Lon.gs: A URL shortener in C - <AUTHOR> http://lon.gs/ <comment><USER2> Is _anyone_ suffering from lack of URL shorteners? Or does anyone really care what their URL shortener is implemented in? Is there even any way that the application code contributes to the request time more meaningfully than the persistence mechanism used?

Cool hacks are cool I guess but from the sounds of it, the C code is a bit scary. If you had to build this, why not build it in Rust? At least it wouldn't be so terrifying from a security standpoint and you'd still get whatever performance is supposedly needed.

<comment><USER3> This code is more than a bit scary. This code is of very poor quality, is very poorly documented and has numerous (I'm pretty confident that they're exploitable, too) bugs.

It really isn't a project that I'd recommend to anyone, unless I wanted a shell on their machine. I'm quite distraught that it is getting this many (seemingly blind) upvotes.

<comment><USER4> Can you define shell? Do you mean you can get a bash shell from an exploit in this code?

<comment><USER5> Yes. If there's a working buffer overflow anywhere in code (and there appear to be several here), you can turn that into a call out to a shell, and hand it some script code to perform.

<comment><USER4> Wouldn't the process just die? It would say segmentation fault or something and return to the caller I would assume. How would you get a bash shell?

<comment><USER5> > Wouldn't the process just die? It would say segmentation fault or something > and return to the caller I would assume.

A segfault only happens when you try to access a virtual memory address not mapped to your process, or try to write to a page mapped to you but not mapped as writable.

Remember, this is C. There's nothing to stop you from writing past the end of some memory like an array as long as whatever memory you're writing into still belongs to you. If you write _far enough_ , you'll eventually walk out of your mapped memory pages and trigger a segfault, but if you don't stray toooo far, you can overwrite some important data and absolutely nothing will complain. When people say C isn't a safe language, they mean it. C will let you get away with murder.

And it turns out that there's some very important data you can overwrite this way.

> How would you get a bash shell?

Let's say there's a function foo() that writes some data to a buffer on foo's stack, and I can control what data it writes (because it's data from a text box on a webpage, let's say). And foo() is buggy and doesn't validate that in all cases the data I control fits in the bounds of the buffer it writes to.

I can then overflow the buffer with my data, and take advantage of that to overwrite the return address of foo(), because the return address for the function happens to exist past the end of all the stack local memory for the function. When foo() returns, it will jump to the address I wrote in there, instead of where it was supposed to go back to. And as long as that address is in the process's mapped memory pages, again, nothing will complain.

To get a shell, as part of the overflow I either insert the binary data corresponding to the x86 instructions for something like a call to execve("/bin/sh", ...) and then have foo()'s return jump to the beginning of my instructions, or I cause the return to jump to some other code or library that will do that for me that happens to already be in place (there are more sophisticated versions of this exploit called Return Oriented Programming).

If want to read up on this: [https://www.win.tue.nl/~aeb/linux/hh/hh-10.html](https://www.win.tue.nl/~aeb/linux/hh/hh-10.html)

</comment></comment></comment></comment></comment></comment><comment><USER6> Looking at the coding patterns used in the C source, I am utterly horrified this is running live on a public facing website.

I can see at least one buffer overrun dependent on database contents, and I wouldn't be surprised if there's public-facing vulnerabilities in this thing, but I don't want to spend another 5 minutes looking.

<comment><AUTHOR> Judging by the code, everything that goes into the database is a Base64 encoded. Where do you see a buffer overflow?

<comment><USER7> Long URLs make it crash. Really. Just try and put in a very long URL...

[https://github.com/riolet/longs/blob/master/longs.c#L238](https://github.com/riolet/longs/blob/master/longs.c#L238) looks like an example of a buffer overflow.

Etc.

<comment><USER8> SIZE is defined as 2048 bytes (line 59). Firefox can do GET requests with 8KiB URLs.

<comment><USER7> The URL is base64-encoded before they try and fit it in a 2K buffer, so the the longest URL it can handle is actually shorter than 2K.

</comment></comment></comment></comment></comment><comment><USER9> I respect the desire to work on low level language like C. Programmers should not be afraid of it.

But that said, building a proper HTTP stack is not trivial.

If you want to use C language, then why not create Nginx module?

Nginx already solved the hard problems:

* HTTP parser

* Distribute work via event loop on multiple workers

* Useful load balancing strategies (not as great as HAProxy, but i am satisfied with it)

* Serious effort in dealing with CVE

* Widely used and battle tested

Here's a fine guide on how to write Nginx module in C: [http://www.evanmiller.org/nginx-modules- guide.html](http://www.evanmiller.org/nginx-modules-guide.html)

<comment><USER10> [https://kore.io/](https://kore.io/) is also a (very?) good C framework for this stuff. I don't know enough C to honestly evaluate that though.

<comment><USER9> Thanks for sharing, I haven't heard about this framework.

</comment></comment></comment><comment><USER11> The C code in the "framework" this thing uses is pretty scary; grep for MAX_BUFFER_SIZE, malloc, strcpy, &c. The header parsing in particular.

<comment><USER3> Agreed.

        q3k@nihilism ~/Projects/longs $ python2 -c "print 'GET / HTTP/1.1.\r\n' + 'a'*2000 + '\r\n\r\n'" | nc 127.0.0.1 1337

        q3k@nihilism ~/Projects/longs $ PORT=1337 ./longs
        *** Error in `./longs': free(): invalid next size (normal): 0x000000000155a5f0 ***
        ...

Sounds like a fun heap exploitation challenge. Almost CTF-like.

EDIT: It also throws a whole bunch of warning when compiling. [moved this here from the first line after child post mention]

<comment><USER4> That's not a warning. That's a runtime error.

<comment><USER3> I know, this is some internal glibc allocation code failing because that request overflowed a buffer on the heap. The bug is, as tptacek mentioned, in the header receiving function [1].

The compilation warnings was an additional remark, I should've phrased that post better.

[1] - [https://github.com/riolet/longs/blob/master/wafer.c#L334-337](https://github.com/riolet/longs/blob/master/wafer.c#L334-337)

<comment><USER11> Not the only case of this, either.

</comment></comment></comment></comment></comment><comment><USER12> hum. I tried to short "[http://lon.gs"](http://lon.gs") and then short the result again, now it redirects indefinitely... [http://lon.gs/ack](http://lon.gs/ack)

</comment><comment><USER13> Seems a bit buggy. I shortened "[http://hello.com"](http://hello.com"), it returned "lon.gs/akm", and I visited the shortened URL only to be redirected to [https://codeandoando.com/integracion-continua-con- drone/](https://codeandoando.com/integracion-continua-con-drone/).

</comment><comment><USER14> Looks like the perfect way to turn URL's in to root shells on the hosting server

</comment><comment> ryan-c From [https://www.reddit.com/r/C_Programming/comments/4p5ung/longs...](https://www.reddit.com/r/C_Programming/comments/4p5ung/longs_we_wrote_a_url_shortener_in_c_with_wafer/d4iihi7)

        $ curl -i http://lon.gs/abf
        HTTP/1.1 301 Moved Permanently
        Location: foo
        X-Evil-Header: evilvalue

there were also examples of XSS and data URIs.

(they claim to have fixed this elsewhere in the thread, but I guess some of the "evil" URLs still work)

</comment><comment><USER15> Some comments about comments and the code: 1\. The URL shortener is just a demonstration of the framework being used. For a POC/MVP i would not expect it to be the most reliable code on the planet. Im ok with that. 2\. The WAFer framework is great idea for bringing a very lite server and minimalist framework to certain devices. This has applications in SBC and IOT devices where all resources are at a premium. 3\. Yes the C code might not be perfect but remove any github project that isnt perfect, secure and you wont have many left. The principle objective is 'get it out there' and let people like the other commenters have their input/opinion from which to make it better. 4\. The concept and this lite implementation of the idea is hugely useful in certain use cases. Just like nginx is great for general purpose servers. This is almost a C implementation of Bottle for python. 5\. nodesocket and chadscira seem to have gotten the point of this and given useful feedback to the authors (Im not one of them in case you were thinking that).

So to sum it up - a great post, excellent work with a tool that has a lot of potential for specific scenarios. When deploying if using things like Cloudfare Edge and giving it a bit of Productizing (my day job is as a Product Manager for a global ERP business) then this could be a hit (pun intended :-J ).

<comment><USER11> The vulnerabilities found so far are in the framework, not in the application code. Those vulnerabilities are grave.

</comment></comment><comment><USER16> I'm surprised there's still any interest in standalone URL shorteners. Didn't Twitter make them obsolete when it implemented its own?

<comment><USER17> We[1] just launched a new shortener and it supports URLs.

That's not the primary use-case for it[2][3], but we're happy to support people shortening URLs if they want to. The reason there's room for this is that our URL shortening function has no ads, no third party tracking, no bloat ... no dark patterns.

That's worth something to some people.

[1] Oh By, Inc.

[2] [https://0x.co/examples.html](https://0x.co/examples.html)

[3] [https://0x.co/hnfaq.html](https://0x.co/hnfaq.html)

<comment><USER18> > The reason there's room for this is that our URL shortening function has no > ads, no third party tracking, no bloat ... no dark patterns.

But it's still a closed, proprietary database and there's no way to decode an "Oh By Code" if the service goes down, which is the disadvantage number one you have with URL shorteners.

> The real utility are the easily recognizable codes, prefixed with "0x".

Why not using a prefix that helps differentiate your codes from hexadecimal numbers? How do you plan to get people to know your service if it's not recognizable? Let's say I put one of those codes on my business card, I still have to write somewhere that people should use 0x.co to access the content, which ruins the advantage of having just one code rather than a URL to my website (literally anyone knows how to open a URL in a browser).

<comment><USER17> "But it's still a closed, proprietary database and there's no way to decode an "Oh By Code" if the service goes down, which is the disadvantage number one you have with URL shorteners."

Yes, that's correct. In this case, "Oh By" will continue running indefinitely. This is true for two reasons:

1) Building an extremely lightweight, ad free interface has a happy byproduct of ... being extremely lightweight. The infrastructure requirements for even a wildly popular "Oh By" are trivial.

2) Because Oh By is self-funded, there is no pressure from outside parties to _break_ the pattern of an ad free, tracking free service with zero bloat.

If you're having trouble swallowing this, remember that rsync.net has been running continuously since 2001[1]. I think that's a credible track record[2].

[1] As a feature of JohnCompanies, the first VPS provider, and then as a standalone corporation in 2006.

[2] In fact, the rsync.net warrant canary turns 10 years old this year.

<comment><USER19> Past performance is no indicator of future success.

There's a 0% chance this will be running "indefinitely." You're just skirting the issue by making a promise you can't keep.

<comment><USER17> The "Oh By" shortener will be running, and codes you create today will be functioning, twenty years from now - in 2036.

</comment></comment></comment></comment></comment></comment><comment><USER20> CloudFlare is a perfect companion for something like this because you can hard cache the redirects on their edges. I have a few services that run off tiny boxes, and just leverage CloudFlare free edge caching.

<comment><USER21> And handle an HN influx better than many Wordpress sites.

</comment></comment><comment><USER22> Shortened a URL, but service doesn't appear to redirect: [http://lon.gs/akt](http://lon.gs/akt)

EDIT: Very strange, the redirect now goes to a URL I didn't enter... ([http://www.sadfasdfasfdasdfsadfasd.com](http://www.sadfasdfasfdasdfsadfasd.com))

</comment><comment><USER23> Seems great and performant, but not productized. Seems like things are hard- coded in the c code. For example...

What are the api endpoints? docs? Can you view a list of all shortened urls? Can you delete shortened urls?

Can you change the base domain of lon.gs?

</comment><comment><USER24> Website seems down (connection refused). Did you use any network library (aside from native, I mean)?

<comment><USER25> Is the website actually the URL shortener, or some other stack? I think it's highly unlikely HN just C10K'd them.

<comment><USER26> t2.nano has CPU credits, they may have gotten spent and we're now seeing the results of throttling (limit on % cpu allowed to use)

</comment></comment></comment><comment><USER27> Perhaps I am the only one, but is anyone interested in the opposite direction, static site generator like CLI app to do short linking?

YOURLS was popular for a while, and I tried it, but I was concerned with running a not very popular PHP app even on shared hosting. At least Wordpress gets decent attention. I was worried of people compromising my own YOURLS instance against me.

[http://www.cvedetails.com/vulnerability- list.php?vendor_id=1...](http://www.cvedetails.com/vulnerability- list.php?vendor_id=11533&product_id=21232&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=2&sha=59b76e93ee62fd17aa2253076d9777cb4f7d57f6)

<comment><USER28> There's this, which is a script that manipulates Apache .htaccess to do short linking: [http://lucasgonze.github.io/shurl/](http://lucasgonze.github.io/shurl/)

No idea about equivalents for nginx, or something that could run on Github Pages (these would probably be the same, given that nginx doesn't have an equivalent to .htaccess out of the box).

<comment><USER27> I am going to check out shurl, very interesting. It does sound familiar but I cannot remember why. Sometimes I see these things and forget to bookmark them later.

</comment></comment></comment><comment><USER29> the URL creation and the browsing of a short URL definitely works fast, I guess this being on the front page is a cheap way to verify if the C10k claims are true!

</comment><comment><USER4> I consider the fact that it is written in C a feature.

<comment><USER30> And now, reload this entire thread and check all the horrible bugs and security vulnerabilities this so called "feature" got you.

This is why you should never use C in networked code or when working with third-party data unless you absolutely bloody well have to: It's just too many ways to fuck up, and most programmers will.

<comment><USER4> You're forgetting something about networked code. At some layer of the stack it has to be written in C or assembly.

<comment><USER31> No he didn't forget. The lower layers, yeah it probably will be in C (but it doesn't HAVE to be). But in the application layer, it probably shouldn't be.

If things like memory management are not _the_ first priority when writing every line of code, then you shouldn't be using C, and that's really the only reason you should be using C, when there's a specific need for memory management.

Not surprisingly, this is exactly why the world has moved beyond C for the application layer, it's painful to have to think about that stuff constantly, so people just don't (this being an example).

</comment></comment></comment></comment><comment><USER32> Let's look at this project as a cautionary tale.

</comment><comment><USER33> This is broken.

Here's the short url of [http://news.ycombinator.com](http://news.ycombinator.com) \--> lon.gs/amk

Going to lon.gs/amk redirects me to an overstock.com address for a specific product.

The site doesn't appear to have been hacked, at least there's no affiliate link in the URL I was sent to. It just appears the site is broken.

<comment><USER34> Thank you for raising this bug. We have fixed it.

</comment></comment><comment><USER22> Oddly, was hoping this was a way to turn URLs into long URLs; 2,083 characters if you want to support all the web clients.

<comment><USER31> There are many, like [http://longurlmaker.com](http://longurlmaker.com). I find [http://shadyurl.com](http://shadyurl.com) to be more useful in getting people to not click a link though.

</comment></comment><comment><USER35> If there are any aspiring crackers looking to bring down their first site, this one should be easier than the average

</comment><comment><USER36> This does not handle Microsoft office URL pre-fetching...and is written in C...

</comment><comment><USER37> Wasn't there something posted recently about urls that are too short are too easily guessed and that it's good to make sure that these short urls are longer?

</comment><comment><USER38> It seems pretty responsive.

</comment><comment><USER39> Why would you write something like this in C anymore? If you really need it to have a tiny memory footprint, write it in rust. If you need it to be fast, but can handle a runtime taking care of memory management, write it in go. C is just asking for trouble anymore.

</comment><comment><USER40> this made my URL longer :/ lon.gs/ae9</comment>


The Next Generation of Distributed and Autonomous Files - <AUTHOR> https://twitter.com/alexsicart/status/970569859032666112 <comment><USER2> Meta: Alex, why are you linking to your own twitter and not the medium directly?</comment>


If you miss Winamp and don't want itunes - <AUTHOR> http://code.google.com/p/rhythmote/

<comment><AUTHOR> Checkout the VM ([http://code.google.com/p/rhythmote/wiki/RuckusDJ](http://code.google.com/p/rhythmote/wiki/RuckusDJ)) solution, that is what I use since I have a windows box for my music.</comment>


Killing Lara Croft - <AUTHOR> https://quarterly.camposanto.com/killing-lara-croft-869cd174ae34#.xd4cfcltn <comment><USER2> As someone who remembers the first Tomb Raider, it was a weird time in gaming^. I'd sum it up as everything was either 'the epitome of 2D gaming' or the first steps into 'a 3D version of {insert game concept here}'.

Laura Croft was a 3D version of James Bond and Indiana Jones' love child. The hook was that it was one of the first 3D games were things looked kind-of, sort-of, maybe-if-you-squinted-at-them realistic. And also the first 3D game that I saw with realistic translations between animation states.

It's probably a lost cause trying to explain it to people who have grown up with high fidelity graphics, but there's a certain magic to "Wow, that hedge looks like a hedge!"

PS: So much hate for TR2's canal level [https://www.youtube.com/watch?v=dA0r_Wp- EtU&t=8m30s](https://www.youtube.com/watch?v=dA0r_Wp-EtU&t=8m30s)

^For reference, 1996 was Duke Nukem 3D, Civ 2, Time Crisis, Super Mario RPG, Resident Evil, Metal Slug, Pokemon, Quake, Super Mario 64, NiGHTS, TES II: Daggerfall, Pilotwings 64, Wipeout 2097/XL, Marathon Infinity, MoO2, C&C:RA, DoA, and Diablo ( [https://en.wikipedia.org/wiki/1996_in_video_gaming](https://en.wikipedia.org/wiki/1996_in_video_gaming) )

<comment><USER3> > PS: So much hate for TR2's canal level

To this day, my wife and I still talk about that level, and trying to solve it together so many years ago.

<comment><USER4> I remember playing through TR2 with my brother as youngsters. I don't think he's forgiven me for 'progressing' in the level by killing a couple of enemies, using all the medkits, and overwriting the only save with low health at this point [1] - just before you have to climb a ladder into a small room with two enemies

[1][https://www.youtube.com/watch?v=dA0r_Wp- EtU&t=9m15s](https://www.youtube.com/watch?v=dA0r_Wp-EtU&t=9m15s)

</comment></comment></comment><comment><USER5> > "we talked about things like having her visibly decapitated, but then we > thought that [Heath-Smith] would kill us. And we always had a fondness for > Lara, we were just sick of her, really. We were buying houses because of > Lara. Because of Toby, in hindsight. I don't think we actually wanted to do > anything brutal to her."

This is funny since there were tons of scenes worse than decapitations in the 2013 reboot: [https://www.youtube.com/watch?v=iyVHV7ct4gU](https://www.youtube.com/watch?v=iyVHV7ct4gU)

<comment><USER6> This "push button to not die" BS is why I don't play console games anymore.

<comment><USER7> Some modern games are best thought of as semi-interactive movies.

<comment><USER8> Which explains the popularity of a lot of YouTube channels.

I watched someone play "The Last of Us" and "Uncharted 4" the whole way through. It was very enjoyable (partially because I found someone who could keep their mouth shut through a lot of the cut scenes), and I knew I was probably never going to play through those games all the way through.

<comment><USER9> I did the same for "The Last of Us" (and also watched a video where the guy barely spoke; I wonder was it the same one you watched...). I watched it because I heard all the good things about it and thought since it was a PS3 game that I'd never play it. I loved watching it.

Then later it got remade for PS4 and I bought it and played it the whole way through. Despite having watched the entire thing, I really enjoyed playing it just as much as I assume I would have without watching it, and, interestingly enough, I enjoyed the gameplay much more than I was expecting.

<comment><USER8> I'm pretty terrible at video games, especially tense FPS ones like The Last of Us; I own a copy, but I was hoping my wife would play it so I could watch it that way :P

</comment></comment></comment></comment></comment></comment><comment><USER10> I remember playing the original Tomb Raider as a teenager, and while Lara did have "sex appeal," it was the action and violence I enjoyed the most. Let's not kid ourselves--violence sells video games. Imagine if Lara Croft never died and never killed anything/anyone. She wouldn't be Lara Croft. Almost every photo in this article shows a woman holding two guns. She is a killer, and I love her for that.

<comment><USER11> I was more interested in the exploration aspect. Levels in the first Tomb Raider are very good, with puzzles and spooky traps. Violence plays quite a minor role there.

</comment></comment><comment><USER12> What's the story behind this blog? It just occurred to me that the domain is for the developers of Firewatch; are the authors of the articles employees of Campo Santo?

<comment><USER13> I think they used to use it to provide info about the progress of Firewatch. I remember getting thiese quarterly reviews as a newsletter during development.

</comment></comment><comment><USER14> fun fact, campo santo in italian means graveyard</comment>


I'm a millennial and I can't get my older colleagues to be vulnerable - <AUTHOR> https://work.qz.com/1155475/im-a-millennial-and-i-cant-get-my-older-colleagues-to-be-vulnerable-help/ <comment><USER2> Maybe work is for work?

There was an article a few months ago about how dress codes and standardization at IBM lead to better work and social relationships. Everyone followed the same work and dress code. It relived the stress of culture differences (race, religion, vulnerabilities, ect.) by focusing on the job at hand. They became friends because they didn't have to worry about social issues while at work.

Also back to the original article you posted, finding out that someone has a condition like epilepsy may prevent them from advancing in their career. You don't want to put too much stress on them because you never know when they could have a seizure. Even if they've been stable for years.

</comment><comment><USER3> Its a job, not the center of your life. Broaden your life outside of work instead of trying to find meaning where there is likely none. Your boss is not your friend, and may one day need to lay your off for no fault of your own. What will you do then if your job is the center of your life?

</comment><comment><USER4> And maybe you should stop trying?

As the other commenter wrote: work is for work. It is not a place for your personal issues. It's almost as if our language even has different words: _friend_ vs. _colleague_.

If colleagues become friends, that's fine. However, if you only want to work with friends, that is _unprofessional_.

And of course, the whole "we're not a company, we're a family" BS is just a ruse to get you to put in extra time for free. If you're lucky.

If you're unlucky, they are actually so delusional as to think they mean it. They cannot actually mean it, because a company is fundamentally different from a family, and when push comes to shove, that nature will assert itself and many a tear will be shed as the illusion pops.</comment>


Why You Should Stop Taking Pictures on Your Phone and Learn to Draw - <AUTHOR> http://www.thebookoflife.org/why-you-should-stop-taking-pictures-on-your-phone-and-learn-to-draw/

<comment><USER2> I am considering taking a small plain notebook with me along with either a pen or a fude pen (self contained ink brush) and try my hand at sketching stuff instead of relying on the cell phone only. Anyone has tried this already? Experiences?</comment>


Why Did Nick Denton Think Peter Thiel Was Behind the Hulk Hogan Suit? - <AUTHOR> http://www.recode.net/2016/5/24/11765246/peter-thiel-nick-denton-hulk-hogan-gawker-valleywag <comment><USER2> Well, how many _other_ people were running around literally calling Valleywag "terrorists"?</comment>


The IT department is dead - <AUTHOR> http://www.networkworld.com/news/2008/010708-carr-it-dead.html

<comment><USER2> Uh-huh. This guy Carr reminds me of the famous New Yorker cartoon showing two scientists standing at a blackboard. On the left and right are a bunch of equations, and in the middle, connecting the left-side with the right-side is a cloud labeled "then a miracle occurs"...

See it here: <http://www.cartoonbank.com/product_details.asp?sid=40967>

Or maybe he was the screenwriter of the movie "Independence Day" who thought that genius hacker Jeff Goldblum could easily connect his earthling laptop to the alien mother-computer and inject a virus that would destroy all their critical systems. Great cinema, lousy computer theory.

I work for a high-priced technical consulting company and regularly work closely with a number corporate 1000 companies. Guess what? Their problems are complex, their systems and applications are complex and wildly divergent (even when comparing companies within the _same_ industry), and their management and IT people exhibit vastly different levels of skill. It is far from being a cookie-cutter world out there, and Carr is a fool for implying otherwise.

Carr is making a living by being controversial and inflammatory. He should spend more time on the ground actually working closely with some IT organizations and get to know their problems... then let's see if he believes this nonsense then (assuming he's even capable of understanding the details of what his IT friends actually _do_ from day to day).

Shame on any execs who actually swallow this bilge...

</comment><comment><USER3> Most of what internal IT departments do is act as support. They mediate the non-technical workers relationship with technology. That's not going away just because the servers happen to be a few extra miles away.

</comment><comment><USER4> How will data that should be private and well-protected (like health and financial information) work in this "cloud"?

Besides, most IT departments relish complicated proprietary "enterprise" technology for job-security reasons. They're not going to tell the CEO that they're no longer relevant, not when IT is already viewed as a cost center.

<comment><USER5> "They're not going to tell the CEO that they're no longer relevant"

No, the shareholders will when the "cost center" starts eating into their dividends.

</comment></comment><comment><USER6> "Business units and even individual employees will be able to control the processing of information directly, without the need for legions of technical people."

lulz! Typical employees can't even keep their Windows systems free of spyware. Suddenly they're interested in "controlling the processing of information directly"?

And how is this cloud utility computing going to work? Web applications? A monster JavaScript hack is going to replace Excel? Not anytime soon, especially for hardcore users.

As long as someone accidentally backing a truck into a power cable in San Francisco can immediately take down a third of these bratty little Web 2.0 outfits, little of what Carr says is going to transpire anytime soon. (It doesn't matter, even if your quarterly report is due in 8 hours - this is WEB 2.0!!!)

Oh, and good luck getting companies off Exchange Server.

<comment><USER7> "Typical employees can't even keep their Windows systems free of spyware."

He also predicts the demise of the PC.

"As long as someone accidentally backing a truck into a power cable in San Francisco can immediately take down a third of these bratty little Web 2.0 outfits, little of what Carr says is going to transpire anytime soon."

You can make the same argument for on-site power generation. That didn't keep companies from using the power grid.

"Oh, and good luck getting companies off Exchange Server."

This is actually a good point, for reasons of compliance with Sarbanes-Oxley, etc. Corporations likely want tight control of email for legal reasons, at least for now. If that gets solved by an off-site email provider to the satisfaction of corporate attorneys, on-site Exchange installations won't last long, either.

<comment><USER6> Demise of the PC? To be replaced by what? Thin clients?

Will it maintain backward compatibility with all the unmaintained proprietary software people use to run businesses? Probably not (Windows is very unhip and everyone uses Linux).

Weren't thin clients supposed to take over long ago?

I think everything he says will _eventually_ happen, just not soon.

"You can make the same argument for on-site power generation. That didn't keep companies from using the power grid."

A major selling point of these stupid data centers is supposed to be their high uptime and resilience against power problems. What went down is a data center, and that killed dozens of hip Web 2.0 services. If all your computing stuff is in the cloud and a major part of the cloud goes down, you have no computing and you have absolutely no control over the situation, because after all, the data center never goes down. Oh well, you're doing what the pundits tell you to!

I'm fucking sick of how people on this site don't care that web applications often have shitty uptime.

</comment></comment></comment><comment><USER8> Yahoo and Microsoft will trust their data with Google?

Besides this problem, I think he is right.

</comment><comment><USER9> Hm, I don't know?? Sure, standard things like email can be outsourced, but isn't IT in theory a blueprint for the business processes in the company? Would that mean that all companies would be the same? I don't think that will happen.

</comment><comment><USER10> Oh, right. The cloud. Whatever.

</comment><comment><USER5> I agree.

This is the same argument for microcomputers 25 years ago. IT departments fought against them because they feared losing control. They were foisted upon the organization by users that refused to wait months (and years) for apps, so they made their own.

The same thing is happening again, only this time it will be much, much faster. You don't need much budget approval to get it done in the "cloud".</comment>


An actual example of an MITM in the wild [2008] - <AUTHOR> https://blog.startcom.org/?p=125

<comment><USER2> [2008]

<comment><AUTHOR> Fixed the title.</comment></comment>


I learned to read in graduate school - <AUTHOR> https://jpv206.wordpress.com/2015/03/28/i-learned-to-read-in-graduate-school/

<comment><USER2> I use a pen when I read. I underline important bits and actually write down the key points in the margin. Writing these things down helps memory and I don't really care about leaving the pages in the same state that I found them. Also I don't always have a notebook with me, and I do this to my own books only. I just don't care about "ruining" a book -- I want the knowledge!

Of course you might not want to borrow some of my books when I leave them in this state -- they look like study aids from a med school study-a-thon. But whatever trick YOU find that helps you pound knowledge into your brain is worth it.

</comment><comment><USER3> Mr Polad, my 8th grade US history teacher taught me this same lesson. It does seem tedium at first, but I've never found anything better at retention.

Granted I think taking a lecture on the same topics is a major reinforcement.</comment>


Big Blog Theory - <AUTHOR> http://thebigblogtheory.wordpress.com/

<comment><USER2> in case you are skeptical about clicking the link. This is the unofficial blog of the CBS show, "Big Bang Theory."

It expands on the concepts in the show and explains them to a layman. The first post is about the LHC because the characters were invited to go see it. It also talks about graphene because the tall skinny guy was trying to figure out why electrons have no mass moving across them.

Kind of neat. Might be better to have read these posts _before_ the episode airs to have a better understanding of the concepts and humor during the show. I didn't now what graphene was when i watched that episode, but after reading the blog post, the episode makes a lot more sense.

<comment><USER3> The blog posts are written by David Saltzberg, PhD in physics and astronomy.

I think this is his homepage: <http://www.physics.ucla.edu/~saltzbrg/bio.html>

Wikipedia page: <http://en.wikipedia.org/wiki/David_Saltzberg>

</comment></comment><comment><USER4> Earlier post on the "Big Bang Theory" show that is the topic of this blog. The blog was linked in the posted Wired article.

<http://news.ycombinator.com/item?id=1124202></comment>


Show HN: TimePike – employees time tracking, simplified - <AUTHOR> https://www.timepike.com <comment><AUTHOR> Hi HN,

I built TimePike because in all my previous jobs there was a problem: tracking my working hours and holidays was not an easy task. I was working mostly in Software Houses, but not only. We did not have a proper software.

TimePike is solution to those problems. It lets track working hours, overtime, sick leaves, work from homes, and holidays. You can see who is on holiday today. Agencies/consulting firms can generate automatic reports and invoices for their clients.

Primarily I am totally/passionately focusing on building solution which is super simple to use. Most of tools I have stumbled upon were really way too complicated.

You can try it for free. I am looking for feedback!

Cheers, Wiktor</comment>


How Not to Explain Success - <AUTHOR> http://www.nytimes.com/2016/04/10/opinion/sunday/how-not-to-explain-success.html <comment><AUTHOR> The associated journal article, unfortunately, appears to be paywalled:

[http://www.sciencedirect.com/science/article/pii/S0191886915...](http://www.sciencedirect.com/science/article/pii/S0191886915301227)</comment>


First new U.S. nuclear reactors in decades approved - <AUTHOR> http://www.latimes.com/news/nationworld/nation/la-na-nuclear-20120210,0,3657441.story <comment><USER2> As a state that's 49% nuclear power (New Hampshire) I really welcome this news. It almost seems too good to be true.

I hope we will someday be able to close down the single coal plant in my state (coal is 14% of NH power).

For all its faults I think Nuclear has gotten a bad reputation from an extremely small amount of catastrophes. Obviously those events are very salient in the public's mind, but it is worth remembering that coal plants are a catastrophe _every single day._

There are lakes in New Hampshire with abnormally high mercury levels that have never been touched by humans save for testing the water. Coal from as far as Ohio give rise to uncomfortable asthma statistics. I know it won't be soon, but there's at least one technology I can't wait to shutter.

<comment><USER3> Have these new designs improved on water usage problems [1]?

Although I agree about the closure of coal plants, it seems nuclear still has water usage issues (cooling needs) and given the upcoming fresh-water crisis [2], wouldn't solar be a better bet?

[1] [http://www.ucsusa.org/nuclear_power/nuclear_power_technology...](http://www.ucsusa.org/nuclear_power/nuclear_power_technology/got- water-nuclear-power.html)

[2] <http://www.ncbi.nlm.nih.gov/pubmed/12291371>

<comment><USER4> Is solar feasible at the scale we're talking about? What's the $/kwh?

<comment><USER5> I have some experience with solar energy at the small scale (1-2 kwh arrays) and I can say that at the consumer level, the cost for a solar array is now dropping to roughly $0.50/watt. It's still nowhere near the scale/cost of nuclear/coal but it's definitely more feasible than it was ten years ago.

Using the figure of $0.50/watt, to construct a 50MW plant would cost $25 million for the panels alone; bring in the infrastructure, mounting, and remember that the panels lose roughly 10% of their capacity every ten years. Plus account for cloudy days (not as much of an issue in, say, Arizona) and you start to realize that solar isn't a very viable option.

It works really well at the consumer/personal/business level but fails horribly at large, centralized setups. For those about to mention the `good sunlight' requirement, I will provide some refutation for that: my panels are located such that there is a good 30-degree angle to the east the sun has to peak before the light reaches them. The only time that power becomes an issue is the three weeks either side of the winter solstice; at which point I have to start watching my power consumption and regulating computer use etc.

I've assembled the array (roughly 1.5KWh) over the past ten years or so; the cost has been small considering what the equivalent would have been to purchase electricity from the power grid.

I have rambled on for quite a while here, for which I apologize. I guess the TL;DR version is: I don't think solar is feasible at large scale, but it seems to be at a small scale in my own experience.

<comment><USER6> Is that price per watt of peak power production, or per watt of average power? Solar tends to have a fairly low capacity factor, which is important to include in economics calculations.

<comment><USER5> That is per watt of peak power production.

</comment></comment></comment></comment></comment></comment><comment><USER7> Finally a step in the right direction. We need dependable energy that can live with society.

Smog from coal power kills 24,000 American annually (and $53 billion in damages: IE from its relation to non life threatening diseases like pneumonia) . Nuclear has killed 31 workers in its entirety of operation. The WHO estimates Chernobyl may have caused 4,000 civilian deaths since the accident, the Union of Concerned Scientists says 25,000.

I don't get why a single coal plant is still open when even the worst nuclear disaster on record is just another normal day for fossil fuel usage.

<comment><USER8> Probably has something to do with that whole town that's uninhabitable. People are funny that way.

<comment><USER9> Haven't heard anyone arguing for the elimination of the chemical industry after the Bhopal accident.

<comment><USER10> Note to dead responder mark_up (<http://news.ycombinator.com/user?id=mark_up>): your account (and every comment you have posted) is, for whatever reason, flagged. Was your first comment massively downvoted and/or flagged, then deleted?

</comment></comment></comment></comment><comment><USER11> It's baffling to me that so many people seem unwilling to accept the idea that maybe, perhaps, we've learned a few lessons about building safe nuclear reactors over the last 50 years.

It's also baffling to me that the widespread ecological disaster that coal- and oil-fired plants directly cause (and I'm not even referring to climate change!) is somehow more acceptable than the limited, mostly controlled circumstances of a handful of nuclear reactor failures (which Chernobyl has proven is not a permanent state of affairs.)

<comment><USER12> As a rule humans are catastrophically bad at estimating and ranking risk.

People are afraid of strangers abducting their kids, of air travel, of nuclear power. They aren't generally afraid of cheeseburgers, raising kids who don't exercise, cars, and coal power, but they should be.

<comment><USER11> How is it possible that the Human Race has survived until now, given those facts?

<comment><USER13> Our risk estimation brains are based on the ancestral environment. Technology multiplies impacts.

<comment><USER14> Okay, so some part of our risk estimation ability comes from risk-evaluation- specific heuristics that have developed in ancestral environment. But how much impact does this have on the result of any serious evaluation? How easily do the ancestral parts get overridden by rational correction or outright calculation?

</comment></comment></comment></comment></comment><comment><USER9> "two new atomic energy reactors at an estimated cost of $14 billion [...] known as AP1000s, built by Westinghouse Electric Co."

From <http://en.wikipedia.org/wiki/AP1000>:

"China has officially adopted the AP1000 as a standard for inland nuclear projects.", "In the spring of 2007 China National Nuclear Corp. selected the Westinghouse/Shaw consortium to build four nuclear reactors for an estimated US$8 billion."

So the same model is built in the US for 7 billion each, and in China for 2?

<comment><USER15> Regulation is a bitch.

That being said, I could see passing certain demanding regulatory tests and designs in the US could add a significant amount, perhaps even a billion, but I would guess raw supplies and labour are cheaper to source in china as well?

<comment><USER16> Going rate at the NRC (Nuclear Regulatory Commission) is 250+ $/hour to just review documents which are several hundred thousand pages long.

'One of my key concerns was the effect on the schedules for new license applications – not only do applicants have to pay $273 for every regulator hour, but they have to pay the staff and contractors that they use to apply for permission and answer regulator questions. Longer licensing processes cost more in salaries and other overhead and they push potential revenue out into the future.'

<http://atomicinsights.com/2011/12/audit-the-nrc.html>

<comment><USER6> Loan interest also accumulates over time. It's a major part of the cost of US nuclear construction, because the process takes so long.

</comment></comment></comment></comment><comment><USER17> Nuclear reactors are the best source of energy - they just need more research and improvement, and you can't do that without actually building and running some of them on a large scale.

The sun is one huge nuclear reactor, and recreating that wherever we need it is simply awesome. Thorium reactors look promising and if fusion becomes feasible within ~100 years, that would solve a lot of problems...

The so-called "catastrophes" are nothing compared to the lives lost on coal plants and the whole coal power chain. Let's not forget that Hiroshima and Nagasaki are bustling with life, Tokyo is doing just fine with that "deadly radiation" around them (all things considered, of course), and Chernobyl is actually very green (no pun intended - plants and trees are growing nicely, the only ugly stuff laying and rusting around is human-made)...

<comment><USER18> just harvest the sun.

<comment><USER17> Definitely, but where it's not possible, cut out the middleman and create your own sun :-)

<comment><USER19> France is on it: <http://en.wikipedia.org/wiki/ITER>

</comment></comment></comment></comment><comment><USER16> Hopefully this will be a good start towards a new understanding of nuclear power. Also, we need to start building again in order to keep the knowledge of craftsmen that know how to build these. From pipe welders to concrete specialists, let alone the nuke engineers needed. N-Stamp skills could be forever lost in this country if we abandon this power source.

</comment><comment><USER20> Thorium anyone? <http://www.wired.com/magazine/2009/12/ff_new_nukes/all/1>

<comment><USER21> Would be awesome wouldn't it?

The weird thing is that we have to excise, as a species, this notion that nuclear power's risks are unmanageable. That takes time, and a lot of people dying. Not from nuclear accidents but just dying of old age and with old fashioned ideas and an inability to get past their emotions and back into reasoning about something.

For all its promise, investment in Thorium is a non-issue until we can prove that we can license and build new nuclear plants. Sure Larry or Sergei could fund it but the challenge is in the deployment.

The comment above about how they cost $2B for the Chinese and $7B for the US is indicative of that challenge. That and a liability cap which makes them insurable in the first place. If you're government gets to just say what is going to be true then you only pay the cost of building it, which is much much less.

<comment><USER22> You're commenting on a article that states a nuclear reactor of current design was approved, so what's your complaining for? Your "side" seems to be winning, despite the current crop of designs not being the blessed thorium reactor...

<comment><USER21> I'm only observing. The AP1000 design was originally proposed by Westinghouse in early 2004, based on entirely understood physics and components. Here we are 8 years later seeing the approval. I attribute much of that delay to a requirement that Westinghouse prove it would never fail. Meeting such a standard has been, for many years, effectively impossible, even for designs with a known history.

Thorium reactors don't have any of the 'known' history to rely on and so they have to prove something which cannot be proven without building one. In order to get past that cognitive stall, one has to 'take the risk' of actually building one with the promise that should the risk pan out as being Ok, the reactor will be allowed to continue to exist. It has been politically impossible to do that with a new nuclear technology in the US for some time.

Some cynics have suggested that the _only_ reason the NRC licensed it in the US is because China is going to build them and the US wanted a local copy so that they could use as a model should they want to take the Chinese reactors offline "the hard way." I don't subscribe to that level of cynicism.

So ultimately I believe that Thorium reactors are worth pursuing, however any work beyond theoretical requires a different political climate than the one we've existed in to this point. Fortunately that is changing. I would love to find ways to help people with their emotional response to nuclear power, that will be a necessary part of putting us back on to a path of a sustainable future.

<comment><USER23> Fortunately for the cynics, China is making a big investment in liquid thorium reactors as well.

I've actually had a lot of success advocating liquid thorium to people who are otherwise strongly anti-nuclear. Having a completely different fuel, with small amounts of short-lived waste and easily-understood safety features, goes a long way.

<comment><USER21> Me too, however I have thoroughly unsuccessful in getting anyone in the legislature past the word 'nuclear.' Once, during a moment of lucid depression about the energy picture, someone pointed out that the Indiana legislature once tried to change the value of Pi to 3.2 to make it "easier to deal with." [1] It was suggested that if we could get a liquid thorium process redefined as a 'fossil fuel' then perhaps we could get permits to build 'new' fossil fuel power plants.

The UK has an interesting thorium program as well and that may yet yield the needed 'proof of concept' that we don't have in the US (nor can we get funding to build).

[1] <https://en.wikipedia.org/wiki/Indiana_Pi_Bill>

</comment></comment></comment></comment></comment></comment><comment><USER24> What about micro nuclear reactors ? eg. <http://en.wikipedia.org/wiki/Toshiba_4S>

I'm unfamiliar with the details but simply based on the concepts :

\- It solves the large scale catastrophe potential, a small reactor should threaten a very limited area (correct me if I'm wrong)

\- It can be installed incrementally because of small unit costs and could be distributed/mass produced dropping the costs.

\- Power loss from transmission is cut down to a minimum because this sort of micro reactor would be installed close to the consumers.

So any drawbacks I'm missing ? Why not subsidize that (if we have to subsidize something, simply going on technical/economic merits, I would prefer they don't subsidize anything) ?

<comment><USER25> As the article mentions; these reactors are legally just as dangerous as a full-size installation; it'll take a lot of political legwork to make them feasible. Said politics would be a tad more difficult than usual; since your average voter will think of the following:

a) you're literally putting nuke plants in people's backyards. folk will worry about getting green suntans.

b) assuming they're meant to be autonomous; there's the issue of potential sabotage. they're small nukes, but they're still nukes. (and if they're networked, could be even worse than a centralized plant)

PS: perhaps this design would be far more sensible as a cluster (housed like a normal nuke plant); theoretically the entire plant would be safer as the smaller reactors would be easier to control and contain if things went south.

<comment><USER24> I'm not a nuclear physicist but in what way is a nuclear reactor equivalent to a nuke ? AFAIK reactors can't actually reach the critical level that's required to create a nuclear explosion - it's a completely different design, different isotope concentration, so the biggest threat is exposure to radioactive materials and maybe heat/pressure explosion. And 4S has passive safety mechanisms so sabotage would have to be manual, chain sabotage would be impossible, especially if they were properly monitored.

The biggest safety concern I've heard is that you could use them to create small quantities of weapons grade plutonium, but I guess if you know how to do that you could get it in other ways.

<comment><USER25> They aren't; that's what people will think of them as though. It's taken us this long to actually build a new plant period; it'll be a while longer before people are convinced it's safe to live across the street from one.

<comment><USER26> This contradicts what you said in your first post: "they're small nukes, but they're still nukes. (and if they're networked, could be even worse than a centralized plant)"

What is the issue? That they are dangerous or that people perceive them to be?

<comment><USER6> "Nuke", in this case, was being used as a shorter way to say "nuclear reactor". Nuclear reactors are, of course, completely different from nuclear bombs.

</comment></comment></comment></comment></comment></comment><comment><USER27> If engineers could pursue nuclear power free from influence and interference, then I would have full confidence in their ability to create safe systems. Unfortunately politics and other forces have a way of always intruding.

Feynman's analysis of the Challenger disaster, and of the engineer who stayed up in the middle of the night refusing to sign-off on the launch in the face of commerical and political pressure ought to give anyone pause. In fact he was able to cite the exact reason for failure that occured - gaseous breach of the O-rings, due to operation outside design paramters. The fact his career was also finished, is the icing on the cake.

Chernobyl(cumulative maintenance procedural failures) and Fukushima (concrete walls too low to withstand the Tsunami) also stand as evidence that science and engineering doens't exist in a vaccum and always gets co-opted.

<comment><USER23> Chernobyl was a reactor that (1) caused the reaction rate to increase as the temperature increased, a property viewed as madness today, and (2) had no containment building whatsoever.

Fukushima was better, but was still a reactor from the 70s. There were reactors right next door, built in the 80s with better safety features, that withstood the same events just fine.

Modern designs are much better than those 1980s reactors.

</comment></comment><comment><USER28> This is bad news. If you read the article to the end you will see that the whole thing is funded with taxpayer money. Also, the electricity bill payers will be expected to pay extra to make up for the additional costs of nuclear energy.

This is only happening because of subsidies, and if we are to subsidize something we should subsidize renewable energy which is rapidly growing and decreasing in cost as opposed to nuclear which keep increasing in cost as new dangers of nuclear plants get discovered.

And by the way there are problems with this new advanced design too. A structural engineer that worked on the project says that the shield building is not well tested and there is no reason to assume that it can withstand the earthquakes and hits it is supposed to withstand.

pbadupws.nrc.gov/docs/ML1033/ML103370648.pdf

<comment><USER9> "What makes a difference in Georgia is that the state has ruled that _customers_ are going to have to pay, he said."

Not taxpayers. Subsidies have actually been going to wind and solar for quite a few decades (see Solyndra) - not to nuclear.

<comment><USER22> If people are steeling themselves for high electricity bills, then why not focus on renewables where the current technology is improving very quickly? When the amazing thorium reactors show up I'll reconsider, but until then... why be willing to pay big for nuclear?

<comment><USER29> I would assume (though I'm not fully up to date) that the so-called "safer" reactor designs such as high-temperature gas cooled, pebble-bed, or thorium reactors are still pretty much research projects. They are likely at least a decade or more away from commercial scale feasibility.

<comment><USER23> One exception is the Integral Fast Reactor, which was near production-ready when Clinton cancelled the program in 1994. GE-Hitachi has a similar design called the PRISM which has been approved by the NRC for a full-scale demo reactor. GE is trying to sell it to the UK to burn up their plutonium stockpiles.

In the IFR tests at Argonne, researchers cut off the cooling system entirely, and the reactor just quietly shut down, with no damage.

A great new book on the IFR is Plentiful Energy by Till and Chang, two senior scientists at the Argonne project.

</comment></comment></comment></comment></comment><comment><USER30> If they are going to use taxpayer money, can't they focus on something that is more forward looking like Thorium reactors, or even subsidizing renewable energy?

<comment><USER31> They are already subsidizing a _heck_ of a lot of renewable energy. And I don't doubt that there is NSF-funded research on thorium reactors going on somewhere in the United States.

<comment><USER23> I'm on a mailing list with some prominent people involved with liquid thorium reactors, and they're not aware of any current government-funded research in the U.S. (There's plenty in China, though.)

</comment></comment></comment><comment><USER32> Generally good news I think, although as the article hints, the economics still seem to be tough, at least without any sort of more stringent regulation or taxation of their ultra-cheap competitors, goal and natural gas. It seems like either price will have to come down, or these quite generous federal subsidies will have to be extended to a number of additional new plants, in order to make the (very large) construction expense have a sufficient ROI for a private-sector company to undertake.

</comment><comment><USER33> It's all going to come down to two things: are the workers any good, and do they give a shit.

Just like everything else.

</comment><comment><USER34> About time.

</comment><comment> mkr-hn I thought this was already approved months ago when I first heard about it. I'm glad it's moving forward.

</comment><comment><USER35> As a counterpoint to all the comments like this:

 _> It's baffling to me that so many people seem unwilling to accept the idea that maybe, perhaps, we've learned a few lessons about building safe nuclear reactors over the last 50 years._

I would suggest that the real problem with nuclear energy is that _we don't know how dangerous it is_. And we have no means of estimating the danger that isn't obviously inadequate. You see, nuclear disasters don't happen because engineers are incapable of designing failsafes and containment buildings. Nuclear disasters happen because it's impossible for engineers to envision all the possible failure modes. The confluence of events that causes a meltdown is inevitably something the engineers didn't design for.

In an enlightening article [0] written after the Fukushima disaster, a physicist and expert on nuclear safety argues that

\- severe accidents at nuclear reactors have occurred much more frequently than what risk-assessment models predicted;

\- the probabilistic risk assessment method does a poor job of anticipating accidents in which a single event, such as a tsunami, causes failures in multiple safety systems; and

\- catastrophic nuclear accidents are inevitable, because designers and risk modelers cannot envision all possible ways in which complex systems can fail.

In other words, everything we "know" about nuclear safety is wrong.

0\. [http://thebulletin.org/web-edition/features/beyond-our- imagi...](http://thebulletin.org/web-edition/features/beyond-our-imagination- fukushima-and-the-problem-of-assessing-risk)

<comment><USER36> Your argument is too powerful. It proves engineering as a whole is impossible. It equally proves we should never build any sort of building, because it could fall down and kill people and we can never be 100% sure we've prevented it.

It's an irrational appeal to emotion dressed up in rational trappings.

<comment><USER35> _> Your argument is too powerful. It proves engineering as a whole is impossible._

No. It's an argument that we have no good way of estimating the damage caused by rare, spectacular failures in complex systems. But thanks for the down- vote.

 _> It's an irrational appeal to emotion dressed up in rational trappings._

No. It's pointing out an epistemic hole, one that is essentially the reverse of the sunrise problem [0], that has been discussed by countless philosophers of science, probability theorists, and scientists across dozens of fields. I suggest you read the article I linked and some of the papers it cites rather than make a spectacle of your downright hurr-durr ignorance of the subject.

0\. <http://en.wikipedia.org/wiki/Sunrise_problem></comment></comment></comment>


Free Font: Norwester - <AUTHOR> http://jamiewilson.io/norwester/

<comment><USER2> Hey everybody. I'm the designer of Norwester. Thanks for the interest and feedback. Yea, the font is really limited right now. Please use it judiciously as there are a lot of glyphs not accounted for, as digitalengineer pointed out. Please let me know if you have any special requests or catch any thing not looking right. Thanks again!

<comment><USER3> Here are some possible improvements that jumped out at me:

\- Certain letters including C, D, and S appear shorter than other letters, because of their round tops. Optical illusions cause letterforms with round edges (C, O, S) or pointed edges (A, V, W) to need to extend slightly farther in the rounded/pointed direction to appear to be the same size as other straighter shapes. This is called "overshoot" ([https://en.wikipedia.org/wiki/Overshoot_%28typography%29](https://en.wikipedia.org/wiki/Overshoot_%28typography%29)).

\- The spacing and kerning both need work. Letter pairs such as OV, FR, IA, AI, KE, EY, OX, MY, AP, and RT are too far apart. I've found that it's easier to kern if you look at your outlines upside-down and backwards (I know Fontlab Studio has a built-in option to preview text in this manner, Glyphs might as well). Doing so helps your brain regard the outlines purely as shapes without getting sidetracked by their semiotic significance.

Another trick to type design is understanding that mathematical/geometric precision do not always result in the _appearance_ of mathematical/geometric precision. Measurements that should theoretically be equal (such as the heights of letters as previously mentioned) often need to be fudged in order to look equal to the imperfect human eye.

The forums at Typophile are a great place to have your work critiqued by professional type designers ([http://typophile.com/forum/1](http://typophile.com/forum/1)). Or, feel free to contact me if any of this is interesting and you want to know more. :)

<comment><USER2> Very helpful. Thank you very much. I'll keep tweaking the kerning and consider those optical adjustments moving forward.

</comment></comment></comment><comment><USER4> Great job. I saw this font on Designer News yesterday and downloaded it instantly.

I think creating a font from scratch could become a designer's _rite of passage_. It involves usability, aesthetics, and technical knowledge (kerning, weights, character encoding, horizontal and vertical metrics...). I always thought about creating one myself but usually ended up browsing the web for original and better designed fonts.

You got me questioning my behavior.

<comment><USER5> Possibly, but graphic design and type design are vastly different fields. A good graphic designer isn't necessarily a good type designer.

<comment><USER6> Indeed. A good visual designer should know how to take a typeface apart, but you really need to become a type designer to put one together.

</comment></comment></comment><comment><USER7> Thank you for putting the license in the zipfile. We've had to avoid using certain fonts because it wasn't possible to identify the license.

Can you please put another file with a link back to your website and the request to donate to the International Justice Mission if used?

<comment><USER8> Ahh, lawyers destroying business opportunities since forever

</comment></comment><comment><USER9> Looks nice. It's Open Type so thats cool. However, no serious designer would choose this font for production as it is right now though. You dev's would call it 'Aplha' or 'Beta'. It contains only the 'Western' letters and even for that, not most variables. This makes it dangerous to use for your company's branding. Imagine if you want to write an é, ü, î or what not. You can not. So, nice to try a bit but be careful using it for production.

If you wish to compare it to something, have a look at these free fonts: [http://www.exljbris.com/](http://www.exljbris.com/) They're free for the Roman, Bold, Heavy, Italic and small caps, but if you want more variables, say a Heavy Italic you pay a small fee.

<comment><USER10> How would you make it better? At the end of the page the author acknowledges the need for help in making the font better. I know nothing about making fonts, but you clearly have some ideas.

So, what needs to be added before a professional designer would consider this font?

<comment><USER9> Idon't mean to say this is not good, but as it is now it's not complete. A lot of the glyphs (characters) are missing. I'm not talking about ff or other combinations that can be replaced by a specific glyph for typographical purity, or non-western letters (Central European, Russian, Turkish, Chines...) but rather the extra's even our own Latin based fonts need.

</comment></comment></comment><comment><USER11> This font will be great to use in headlines. Will this font be available in Google Fonts [1]? Because Google hosts many fonts under SIL Open Font License .

[1] [http://www.google.com/fonts](http://www.google.com/fonts)

</comment><comment><AUTHOR> Just to be clear: I submitted this but I'm not related to the OP. I just found it on [http://sidebar.io/](http://sidebar.io/) earlier today and liked both the open license and the fact that the author seems open to suggestions.

<comment><USER2> Thanks for sharing my font! you're awesome.

<comment><AUTHOR> You're most welcome! I was, in fact, surprised nobody had submitted it. I love what you've done here and hope you'll be able to push it forward. If I had one request, it would be french diacritical marks, but I will definitely find uses for the font as-is.

Thanks for the hard work!

</comment></comment></comment><comment><USER12> It's a pity this font can't be used in many countries due to lack of any diacritics... :(

<comment><USER2> Sorry for the lack of those glyphs. I really hope to expand it soon to make it more useful. Thanks for the interest though.

<comment><USER12> thanks! looking forward to the expanded version! (i know providing diacritics is not an easy thing to do...)

</comment></comment></comment><comment><USER13> I love the fact that you've asked people to donate to the International Justice Mission - they do great work! What made you choose them? Is the font somehow inspired by the work they do? (maybe you could convince them to incorporate it into a rebrand ;)!

</comment><comment><USER14> What license is this released under?

<comment><USER15> Found in the zip file:

This Font Software is licensed under the SIL Open Font License, Version 1.1. This license is copied below, and is also available with a FAQ at: [http://scripts.sil.org/OFL](http://scripts.sil.org/OFL)

<comment><USER14> Ah! Thank you - I should have opened the file first.

</comment></comment></comment><comment><USER16> Fantastic. I just wish more fonts used a slash zero :(

</comment><comment><USER17> Looks a lot like "Bank Gothic". I almost expect to see it on a refrigerator... (S M E G)

</comment><comment><USER18> Wow, an ASCII font. Useless in most part of the world (sorry for being dismissive. I actually like the font, but without any "funny" characters, it's use is very limited) Now, I'll probably get all the downvotes from today...

<comment><USER19> well it doesn't have lowercase either

<comment><USER20> Lowercase is small caps.

</comment></comment></comment><comment><USER21> Why did you use images of the font on your demo page (rather than using it as a web font)?

</comment><comment><USER22> Very nice looking, thank you!

</comment><comment><USER23> I love it. It has that cold war propaganda feel to it. Great for headlines.

</comment><comment><USER24> The "R" and "5" are quite interesting, and the symbols look fun, specially that "@".

</comment><comment><USER25> is this font legit? it looks like it was build based on some other font, and there are still original/unchanged characters left. f.e. try to render A, Á and notice the difference in font-weight and also the char differences. or am i missing something?

<comment><USER26> > it looks like it was build based on some other font, and there are still > original/unchanged characters left.

There is nothing wrong with doing that. Fonts can't be copyrighted.

The font file itself can (sometimes) be copyrighted as a form of computer program, but not the font (i.e. the shape).

<comment><USER25> >Fonts can't be copyrighted are you sure? than what are all this online web- font services like typekit about? are you saying that i can download any font, edit its metadata, maybe add 1 point to every character and freely use it?

<comment><USER26> > than what are all this online web-font services like typekit about?

Good question. They are maintaining the fiction that the font can be copyrighted and hope that everyone plays along. Keep in mind the font file itself is copyrighted because font files are actually little computer programs.

> are you saying that i can download any font, edit its metadata, maybe add 1 > point to every character and freely use it?

Probably not, that's not a sufficient change of the file. What you can do is display the rendered font on your screen, then exactly copy it using a font editor. You will loose hinting this way though (the program embedded in the font to make the hints is copyrighted, the specific hints at each size is not), so there is some extra work you will need to do to replicate the hinting.

</comment></comment></comment></comment><comment><USER27> Boxy! Downloaded it to play around, thx.</comment>


The mathematical explanation behind "Y Combinator" function - <AUTHOR> http://en.wikipedia.org/wiki/Fixed_point_combinator <comment><AUTHOR> From wikipedia's article on Lambda calculus:

"..in other words, f must expand to g(f). This call to g will then expand to the above factorial function and calculate down to another level of recursion. In that expansion the function f will appear again, and will again expand to g(f) and continue the recursion. This kind of function, where f = g(f), is called a fixed-point of g, and it turns out that it can be implemented in the lambda calculus using what is known as the paradoxical operator or fixed-point operator and is represented as Y -- the Y combinator."</comment>


Hello World. Fast Company launches Co.LABS, to focus on software - <AUTHOR> http://www.fastcolabs.com/3006489/welcome-colabs-were-building-software-about-software

<comment><USER2> Am I the only person somewhat confused by the site at present? It feels as if they're trying to muscle in on TC/Wired/Netmag … yet I don't know what exactly I'm reading as of yet.</comment>


TodoMVC in Rust - <AUTHOR> http://tcr.github.io/rust-todomvc/ <comment><USER2> I appreciate it's to demo the capacity to compile Rust to js, but that's some really nasty code.

[https://github.com/tcr/rust- todomvc/blob/master/src/main.rs](https://github.com/tcr/rust- todomvc/blob/master/src/main.rs)

Why put it all in the main? Why define functions as variables? Why .parent().unwrap().parent().unwrap()?

<comment><USER3>
      > Why define functions as variables?

I'm not sure what you mean here, exactly.

      > Why .parent().unwrap().parent().unwrap()?

I'm not mega familiar with the code, but using a low-level binding to something else that has nulls often means a lot of Option, which means a lot of unwrapping. A nicer library could probably get rid of some of this.

<comment><USER4> >which means a lot of unwrapping

         .unwrap()

In rust is generally a bad pattern to use. Its basically short hand for

        let o :Option< u64 >;

        let value :u64 = match o {
                            Some( t ) => t,
                            None => panic!()
                         };

So if you don't met the condition, you explode. When ever you see .unwrap() in Rust just mentally switch it for / _TODO add error handling_ */

<comment><USER3> Yeah, I was just using "unwrapping" as a more general term for "extract the T out."

We almost changed 'unwrap' to 'assert', but people found it a bit too weird.

<comment><USER4> >We almost changed 'unwrap' to 'assert', but people found it a bit too weird.

That is weird. idk I guess its already sort of being done, you're more or less asserting Option::Some( _ ) is the value.

</comment></comment></comment></comment></comment><comment><USER5> Would be cool if there was some small web framework you could use so you could avoid having your state in RC(RefCell)'s. Perhaps it's the Haskell guy in me but I always try to make my code have zero RC or even RefCells. I'm also a complete rust noobie, so perhaps that's not good practice at all :)

<comment><USER6> I'd love to refactor this to not need RC's for DOM nodes. I'm new to Rust, but I expect there's a ton of room for refactoring.

</comment></comment><comment><USER7> What's the development process like for a Rust-in-the-browser project like this? I mean, is it like; write some Rust - manually start a compile process - wait a while - view result in browser - repeat? Are there nice tools? :)

I'm used to working with raw JavaScript, ClojureScript with Figwheel, and Java/xhtml with JSF. Of the three, ClojureScript/Figwheel has given me the smoothest process so far, though I know there are tools for autoreloading raw js as well, just haven't gotten around to using them.

<comment><USER3> The general workflow with Rust is

        $ git clone <foo>
        $ cd <foo>
        $ cargo run

With something like this, you might want to also use [https://github.com/passcod/cargo-watch](https://github.com/passcod/cargo- watch) , which, after installing it, changes that last line to

        $ cargo watch

and then it will recompile when you change a file, automatically.

I haven't been able to test that this project works exactly this way because it looks like they're on an older nightly than I have on my machine, but it looks like that's all you need.

<comment><USER8> I will be amazed if true! Last time I looked at the emscripten-Rust stack it was a tower of hacks and required a custom-hacked standard library. If that's all abstracted behind cargo build scripts that's awesome, but we're still a ways from having this be elegantly integrated into the Rust system.

It's going to improve rapidly though.

<comment><USER3> I think it's gotten better due to recent LLVM changes in emscripten, last I heard, but maybe maybe not. Can't wait until it's just trivial.

</comment></comment></comment></comment><comment><USER9> For something compiled with Emscripten, this was stupid quick to startup. Wow.

<comment><USER10> I had to check and the generated .js file is 248kByte compressed, 787kByte uncompressed. That's in the same ballpark as a comparable C++ demo, looking at the code it is even a bit big (e.g. my emscripten demos here are between 100kByte and 500kbyte: [http://floooh.github.io/oryol/](http://floooh.github.io/oryol/)).

There is some inherent size overhead because the linked parts of the C runtime library and C++ std lib are part of the emscripten-generated JS (std::iostream and printf seem to be the biggest offenders on the C++ and C side) while on some native platforms this code lives in DLLs, but gzipped asm.js code itself isn't bigger than its gzipped 'native equivalent' (usually within +/\- 10%).

It _is_ easy to created bloated code with emscripten, especially when using C++ instead of C, but for the same reasons the code would also be bloated as native executable (e.g. massive use of template and inline code).

</comment></comment><comment><USER11> Nice. Maybe that can be one good use case for the use of rust. Using it in place of C++ for Emscripten. I wonder what are the other languages supported.

</comment><comment><USER12> Where's the code?

<comment><USER13> [https://github.com/tcr/rust-todomvc](https://github.com/tcr/rust-todomvc)

</comment></comment><comment><USER14> Looks fast.</comment>


Ask HN: Sterilizing used N95 respirators with UVC light? - <AUTHOR> I've heard about the shortages in many countries of disposable N95 respirator masks.
Specifically, many hospitals are being forced to or will be forced to reuse their respirator masks.  They're not designed for this, but it happens anyway due to limited supply.
I'm working on building something similar to
https://www.amazon.com/Light-Clean-Ozone-minutes-Capacity/dp/B07KWCQBKX/ref=sr_1_4?keywords=uvc+sterilizer&qid=1584471270&sr=8-4
but for less money, using
https://www.amazon.com/gp/product/B00FB140TU/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1
(basically an aquarium sterilizer bulb, which should have fairly good inventory).
I believe putting a respirator in such a sterilizer for 30m would be preferable to trying to sterilize it with liquid (which would likely ruin the mask) or to not sterilizing it at all (which apparently runs a good risk of reinfection).
My question: assuming this or a similar UVC-based sterilizer was cheap and readily available to health care facilities, would it be a good idea?
Disclaimer: I am a software engineer and definitely not a healthcare professional.  I have a little bit of biotech lab experience, and have not seen UVC light used in a biotech context for this sort of thing. <comment><AUTHOR> OP comment: Here's a link that supports the idea [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4699414/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4699414/)

Also clickable links for the Amazon items mentioned in the post:

[https://www.amazon.com/Light-Clean-Ozone-minutes- Capacity/dp...](https://www.amazon.com/Light-Clean-Ozone-minutes- Capacity/dp/B07KWCQBKX/ref=sr_1_4?keywords=uvc+sterilizer&qid=1584471270&sr=8-4)

[https://www.amazon.com/gp/product/B00FB140TU/ref=ppx_yo_dt_b...](https://www.amazon.com/gp/product/B00FB140TU/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1)</comment>


Experian Site Can Give Anyone Your Credit Freeze PIN - <AUTHOR> https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/ <comment><USER2> This isn't going to stop until we stop treating SSNs like they're secret. Mine's not; it's been leaked at least once that I know of and I've given it freely to dozens of clerks and HR staffers over the years, any of whom had ample opportunity to jot it down for personal use.

I know this will never actually happen, but I sincerely wish the Social Security Administration would publish a complete official database of real name to SSN mappings. It wouldn't impede their use as _Social Security Numbers_ , but it would make it extremely obvious how inappropriate they are as a proof of identity. Maybe then we'd finally be forced to come up with something a bit less insane.

<comment><USER3> So as soon as you make SSN secret, companies are going to use another ID to uniquely identify people and we are right back in the same boat.

<comment><USER4> They would probably pick something more secure than the government did, considering they have a vested interest in not succumbing to fraud.

<comment><USER5> > not succumbing to fraud.

Erm... that's the entire fucking point of Experian. And yet they failed.

Experian is a free-market for-profit corporation.

<comment><USER4> If the government already chose a 9-digit 'secret' number that can be used to pay taxes and get tax refunds and do pretty much any other sensitive communication, is it the onus of private industry to supersede it?

Experian failed, but the system was designed to fail. You can already get all of this important info with this number, so there was little incentive to create a new system and ensure that every American participated in it. Their operation was also entrenched by government credit reporting acts, pretty much setting in stone how things are and preventing innovation. This was a pseudo- government 'industry', not a free market system with new startups frequently joining.

<comment><USER5> Last I checked, the US Government requires:

* Government Issued IDs -- Most situations. Police Tickets, Court issues, etc. etc. Usually your driver's license. This is effectively a security token, since its illegal to make illegitimate copies of a Government issued ID (although cryptography should be used in future ID efforts IMO)

* Tax PIN number and Last year's tax refund -- Pay taxes and do tax refunds. There's a ton of OTHER information you need to submit with your taxes to get it processed. The SSN is purely the "username" for your taxes, it isn't the "password".

\----

In the free market? People use SSN as a password, because free market doesn't give a care about you or decent security practices. Or at least, Experian doesn't (and they're a free market actor)

<comment><USER4> > Tax PIN number and Last year's tax refund -- Pay taxes and do tax refunds

For individuals, your TIN (Taxpayer Identification Number) defaults to your SSN, and you do _not_ need the previous year's return to file taxes. Not sure where you are coming up with these imaginative claims, and I find it somewhat concerning how confident you feel in bureaucratic design decisions.

<comment><USER5> [https://www.irs.gov/individuals/electronic-filing-pin- reques...](https://www.irs.gov/individuals/electronic-filing-pin-request)

<comment><USER4> (Your link is only for e-filing.) Millions of returns are still processed via mail.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Quick tl;dr

"The first hurdle for instantly revealing anyone's freeze PIN is to provide the person's name, address, date of birth and Social Security number (all data that has been jeopardized in breaches 100 times over — including in the recent Equifax breach — and that is broadly for sale in the cybercrime underground).

After that, one just needs to input an email address to receive the PIN and swear that the information is true and belongs to the submitter. I'm certain this warning would deter all but the bravest of identity thieves!"

<comment><USER7> Considering that address and date of birth strongly predict most of the digits of the SSN, this is pretty bad. Consider further than even name can predict SSN (people named Stein more likely to have been born at the Jewish hospital, and SSNs are sharded by hospital).

SSN is not a secret. End of story.

</comment></comment><comment><USER8> This just keeps getting more and more outlandish. I'm pretty sure you have to deliberately work at it, if you want to be this incompetent. Had they just had the entire IT staff play minesweeper, they might actually be better off than they are now.

I am not actually sure that I've seen a bigger display of ineptitude. I suspect there's going to be academic research papers published about this and studied for years to come. I'm not big on conspiracy theories, but I could understand someone believing this is deliberate incompetence. I'm not even sure I could fault them for believing that.

<comment><USER9> There is _no_ solution to this problem of identity. So they invent the credit freeze. Then they invent the credit freeze PIN. Then someone loses their PIN and they want to buy a car _now_. So business adds "look up your PIN" feature. It is face-palming. But that's what you get when your business requires a way to securely identify people when no such method exists.

<comment><USER8> There may be no perfect solution but I am really hoping something better can exist. There isn't as much trouble in some other countries, maybe we can look into what they are doing?

I don't have the answers. But, just because I'm not an MD doesn't mean I can't point out an obviously broken arm. This is a problem and it does need fixing.

At this point, it's reached the level of absurd. Not even a great author could have come up with a better storyline. This has reached the point of being surreal. If I weren't witnessing this, I'd have trouble believing it - it's that bad.

At this point, I'm having trouble thinking of something they haven't screwed up. This has more twists than a soap opera.

<comment><USER10> Other countries don't have the free/easy relationship to credit that we do.

In many places, if you want to get a small, revolving line of credit it's considered perfectly normal to spend _weeks_ validating your identity, including one or more in-person visits by a financial official. Can you imagine doing this in modern America? The economy would shrink by whole percentage points overnight.

We've made a deal with the devil, and this is how we pay.

<comment><USER8> That might just be the saddest post I'm going to read all day because you're probably right. Individuals have access to lots of credit, it fuels our American consumerism.

Maybe it's better, in the long term, to suffer that shrinkage? I'm absolutely not an economist, so I don't really know. Maybe we are in a credit bubble and it needs to pop?

Could we absorb the negative drop in the economy without there being riots in the street? Would it be better in the long run?

</comment></comment></comment></comment></comment><comment><USER11> It's a weird situation. Your credit information is so crucial that the agencies need a workaround for everything - a user can't be allowed to get stuck in a state that locks them out of their credit forever.

I'm still annoyed by this entire debacle but I'm not sure what the correct solution for a lost PIN should be.

<comment><USER12> > I'm not sure what the correct solution for a lost PIN should be

Krebs gives an answer in the article and I think I agree:

> I understand if people who place freezes on their credit files are prone to > misplacing the PIN provided by the bureaus that is needed to unlock or thaw > a freeze. This is human nature, and the bureaus should absolutely have a > reliable process to recover this PIN. However, the information should be > sent via snail mail to the address on the credit record, not via email to > any old email address.

Until we have a way to guarantee our electronic identity to the government (e.g. an RSA key registry so that I can sign a message like "I am $name and $email is my email"), physical delivery is the best option.

<comment><USER13> > However, the information should be sent via snail mail to the address on the > credit record

What would happen when that address is incorrect or outdated?

<comment><USER14> If it's incorrect, you likely have bigger problems than where to send the pin. And I think there are ways to correct the address.

If it's outdated, then it simply goes to your old address. If you moved, the Post Office will forward mail addressed to you at your old address to your new address.

<comment><USER15> I always hear this story about post offices forwarding mail with old addresses, but in my life (having moved a ton), I've _never_ received mail at a new address with an old address printed on it, while I _have_ received huge volumes of mail addressed to the last guy living where I'm at. Is forwarding an American thing?

<comment><USER16> Yes, I have gotten mail forwarded as much as 8 months after a move. It get's a yellow sticker with your new address on the bottom right. I believe it's based on names so it may not work for all mail.

<comment><USER17> Having one's email forwarded to another address can also be subject to fraud. Haven't done it in awhile, possibly you now have to go to the counter and show some id, but it used to be far too easy to fill out the little card and hand it to the person behind the counter, no questions asked.

[https://www.identityguard.com/news-insights/beware-change- ad...](https://www.identityguard.com/news-insights/beware-change-address- scams/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> I know it is popular meme when it comes to Google, Facebook, etc. that "you are not the customer", but at least you have a choice not to use their services. It's impossible to opt out of allowing credit bureaus access to your personal information and still function in society.

</comment><comment><USER18> Should be read together with the follow-up [https://krebsonsecurity.com/2017/09/equifax-breach- setting-t...](https://krebsonsecurity.com/2017/09/equifax-breach-setting-the- record-straight/)

</comment><comment><USER19> Looks like I wasted $10. My only hope is that with 143m affected people, they just skip to the next one if they encounter a Credit Freeze.

<comment><USER20> On the upside, you now have quantified damages.

</comment></comment><comment><USER21> What could be a possible solution to the PIN reset? Security practices say that we can authenticate across 3 ways; something you are, something you have, and something you know. Its obvious to me that the something you know is also known by hackers, and I don't think biometrics are going to be overly popular after this. Does Experian send out a hardware token to all users that request a security freeze?

<comment><USER22> A mailed letter would work. Plenty of other orgs do that as the only way to communicate your PIN to you.

<comment><USER23> It's interesting that this isn't one of the three traditional ways to authenticate, but it's obviously effective to some degree. Maybe it suggests a new mode of authenticating: some place where you are.

</comment></comment></comment><comment><USER24> This is where Congress has utterly failed in its regulatory responsibilities. There's no way this labyrinth of credit-related breaches/issues should be confronting consumers.

Two things I do: monitory my credit reports regularly and give nonsensical answers to the security questions.

<comment><USER25> The lesson Congress takes to heart that you should learn: Greed is more important than your financial security.

</comment></comment><comment><USER26> How the heck do other countries take care of these things? Aren't credit agencies and their reliance on SSN's a purely American concept?

<comment><USER27> In the Netherlands every citizen has a digid, which is a two factor digital identification mechanism. Almost all government and almost all (semi-)public companies use it. Works like a charm and very secure.

</comment></comment><comment><USER28> the only solution is to implant a RSA token generator on arms of every citizen at birth. perfect 2FA. they get to turn you chip off if you make too much trouble.

</comment><comment><USER29> I think it's also worth noting while I do think they at least hash your password if you sign up for an account you are limited to a 14 character password.</comment>