Iran forged the wrong SSL certificate - <AUTHOR> http://www.daemonology.net/blog/2011-09-01-Iran-forged-the-wrong-SSL-certificate.html <comment><USER2> This is something I've been talking about for a while. Back in 2009 I gave a presentation at Virus Bulletin on JavaScript security problems and highlighted some statistics on remotely loaded JavaScript:

1\. 47% of the top 1,000 web sites include google-analytics.com

2\. 69% include a remotely loaded web analytics solution

3\. 97% load something remotely

If you can attack any of these you get access to a very large number of web sites and can inject arbitrary code. Clearly forging the SSL certificate for SSL loaded remote JavaScript is one way in, another is an attack on the DNS of non-securely loaded remote JavaScript.

At the time techcrunch.com loaded 18 different JavaScript elements remotely. Attacking one would allow a complete site takeover using JavaScript. And those 18 elements could easily have been loading other elements so that attack could have been done through a third-party.

A quick survey in the UK shows that the banks HSBC, Lloyds TSB, Royal Bank of Scotland all load third-party JavaScript on the secure page used for online banking login. Barclays look like they are not, but in fact the domain they are using for one piece of JavaScript is a CNAME for a third-party.

<comment><USER3> After I started using NoScript, I was amazed at how many sites load Javascript from other sites. Google-analytics is common but I have noticed more and more sites are trying to load Facebook scripts as well.

Happily, my bank doesn't load Javascript from anywhere else.

<comment><USER4> Or so you think - as the parent says, it just takes a DNS entry to make somebody else's server appear to be yours.

<comment><USER5> That, or they might proxy a remote JS file through a script on their servers. I've seen that done a number of times.

</comment></comment></comment></comment><comment><USER6> There's an easy solution here: Load Google Analytics locally. There's no urgent need to load ga.js from Google's servers; there are benefits, namely speed, utilizing client cache, and getting updates, but its core functionality does not rely on _where_ ga.js comes from.

Then, the only resource loaded form Google's servers is <http://ssl.google- analytics.com/__utm.gif>, and that's just loaded via a new Image(), so even if you MITM that resource request, it doesn't execute as a script or anything similar.

</comment><comment><USER7> The DigiNotar hack adds to the hack of Comodo in terms of recent attacks on certificate authorities. The lead of Comodo blamed the attack on "a sophisticated state actor" aka Iran.

Moxie Marlinspike pointed out that it was his script 'sslsniff' that the hackers downloaded to carry out the attack. They didn't even change IPs from the one they used to download 'sslsniff' to the one used in the attack. The lesson: this could have been carried out by a script kiddie.

The head of security companies implying that hacking attacks must be caused by a state actor, simply because they don't understand the attack, creates a frightful prospect for the future of world security. Take these claims with a grain of salt. So long for 'sophisticated state actors'.

Source: <http://www.youtube.com/watch?v=Z7Wl2FW2TcA>

<comment><USER8> I agree. the "Iran Forged ...." heading is a bit much. No one really has any idea if this was state sponsored/encouraged or not. One cannot discount the single self motivated actor in this case. In fairness, the article does mention the presumption. I would be happier if they just said someone from within Iran.

</comment></comment><comment><USER9> We don't know that they didn't get a forged certificate for ssl.google- analytics.com.

Diginotar haven't (AFAIK) released even a partial list of affected domains, other than admitting that there were quite a lot of them.

<comment><AUTHOR> Quite true. If they did get a certificate for ssl.google-analytics.com, I guess the title of my post should have been "We're paying attention to the wrong forged SSL certificate" -- the contents of the post is still valid, though.

</comment></comment><comment><AUTHOR> Paging tptacek, please come to the white courtesy phone and explain that SSL is the greatest thing since sliced bread. ;-)

<comment><USER10> Colin, I'd like it if you're stop muddying the waters about my take on SSL/TLS.

I am _not_ a fan of the HTTPS/TLS CA system. You know I'm not.

I _am_ a "fan" of TLS, as much as anyone can be a fan of a protocol. Most if not all of the smartest crypto protocol people in the world have taken shots at TLS. Roughly once every 3-5 years, one of them finds a new vulnerability in TLS, which, when fixed, makes the protocol stronger. That's gone on for roughly 15 years now, making TLS the soundest cryptosystem available to developers on the whole Internet.

You don't like TLS. I get it. You think TLS is too complicated, that it has too much negotiation and too much statekeeping to reason about its security. I think that's a reasonable position to take.

You used to advocate that people write their own encrypted transports to avoid using TLS. You don't do that so much anymore. When you used to advocate that, I yelled about it, because you were wrong. Predictably, when people† write their own encrypted transports, they make grave errors that cause their cryptosystems to blow up.

Now you advocate that people use things like spiped, your new encrypted transport. That's fine too. I'm not recommending it, but wouldn't flag it if I found it on an engagement.

There you have the entirety of our engagement on the issue of SSL and TLS. Note how the Internet trust model doesn't factor into it? That's because we agree on that issue and there is no reason for us to argue about it.

† _never mind_.

<comment><AUTHOR> _I am not a fan of the HTTPS/TLS CA system. You know I'm not._

Yeah, but to 99.99% of people out there, the existing CA system is an integral part of TLS. Every time you tell people to use TLS, you're (inadvertently) encouraging them to trust the certificate authority structure.

<comment><USER10> No I'm not.

<comment><AUTHOR> Umm... care to elaborate? I'm not sure which bit you're disagreeing with here.

</comment></comment></comment></comment></comment><comment> mike-cardwell I'm not a big fan of handing over the security of my website to third parties by letting them inject arbitrary code into my pages, eg Google Analytics. A lot of people seem to do it without giving it any consideration though.

You have to weigh up the pros and cons I agree. However, do you _need_ that like button which works by including javascript from facebook.com, or can you live without it? Even better, can you do something alternative which allows you to have a like button, but without including third party script?

<comment><USER11> > can you do something alternative which allows you to have a like button, but > without including third party script?

How about create a JavaScript library that sandboxes execution of third-party scripts by loading them in iframes based off of a different domain? This would allow site owners to embed Google Analytics or FB Like buttons without worrying about the third-party scripts getting compromised or becoming malicious.

<comment><USER12> Most social plugins already have an iframe option.

E.g. search for iframe in <http://developers.facebook.com/docs/opengraph/>

Edit: I think I may have misunderstood you. Did you mean embed an iframe and using postMessage to control it?

<comment><USER11> There's a difference between the iframe version of Facebook's like button and the XFBML version. The XFBML version, for various reasons, is preferable to the iframe version (e.g. say you want to subscribe to the edge.create event to determine if someone clicked on the like button).

Now, if you want to add the XFBML version of the like button, you'd have to embed Facebook's JavaScript SDK script (<https://connect.facebook.net/en_US/all.js>) to your site. If connect.facebook.net ever gets compromised via a fake SSL certificate, your site will also be compromised.

Instead of letting third-party scripts run on your main site, it may be safer to let them run within an iframe based off of a different domain so that a compromised third-party script doesn't compromise your main site.

</comment></comment></comment></comment><comment><USER7> A solution: <http://www.convergence.io>

<comment><USER13> And how do you choose who to trust?

Until this incident DigiNotar seemed trustworthy.

<comment><USER7> It relies on people to set up Notaries that you can specify you trust. There are many organizations I trust. The Tor Project, EFF, my university, the local hackerspace etc. If they ran notaries, I would specify that I trust them. If a SSL Authority/Notary is hacked, you remove them from the list that you trust. At the moment, trust is not agile. Browsers specify in advance which authorities are to be trusted or not.

This project is in its infancy, so get involved, set up a Notary, contribute on GitHub.

<comment><USER14> I don't see how this is different (even after reading the blog above), other than reducing the initial input list of CAs. Today, if a CA gets hacked, I pull them out of my trust-chain. Either way, I have to pay attention. Help me understand how it solves this, because I do think SSL is currently quite broken and would like to see a solution.

<comment><USER15> In this case DigiNotar is being removed from browsers because nobody that lives in Mountain View happens to visit sites signed by DigiNotar. And aside from being Dutch, they're also unusually small (they only made 100k in revenue from certificate sales this year).

This is not the common case. There was a very similar incident with Comodo in March, and they weren't removed. This is because Comodo certifies some non- negligible portion of the internet (between 1/4 and 1/5th of certificates), and so removing them would break a lot of things.

The same is true for VeriSign, Thawte, Comodo RAs, Geotrust, Equifax, etc...

I don't trust any of these parties, and yet I kept them in my trust DB for years, because without them the internet was unusable.

What Convergence aims to do is make trust agility even easier than it was for DigiNotar, which itself was unusually simple for the CA model. It also aims to invert the trust relationship, and put trust decisions fully in the hands of the client.

<comment><USER14> I can appreciate that, I'm just not sure I understand how that will happen. I don't have a direct trust relationship with the vast majority of the internet, so I need to put my trust in somebody else I have a closer relationship with.

Right now, I trust the browser/OS vendors with the ability to black-list individual CAs (or white-list, as the case may be). In the "trust agility" model, I just have to choose somebody else I trust, right?

Maybe as a technical person who spends time in the security world, I can figure out who that should be, but isn't the average person going to find themselves in the same situation (trusting the browser/OS provider)?

Perhaps the better way to phrase this question is thus: How does this prevent 1/4th of the SSL Internet from going down when Comodo gets hacked?

<comment><USER15> The problem is that right now, in the common case, the browser/OS vendors _can't_ black-list individual CAs. Their ability to do so with DigiNotar is exceptionally rare, and would not be possible most of the time.

Trust agility ensures that _clients_ have the ability to make these trust decisions easily. A client does not necessarily have to be a _user_ , it could still be the browser/OS vendors. For details on how Convergence works, in order to answer your question of how it prevents 1/4th of the SSL internet from going down when Comodo gets hacked, the best reference is (unfortunately) still the presentation: <http://www.youtube.com/watch?v=Z7Wl2FW2TcA>

<comment><USER14> The presentation cleared things up marvelously. It may be worth adding the presentation to the convergence.io details page, even if it was just a clip of the last few minutes where you talk about notaries. Once you went through that, everything cleared up.

Thanks for taking the time to educate me.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> brown9-2 _Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope otherwise. What can we do about it? Don't load the Google Analytics javascript when your site is accessed via HTTPS. This is easy to do: Just throw a if("http:" == document.location.protocol) around the document.write or s.parentNode.insertBefore code which loads the Google Analytics javascript. On the website for my Tarsnap online backup service I've been doing this for years — not just out of concern for the possibility of forged SSL certificates, but also because I don't want Google to be able to steal my users' passwords either!_

I don't understand - if you are uncomfortable loading the GA javascript into your pages when users are using https to visit your site, why are you ok with loading the GA JS when visitors are using http?

Or is it implied in here that the analytics is used on http only pages because the sensitive pages on your site are https only? In other words, you are only using GA on non-sensitive portions of your site?

<comment><USER16> If you're using http then an attacker capable of a MITM attack can spy on your users no matter what you do.

</comment></comment><comment><USER17> How come it's just one CA that is needed to ensure the trust of a domain, especially one as important as *.google.com? It seems like it's only a matter of time before something like this happens again.

<comment><USER18> The idea is that all CA's are effectively fully trustworthy. The public keys for the CA's certs are loaded into browsers. When a specific SSL cert is created the private key is generated by the buyer (and never revealed) then the public key for that is sent to the CA and signed. In this way a link of trust is created between the CA and whoever bought the SSL cert.

Now, when a browser is used to go to a website using SSL it will ask that site for its cert, which contains the public key and the digital signature from the CA. If the cert is signed by a CA that the browser trusts then the browser in turn trusts that specific cert. The browser then uses the public key to encrypt a message to the site containing information for encrypting return transmissions to the browser.

The point being, all CA's are on an equal playing field, and fully trusted. The moment any one CA is no longer fully trustworthy or the moment its private key is no longer secure the whole system fails.

<comment><USER19> The said chrome will only accept one particular CA when verifying the signature for google.com (which is one of the reason the fraudulent cert was detected).

<comment><USER20> This should be a feature they offer to all of the Alexa top 100 websites.

<comment><USER19> Given the last comment here, I think they would accept it: <http://www.imperialviolet.org/2011/05/04/pinning.html>

</comment></comment></comment></comment></comment><comment><USER21> It's like Comodo and RSA are the security equivalent of 'too big to fail.'

</comment><comment><USER22> This is how you delete Diginotar from Firefox btw

[http://support.mozilla.com/en-US/kb/deleting-diginotar-ca- ce...](http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert)

but I think they just pushed new minor versions with them removed anyway.

<comment><USER23> This is how to disable it in OS X:

Utilities > KeyChain Access > System Roots (left) > All Items > find "DigiNotar Root CA" > right click, get info > expand Trust > When using this certificate, never trust

</comment></comment><comment><USER24> All this SSL spoofing of late coincides nicely with the adoption of "always on https" by facebook/google/twitter/et al.

<comment><USER25> The average person on the coffee shop wifi isn't an SSL CA, and that's what "always on https" is defending against. SSL doesn't protect you from someone breaking into your house with a gun and forcing you to reveal your email archive. But that doesn't mean it's not useful.

<comment><USER24> I'm aware of this; however, I'm just pointing out the ironic timing of these exploits.

You teach people to fear one thing, and in this case, they leap head first into something even further beyond their comprehension. They need to start teaching Internet 101 classes in middle school.

<comment><USER26> > You teach people to fear one thing, and in this case, they leap head first > into something even further beyond their comprehension.

Which, in this case, was the right thing to do.

</comment></comment></comment></comment><comment><USER27> I use NoScript. google-analytics is never activated.

<comment><USER28> I use Ghostery (linked on the DDG privacy site). Less invasive, should protect my privacy and help against the attack outlined in the blog post.

<comment><USER29> I use both. It lets me use sites that totally break with JavaScript off (lots of them!) while still nuking external tracker scripts.

</comment></comment></comment><comment><USER30> Slightly offtopic. can anyone explain how DigiNotar revoking the wrong certificate works?

As per my understanding the browser simply trusts all certificates issued by a trusted issuing authority, so how would you revoke a single certificate?

<comment><AUTHOR> Revoking a certificate works as follows:

1\. You add the certificate to your Certificate Revocation List.

2\. You pretend that people will check the CRL before trusting the forged certificate, ignoring the fact that some clients only check for updates to the CRL periodically and most don't check CRLs at all.

In short, it doesn't really work.

<comment><USER31> See also <http://www.imperialviolet.org/2011/03/18/revocation.html>

</comment></comment></comment><comment><USER32> Does this apply to ad networks as well?

<comment><AUTHOR> Depends how you insert the ad code into your website; but probably, yes.

<comment><USER33> If the ad code is inserted via JavaScript, then yes, the problem is real. Most ad code is inserted via JS, e.g. Google's AdSense.

But according to [https://www.google.com/adsense/support/bin/answer.py?answer=...](https://www.google.com/adsense/support/bin/answer.py?answer=10528) AdSense isn't available over https, so this specific problem of forged SSL certs does not apply here. But if you embed non-SSL code in your httpS page (and I assume that most users just ignore the message that would popup in this case, alerting them that non-SSL code is loaded into the "secure" site) there's no need to do that: just do the MitM attack.

</comment></comment></comment><comment><USER34> Just by having a forged SSL Certificate for ssl.google-analytics.com how can they supply their javscript ? The request still goes to the google servers and not to any evil-democracy-suppressors.gov.ir

So sure if they could reroute the request to their servers evil things could be done. But they can NOT. Or am i missing something ?

<comment><USER35> Of course they can reroute traffic. All they have to do is

* Force every ISP/Telco within their borders to add fake google.com entries to their DNS servers.

and/or

* Force every ISP/Telco to transparently proxy all DNS traffic and provide fake replies for google.com queries

You can even make it easier:

Just hijack IP routing at the borders, such that IP traffic to 184.108.40.206 (and all other google networks) are not routed to the real google servers on the internet, but their own malicious filtering proxies.

Even without involving the ISPs/Telcos, they could transparently hijack and proxy you, for a whole country it might be a rather big task though, but here's what you do:

* Find all the cables carrying internet traffic in/out of your country.

* Bring a shovel, dig up the cables.

* break the cables.

* hook up the cables to your transparent proxy/filtering machinery.

Done properly, all everyone would know know was some lights flickering in the few seconds the cables were broken.

<comment><USER36> If they can reroute traffic, why can't the exchange the certificates in downloaded versions of Firefox?

<comment><USER35> It'd be a far greater task intercepting all downloads for every browser out there and replace it with a malicious one. Besides, you'd not get to hijack people browsing with the IE that came installed on their PC, which likely outnumbers firefox users.

</comment></comment></comment></comment><comment><USER37> What would be necessary for some Paxos-based system to be used to sign certificates? That way, half of CAs would have to get hacked before something like this could be pulled off?

</comment><comment><USER38> Can anyone explain to me how I can open up a CA and get my CA certs distributed with browsers and JVMs and what not? Is there some sort of "IANA" that approves and manages this and why would they approve all sort of shady CAs which clearly are a dangerous weak link in the whole SSL construct.

<comment><USER39> There is no approval process, no central authority. If you want your CA in OS X, you talk to Apple, if you want it in Windows, you talk to Microsoft. If you want it in Firefox, you talk to Mozilla.

<comment><USER9> All vendors want market share in the Netherlands, so a few Dutch CAs get on the list; and they all want market share in China so the Chinese Ministry of Information gets on the list.

No browser wants to be the one which doesn't work with someone, somewhere's bank, so once you're on one list, you tend to get added to all of them; and it becomes nigh-on impossible for marketing reasons to remove anyone from the list ever.

15 years later, browsers have 80 CAs and 200 certificates built-in.

<comment><USER40> ...and what compounds the problem is that CAs are trusted on an all-or-nothing basis - you don't have a concept of _"this CA is trusted only for .nl domains, and this other CA is trusted only for .cn and .hk domains"_.

<comment><USER41> Chrome plugins are too limited, but could this functionality be implemented via a Firefox extension?

</comment></comment></comment></comment></comment><comment><USER42> What with Mozilla wanting to build a browser-based OS, the non-existent security measures of the DOM will beam us back like several decades in terms of security. Awesome. Not.

</comment><comment><USER43> I know that security through obscurity is no security at all, but I don't think it's particularly clever or helpful to give direct, useful advice to the goons in Iran.

This is not an anonymous argument. If you were sitting next to me, I'd be, right now, arguing that you should not publish this article because it will only cause harm overall.

What's next? "Why terrorists are stupid and what they should do to cause maximum damage"? How will you feel when the Iranian government does implement your kind suggestion?

<comment><USER44> If they're smart enough to forge SSL certificates, they're certainly smart enough to know about XSS.

<comment><USER43> The people who carry out the orders are not the ones giving the orders. Just because they're being ordered to "hack into Gmail" doesn't mean they have to find creative ways to do so. This blog post, however, provides useful, practical, exact, almost step-by-step suggestions to the people giving the orders.

I've not lived in a dictatorship, but my parents have, and from their stories, I gather that most of the smart people in a dictatorship do not really want to help the regime, but they have to because otherwise their lives or their families' lives and careers could be destroyed.

By pointing out exactly how they should do it, this article removes the wiggle room of plausible deniability that "we didn't know there was another way to do it".

<comment><USER45> Your argument is like saying that we shouldn't discuss guns since any criminal could just realize that guns kill people and start killing people.

<comment><USER46> I think his argument is more aligned with "responsible disclosure".

Or it's the difference between knowing the ingredients to Coke vs. the recipe.

<comment><USER47> But XSS isn't novel by any stretch of the imagination, so there's no "disclosure" going on here at all.</comment></comment></comment></comment></comment></comment>


California legislator launches country's first crowdsourced bill - <AUTHOR> http://america.aljazeera.com/watch/shows/the-stream/the-stream-officialblog/2014/1/1/california-legislatorlaunchescountrysfirstcrowdsourcedbill.html

<comment><USER2> Hardly the first as Darrell Issa and the OpenGov Foundation's Madison Platform inspired me in early 2012 but nevertheless a good move</comment>


Paul Graham Will Bring Office Hours Back To Disrupt SF, Sign Up Now - <AUTHOR> http://techcrunch.com/2011/09/06/paul-graham-office-hours-disrupt-s/

<comment><USER2> Unsure if it's just me, but it's amazing how much his questions remind me of thesis/dissertation defenses as well as grant writing in chemistry.

What problem are you solving? If you're successful who will benefit the most? What experiments will need to done? Is your lab capable of doing them? How much will it cost and how long until you get preliminary results?

My guess this applies to other hard sciences as well.

<comment><USER3> I worry. I worry.

</comment></comment><comment><USER4> Meanwhile, I hold Office Hours weekly at the Alembic in San Francisco, something I've been doing on and off since 2008[0] (and based off of a friend's office hours, same time same place, which he starting holding in 2007).

If you'd like free, abrasive, honest advice, suggestions, etc, feel free to show up:

<http://plancast.com/wooster>

Bonus: it's free. Interesting people sometimes show up (other than myself, of course).

[0] Started at Coupa Café in Palo Alto.

</comment><comment><USER5> Is this a "must attend" event?

<comment><USER6> I think tickets are like $3k or is that just for startup alley?

<comment><USER7> Yes, tickets are approximately $3,000. We would love to go, and apply for PG office hours, but can't swing that expense right now.</comment></comment></comment>


Understanding the LZ4 Memory Corruption Vulnerability: You Don't Play Right - <AUTHOR> http://blog.securitymouse.com/2014/06/understanding-lz4-memory-corruption.html

<comment><USER2> This article sounds bunk. The argument boils down to "because a security flaw is theoretically possible, we should consider it to be practically critical".

Obviously, that's nonsense. Assuming other analysis is correct suggesting that no vulnerable applications could be found, then there is no security flaw. LZ4 is not exploitable by itself; it is not a standalone application. Clearly, there's a bug. It's nice that it's fixed because it might have caused nasty problems in the future.

By analogy; is C a security flaw because it is not memory safe? Clearly, usage of C can result in overflows and other memory corruption. Nevertheless, usage of C does not necessarily imply security flaws. It's nice (and important in the long run) that we can avoid certain risks by fixing bugs or design flaws in our tools, and many other languages attempt to by being (mostly) memory safe to avoid this class of risk. But, however important, that long-term improvement is not the same thing as a critical security flaw now.

</comment><comment><USER3> The LZ4 Memory corruption was already fully described at the LZ4 issue board, and accepted by the LZ4 author. What is this article supposed to learn us ?

<comment><USER3> btw : [http://fastcompression.blogspot.fr/2014/06/lets-move- on.html](http://fastcompression.blogspot.fr/2014/06/lets-move-on.html)

</comment></comment><comment><AUTHOR>
      It's Just Not Big Enough
      The claim that 64bit platforms are not exploitable is
      incorrect. This is the same mindset that created today's
      LZO/LZ4 vulnerability. "No one will ever have that much
      RAM to cause a 32bit integer overflow!". Well, today we
      do. If this bug would have persisted and propagated
      further, surely 64bit architectures would be effected in
      the not-so-near future.

Worrying that RAM sizes will exceed 64-bit addressability hasn't been one of my worries. 2^64 is about 70,000 Petabytes. Of course, it wasn't too long ago when a Petabyte seemed unattainable, and not too long before that that a Gigabyte seemed giant, and even a Megabyte once seemed almost limitless. Am I just being short sighted?

<comment><USER3> Of course, this argument is totally nuts. 2^64 of RAM is not accessible, period. It's ludicrous to pretend that a code delivered today should take into consideration a potential issue that might happen in 30 years from now. Frankly, you expect the code to no longer be updated that long and still be used ??

<comment><USER4> Well, if a fix is possible without much hassle, it should be implemented. But it's crazy to raise as much attention as in this case.

</comment></comment></comment><comment><USER5> Ok, it appears there is a possible overflow in the Linux LZ4 decompression routine... But what actually uses this in the Linux kernel? Not saying it shouldn't be addressed, but is this really critical as it currently stands? It doesn't look like there is any way to _currently_ use this vulnerability.

<comment><USER3> Current kernel users : zRam, SquashFS, BTRFS, BootLoader First 3 use small block sizes, KB range. Last one used the LZ4 file format, which limits blocks to 8 MB.

Yes, there is no kernel program at risk right now, but it's nonetheless good to plug the vulnerability, in anticipation for future usages.

In my view, this does not deserve headlines. Instead, we should be happy to have software coders fixing problems even before they get a chance to happen.

</comment></comment><comment><USER4> I think the point of his critics wasn't that this is no real vulnerability but that the implied severity was blown out of proportion.

</comment><comment><USER6> I'm a little confused. Did Bailey find this bug, or did Ludwig Strigeus?

<comment><USER7> Ludwig did : [https://code.google.com/p/lz4/issues/detail?id=52&can=1](https://code.google.com/p/lz4/issues/detail?id=52&can=1) Bailey then misappropriate the finding, pretending to have done all analysis, which was all readable and accessible for everybody within this thread.

<comment><USER6> Do you have firsthand knowledge of this? Does that include all the various places the bug exists? Bailey documented more than one bug.

I read the bug report and the angry blog post about it, too.

<comment><USER3> Yeah, it could be that both discovered the vulnerability independently. It's just that, from a timing perspective, Ludwig found it first, and provided explanations which where accessible and readable to all on the public board. It doesn't necessarily mean that Bailey read them and appropriate them.</comment></comment></comment></comment>


Ask HN: Why aren't there any large e-ink monitors? - <AUTHOR> I tend to read PDFs at my computer, and I would prefer to read them on e-ink, on a large display.
I just searched and found Dasung Paperlike[0], but it seems both quite small and quite expensive.
Is there some technological limitation to creating a large e-ink monitor?
0:https://www.indiegogo.com/projects/paperlike-world-s-first-e-ink-monitor-13-3#/ <comment><USER2> Visionect have a 32" ePaper displays in color and grayscale: [https://www.visionect.com/blog/32-inch-eink-development- kit-...](https://www.visionect.com/blog/32-inch-eink-development-kit-by- visionect)

But they're pricy: grayscale is $3600, color is $4700: [https://www.visionect.com/development_kits](https://www.visionect.com/development_kits)

The underlying display is still made by eInk Inc, who sells a very similar product on their own website: 31.5" instead of 32", and only in grayscale - but surprisingly: for only $2000: [http://shopkits.eink.com/product/signage- evaluation-kit-v3-w...](http://shopkits.eink.com/product/signage-evaluation- kit-v3-with-31-2-epaper-display-ed312tt2/)

I plan to buy one of these large eInk/ePaper displays and mount them on the wall in my home's atrium where I'll display a dashboard showing traffic levels, road cameras, and a weather update. I'd really like color though, but $2000 vs $4700 - I guess I'll make-do.

<comment> luka-birsa I'm one of the founders of Visionect and we've been providing tools for EPD development for a while now. The pricing towards E Inks development kit reflects the tooling that is included in our development kits - you're able to plug one 32" panel to ethernet, configure the IP and display an image in minutes. Dynamic applications are simple web pages, so that gets our developers off the ground very fast - for instance: integration with Geckoboard literally means entering one URL in the server configuration.

PS: If I were looking to deploy a wall mounted panel which doesn't look like a development kit, I would wait for a while. ;)

</comment></comment><comment><USER3> I'm the founder of Sonder, an E Ink smart keyboard startup; I've written here previously about E Ink when we were published in WSJ regarding Apple.

E Ink is a brilliant display, but the process of manufacturing, cutting the TFT mask etc is expensive; only on mass volumes can displays costs become incredibly cheap (6" E Ink in a kindle is <$10 USD). It's the same for most displays OLED etc in small volumes are expensive; which is why the touchbar solution COGS is over $200 USD.

Therefore E Ink has a high MOQ of a few hundred thousand units, anything below that and you're priced at basically prototype costs which is why a 32" E Ink display is $2k.

</comment><comment><USER4> Depends how large you want to get, and what you really want it for.

If its really just for reading PDFs, have you tried a Kindle DX?

If you want something hooked up to a computer for whatever reason, I know [http://shopkits.eink.com/product/13-3%CB%9D-epaper- display-e...](http://shopkits.eink.com/product/13-3%CB%9D-epaper-display- es133ut2/) does exist and you can buy it (alibet its expensive -- but not as expensive as the dasung, wow, 1300?) but its very DIY development kit.

There was another company in the USA that I found that also sells e-ink displays that are _HUGE_ , they do it as digital signage (menu at a coffee bar type stuff). I can't fathom what they charge but its probably astronomical.

I do think this is all a bit unfortunate, I would love to have a few of these e-ink displays on my walls at home for things like shared calendar with my family and put a few in the office for our calendars too but its just crazy expensive and very inaccessible for now.

Unfortunately I think e-ink missed the boat. They never got past the volume curve to make large displays remotely mass produced (due to expense), and they are expensive because they aren't mass produced....

<comment><AUTHOR> I haven't tried the DX. Ideally I'd like a monitor that was _bigger_ than the standard 8.5x11 PDF page.

The other use case for it being a monitor is ease of use. It is slightly difficult to transfer a PDF to a Kindle; not very difficult I know, but enough that I rarely do it.

I think you are right about manufacturing scale. LCDs have such incredible scale I don't think e-ink could ever match, unless there was a combined e-ink LCD.

\---

Side note, that 13.3 e-ink kit looks suspiciously like the Dasung Paperlike form factor.

<comment><USER2> I got my dad an Amazon Kindle DX for Christmas 2013 - right around the time they discontinued it. The display still looks good today, though not as white as the latter-day handheld Kindles, and the product casing bends easily with slight pressure which makes the device feel cheap, though I appreciate it is very lightweight for its size.

It'd be great if Apple's industrial design team did an e-ink iPad, they would be able to make it considerably thinner and sturdier.

</comment></comment></comment><comment><USER5> Madness. If you want black and white dashboards in your office or home, or if you want to mount it vertically and read PDFs, just get a matte HD monitor, and set it up for B&W on your software settings. Then, you can turn it into a fish tank display when you aren't reading or viewing your dashboard (which sounds lame to me, but geekiness knows no bounds, I suppose). What is e-ink for? The "powered off" viewability? A real monitor left on all year takes almost no energy. I mean, if you can consider $3000 to put a dashboard up to monitor the weather (what is happening to the human race?), you can swing the extra $20/year by just leaving a real monitor on 24/7, especially when you'll only pay $250 for it. Madness. Maybe go out and spend time in the rain and not know it was coming? Or just talk to people and get to know them? Or explore new places in town with using a mapping tool first? Sigh... we are all doomed.

</comment><comment> luka-birsa I'm one of the founders of Visionect ([http://www.visionect.com](http://www.visionect.com)), that focuses on EPD solutions. We offer a bunch of development kits (6"-32") that can be easily productivized (our customers are building bus stops, traffic signs, museum signage, room booking systems,...)

There are no technological limitations in terms of the panel size (backplane technology is practically the same as TFT), but its rather a volume question.

We see this "personal display" theme pop-up quite often on our email, but the pricing is prohibitive (even compared to high quality and high resolution LCD _consumer_ panel) and the refresh rate does impose a lot of limitations on what you can do.

I think that E Ink is best used for displaying information and use cases that benefit from E Ink itself (think high contrast, outdoor scenarios, indoor units that work 24/7, applications where you can power a display with a battery and reduce installation complexity).

<comment><USER6> There is a minority of people who are interested in e-ink monitors because it's felt this type of screen does not trigger migraines. My experience with e-ink is with the Kindle, and it seems that I am not tensing up my forehead as much. My second point is going to sound a bit silly, but I'll put it out there anyway with the chance that someone relates. I think I have an Internet addiction problem, and I like the idea of making it a bit harder/slower to peruse the Internet. If it takes a site longer to load, I'm going to be more judicious in what I click on. Ok. Go ahead and laugh now.

</comment></comment><comment><USER7> [https://www.engadget.com/2017/01/03/quirklogic-s-quilla- is-a...](https://www.engadget.com/2017/01/03/quirklogic-s-quilla-is-a-42-inch- e-ink-whiteboard/)

Looks like if it's a technical issue, it's a solvable one.

<comment><USER4> That looks really cool and I'd totally buy one even if it was like 1-2k, but unfortunately its probably 10x that or more.

</comment></comment><comment><USER8> There's Visionect's 32" e-ink display ($3599 for the dev kit or $4699 if you want the color version): [https://www.visionect.com/product/development-kit- with-grays...](https://www.visionect.com/product/development-kit-with- grayscale-32-e-ink-display/24)

There isn't any technological limitation as far as I know; it's just that e-ink displays are hideously expensive to make.

</comment><comment><USER9> I wouldn't mind having a 24" or 27" for coding use. All those years of having active pixels (and phosphors) blasting my eyes can't be a good thing. An issue might be getting good quality ambient lighting to use with a display like this.

<comment><USER10> I think the slow refresh rate would make coding impossible.

<comment><USER11> The refresh rate of the e-ink displays of certain smart watches surprised me. It was displaying fluid animations without any ghosting.

I'm not sure if refresh rate is a function of display size at all, but I will say they've come a long way at improving it over earlier Kindle modles.

<comment><USER12> If you're referring to the Pebble, that used Memory LCD, not EInk, and it's a completely different technology.

</comment></comment></comment></comment><comment><USER13> There is the Onyx Book Max which is a 13.3" grayscale Android tablet with an e-ink display. Which is kinda "cheap" with around $750 compared to other large e-ink devices.

I use it to read PDFs and take notes with a stylus pen.

[https://www.amazon.com/Onyx-Max-13-3-Flexible- Handwriting/dp...](https://www.amazon.com/Onyx-Max-13-3-Flexible- Handwriting/dp/B01EVACVHY)

</comment><comment><USER14> There is also PaperCast company ([http://www.papercast.net](http://www.papercast.net)). They found their market in bus stop displays, but also work for other applications. You get illuminated device for outdoor use in anodised aluminium frame and with antiglare front protective glass. Just contact them. They will try to find a solution also for your application.

</comment><comment><USER15> A little searching brought up a recent survey of available "large" e-ink based readers which I'm pasting here in case others also find it useful: [http://blog.the-ebook-reader.com/2017/01/19/large-e-ink- erea...](http://blog.the-ebook-reader.com/2017/01/19/large-e-ink-ereaders- roundup-for-2017/)

</comment><comment><USER16> Sony has a bigger screen ebook reader but it is also expensive. I have been using Kindle DXG but it has no WIFI module.

</comment><comment><USER17> e-ink displays refresh rather slowly. My Kindle is slow to page refresh when I use the built-in browser. I'm assuming that that flicker would become progressively worse as the displays become larger.

<comment><USER3> Our E Ink keyboard startup has developed timing controllers to avoid this. This is 4hz, you can get up to 20 Hz; and play videos or games on E Ink.

[https://www.youtube.com/watch?v=u1tmjDDK7jY](https://www.youtube.com/watch?v=u1tmjDDK7jY)</comment></comment>


Build Your Own Intellectual Oasis - <AUTHOR> https://quillette.com/2020/01/04/build-your-own-intellectual-oasis/ <comment><USER2> Because it is possible!</comment>


The Command Line Challenge. - <AUTHOR> http://blog.chavezgu.com/2012/03/07/the-command-line-challenge/ <comment><USER2> Amusingly, Emacs can do pretty much all he listed. Of course, as somebody who pretty much lives in Emacs and a browser, I'm probably the wrong demographic :).

Also, I'm annoyed at other commenters' equating "command line" with primitive: just because GUIs are newer does _not_ mean they are superior or that the command line is obsolete! For a large range of tasks like file management or system administration it is actually superior; for quite a lot of other things it's completely usable. I'm not saying GUIs are useless or that the command line is perfect for everything, but it is far from obsolete or inferior.

Now, doing _everything_ in a terminal is overkill, which is why this is a _challenge_ \--you're not expected to use a terminal forever, just long enough to get sufficiently acquainted with it so that when you do things the terminal is great at--which you will--you will be able to use it as efficiently as possible. And, since all the readers here doubtlessly spend _very_ large amounts of time behind a computer, being as efficient as possible there should be a priority.

Coincidentally, I say all this as somebody who started using a computer with Windows 95. I only learned how to use the command line (first a bit on Windows then on Linux) because it looked cool; I continue using it because it turned out to be more efficient at a whole host of tasks than using a GUI.

</comment><comment><USER3> More like "the terminal challenge." Curses-based programs (like vim, mutt and lynx) still have graphical user interfaces, they just have really shitty graphics. (And that's not a criticism of those programs.)

Try spending a week using just ed, mail, and curl. Those are actual command- line programs, not just terminal-based programs. The litmus test is whether they would work with a real paper teletype.

<comment><USER4> _Curses-based programs (like vim, mutt and lynx) still have graphical user interfaces, they just have really shitty graphics. (And that's not a criticism of those programs.)_

I'd say the keyboard-centricness still separates them from, say, Eclipse.

<comment><USER5> For those looking for a keyboard-driven browser, try <http://conkeror.org/>

<comment><USER6> or <http://uzbl.org>

<comment><USER7> or <http://dactyl.sourceforge.net/pentadactyl/>

or <http://luakit.org/projects/luakit/>

</comment></comment></comment></comment></comment><comment><USER8> My (unintentional) Command Line Challenge was trying to build Gentoo on a 100MHz laptop with no other computers around. That was about 2 days of compute work. At the time, it didn't compile reliably either, so emerge would crash 5-10 times while trying to get to Xorg. Learning to fix the problems, particularly via lynx, brought me up to speed more quickly than anything else.

Something to be said for leaning by immersion.

<comment><USER9> I agree with your general point, but configuring Xorg is a form of torture no man deserves to go through.

<comment><USER10> Hah, kids these days. Xorg is a DREAM compared to it's predecessors X11 and friends.

<comment><USER9> Xorg is fine today, it's pretty much automatic. I'm talking about 6 or 7 years ago when you had to dive into xorg.conf to get 75% of graphics cards to work.

</comment></comment></comment></comment><comment><USER11> Short answer: No.

Lynx/links/elinks are not acceptable substitutes for a modern browser.

The command line is a powerful tool, and it has its place, like any other tool. This just reeks of "all I have is a hammer..." syndrome.

<comment><AUTHOR> It's not intended as a full replacement. It's about reducing your technology for a few days in order to get proficient in the console. The browsers are just because we all need google or hacker news sooner or later.

<comment><USER12> With respect: "larval mode makes you learn things" is obvious even without a blog post.

</comment></comment></comment><comment><USER13> _I recommend Vim because I use it every day._

I have to say that I haven't seen such a fair argument in favor of emacs or vi for years.

</comment><comment><USER14> I upvoted this because it links to a lot of useful-looking terminal programs that I didn't already know about.

<comment><USER7> Related, a great list of them: <http://jaredandcoralee.com/CLIapps.html>

</comment></comment><comment><USER15> Will using cli tools for no real reason be the next hipster retro thing? If so, I just want to state that I've used the terminal and cli applications/tools long before it was cool :p

</comment><comment><USER16> Yeah, so, I did that. On VT-220 and VT-320 terminals, connected to VMS on VAX and Solaris on Sun. Oh, and command line on a 486DX33 running Linux so long ago that the concept of a distribution was new.

I love command lines, and I use them every day. Most of my work is on a command line... in a term window in X. The Linux virtual terminal system was a great advantage. The ability to run multiple terminal windows on-screen at the same time, with a clipboard! that was an amazing achievement. Virtual desktops? Great.

All of these things are advantages, and you don't need to stop using the good stuff that works in order to use the new stuff that works. Today I click on one of my sidebar icons to summon the terminal windows in which I do most of my work. I have enough RAM that I can keep heavy graphical browsers open -- FF and Chrome -- with hundreds of tabs open.

I'm happy to be able to use everything. I'm happy to have choices.

<comment><USER17> The article didn't make any religious argument for the command line opposed to a GUI. His background is the opposite of yours. For him, relying on the ease of a graphical interface was a habitual deterrent to stepping out of his comfort zone and learning the CLI. Temporarily restricting himself to use only CLI was a focusing mechanism to help him gain strength in a weak area. His efforts demonstrate the hacker ethic quite well. He could have easily stuck with the familiar, but decided to force himself to go out on a limb.

</comment></comment><comment><USER9> > lynx has more options and is more powerful in general, but elinks has a > better rendering and looks.

I've never understood why lynx gets so much more love and respect than elinks. Elinks has tabs, lynx doesn't. Elinks supports some EMCAscript, lynx does not. What are these special features that only lynx has?

</comment><comment><USER18> Honestly, I'm going to fall back on right tool for the right task.

I just happen to be able to get a lot done using a terminal. However, that does not mean I want to be doing something Excel-ish in anything but Excel.

<comment><USER19> Yes. But. The trick is knowing other tools in sufficient depth to know when Excel is an anti-pattern.

Which is hard, b/c it's so flexible that it gets adapted to a lot of stuff it really shouldn't be. A big chunk of Corporate America uses Excel the way our foreprogrammers used Perl or Bash, adapting it to all manner of tasks because it's what they know. I admire their resourcefulness (and scorn their IT environment for limiting their access to better tools) but that handiness leads them into solutions that are fragile, unmaintainable, uncheckable and unscaleable.

The step from Excel to broader, more flexible tools is the move away from graphically delineated relationships to logically stated relationships. It's a very hard step, and one most people won't make unless they force themselves through a period of clumsiness while they orient themselves to a new approach.

Exercises like the OP are a great way to do just that: "I'm going to force myself in this direction by setting some simple but arbitrary obstacle that will build capabilities I can use elsewhere." Doing so on tasks that are well understood may help even more -- "I know how I would do this in Excel, how do I do it in Python?" -- because your knowledge of the problem frees you to learn the new things about this new sort of solution.

The OP isn't saying the CLI is the right tool for everything, he's saying this is a way to build the understanding that lets you move to it freely when it is the right.

</comment></comment><comment><USER20> I do this. I live in the command line exclusively and have for over a decade, except for web browsing (Lynx is extremely useful though) with Firefox + pentadactyl, and PDF/image,video viewing/editing.

But then again I'm a little biased, since I work for a company that makes our own vi, perl, awk port of entire POSIX APIs for Windows and UNIX shells etc. And cross platform ALM suite of applications (Linux, Solaris, AIX, HPUX, Windows, Mac OS X). I can't imagine being a developer and not being in the CLI 99% of the time.

<comment><USER9> It's frustrating. I envy you.

</comment></comment><comment><USER21> On image viewing:

You can use the (terribly named.) libcaca. Or you can use fbi as root and take advantage of having a display that isn't a physical teletype.

<comment><USER4> If you let 'console' include 'xterm' (in Ratpoison, perhaps) then w3m displays images in an xterm just fine.

</comment></comment><comment><USER22> CLI is great from *NIX perspective and I believe most of us had used it extensively in the past. I still use CLI but if and only if it suits as the best tool for the problem I'm working on. The fact is, that the paradigm has changed, therefore the way we interact with our computing devices.

IMHO, bigotry is not only bad in politics. We have to embrace the change, learn new tools, improve, share our knowledge and not only make our jobs better for ourselves, but also for others. Especially for rookies, who will have to be doing more tomorrow than what we do today. I don't believe `libcaca` has anything to serve this purpose.

Using mutt instead of gmail; I'd ask "Why?". We don't need to stick with the tools we've used 10 years ago. If I'd be looking for a challenge as a sysadmin, I'd learn ways to better utilize cloud environments, look for better ways to serve static content for large volume systems, improve my tool base for managing geographically distributed servers, learn about the requirements of the new era of real time web, how to deploy node.js on my servers, etc.

<comment><USER23> You point out that you're familiar with the command line, thus this article isn't really for you.

For people who haven't used CLI before; or who don't have much experience of the command line: it makes some things about the Unix way a bit clearer. One program does one task, but does it well. You pass the output from one command into the input of another. Input and output are text, because text is universal.

These are important powerful concepts and I'm disappointed that they've largely been forgotten in the GUI world.

I'm also baffled that my vastly powerful computer has areas of lagginess when grinding through some seemingly trivial things. A pure-CLI trivially-easy-to- install distro[1] isn't going to happen, but imagine the use people could get from all those old computers which are not coping with modern OSs.

[1] Linux from scratch definitely does not count. TinyCore doesn't really count. Arch sort of comes close, but would need to be i) Much easier to install and ii) have a specific repository for CLI / Curses / etc software.

</comment></comment><comment><USER24> I use a lot of command line tools these days, but I always use a web browser for browsing the web and a proper music player too. I don't think "going cold turkey" from the GUI is really a good idea.

Both have their place.

<comment><USER7> _proper music player_

I can understand the browser - I use a graphical one too - but except for CD covers there's really no content a music player needs images for.

Ncmpcpp has a clear, nice interface with features like automated lyrics downloading, database management, tags editor, playlists, etc. And the advantage is that since it's only an MPD frontend, you can still use mpc to script stuff.

</comment></comment><comment><USER25> Probably not so useful but a more hardcore challenge: limit yourself to a visual equivalent of a braille terminal.

</comment><comment><USER26> I suppose now we have a new generation of developers who have never had nothing but a DOS prompt to stare at. I have no desire to relive the days before high resolution displays, mice, and the most amazing software that has ever existed.

<comment><USER12> Have to agree. I mean, I probably count as the tail end of that generation, at least in terms of actual programming (though I sort-of-fondly remember the joys of SUBSTing drive letters for games in DOS when I was five or six...), but I do definitely remember 80x25-and-that's-all-you-get (heck--QBasic, anybody?). I have been to the land of stone knives and bearskins, and I am so very grateful we don't still live there.

</comment></comment><comment><USER27> I draw the line at viewing pictures in text. C'mon Son!</comment>


Bad SSL certificate found on cnn.com - <AUTHOR> https://www.reddit.com/r/programming/comments/5310bh/heres_how_broken_todays_web_will_feel_in_chromes/d7qfpw7 <comment><AUTHOR> The CNN issue looks like some type of CDN screwup, but the real bad thing is that this single cert covers all of the below domains:

        a.ssl.fastly.net
        *.a.ssl.fastly.net
        fast.wistia.com
        purge.fastly.net
        mirrors.fastly.net
        *.parsecdn.com
        *.fastssl.net
        voxer.com
        www.voxer.com
        *.firebase.com
        sites.yammer.com
        sites.staging.yammer.com
        *.skimlinks.com
        *.skimresources.com
        cdn.thinglink.me
        *.fitbit.com
        *.hosts.fastly.net
        control.fastly.net
        *.wikia-inc.com
        *.perfectaudience.com
        *.wikia.com
        f.cloud.github.com
        *.digitalscirocco.net
        *.etsy.com
        *.etsystatic.com
        *.addthis.com
        *.addthiscdn.com
        fast.wistia.net
        raw.github.com
        www.userfox.com
        *.assets-yammer.com
        *.staging.assets-yammer.com
        assets.huggies-cdn.net
        orbit.shazamid.com
        about.jstor.org
        *.global.ssl.fastly.net
        web.voxer.com
        pypi.python.org
        *.12wbt.com
        www.holderdeord.no
        secured.indn.infolinks.com
        play.vidyard.com
        play-staging.vidyard.com
        secure.img.wfrcdn.com
        secure.img.josscdn.com
        *.gocardless.com
        widgets.pinterest.com
        *.7digital.com
        *.7static.com
        p.datadoghq.com
        new.mulberry.com
        www.safariflow.com
        cdn.contentful.com
        tools.fastly.net
        *.huevosbuenos.com
        *.goodeggs.com
        *.fastly.picmonkey.com
        *.cdn.whipplehill.net
        *.whipplehill.net
        cdn.media34.whipplehill.net
        cdn.media56.whipplehill.net
        cdn.media78.whipplehill.net
        cdn.media910.whipplehill.net
        *.modcloth.com
        *.disquscdn.com
        *.jstor.org
        *.dreamhost.com
        www.flinto.com
        *.chartbeat.com
        *.hipmunk.com
        content.beaverbrooks.co.uk
        secure.common.csnstores.com
        www.joinos.com
        staging-mobile-collector.newrelic.com
        *.modcloth.net
        *.foursquare.com
        *.shazam.com
        *.4sqi.net
        *.metacpan.org
        *.fastly.com
        wikia.com
        fastly.com
        *.gadventures.com
        www.gadventures.com.au
        www.gadventures.co.uk
        kredo.com
        cdn-tags.brainient.com
        my.billspringapp.com
        rvm.io

WTF, Digicert?

Full details can be viewed at: [https://www.censys.io/certificates/ca5c57bee6ab21c055dcdbe8a...](https://www.censys.io/certificates/ca5c57bee6ab21c055dcdbe8ad25feef6d1764a92e2aaaadb5d55fb667c3f8ac)

<comment><USER2> CDNs sharing certs between many clients is not unusual, is there anything particularly bad about this practice?

It increases the risk if one certificate is broken, but if it is stolen an attacker likely could have stolen a set of individual certificates as well.</comment></comment>


Ask HN: Phone interview etiquette - How late is too late? - <AUTHOR> (A throwaway account - I'm an active HN participant)
So I had a bunch of phone interviews with an awesome company which you all have no doubt heard of. The interviews went really well (in my opinion, of course), but here's the issue...while I was told by the interviewer that I'd be contacted for an on-site interview "in a couple of days", it's been a week.
So what should I do at this point? I've already sent in my thank-you-for-the-interview email. Should I move on, and think all is lost? Should I send a reminder email (since it's already been a week) asking if they've any update?
Damn, I feel gutted. <comment><USER2> Contact them and ask them about the status. Sometimes applications fall through cracks and a reach out from you can put the train back on the track.

<comment><AUTHOR> I sent another email. I hope I'm not coming across as someone desperate for the position, but rather as someone who's really keen on working with them!

If I don't hear back, I'm guessing I should throw in the towel. I have their phone numbers though...would it be out of order if I called them, say, a week from now, if I don't get an email reply? Or would that be creepy?

The optimist in me has been crossing fingers in the hope that my application fell through the cracks, as you put it. I will be totally dejected if I don't hear back (at least an outright rejection will put my mind at ease!), especially as I had believed I had built quite a rapport with my latest interviewer who seemed keen on having me on-site.

<comment><USER2> Dont be so upset! I dont know what vertical youre in but if youre in CS then just read up, analyse the tech details you didnt get and apply to other companies. Theres a bunch of companies doing interesting stuff.

<comment><AUTHOR> Surprise, surprise. I got an email for the on-site. Looks like I just needed to "nudge" them after all!

Time to learn to chill out.

Thank you, all!

</comment></comment></comment></comment><comment><USER3> If the company is google chill. It takes a while. Rejections come early. So feel good.

<comment><USER4> This reminds me of school applications. No news is sometimes good news (it may depend on the school), until the final notification date.</comment></comment>


Ask HN: When does it make sense to use a 401K to fund a startup? - <AUTHOR> It's just been brought to my attention that one can use a structure known as ROBS (Rollover for Business Startup) to invest IRA or 401K money into their own business.<p>Has anyone had experience taking this approach? If I'm planning on launching a bootstrapped startup in a year does it make sense to max out my 401K now and invest it via ROBS to bypass income tax? <comment><USER2> If you lost all your 401K money, you not only lost the money, but you also lost the TIME that it took for that money to accumulate and grow. In addition, I would think there would be tax implications for losing that money. I don't know enough, but this sounds like a very risky and bad idea compared to getting a bank loan. In addition, your 401K is safe during bankruptcy -- in case your bank loan goes bad. The approach of using retirement money for a venture is gambling with your safety net.

</comment><comment><USER3> It doesn't. Its far too big of a gamble to risk throwing away your retirement. If you can't finance your start-up with cash on hand then you need to come up with a way to get cash that doesn't involve 401k's/IRAs

</comment><comment><USER4> I'm unfamiliar with ROBS, but in the general case, you not only face penalties for early withdrawal, but it counts as added _regular income_ for tax purposes.

<comment><AUTHOR> Well the point of ROBS is that neither of those apply as far as I can tell. I certainly would not take money out were that not the case.</comment></comment>


Open-plan offices don't work and will be replaced by the 'coffice' - <AUTHOR> http://www.telegraph.co.uk/science/2017/10/01/open-plan-offices-dont-work-will-replaced-coffice-says-bt-futurologist/?WT.mc_id=tmg_share_tw <comment><AUTHOR> Full title includes "says BT futurologist"

</comment><comment><USER2> Looking forward to the covfifice</comment>


Show HN: Emacs org mode integration with IPython - <AUTHOR> https://github.com/gregsexton/ob-ipython <comment><USER3> enupten, you appear to be hellbanned (i.e., your comments are auto-killed so that they won't be visible to people other than you unless they have the "showdead" option on).

This appears to have happened about 2 days ago, I would guess because someone regarded your comments about India and/or "Hinduphobia" as inflammatory or over-political. (Which is not the same as being incorrect.)

It is possible that you may be able to get reinstated by contacting the HN admins and (if appropriate) either defending your comments or promising to change.

[EDITED to add: enupten's comment here was perfectly innocuous: s/he was asking for comparisons with TeXmacs which has kinda-IPython-like facilities for embedding an interpreter in a document. I haven't looked hard at either, but my feeling is that this and IPython-in-org-mode are solving rather different problems: nice typography in one, nice interaction in the other.]

</comment><comment><USER4> Can I please beg and beseech you to please use git version tagging (semver.org is a good place to start) and MELBA stable for your package releases?

</comment><comment><USER5> That is neat! Thank you so much for this.

Learning to embrace org was a long and arid journey (it can do so much you quickly get lost in the process). Babel was the first extension I really enjoyed to use from day 1. It is what I expected from a literate programming tool.

I've never much used IPython but I heard a lot of praise about it. I guess it's the perfect timing to jump in.

Are you planning on adding to the languages' page? [1]

[1] : [http://orgmode.org/worg/org- contrib/babel/languages.html](http://orgmode.org/worg/org- contrib/babel/languages.html)

<comment><USER6> Can you recommend any specific resources that helped you get a handle on org?

<comment><USER5> Worg [1] is IMHO clearly the best place to start (and finish!). There is _a lot_ of stuff there, and I don't think I'm even 10% done. (I still haven't looked at the calendar, tried the to-do list and wasn't convinced, etc.)

At first, comparing it to Markdown (markup-wise) was very helpful. I keep this page ( [http://orgmode.org/manual/Markup.html](http://orgmode.org/manual/Markup.html) ) handy and write my blog posts in Org. (This is why I found babel to be invaluable : I don't have to keep my code separate from my post, which is one hassle less for quick demonstrations).

Right now, my strategy is a little bit like this : the moment I think something would require some writing, I quickly check what org-mode has to offer. The learning might be slower, but I don't get bored this way.

[1] : [http://orgmode.org/worg/](http://orgmode.org/worg/)

</comment></comment></comment><comment><USER7> Nice screenshot[1] with Awesome window manager[2].

[1] [https://github.com/gregsexton/ob- ipython/blob/master/screens...](https://github.com/gregsexton/ob- ipython/blob/master/screenshot.jpg)

[2] [http://awesome.naquadah.org/](http://awesome.naquadah.org/)

</comment><comment><USER8> This is really cool. As far as I can tell a similar workflow was presented at pycon 2013:

[http://pyvideo.org/video/2000/emacs-org-mode-python-in- repro...](http://pyvideo.org/video/2000/emacs-org-mode-python-in-reproducible- researc)

</comment><comment><USER9> As I see for Atom.io there is something similar: [https://atom.io/packages/hydrogen](https://atom.io/packages/hydrogen)

<comment><USER10> Submission:

Show HN: Hydrogen Brings Light Table to Atom

190 points willwhitney 20 days ago 70 comments

[https://atom.io/packages/hydrogen](https://atom.io/packages/hydrogen)

</comment></comment><comment><USER11> Can you use different kernels with this?

</comment><comment><USER12> Stuff like this always amazes me and makes me glad i switched to Emacs not too recently ago. I begin to grasp why Emacs is its own OS and that's even a nice thing! (fwiw, nowadays Emacs is my mail client and my go to editor/IDE)

<comment><USER13> Welcome to the fold. Emacs is basically a lisp image with a built-in text editor. You can even write web servers in it (and people have).

The utility of such a system beyond _just_ editing one or text files at a time is enormous.

Enjoy your stay.

</comment></comment><comment><USER14> IPython Notebook can export a report to PDF with syntax highlighted code - <USER2> this?

<comment><USER15> Probably. You can mark code blocks in .org files with the Emacs "mode" for them, and they will be highlighted appropriately (and you can use a shortcut to open a new buffer in said mode just to edit that block). I imagine that if PDF export exists (I assume it does), this would map to it.

<comment><USER16> Yes, with the "gotcha" that you must set org-src-fontify-natively (a customizable setting) to non-nil.

</comment></comment></comment><comment><USER6> Is it possible to set up something like this for Vim? I am devoting this summer to learning one editor in depth, and I was thinking of going with Vim because it is on servers everywhere. But I've also chosen to deep dive into python and I love the ipython notebooks, so this could be handy

<comment><USER17> Stop with this "vim is on server everywhere", only vi is and it's pretty much useless compare to vim outside of text editing. Plus with emacs you edit the server directly from your machine via ssh with tramp, you don't ssh then open emacs on the server

<comment><USER12> Although i recently had a huge "woah" effect when i SSH'd into a server and wanted to edit a file using emacs. Turns out emacs recognized my X11 forward and i had a fully functional emacs GUI in front of me! I would never had expected this and also don't know any other editor that does this. :)

<comment><USER18> In a situation like that, `gvim` would have opened graphically as well. Although, different command to be sure.

<comment><USER12> Ok.. i ran vim thousands of times but never gvim.

<comment><USER19> Or even vim -g IIRC.

</comment></comment></comment></comment></comment></comment><comment><USER20> Does this work with evil mode?

<comment><AUTHOR> Yes. I use evil mode with it.

</comment></comment><comment><USER21> Neat! Can people in the know share their experience with TeXmacs which is supposed to do very similar stuff ?</comment>


Investing Prophet Jeremy Grantham Takes Aim at Climate Change - <AUTHOR> https://www.bloomberg.com/news/articles/2019-01-17/jeremy-grantham-s-1-billion-plan-to-fight-climate-change <comment><USER2> >With topsoil disappearing at a rate of 1 percent a year and "only 30 to 70 good harvest years left depending on your location,"

Well, that's definitely a scary framing. Does anyone have sources for this specific prediction?

Aside from launching his (for-profit) climate fund, (for-profit) vc investments, and funding research, I'd be very interested in more details on how the money will be used.

<comment><AUTHOR> > Generating three centimeters of top soil takes 1,000 years, and if current > rates of degradation continue all of the world's top soil could be gone > within 60 years, a senior UN official said on Friday.

[https://www.scientificamerican.com/article/only-60-years- of-...](https://www.scientificamerican.com/article/only-60-years-of-farming- left-if-soil-degradation-continues/)

<comment><USER3> > _" Generating three centimeters of top soil takes 1,000 years,"_

Such a vague assertion leaves me with more questions than it resolved. Topsoil should properly be measured in volume, not distance. Presumably they mean a given area will gain three centimeters in 1,000 years, but what area and under what conditions? There are some environments with _zero_ topsoil and some environments with quite a lot of topsoil, so is that _" three centimeters per 1,000 years"_ figure a global average for natural topsoil renewal? I can't imagine how that's a valid measure of anything. You'd have massive regions totally devoid of topsoil like the Gobi Desert dragging down global averages.

And what about anthropogenic topsoils? Maybe one of the most famous examples is _terra preta_ in the Amazon, which not only is madmade but reportedly regenerates itself at a rate of 1 centimeter _per year_ (a few hundred times faster than that _" 3 centimeters per century"_ figure..)

<comment><USER4> > Topsoil should properly be measured in volume, not distance

Should it though?

And regardless of how clear or unclear that is, I gotta say I dislike seeing when the sum of a multitude of reports is expressed in a headline, only for people to nitpick through it without even attempting to check the actual methodology for themselves.

1 cm/year is 33 times faster than 3 cm/100 years, not a few hundred times faster.

AFAIK terra preta is far from fully understood, and farther still from being widely used. Very cool stuff though.

<comment><USER5> Only responding to the one part of your comment, it was 3cm/1000 years, so a few hundred (333) years was accurate.

</comment></comment></comment></comment></comment><comment><USER6> I have reread this article as some of the comments made me question whether or not I understood it or not. I had assumed that Jeremy Grantham was investing his wealth to save the planet, this was the conclusion that the author presents at the end of the article under the title "Bottom Line". But this is not necessarily the case, Mr. Grantham is investing in technology that will show a profit because of climate change, it is a subtle difference but an important one to consider, sort of the grain of salt that should be taken with reading of the article.

<comment><USER7> It's definitely the case that Capital will profit--in the short term, of course--from climate change, and there's a good argument to be made that Capital is perpetuating the cataclysmic destruction of our system for such profits.

Check out [This Changes Everything]([https://www.goodreads.com/book/show/21913812-this-changes- ev...](https://www.goodreads.com/book/show/21913812-this-changes-everything)).

<comment><USER8> Well I'm going to recommend not checking that book out because it is of exceedingly low quality and not worth your time. Unless you're looking for something to reaffirm your existing leftist biases and dogma and not make you think uncomfortable thoughts, then it's pretty good.

<comment><USER9> That's somewhat ad hominem. (Well, ad librem. Tomatoe, tomatoh)

I'm not asking for a detailed critique, but what, in your opinion, _is_ a good book discussing the intersection between capitalism and climate change?

<comment><USER3> _Can Life Prevail?_ by Pentti Linkola.

</comment></comment></comment></comment></comment><comment><USER10> I'm confused at all the comments focusing on the fact that he intends to make money from this because... so what? Making money is not a bad thing, and he still intends to accomplish good things. One doesn't need to be a martyr to be virtuous.

</comment><comment><USER11> While giving away $1 billion, Grantham's planning to make even more money, and he's hoping climate change offers the opportunity.

The key sentence, buried halfway through the article...

<comment><USER12> Not sure why this is getting downvoted. That quote does come from the article and it's is a very real concern. This article seems to be about Grantham's new investment strategy disguised as philanthropy.

<comment><USER13> Not really new for him. He's discussing and working on climate change for a long time, go check some of his prior letters to investors.

<comment><USER12> It's not new, however, it is an investment strategy. Investors at this level are very good at "talking their book." Because doing so helps their investment. I am not suggesting that giving away $1 billion won't help climate change. I'm merely suggesting that Grantham may have other motives for giving money away.

</comment></comment></comment></comment><comment><USER6> Just as vast fortunes were made during the financial crisis of 2008 by selling the markets short ( see the film "The Big Short") I would expect there are people betting on climate change continuing down its current tragectory, and these people now have a vested interest in making this happen. I don't know how many other billionaires are putting their money on the pro climate change side but wouldn't a smart investor diversify their portfolio by betting on both the pro and con sides of climate change?

I don't know what the form of such investments would take but can think of a simple one being investing in real estate northern regions where temperatures are currently too cold to support agriculture. Possibly an investment in water desalination plants would also see a gain from climate change. I'm sure there are many more better examples, my concern is that for every billionaire looking to save the world, there is another looking to make a buck off its collapse. So what happens when more of these profateers decide to use their vast fortunes to tip the scales further towards the collapse rather than salvation?

<comment><USER14> You're supposed to diversify your portfolio by betting on uncorrelated things. Betting both that something will go up and down is like placing money on both red and black, it doesn't make you any richer.

<comment><USER15> Can't you construct a bet that a price will either go up or down, but not remain steady? I believe that's called a long straddle but I'm not super knowledgeable here.

<comment><USER16> yes, but that severely limits your upside, and it's harder to thread the needle (in both timing and pricing).

<comment><USER17> In a straddle/strangle you have unlimited upside on both legs (up and down/call and put). It's a matter of determining if the long gamma+long volatility position is worth the price you pay in option premium up front and decay thereafter (theta).

<comment><USER16> that's true, and a more complete explanation.

i was taking the practical view that in most cases, the underlying options are reasonably priced and volatility is not highly unusual, so the practical upside is small at best. it's easy for the non-professional investor to lose money on these because you really need some extraodinary non-public information to exploit them.

</comment></comment></comment></comment></comment></comment><comment><USER18> > _he gives a talk titled "Race of Our Lives"—the one between the Earth's > rapidly warming temperature and the human beings coming up with ways to > fight and adapt to climate change._

Or, the race between the cause coming up with ways to fight and adapt to the effect.

It's possible that human beings are the problem and climate change is the "solution".

</comment><comment><USER19> "Prophet" who makes one horrifically awful market call after another. He was bullish in February of 2018 (right before implosion), after years of being bearish. What a clown.

<comment><USER6> Even a broken clock shows the correct time twice a day :)

</comment></comment><comment><USER20> As a former fund manager, I found his description of current capitalism quite close to my own. Particularly the bit where he says markets are good at a lot of stuff, but not everything.

Has anyone else had that sort of intellectual journey, where you discover libertarianism, you learn all the tropes, you feel very confident, and then after a while you pull back a bit after finding a few issues? And I suppose on the other side of the spectrum as well?

<comment><USER21> > _Has anyone else had that sort of intellectual journey, where you discover > libertarianism, you learn all the tropes, you feel very confident, and then > after a while you pull back a bit after finding a few issues? And I suppose > on the other side of the spectrum as well?_

For most people, that transition happens between the teenage years and adulthood.

<comment><USER20> How many people know even the basic facts of political or economic history as young adults?

</comment></comment></comment><comment><USER22> Whenever I hear about "investing prophets" I call bullshit and stop reading.

</comment><comment><USER23> If he is so prophetic why does he only have a billion instead of a trillion dollars? Why must we use such a click-baity word in our headlines? Bloomberg could just say "Investor Jeremy Grantham..."

<comment><USER24> > why does he only have a billion instead of a trillion dollars?

Seriously?

</comment></comment><comment><USER25> Going to get downvoted harshly for this, and I deserve some of it.

But let me say, is anyone else just slightly suspicious (don't have to change your minds though and I agree with the science here) that investing billionaires, people who give truth to the saying "behind every great fortune is a great crime", would actually be interested in the best possible thing for the world? Doesn't that sound a little bit suspicious, like a hint from a life that something is afoot?

I think it might be healthy to introduce some doubt into the claims of billionaires no matter what they might be.

<comment><USER11> "While giving away $1 billion, Grantham's planning to make even more money, and he's hoping climate change offers the opportunity. "

I think that you might be on to something...

<comment><USER26> Bad/neutral people can still do good things if they take action on things that reward good deeds (with money).

That's why non-profits hire people to help reach their goals.

<comment><USER27> It's in Grantham's interest to _encourage_ regulation that minimizes carbon emissions (because of his investment company's "Climate Change Fund").

Is it good or bad to set yourself up to profit from that?</comment></comment></comment></comment>


Ask HN: Hacker News invisibly banned my site, anyone know why that would be? - <AUTHOR> It appears that HN has put some sort of ban on my site from appearing on the homepage, regardless of the community votes. Someone submitted a piece I wrote today, it did send some traffic to my site, I came here, voted for it myself as I do when I find one my my stories here, and then waited to see if there were any comments. What I noticed is something that I saw the last time someone submitted a story of mine here... regardless of the vote to time ratio the submission never showed anywhere but the "New" category. If you look here, you can see that it is indeed showing up, with 4 votes in 53 minutes:
http://smackdown.blogsblogsblogs.com/images/hn-new-submissions.png
The one underneath it has less votes over a longer time period, with only 3 points, and it is showing in the "Popular" list, at #46, whereas mine is nowhere to be seen:
http://smackdown.blogsblogsblogs.com/images/hn-popular-page2.png
The same thing happened a few weeks back when I wrote a piece about Matt Cutts, that involved the HN community itself:
http://news.ycombinator.com/item?id=2163390
You can see on that someone else noticed the behavior too, and asked about it. They never did get an answer though. Personally, I assumed that perhaps there was some moratorium on discussing HN on HN, and that a moderator had prevented that particular story from getting any exposure. That story did hit the front page very briefly, enough for 3 people to visit it, and was then removed (I am getting that from the traffic reports). There have been other stories that people have submitted from my site that have gone popular in the past, usually ones I have written about Mahalo or Jason Calacanis, and since I did get those 3 hits from the homepage 3 weeks ago I am pretty sure it was that exact story that caused this.
Don't get me wrong... I am in no way trying to imply that my site has any "rights" when it comes to HN or even being submittable at all, let alone the right to be voted to the front page. If the HN mods don't want people submitting posts from my site here so be it. I will even remove the icon from Socializer on my site if they want me to. I am very curious as to why it happened though. My tin-foil hat self automatically goes to "Maybe Matt Cutts saw the submission and asked a mod to kill it", but it's also just as likely that they didn't like the implications behind me saying that Matt was using the HN community to accomplish some hidden agenda, or that even the mention of HN in a story triggers some guideline. If that were the case though, I am still unsure why it would have been a permanent thing.
Does anyone have any insight into this? Thanks. <comment><USER2> You likely ran afoul of "voter ring detection": <http://twitter.com/#!/paulg/status/22551773068>

I think it works something like this. Say you and I are buddies and only upvote each other's articles. The voting ring algorithm thus flags us both as being part of a voting ring. Votes on our articles are then penalized by some amount to reverse this gaming. Detecting voter rings is important as failing to do so has really hurt communities like Digg.

On a related note, if most of the votes on your articles comes from readers on your site that _only_ upvote your articles, those users will probably all be flagged as part of a voting ring.

<comment><AUTHOR> It's pretty rare that my site shows up here, and my actual readership isn't huge, so I don't think that is the case. Any way to find out though?

</comment></comment><comment><AUTHOR> Ok, I know no one is going to see this, but in looking for this thread I just discovered that the original one I was discussing is now showing up in the "Popular" list, albeit at #147 (5 votes in 10 hours). So obviously if anything was going on earlier, it's been reversed. It's even outranking this thread.

</comment><comment><AUTHOR> And, of course, I just realized - if it is a moratorium on discussing HN itself, then there is a chance that this post will never get seen (or answered) either...

<comment><USER3> It's at #38 as I look at it.

This sort of question and paranoid conspiracy-mongering would probably not come up as much if articles simply had a visible down-vote instead of the hidden down-vote applied when people flag an article (but not early enough to kill it).

<comment><AUTHOR> When you say #38 you mean this discussion and not the article that someone submitted today, correct? Is that what you think happened then, it was simply voted down? Who would be able to confirm or deny it then? I just went through all 690 submissions visible from the homepage onward and didn't see the one someone submitted today at all. You would think it would show up somewhere in that list, wouldn't you?

<comment><USER3> This discussion, and probably.</comment></comment></comment></comment>


The Google Glass Feature No One is Talking About - <AUTHOR> http://creativegood.com/blog/the-google-glass-feature-no-one-is-talking-about/

<comment><USER2> Possible future?

June 2014: Google Glass released to the public.

Dec 2014: First face recognition app released.

May 2015: App to detect "dateability" with strangers reaches #1 on the appstores.

Nov 2015: Trend among girls to apply make-up that makes Glass' face recognition fail.

Apr 2016: Updated algorithm and use of IR-spectrum now greatly improves face recognition capabilities.

Aug 2016: Three women killed by stalker equipped with Google Glass

Oct 2016: Prototype IR-lamp for mounting on Google Glass also works by blinding any onlooking cameras, making face recognition impossible again. It's now easy to film others while avoid being filmed yourself.

Feb 2017: New Glass version includes upgraded sensor, that can filter out selected spectrums. Weeks later, the major face recognition library updates with support, able to block out "blinding lights".

July 2017: Malware discovered on many Glasses, which can spread by WiFi and automatically blurs recorded faces. Security researchers find that it also is able to send back the actual face recognition data to secret servers in Iceland.

Nov 2017: New e-inkpaint makes it possible to create pulsating patterns that disturbs or even crashes Glasses that look at them. A celebrity vlogger is seen wearing it.

<comment><USER3> Jan 2018: [http://upload.wikimedia.org/wikipedia/en/9/98/Laughing_man_l...](http://upload.wikimedia.org/wikipedia/en/9/98/Laughing_man_logo.png)

</comment></comment><comment><USER4> The article sounds a bit paranoid, and too much conspiracy theoretical near the end. I mean, sure, it's possible we will eventually be able to build some device into ourselves, but why does it have to be nefarious? Are computers evil?

I bet in the 60ies (or whenever the general public became aware of computers) they were saying that computers will be used for war, espionage and other malice. Were they right? Yes! But is that the whole truth? No, it's a very small portion of it.

The author (and people) need to stop thinking of our world as the darkest place in this universe.

If anything, the human race will meet its end when cats decide they don't want servants any longer. Meow.

</comment><comment><USER5> This article starts off promising, with valid complaints about the "antidote to distraction" idea and the perils of being recorded, but then derails into paranoia. "Anything you say" might well end up on YouTube, but it's not going to be "tagged to your online identity, and stored in Google's search index", in order to "instantly bring up documentation of every word you've ever spoken within earshot of a Google Glass device." Such a feature would provide no benefit for the person taking the video in the first place, and would, of course, cause an uproar if ever introduced, so it's ridiculous to believe Google would introduce it just because they're working on a HUD. At worst Google might (might! it would still creep a lot of people out) introduce a search-by-face option for YouTube, but it would still presumably be limited to videos people explicitly decided to upload... _maybe_ the ability to search by text at the same time? I'm not seeing it.

<comment><USER6> The argument I took away from this article isn't that we should be afraid that Google is working on some all seeing eye that could be used for evil, but that Glass represents a large step in the erosion of our privacy.

Bit by bit for years we've been uploading our personal information into the public domain. If I tell Facebook I'm a married man who is in to prostitutes and Graph Search exposes it to the world[1], I've erroded my own privacy unwittingly.

If I walk out of a brothel and someone catches me with their Google Glass, now _they've_ eroded my privacy. At first it seems like a small step, no one has Google Glass, what are the odds of me being exposed? But time marches on and technology becomes ubiquitous (especially technology as legitimately useful as Glass). New technology comes along and builds on top of the old and it wears away at our privacy, a little at a time.

I'm sure the married men on Facebook who put they are in to prostitutes did it under the pretence that it would just be shown to whoever they are friends with. Suddenly Graph Search comes along and they're exposed. Apply the same model to Google Glass, and you end up with something like what the author is talking about.

[1] <http://actualfacebookgraphsearches.tumblr.com/>

</comment></comment><comment><USER7> I was talking about this the other day. Easily irritated people are definitely aware the detrimental effect google glass will have on their bullshit tolerance.

</comment><comment><USER8> Double-win: Riding a Segway while wearing Google glasses.

</comment><comment><USER9> Bar Sign Prediction: No Under 21 and No Glasses

</comment><comment><USER10> Eggs. The weapon of the silent majority.</comment>


Ohio Police Department Using Fake Drug Checkpoints - <AUTHOR> https://www.nytimes.com/aponline/2013/06/30/us/ap-us-fake-drug-checkpoints.html

<comment><USER2> > large yellow signs along Interstate 271 that warned drivers that there was a > drug checkpoint ahead, to be prepared to stop and that there was a drug- > sniffing police dog in use.

One thing hinted at in the article is the risk of harm to "innocent"[1] drivers from drivers carrying drugs who are distracted by the large scary yellow signs, and thus driving while distracted.

> Peters said the officer asked him what kind of drugs he had in the car, > saying it would be much easier to confess before other officers and a drug- > sniffing dog arrived. Peters insisted he had no drugs. As promised, other > officers and the dog were summoned, and Peters agreed to allow his car to be > searched.

I'm not a lawyer, but as I understand it you shouldn't agree to be searched. What's the current best practice for this?

[1] using the words of law enforcement to emphasise the point.

<comment><USER3> The current best practice is that when police ask you to give up your fundamental rights you politely say no. Calmly say, "I don't consent to searches."

There is literally nothing good that can come from giving up your rights if you are innocent (for you personally, for the police, for society).

<comment><USER4> The problem is this can be more of a hassle for you. I've been pulled over as a teenager and when I said no he decided to search my car anyway. Saying no doesn't always help, in fact sometimes it makes them give you more trouble and search harder.

<comment><USER5> If you had consented to the search, then anything he found would have been admissible in court; By not giving your consent to the search you made it so anything that was found wouldn't have held up in court. A cop only asks to search your vehicle if he doesn't already have probable cause to do so without your permission.

</comment></comment></comment></comment><comment><USER6> I don't quite understand how this is any different from a real checkpoint. There's a sign that says there's a checkpoint, there's dogs, and four cars were searched.

Only difference is they didn't search 100% of the cars.

<comment><USER4> Not sure how they do it in Ohio, but they've been doing this in Missouri for a while. They post the signs right before an exit that is rarely used that say something like "Drug checkpoint ahead be prepared to stop." I think I even saw it say something like last exit before checkpoint once. They then stop everyone that gets off at the exit. If you take a second to think about it, it's pretty obvious. Apparently it still manages to catch people.

</comment></comment><comment><USER7> I know this technique is probably not going to be used for good purposes, and I'm sure we'll have to apply a new patch to fix that vulnerability in our (legal) code, but I still tip my hat to the clever hacks who came up with this attack.

</comment><comment><USER8> _police can randomly stop cars for just two reasons: ... to get drunk drivers off the road._

If a driver appears to be drunk, how is that a random stop? Isn't that a 'probable cause' thing?

<comment><USER9> > If a driver appears to be drunk, how is that a random stop?

They're not stopping drivers who "appear to be drunk" \- that's the point. They are allowed (supposedly, IANAL) to set up a checkpoint to stop __every __car (effectively a random stop) that passes by to see if the driver is intoxicated, or check to see that they are not in the country illegally.

They're not allowed to check for other crimes without probable cause though. They can't set up a check point to say drug possession or tax evasion, though if you are at a DUI checkpoint I believe you may somehow give them probable cause to check for those things.</comment></comment>


How the World Could Solve the Vendor Prefix Problem in One Month - <AUTHOR> http://camendesign.com/code/-x

<comment><USER2> This would not work. The problem isn't a solution that requires a NEW prefix, but one that there is a ton of information and implementations ALREADY EXISTING that use the -webkit- prefix. Those devs that were too lazy or uninformed to include -moz- or any other prefixes (sometimes even the unprefixed version at all) are not going to go back and update all of their prefixes to -x- now. We don't need more prefixes.

A better solution would be for browser vendors to state that prefixes would only work in alpha/beta browsers, but would be removed from production browsers. That would allow testing, but remove the temptation to use the prefixes in production code. Alas, the standards committee can't keep up with the changes that are required for the browser manufacturers to feel safe doing so, and it could introduce the risk of features landing unprefixed that use different implementations if the manufacturers ignore the standards.</comment>


Custom BI with Firebase, Bigquery and Datastudio - <AUTHOR> https://corepox.net/devlog/building-a-custom-executive-dashboard-with-firebase-analytics-google-datastudio-and-bigquery-1 <comment><USER2> Really important to doing more searching and data visualizations on cloud.</comment>


Prevent mail to Gmail users from being blocked or sent to spam - <AUTHOR> https://support.google.com/mail/answer/81126 <comment><AUTHOR> Found on Twitter:

'We've updated our guidelines to help ensure your messages are delivered to #gmail users' inbox. Using these methods reduces the possibility that your messages will be marked as spam, or blocked by Gmail.'

[https://twitter.com/gmail/status/1222592248199745537](https://twitter.com/gmail/status/1222592248199745537)</comment>