you guys think?</comment>


Single-tasking/workflow manager - <AUTHOR>

I was playing with MongoDB the other day and came up with a simple single tasking/workflow manager.
Feel free to try it and use it if you like :)
http://utasks.idev.lt <comment><USER2> It's cool that you did this. Not sure that sort of focus works for me but at least you have it for you now ;)

I do have one suggestion anyway: knowing how many tasks remain ahead might be cool. Like a progress bar, or an "i/N" counter.

<comment><AUTHOR> I was thinking about adding i/N counter, but I decided that it may disturb.

I may add show/hide for this in the next revision.

Thanks for suggestion!

</comment></comment><comment><USER3> Broken for me -- I can't add a new list of tasks.

<http://utasks.idev.lt/lists/4b33dd7e6b2f6b571b000010>

EDIT: I was doing it wrong.

</comment><comment><AUTHOR> clickable link: <http://utasks.idev.lt/>

</comment><comment><USER4> what other technologies are you using apart from MongoDB ?

<comment><AUTHOR> sinatra, heroku and mongoHQ

<comment><USER5> Weird. I did a to-do list using the same technologies, Sinatra and MongoDB. <http://tasks.cfpg.me/>

<comment><AUTHOR> Hehe. Weird things happen.</comment></comment></comment></comment>


Show HN: A Parody of our Product - <AUTHOR> http://www.meowbify.com/

<comment><AUTHOR> (Author here) This is an offshoot of a codebase that is used as an internal (and soon to be external) development tool.

It's a hit around the office and makes light fun of our real product.

It's build on Node.js, and in particular uses a nice SAX parser (<https://github.com/tautologistics/node-htmlparser/>) to handle the page transformation.

Also, <http://www.catapi.com> provides the cat images.</comment>


How To Not Fit In On A Development Team - <AUTHOR> http://blog.james-carr.org/2008/08/18/how-to-not-fit-in-on-a-development-team/

<comment><USER2> Hm, sounds like a whole lot stupid guys are throwing a popularity contest. Remind me not to apply for a job with carr's team.

<comment><USER3> The way I see it, Carr is saying that being a prima donna on a team is a bad thing. Do you disagree with that?</comment></comment>


Ask HN: How do you read the news without getting depressed? - <AUTHOR> I don't want to stop following the news for fear of not knowing what's going on, but I'm finding that reading the daily news leads my thoughts into a dark place of dwelling on all the miseries I'm powerless to fix.<p>How do you do it? <comment><USER3> I try to not read that much news and instead try to read books.

The quality of the news is decreasing to Facebook/reddit levels and designed to increase engagement by preying on your emotions. It's much like marketing.

The book Factfulness by Hans Rosling has some good thoughts on this - <USER2> the world is getting better, but the news has to sell ads, which means telling dramatic stories.

If something is truly important, I'll find out about it somehow (word of mouth etc).

That's not to say I don't skim the headlines once in a while, but let's face it, it's not really my job to know what is going on 24/7, so why worry about it?

<comment><USER4> > The quality of the news is decreasing to Facebook/reddit levels

News doesn't try to be objective anymore. Nowadays almost all tv hosts show their bias outright, even though they might invite people from the other side.

It's sometimes like watching a daytime talk show. I just started ignoring anything news related lately on YouTube and reddit, and I can feel my negativity decreasing.

<comment><USER3> Many of the article titles on Bloomberg etc seem to have turned into clickbait in the last few years. I suppose that's what works for driving clicks or maybe I have just wised up to it as I grew older.

I remember a 10th or 11th grade English class (US public school) where they brought in a guest journalist. She basically told the class that readers would rather read about the story of a family who went through a tornado rather than stats about how fewer people are dying from tornados... so I suppose things haven't really changed.

</comment></comment></comment><comment><USER5> You don't have to know everything that's going on. It won't change your life and you often won't have the means to affect the situation.

For example, I don't know what's going on in New Zealand. I've heard vague things about the shooting from people talking about it but I'm not even going to bother looking it up.

People die every day for depressing reasons. This is just another event that is only differentiated by the fact that it captured the attention of a Western audience.

Instead, I'm focusing on other things that I've already decided need my time. Don't let the news set your agenda. You can be informed on a slower cadence despite what people and the 24/7 news factory would want you to believe.

<comment><USER6> You make a very good point. Also, time gives us a saner perspective to view an event with, without attachment to emotions and impulsive thoughts. I am very much in agreement with what you said. I don't mind reading about something 6 months later.

Short of an armed overthrowing od the government where I live, or aliens attacking, or an asteroid hitting the planet, I don't see how instantly knowing the "news" helps me keep my peace if mine.

<comment><USER7> It also gives time for the media themselves to work out "the news". Oftentimes if you follow a story, it goes through many cycles before it gets to the actual truth. Delaying consumption here is actually beneficial from a time/cost perspective, too.

</comment></comment></comment><comment><USER8> Some random thoughts...

I still listen to NPR. It seems to be slightly tame / a little bit liberal. (I need to listen to something during the day, as I'm a programmer in an open office.)

I read Bloomberg Business week,(actual paper edition) cause it's a little more business orientated and I don't see a big political agenda.

I have a kindle that is probably 6 years old, with limited features. I think it is awesome because I can just read a book and not accidentally click on a website...

I have stopped checking news sites, or have reduce it significantly. Zerohedge, splinternews...

What has helped the most, removing Facebook in 2010 and then twitter in 2017. That has been a relief and I feel as a burden has been lifted from me. Just cause I can, doesn't mean that I need to know what everybody thinks about a particular issue.

I also go to the gym for the sole purpose of getting away from the computer and phone. I rarely, use my phone while in bed. From dinner time to when my son goes to bed (about 3 hours) I put my phone away completely. I personally believe that the phone addiction is part of the problem with the 24 hour news cycle.

I don't have cable tv

</comment><comment><USER9> In 2014 I've found myself trapped in Eastern Ukraine under Russian occupation. We had both Ukrainian and Russian news available, and I've learned three things from this experience.

1\. The defending side never knows what's going on. If they know, they prevent it with available countermeasures, and there is nothing to make news from.

2\. The offending side always uses the knowledge they have for propaganda. If they don't, it's because their news-making activities have been successfully prevented by the defending side.

3\. Never spill the third thing if you don't want to start a needless flame war.

I don't watch the news since then.

</comment><comment><USER10> It's important to consider what "the news" is. Pre-cable TV, it was 30 minutes a night to summarize everything in the world. As I understand it, it was closer to a public service than profit-seeking content.

Cable news changed everything, because then there was all day news, and competition between news sources. To succeed, it's about engagement, not education. This has become amplified with the internet. All of the incentives are in place to manipulate you with emotional triggers and take advantage of your sympathies to get your clicks.

Not only does this not keep you "informed," it actually helps give you an incorrect worldview that's overly pessimistic.

To get a much better understanding of the world, and how to navigate this sort of media coverage, read the book Factfulness. It's a much better use of your time and it turns out that the world is a much different place than the narratives you find in clickbait.

</comment><comment><USER11> I try to add more structure to how I do things these days. It was not that long ago that I could just sit around for hours on social media, but it helped to have life goals that pulled me away from that.

I am only really aware of news in a few enthusiast areas, where it's effectively a source of entertainment, and a bit of local news(and then mostly headlines). When I need to be informed about something(e.g. elections), then it is a research project like in school. My experience with news is that the more you try to "understand" events by consuming news product, the more you get drawn in to a manufactured story of some kind(whether it's "scene drama", conspiracies, apocalyptic fears or ineffectual radical causes). But boring news - demographic statistics, business summaries, legislation, and so forth - contains all the whispers of the truth, all the facts that we very loudly obscure under public dialogue.

To create the world I want to live in, I must actively live in a way that creates that world, which means managing who I am and how I behave, and discarding parts of the rat race, while not going to full hermit/off-grid mode. Letting my grip on things loosen to play is OK, but I have to put myself in a situation where I'm not just looking for random stimulation and grabbing whatever works.

</comment><comment><USER12> Stoicism:

Focus on the things you can control.

Also, try to limit your exposure to the news, be deliberate about how much information/spam/whatever you are bombarded with on a daily basis.

<comment><USER13> This podcast episode is a good introduction to the ideas directly relating to stoicism and news: [https://soundcloud.com/goodfortunecast/episode-6](https://soundcloud.com/goodfortunecast/episode-6) \- it's on iTunes as well.

</comment></comment><comment><USER14> Don't read the news. It has nothing to do with what's going on. Actual history, big trends and really significant changes, usually show up in journal articles. The news is just a cycle of stories about people that people think are important. If you read the news from 1914, it tells you almost nothing about 1914, aside from what seemed interesting at the time, with a side-dish of nonsense.

If you hear about something contemporary that interests you (terrorism, brexit, war in yemen, etc) take the time to research it properly. Even wikipedia is much more information-dense than any but the best newspaper articles.

</comment><comment><USER15> I stopped reading/watching the news in the late 90s. I started by not reading the news for a day to see if there was anything important I was missing. Then a week and then a month. I pretty much realized anything important would filter though. For example I found out about 9/11 the morning it happened because it was in a huge font on yahoo's homepage (this was before they had news on the front page). For me I've decided I'm much better off. I'm not wasting a bunch of time on things I can't do anything about.

</comment><comment><USER16> Maybe you should screw your head right. What is so depressing about the news? Journalism has always been about sensationalism and clickbait, but for every depressing news, there are dozen little victories that the press ignores. We live in an age of unprecedented prosperity and the future trajectory is looking promising on multiple avenues. Millions of people will be lifted from poverty, hundreds of diseases will be eradicated, more and more people are getting connected globally and many things are affordable and will be increasingly so during your lifetime. We are sending rockets to space so casually that it's becoming mundane even to a layperson. Don't get me wrong, sure we are facing serious stuff on many many avenues, but you have to understand the scale and nature of everything that is going on. News only covers the wafer-thin cross-section of the global experience, and even then they just cover the fumbles and foibles.

Maybe what I'm saying is that you have to balance your diet with the awesome heroics that people constantly do and broaden your view of what is actually happening around the world. I don't have a simple answer to this, but what I can suggest is that maybe you look for science and engineering news, there might be positive sources for the developing human condition other than trashy journalism.

<comment><USER17> From my perspective, news has become far more angry and vicious in the last couple of years. Writers who in the past were more or less kindly and factual (if sometimes a bit goofy) have started putting out really hateful stuff. It's shocking and, yes, depressing.

<comment><USER16> I moved from general news to specific news a couple of decades ago, mainly because I was in an opportune position to see how the general news just tend to attack something they have really thin knowledge but hold as absolute truth. This was back in the late 90s and even if the more specific news outlets that had the expertise and knowledge to explain and educate, would later come to "fix the holes" it was pretty much pointless since the majority of people would just ignore facts because the story was already told.

News has been angry and vicious for a long time, maybe it's just now starting to hurt everybody due to public exposure by social media, the vicious crews can now attack anybody who has a public surface, and everybody has public surface thanks to social media.

</comment></comment></comment><comment><USER18> Follow Stephen Pinker's stuff, and remind yourself that the world is getting better and more peaceful but the media is just getting better at streaming what bad stuff is still happening direct to you. eg [https://www.nytimes.com/2018/11/19/science/steven-pinker- fut...](https://www.nytimes.com/2018/11/19/science/steven-pinker-future- science.html)

</comment><comment><USER19> Don't read the news.

</comment><comment><USER20> Why do you need to know "what's going on"? I've gone off grid for a month, and come back and realized that all the news I wasn't reading didn't affect me at all!

If you really need to "know", I suggest putting a reminder on your calendar to check Wikipedia current events [0] page once a week. And make a rule to not check it at any other time.

[https://en.wikipedia.org/wiki/Portal:Current_events](https://en.wikipedia.org/wiki/Portal:Current_events)

</comment><comment><USER21> Understand that "news" is a filtered set of "information" packaged for maximum impact in minimum time. For those in the "news business" they are there to get eyeballs, clicks, etc. for profit or world view support motives.

Basically I am noting that all "news" is filtered, edited, and often creatively rewritten. This is to maximize the likelihood of a particular desirable audience segment to interact with it.

So, yeah, I try to ignore pretty much all of it at this point. I skim some breaking news blogs/aggregators to see if anyone has started a war, or if there are disasters anywhere.

But I've learned to take everything "news" I read with a kg or two of salt. Its worse in science, where creative writing distorts actual discussions. The whole "IBM quantum computer went backward in time" bit from a few days ago is a perfect example of how wrong something can go by ignoring the language given to the reporter/PR firm, and replaced with a more creative exciting (in)equivalent paragraph. This is just one of a plethora of examples, but the point is, you generally cannot rely upon information content being accurate in the vast majority of writings.

I am sorry I am so cynical on this, but honestly, you'll feel much better if you stop reading the "news".

Note: scare quotes "" intentional.

</comment><comment><USER22> The principle of Despair-meme is simple, it is transmitted in the form of signals that simultaneously carry a danger and the impossibility of resisting it. For example: an endless stream of bad and terrifying news in public media, aggression from people in a higher position in the social hierarchy, nagging people who cause discomfort at the level of empathy, but not taking advice to solve problems, etc. Since the resulting stress is unsolvable, a closed cycle of self-reflection is created, producing stress and a feeling of helplessness, prompting a person to search for an accessible target for their sublimation and send the same signal to someone else. When the external signal ceases to function, the consciousness continues to paranoidly seek out any signs of a similar danger and inventing threats where there are none. So the meme of helplessness auto-stimulates itself. Thus, any new and unusual information will be perceived with suspicion.

Increased exposure to Despair-meme can also lead to apathy and paranoia. And this is just one of the well-known memetic hazards that the explorer of reality-tunnels should fear. Filter-bubbles and their habits to notice only useful things in your everyday life will also significantly reduce your chances of getting out of the pattern.

</comment><comment><USER23> I would suggest, first and foremost:

\- Don't read the comments. If you are on FB/HN/Reddit, you are not coming across news organically, but rather from a feed that is based on a black box of votes and engagement metrics. You open the comments thinking you'll be talking to people with a broad range of views, and that will rarely happen.

\- Comments on political topics are doubly exhausting to consume, as you are processing not just the article's thesis, but also the volume of comments, many of which are often phrased in a "Debate me!" way, that's not conducive to learning something new or changing your viewpoint on something.

\- Slow, long form news >> live feed news. Internet browsing has changed as the medium adapted to consumption of news on mobile. Everything is excessively short so its easily consumable and (ugh) shareable, and the trickle of articles with limited net-new information makes you think you need to be online all the time to keep up. You don't. Subscribe to a newspaper and read the daily edition at your leisure. With the daily edition you'll get a discrete amount of content that's time-bounded, whereas the web edition has no beginning and no end, and can feel impossible to keep up with.

</comment><comment><USER24> Listen to things like the marketplace or NPR podcasts. They focus on business and deliver things in a fun educational way. Don't read mass media terror news.

</comment><comment><USER25> You don't say where you are, but here in the UK at least there are weekly publications that give a summary of the week's news. Good thing there is that the terseness mandated by compressing a week's news into a page or two forces them to focus more on the facts, rather than pushing the publication's political doctrine (which depressingly seems to be the case in the MSM).

</comment><comment><USER26> I'm assuming you mean like current events news? I don't. If something important happens, I'll probably find out through osmosis. I'm stressed enough by things I can't control, why would I willingly subject myself to something that I know makes me stressed/depressed? Same reason I mute all notifications and only check them once/twice a day. If there's real emergency I'm going to get a call.

Not that I don't read any news, I just don't follow it, and try to avoid that type of news. I follow sites/blogs about things that interest me (arts, tech, science) and regarding political/philosophical stuff I read books. Sometimes I might be curious about some event (current or historical), in which case I'll go to look for the information I want to know from several different sources or if it's far back enough to have some books about it, get a book or two. For current news this is usually more than a few days after the event so info is also more accurate.

</comment><comment><USER27> Do you really have to read it?

If you must:

\- Choose an rss reader and curate your own sources.

\- Read long-form news periodicals instead of the daily news, which tend to be less toxic.

</comment><comment><USER28> One thing I think a lot people are pretty bad at is filtering content. We're overloaded with content now, and I hear a lot of people saying "X is bad because there's bad content" where X can be Hacker News, Reddit, Twitter the news, etc.

I've never really understand that, because it discounts the fact that there is enormous value in every medium, you just have to skip the bad stuff.

I don't even notice that I do it, but hearing that made me realize how quickly I scan any of those media and just cherry pick the content I find valuable.

Maybe I'm just not as curious as other people, but I feel no obligation to read or look at something if it fails a 2 second gut check of "does this add value to my life?" No doubt, I probably skip a lot of good stuff, but I'm fine with the false negatives if I feel like I'm getting the valuable stuff I want frequently enough.

</comment><comment><USER29> Things aren't happening as fast as 24/7 cable news needs to fill hours. It is a lot easier to pick an half hour to pick articles and a half hour in the evening than be consumed by it. For better or worse Google news is still valuable to me for putting multiple headlines side by side and the difference in intent can be enlightening in its own way.

Another thing is especially in the last five years or so the number of pointless articles that do not inform or do real anything that end up as news just is too high. The article that is third or fourth to the post can be 100x more valuable in actually showing references or deeper analysis. It's ok to put the news on hold to stop eating your time/money. Also ditch 95% of opinion articles as hopeless.

</comment><comment><USER30> I don't. For exactly the reasons you describe. It's just downright ridiculous how much "bad news sells" has taken over. Worse click bait designed to trigger people is everywhere.

So headlines aside I just don't bother anymore

</comment><comment><USER31> Realize that you're a little fish in the larger scheme of things AND realize that your sense of moral calculation might be obselete if it tries to evaluate things beyond your local ken.

To paraphrase Nietzsche, work on your garden away from the storm of life. The world is merciless to phenomenal entities and it won't bend to your self- indignation.

</comment><comment><USER32> The book "Amusing Ourselves to Death" by Neil Postman presents an helpful idea to deal with it : information-action ratio. Basically, news about things you can do nothing about are not news, they are noise. After reading the book, I started selected my news source based on that ratio. Now I only read tech news and local news.

</comment><comment><USER33> Don't try to shoulder every single problem in the world.

Atlas isn't merely a mythological figure he's a cautionary tale.

</comment><comment><USER34> I can recommend the Farnam Street blog. It has an excellent article on this subject.

It may be what you need

[https://fs.blog/2013/12/stop-reading-news/](https://fs.blog/2013/12/stop- reading-news/)

</comment><comment><USER35> [https://en.wikipedia.org/wiki/Mean_world_syndrome](https://en.wikipedia.org/wiki/Mean_world_syndrome)

Don't think that because all you read is bad that the world is bad.

</comment><comment><USER36> I've put myself on a strict diet of no news, and I feel way better. It's way too easy to get weighed down by things you really can't do anything about. It was killing me.

Hope you're doing better!

</comment><comment><USER37> Study history, and realize that the world used to be so. much. worse.

</comment><comment><USER38> I read a lot less of it than I used to.

Most items are covered many times a day.

</comment><comment><USER39> [http://www.aaronsw.com/weblog/hatethenews](http://www.aaronsw.com/weblog/hatethenews)

</comment><comment><USER40> Anarchism.

Seriously.

Once you embrace the chaos, all of the toxicity is practically pornographic.

Tragedies are sad though. Just take comfort that they are less frequent all the time.

</comment><comment><USER41> I'm pretty wound up about the responses in this thread, so I'm going to come across a little hot, but it is not directed at you. You are asking a very important question, and you deserve a decent attempt at an answer.

First things first: everyone telling you to run away and do nothing is wrong. It's fine to limit your exposure to the World Wide Skinner Box and all, especially if it is eating all your free time, but disconnecting entirely is not the answer.

The word "idiot" comes to us from ancient Greece. "Idiotes" (ΙΔΙΩΤΕΣ) was a word used to describe people who abdicated their civic duties and stayed entirely absorbed in their own lives. Yes, it was meant as an insult. It still is, but it used to, too.

Your problem is that you aren't an idiot.

The best thing you can do is go out and act on these feelings. Getting stuck in a loop of "Read, refresh, despair" absolutely sucks. It makes a person feel so helpless. It's the worst.

The trick is to realize that you aren't actually helpless. Sure, you can't personally convince everyone in your country that maybe they shouldn't (for example) throw away democracy, nor can you expect to solve world hunger all alone. The biggest problems can't be solved all in one go by an individual. This can be hard to admit, especially for we folks who grew up reading sci-fi competency porn, but the first step to feeling better about your place in the world is to be honest about what you can do from a standing start. You're only human, and that's OK.

But still, you can act, and in a big way. How? What you CAN do is apply the same skills you use in programming to the big problems, i.e. break down the problem of your choice into smaller pieces that you CAN realistically attack. Then, pick a promising problem fragment and budget time, say 3-5 hours a week to start with. Don't try to do too much, especially at first, lest it become a huge burden that you resent. You still need to have time for fun stuff like visiting friends and wrecking noobs on your favorite war-themed hat simulator.

The easiest way to do this (in my personal experience) is to find a local cause to attach yourself to. You can absolutely make a huge difference in your local space. Bonus points if you can use your particular skill set to help, that's a substantial multiplier!

Does a local charity you like run their entire operation off of a 12 year old Dell Opteron running Windows Vista? BOOM, you can help!

Local political campaigns are just getting started, and getting in now will give your opinions more weight inside the campaign organizations since you'll be getting in on the ground floor. Does a local candidate need help managing their data operations via VANS/whatever the Republicans use? Could you run for something? BOOM, there you go!

Hell, it may be enough to find a meetup of people who drink (beer or coffee) and worry about the same things you do. History has loads of examples of great stuff that has come from sharp people hanging out in bars and cafes and shooting the shit (Bar napkins can be used for way more than physics problems!). Plus, you might get some new friends, which is also great for pulling yourself out of the aforementioned dark places all on its own.

If your experience matches mine, you'll feel loads better having put your shoulder to the burden and pushed. You won't be a bystander anymore. Agency is a currency that feels like solid gold, my friend. It won't make things not suck, not immediately, but you'll be doing your part, and that'll go a long way.

</comment><comment><USER42> Read [https://www.goodnewsnetwork.org/](https://www.goodnewsnetwork.org/)

</comment><comment><USER43> When I was undergraduate student I was spending 2-3 hours a day consuming politics in a wider sense. Of course this included daily news but also longer magazine articles and documentaries. Maybe that's just me but oftentimes when I see how people have much more bad lives than I do, I don't feel so bad anymore.

Oh and daily news is often presented in a very boring way, you don't have that so much with in-depth articles or even books about politics, those are sometimes even written in an ironic way. (Stating the obvious but probably it also makes sense not to read too many right wing sources with an aggressive sentiment - although as a proper democrat one should cross read. Still, reading a little tabloid stuff can be really funny btw.)

</comment><comment><USER44> i changed my primary news feed to Microsoft News. As silly as it might sound, they've done a way better job than others of putting positive news articles in the feed. When I was using Google News, which I can only assume tailored news to my previous viewing habits, I kept coming up with the same types of angry, depressing, divisive topics. Microsoft has more mainstream sources, the occasional outlier, and more "good news" stories.

If I want deeper topics, I know where to look. I started looking at more tech news, but i stray away from sites that insisted on getting more and more political. I get really burnt out on the constant anti-Trump mentality.

Oh, and quit using Facebook. Curtailing facebook usage alone helped me out a lot.

</comment><comment><USER45> I don't.

</comment><comment><USER46> I get my news from HN.</comment>


Show HN: Weeklies.io – collection of weekly newsletters - <AUTHOR> http://weeklies.io/ <comment><USER2> Any difference to Calacanis' inside.com ?</comment>


Show HN: Frequency.io a realtime news feed for your team - <AUTHOR> http://www.frequency.io A free service that lets you easily build a real time news feed for your team. Keep everyone up to date with deployments, events, etc. <comment><AUTHOR> A link to documentation [https://github.com/owainlewis/frequency- docs](https://github.com/owainlewis/frequency-docs)</comment>


LockIfNotHot Uses Temperature Sensor to Lock Your PC When You Leave Your Chair - <AUTHOR> http://blog.didierstevens.com/2011/04/06/lockifnothot/ <comment><USER2> Great, now my cat is a security risk. Nothing like a warm chair to exert an almost magnetic pull.

</comment><comment><USER3> This is a really cool concept - if only it didnt need extra hardware.

If the sensor was integrated into a laptop - that would be awesome.

<comment><USER4> One could use the webcam for this, although I'm not sure how that affects battery life. Also personally it would creep me out to have the cam enabled permanently.</comment></comment>


Gruber: Raining on the OpenClip Parade - <AUTHOR> http://daringfireball.net/2008/08/raining_on_the_openclip_parade

<comment><USER2> _"... The intent of OpenClip is fine. That there's been so much coverage regarding OpenClip in the past 24 hours shows just how much demand there is for inter-application copy-and-paste. But developers would be foolish to adopt a framework that only works today because of a loophole in iPhone OS 2.0 that is already closed in iPhone OS 2.1. ..."_

Protects users from nasties, protects Apple. Evil in good ways and bad.</comment>


Fool.js - April 1st Javascript Snippet - <AUTHOR> https://github.com/tsenart/fool.js

<comment><AUTHOR> Just paste this before your body closes: <script> // Uncomment the next line if you want the prank to happen only when the url hashtag is #april // if (document.location.hash.indexOf('april') > -1) document.body.style.webkitTransform = document.body.style.MozTransform = 'rotate(' + [45, 90, 135, 180, 225, 270, 315][Math.floor(Math.random() * 7)] + 'deg)'; </script>

</comment><comment><USER2> Am I the only one bothered by the fact that they refer to the URL anchor section as a 'hashtag'?</comment>


New York Post website blocks iPad Safari users to force app.  - <AUTHOR> http://www.appleinsider.com/articles/11/06/18/new_york_post_website_now_blocking_safari_access_on_ipad.html

<comment><USER2> It seems in some ways it is more valuable to have a tablet / phone with a really low market share and an uncommon user agent so it is treated just like a desktop browser by web sites.

My mobile phone is a Maemo device (running Linux), which most people haven't heard of. I've only noticed about 5 sites that detect the browser's user agent string as mobile so I get the desktop version of just about every site.

This has pros and cons. The browser slows down with some Flash embeds and obviously many mobile sites are more suited to a mobile device. Many sites also allow me to switch to the mobile version if I feel like it and I can't ever imagine being blocked like the New York Post is doing with the iPad.</comment>


Similarities between the behavioural effects of oxytocin and alcohol - <AUTHOR> http://www.eurekalert.org/pub_releases/2015-05/uob-tds051515.php <comment><USER3> Interesting. SWIM always felt that MDMA(Dosed correctly) gives many of the same effects as Alcohol.

It does take a long time to learn how to control MDMA and i think that it's mostly because of the intense Oxytocin overload which can make people do weird shit like taking of all their clothes, touching and feeling others inappropriately, trusting people they shouldn't etc. But once you know your dose SWIM think it's a great alternative to alcohol. At least for SWIM, it has many of the same desirable effects, that alcohol does, and i think that a large part of that, is the Oxytocin

If you think about it, it's kind of the same with alcohol. For me at least, it took a looong time to control, and to this day i still can't control it though that's mainly because of culture on social norms where we encourage and pace each other to get gobsmacked drunk. And lets be honest, alcohol makes us do weird shit too..

This article shines some light on SWIM's experience, and i can only nod while reading through the article.. And maybe, just maybe SWIM could try clean Oxytocin sometime in the future.

<comment><USER4> >SWIM

 _sigh_ this term is so moronic

<comment><USER5> I feel silly asking, but what does it mean?

<comment><USER6> Someone Who Isn't Me. Common term on drug-related forums. Typically because forums don't want people talking about their own drug use, presumably for liability reasons.

<comment><USER7> Because I'm sure it would hold up in court. "Your honor, my client was clearly talking about someone who isn't them." "CASE DISMISSED." _cheers erupt around the courtroom_

<comment><USER8> I suspect it's less about what would hold up in court vs. allowing people who would otherwise feel the need to act a fig leaf to look the other way.

Sort of like phrasing an interview question like this:

"First let me say we don't do drugs tests AND it does not look like your doing drugs right this second. Now, with that in mind are you _currently_... "

"By currently you mean right this second?" "Yes"

"Well then no."

Sure, both sides knew the correct answer to that question, but the _desired_ box was checked.

</comment></comment></comment></comment></comment></comment><comment><USER9> I don't really buy it. I work on oxytocin in the lab and while it has some interesting psychosocial effects to compare it to alcohol is a bit disingenuous.

They give it to pregnant women postpartum primarily to stop bleeding and unless you're bumping the dosage way up so that it can cross the bbb then It's not going to do much.

Edit: To the comment below suggesting oxytocin as a disruptor. The PK profile for OT is pretty underwhelming. Unless you inject it or snort it you wont get great absorption.

</comment><comment><USER10>
      Dr Gillespie added, "I don't think we'll see a time when
      oxytocin is used socially as an alternative to alcohol.
      But it is a fascinating neurochemical and, away from
      matters of the heart, has a possible use in treatment of
      psychological and psychiatric conditions.

Alcohol being the great social lubricant with some nasty side effects on your health - definitely feels like it could be disrupted by a "safer" oxytocin based product. Has a similar feeling to vaping vs smoking.

I would imagine a dose of oxytocin would produce a different concentration pattern of the hormone in your body versus normal/natural production - <USER2> there any known studies of long term effects of Oxytocin usage?

<comment><USER11> There is a better product / drug already:

It's called GHB, is endogenous to the body, has similar effects like alcohol, but is less toxic.

[https://en.wikipedia.org/wiki/Gamma- Hydroxybutyric_acid](https://en.wikipedia.org/wiki/Gamma-Hydroxybutyric_acid)

<comment><USER12> This is probably a good place to point out that GHB is not, in fact, completely safe. It can easily kill you when combined with other depressants, particularly alcohol. It's also physically addictive, and the associated withdrawal can be fatal. It's also been used as a 'date rape' drug due to the fact that relatively small doses can cause a 'coma'.

[https://www.erowid.org/chemicals/ghb/ghb_health.shtml](https://www.erowid.org/chemicals/ghb/ghb_health.shtml)

[https://en.wikipedia.org/wiki/Gamma- Hydroxybutyric_acid#Adve...](https://en.wikipedia.org/wiki/Gamma- Hydroxybutyric_acid#Adverse_effects)

<comment><USER13> All of which would be true of alcohol if it was primarily consumed at 200 proof.

I didn't hear the parent claim that GHB was completely safe. There is plenty of evidence, however, that it is safer and less toxic than ethanol.

</comment></comment></comment></comment><comment><USER14> GABA is the main inhibiting transmitter in the central nervous system. The opponent of cortisol which facilitates stress and alertness, so to say.

I dare to say that everything that calms the body, like alcohol, other drugs (GHB), or going to sleep has to do with GABA ;).</comment>