CircleCI Security Incident - <AUTHOR> https://support.circleci.com/hc/en-us/articles/360034852194-Security-Incident-on-8-31-2019-Details-and-FAQs- <comment><USER3> Relevant post on HN 2 years ago: [https://news.ycombinator.com/item?id=15442636](https://news.ycombinator.com/item?id=15442636)

<comment><USER4> "CircleCI trusts 8 analytics companies with your source code and API tokens, October 9, 2017. When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser."

So, did they do anything about that?

Even if using iframes and a secure api over postMessage/onmessage: safe, and security can be controlled by the external provider i.e. safer for both parties (ideally the servers pass the security context between each other - <USER2> even use an iframe internally for all the same reasons).

[https://kevin.burke.dev/kevin/circleci-is-hopelessly- insecur...](https://kevin.burke.dev/kevin/circleci-is-hopelessly-insecure/)

<comment><USER5> > for e.g CircleCI's account for Google Analytics

Google allows custom JS injection via Tag manager, so there are possible vectors, even if only access to 3rd party site was stolen. Of course I have no idea what was the deal here.

It's worth noting, that CircleCI did nothing to address issues raised in the linked post. Their main app still loads tons of third party analytics garbage for e.g. Google, Hotjar, Amplitude and even Facebook of all people. I do block all those, but as someone pointed out it's not a solution and cant even be reliable at all times.

Please bear in mind, that CircleCI not only has access to private repositories. More often then not they do store private SSH keys to your production servers.

</comment></comment></comment><comment><USER6> This is how you handle a security notification. Well done CircleCI, looking forward to the full postmortem.

<comment><USER7> I absolutely agree. This is a very professional example of handling a serious security incident. CircleCI immediately took action and notified all affected accounts afterwards and as with this post, they did a detailed FAQ-style breakdown of what happened and how they will stop another attack.

> Security is taken very seriously here at CircleCI.

Compared with the other security handlings i've seen, this statement sounds genuine.

</comment></comment><comment><USER8> > Security is taken very seriously here at CircleCI ... > In the meantime, we > will review our policies for enforcing 2FA on third-party accounts to the > extent possible, and continue our transition to single sign-on (SSO) for all > of our integrations

Well, if you had taken security seriously, the first thing you'd do is ensure 2fa on all accounts.

</comment><comment><USER9> > _On August 31st at 2:32 p.m. UTC, a CircleCI team member saw an email > notification from one of our third-party analytics vendors and suspected > that unusual activity was taking place in this particular vendor account._

A convention I like is that team members creating, updating or removing accounts should reply to any automated emails sent to mailing lists saying "this is me". Ideally with a link to the relevant issue or story.

It really cuts down on unnecessary nerves.

</comment><comment><USER10> What's sad about this is that CircleCI actually has a great product and is one of the nicest ways to do end to end automation for mobile development/releases. Having their pipeline in place actually feels quite liberating.

The sad part is that they take this for granted and liberate all your data and security weaknesses too to unknown third parties for either a weird ideological reason about interoperability or a small marginal profit.

I don't understand why they can't do both(interoperability and security), their main profit is not data, it's customers paying for infrasctructure. They don't have to share any data at all and are fully capable of providing a competent level of security.

If anything I think if they cut out the profit line from sharing metrics etc with third parties it would actually bring more customers in because of increased confidence in the product.

<comment><USER11> I doubt they are getting paid to share any data at all. Usually, the point of 3rd party services is for improving the service or keeping it bug free and functional.

I would imagine they have some services that are logging JavaScript errors and probably some that are tracking how people use the service.

If you have a Freemium or tiered service especially, you have to understand how people use your service in order to convince them to pay or upgrade.

<comment><USER5> > you have to understand how people use your service

Thats why they need Facebook's tracking inside the admin part of the APP (on na paid account)?

</comment></comment></comment><comment><USER12> I didn't see it, but "who is the third party vendor?" is my key question, since this could be impacting anyone working with that vendor.

<comment><USER13> The vendor might not have been compromised.

> we will review our policies for enforcing 2FA on third-party accounts to the > extent possible, and continue our transition to single sign-on (SSO) for all > of our integrations

I think it is more likely the CircleCI didn't enforce 2FA or SSO[1] with the vendor, and a CircleCI employee reused an already compromised password.

[1] Nearly all SSO identity providers support 2FA, so using SSO is often the easiest way to get 2FA with third-party SaaS providers.

<comment><USER14> Naming the vendor in this case should be fine. Shouldn't it?

In general what I'm missing is _why_ they share my email and github account with a 3rd party. GDPR should prevent them from doing so (at least for European users) without a legitimate reason, or explicit consent.

<comment><USER15> That's not exactly how GDPR works - the criteria depends on what you mean by "share with a 3rd party".

If _you_ as the data controller are allowed (according to GDPR) to do some particular processing of some particular data, then GDPR also allows you to subcontract that processing, and thus provide the data to third parties (data processors).

There are a bunch of restrictions in place (you have to have a specific contract mandating that they only do the thing with the data you're contracting them to do, you're responsible if they violate that, some restrictions on "exporting" data out of EU), and you have to _inform_ the customer to what third party 'data processors' you (as the data controller) are outsourcing these activities - so CircleCI would be required to give an exhaustive list of all the data processors to which they have given your data, but you don't need explicit consent or a very particular reason for that outsourcing.

What _is_ prevented by GDPR is the common (at least in USA) "sharing data with trusted third party partners" where the data is essentially sold to third parties which are free to use that data as they wish for their own business or re-sell it further. _That_ would require a very particular reason or explicit consent, but this is not the common scenario of outsourcing to a GDPR- compliant vendor.

<comment><USER14> My (admittedly limited) understanding of it is that there still needs to be a legitimate reason to provide my email.

So if the email is required in order to, say, send me notifications about CircleCI jobs that are running. That's a legitimate reason. If they share my email with the 3rd party to, for example, optimize their onboarding flows, then this isn't legitimate, unless I explicitly gave my consent to it.

To me, "analytics vendor" as they stated it, usually implies something similar to the latter rather than the former. But since they didn't indicate the provider, nor the reason, I can't really say.

I think we're not in any disagreement here by the way.

</comment></comment></comment></comment></comment><comment><USER16> Curious to hear from CircleCI how their FedRAMP authorization played into what was (or wasn't) compromised and if it improved their response.

[https://circleci.com/blog/modernizing-federal-devops- circlec...](https://circleci.com/blog/modernizing-federal-devops-circleci- becomes-first-continuous-integration-tool-with-fedramp-authorization/)

</comment><comment><USER17> I recieved the email from them a few hours ago, because of the wording of that, and because I spend last night integrating segment's analytics on my project.

I might suspect bc of their wording, segment and not google analytics would be such said 3rd party, and it seems it was one of the team's accounts in such service which got compromised and created a new destination, and no one noticed until 2 months later..

This is just pure speculation, but I would like to know!

<comment><USER18> I just got an email from Segment reporting something very similar. I think you are right

<comment><USER17> Yeah I just saw it on HN homepage, By the timing of it an alert about -segment- or just a segment employee watching this comment thread might have forced them to come clean sooner than they were planning to?

</comment></comment></comment><comment><USER19> Nobody deserves this, but lordy I have lost days of dev time to Circle in the last several years.

<comment><USER20> If I have the choice, I will not be starting any project with them in the future after the crap they pulled with CircleCI 2.0.

"We're introducing this new, 2.0, version. It has some benefits, but is also missing a lot of features and bug ridden. It's easier for us though, so you're going to have to waste a couple days converting from 1.0 to 2.0."

<comment><USER5> My feelings as well. What we really need is a ansible script or a docker file, which would build a Jenkins instance which everyone could use. You would of course need different tools for various build setup and technologies, but CircleCI is far from point and click anyway. I really which I would spend all the time I wasted on their config to build the above. This way everyone could run 5000$/mo of CircleCI on a 50$/mo bare metal.

<comment><USER21> You might want to try Azure Pipelines. It uses a dual model of Microsoft- hosted build agents running several OSes including macOS, and self-hosted build agents running on infrastructure of your choosing. The team I lead uses for Windows-, Linux-, and macOS-based builds, Microsoft-hosted and self-hosted build agents.

<comment><USER5> If I finally decide to pull the plug I will probably invest time to build my own setup around OS tooling. Main benefits would be much lower price and independence from lock in. And it's not like one has to build their own solution here. There are tools available.

</comment></comment></comment></comment></comment><comment><USER22> CircleCI has been very frustrating for us recently.

We have a lot of problems with waiting for builds to start - it seems CircleCI don't have even remotely enough capacity at peak times. We regularly get 10min plus delays to builds starting, sometimes it's over 30 mins!

Mix that with this security issue... it's not a rosy outlook for us.

Edit: oh, and the UI has terrible problems with caching and not updating state. Constantly have to hard refresh pages without cache for build status to update.

</comment><comment><USER23> Initially freaked out when I got the email, but it looks like actual repo contents weren't compromised.

</comment><comment><USER24> Dupe? [https://news.ycombinator.com/item?id=20882624](https://news.ycombinator.com/item?id=20882624)

<comment><USER25> Yes, that was later. Comments have been moved.

</comment></comment><comment><USER26> CircleCI also use wordpress, not ideal in security aspect (as Google Analytics, too), be honest. Also found these services inside my profile page:

* cloudfront

* githubusercontent

* launchdarkly

* zendesk

* zopim

* gravatar

* optimizely

* pusher

* pusherapp

* segment

* statuspage

* wp

* zdassets (3 domains)

I use uMatrix to cut half of this crap, cause the page is too heavy to load on my laptop. Started looking for alternatives.

</comment><comment><USER27> The initial reaction is to TL;DR as weak passwords and no MFA but I am equally/more concerned that the policy granted to vendors allows them to access more data than they really need, or the data they must have access could be better de-identified. For example they could hash/uuid the email and the git repo and branch info. Hacks are going to happen; no password or MFA will prevent it. Zero trust in your policy/schema design minimizes blast radius in these inevitable cases.

<comment><USER28> The idea of treating email addresses as secrets is a nice idea in theory but given the plethora of databases where it's already stored as a user name, including those that have already been compromised, and how email addresses are published in the git commits anyway, I don't think it makes much sense hashing email addresses in practice.

Repository details are another interesting point though. They too are published openly in any git clones but I accept that some people's repositories, including any local clones, would be private and kept secured from prying eyes. That said, what matters more there is access credentials, encryption at rest (for local clones), etc. So keeping the branch names and repository URIs secret feels a little redundant compared to the actual security benefit it brings. One might even say it's security through obscurity, though I don't personally think it offers up even enough benefit to fall under that category. That said, I'm happy to be convinced otherwise if you feel I've overlooked some important detail.

</comment></comment><comment><USER29> I would like one company to post an "incident" reveal in a more honest way:

" Due to our carelessness and relatively insecure practices, we had improperly disclosed user accounts to a moderately savvy hacker. We realize this is our fault.

If you'd like to help and given that we have your attention now, it would be valuable if you can help pentest our servers: the attacker used a simple SQL attack based on an unpatched server via CVE-3245. Are we missing anything else? Please let us know.

Thank you."

</comment><comment><USER30> I have a feeling this is the nail in the coffin for CircleCI. Github Actions are the way forward.</comment>


Tim Peake: UK astronaut heads for space station - <AUTHOR> http://www.bbc.co.uk/news/live/science-environment-34985274 <comment><USER2> Spare a thought for Helen Sharman, _actually_ the first British-born astronaut who ascended to Mir in May 1991 in the 'pre-Twitter' era.

Even wore a Union Flag arm-patch...

[http://www.americaspace.com/?p=35932](http://www.americaspace.com/?p=35932)

<comment><USER3> In fairness, most of the coverage I've seen (at least in reputable publications) has been very clear that he's the first British citizen on board the ISS, rather than the first British astronaut. I'm sure that won't stop half the country reading the headlines and getting the wrong idea, but hey ho.

<comment><USER4> Michael Foale (dual American and British Citizen) was on the Internation Space Station in 2003. He still holds the cumulative-time-in-space record for a UK citizen. He was a NASA astronaut whilst on the ISS.

[https://en.wikipedia.org/wiki/Michael_Foale](https://en.wikipedia.org/wiki/Michael_Foale)

</comment></comment></comment><comment><USER5> If space travel can teach us anything, it's that broadcasting the specific patch of ground you were born in is a ridiculous, tribalistic contrivance.

<comment><USER6> As long as we are at it, for sarcasm purposes, I'll generalize it further:

If anything can teach us anything, any kind of identity is a ridiculous contrivance.

But. We're humans. Our different identities make us feel the 'special snowflakes' that we really aren't, to allow us our sanity to get day-to-day job done. Regional identities are PARTICULARLY useful, as they help unite groups of people who share a common history, traditional, and cultural memory. Not to mention, them having a common identity creates peace and harmony within a geographical region and lets them work as a team [with people who perhaps don't share ANYTHING with them except the geography].

Any of the identities you have (religion? 'technie'? some sort of sci-fi fan?) can be just as equally attacked, with equal pointless gains. Of all your identities, I would argue your geographical one would STILL be the strongest/be benefitting you the most, regardless of how much an irrelevant contrivance you consider it to be.

Communication/technology has not erased geographical boundaries: it has just made more people desire the same boundaries (ie, shown how some places are more desirable). Discounting 'the specific patch of ground you were born in' is an _incredibly_ privileged and individualistic way of seeing things.

Your words reek of the techno-liberto-utopianism that completely disregards history and social context, and discounts the fact that we are, after all, humans, not ideal machines who ought to not get carried away by those dang namby-pamby emotions.

<comment><USER7> Jeez, defending nationalism on _privilege_ grounds is pretty tough.

I live in the US (NYC), which means that various government agencies think that the life of someone like me is worth around $5M -- that's the price they're willing to spend to save one statistical life when evaluating policies.

Three thousand miles away in California, the same is true.

Go a similar distance the other direction, to Senegal, and the Against Malaria Foundation thinks it can save lives for $3000 per life, with plenty of room for more funding and lives to save.

And of course, those people aren't allowed to move to the US. The patch of land they were born in isn't merely "irrelevant"; it's much worse than that.

How is any of this morally defensible, and how is it wrong to call it out as arbitrary and unfair? It's not even like I know these people in California or share geography with them in any meaningful sense.

<comment><USER8> I think the privilege that they were referring to is how most of us here are likely from a developed country with a strong economy and high quality of life, and therefore have little fear of loosing our cultural heritage. We are quick to dismiss cultural diversity as trivial and meaningless because countries like the US are such a broad cultural mix, but often most of the population never has to experience either their culture being taken away from them, them being forced to move, or them being colonized.

Because of that, people don't understand what it is like to experience colonization or cultural integration. As benten10 said, regional identities are usually convenient wrappers for same culture. People will embrace their place of origin because it is _home_ in the deepest most human sense of the word.

However, because we desire to remove the labels of regional similarity (you used nationalism, presumably with the intention of it being a loaded word), doesn't mean that others feel the same way. It is the privilege that we have that we feel comfortable from our place of _relative cultural safety_ that we don't have to be afraid of loosing the things that we feel are valuable to us.

</comment></comment></comment></comment><comment><USER9> And two Raspberry Pi computers are awaiting him on the ISS, running code written by British school children.

</comment><comment><USER10> Proud to be British today. I think Space X are due to launch again soon, looking forward to seeing a successful dragon 9 landing.

<comment><USER11> Looking at potentially Saturday for a launch last I heard

</comment></comment><comment><USER12> I saw the Cosmonauts expo [1] at the Science Museum a few weeks back; strongly recommended if you're interested in the Soviet space programme and are in London. The expo includes a real Soyuz capsule and onboard computer. I'll be tuning in at 7pm tonight to see the Soyuz dock with the ISS.

[1] [http://www.sciencemuseum.org.uk/visitmuseum/Plan_your_visit/...](http://www.sciencemuseum.org.uk/visitmuseum/Plan_your_visit/exhibitions/cosmonauts.aspx)

</comment><comment><USER11> For anyone who missed it, here is some coverage: [https://www.youtube.com/watch?v=r6q3l_1oY-0](https://www.youtube.com/watch?v=r6q3l_1oY-0)

</comment><comment><USER13> 'fleet forever !

[http://www.amazon.co.uk/Dan-Dare-Spacefleet-Operations- Works...](http://www.amazon.co.uk/Dan-Dare-Spacefleet-Operations- Workshop/dp/0857332864)

Congratulations.

</comment><comment><USER14> My son is delighted; he attends the same school as did Tim Peake and today there are a number of special, in-house activities surrounding the launch. An hour or so ago, he sent me a text message to say he'd been on live radio!

<comment><AUTHOR> Looks like the BCC TV cameras were there too: [http://www.bbc.co.uk/news/science- environment-35104825](http://www.bbc.co.uk/news/science-environment-35104825)

</comment></comment><comment><USER15> Space station will get the heads of UK astronauts? That's terrible.</comment>


The Data-Driven Tech Engine at the Heart of Hollywood's Content Factories - <AUTHOR> https://www.wsj.com/articles/the-data-driven-tech-engine-at-the-heart-of-hollywoods-content-factories-11594440059 <comment><USER2> I've thought for a while that if I was a decision maker at a major studio, I'd set up a unit where up-and-coming directors are given pretty free reign to crank out five minute short films. The only real requirement would be for each short to set up a potential franchise.

Then, have a free streaming service that distributes the shorts. Try to monetize them via ads, but most importantly, monitor the hell out of viewer engagement. Collect every metric possible. Make then easy to share on social media, and see what goes viral.

Whenever there's room in the lineup for a new movie outside the existing available franchises, pull the most promising short and crank out a feature film based on it. Lather, rinse, repeat.</comment>


Things to Know about Databases that Leverage Partially Homomorphic Encryption - <AUTHOR> http://www.lab41.org/survey-of-encrypted-databases-that-leverage-partially-homomorphic-encryption/ <comment><USER3> Quick summary of a great article:

Homomorphic encryption allows a provider to run computations over encrypted data. Thus we do not necessarily have to expose sensitive data to a provider in order to manipulate this data and derive insights from it.

The tradeoff comes in the form of increased time to compute and increased complexity in the storage, retrieval, and manipulation of the data - <USER2> provider has some general sense of what type of data is stored where, but cannot simply determine what to do by looking at the plaintext values.

A few companies/research groups are working on bridging the gap between the extremes (unencrypted/fully homomorphic encryption) in order to come up with a good compromise between security and cost.

> Both the CryptDB and Monomi publications cited approximately 20% performance > impact and neither offers full, standard SQL functionality.

With increased regulatory standards on the near-horizon - healthcare/insurance in particular - research in this area holds a lot of potential, especially if they can get the overhead closer to 0% and figure out a way of safely tagging data for manipulation in a way that does not expose it to re-identification.

<comment><USER4> Came here to post a summary but you did a better job than I could.

       > A few companies/research groups are working on bridging
       > the gap between the extremes (unencrypted/fully
       > homomorphic encryption) in order to come up with a good
       > compromise between security and cost.

I just wanted to add that plain text vs homomorphic encryption is indeed a security and cost trade-off.

Fully vs partially homomorphic encryption is a trade-off between supported operations and cost. Fully homomorphic systems allow arbitrary computations while partially homomorphic systems do not, hence the lack of support for standard SQL.

<comment><USER3> Ah thanks for the clarification. I know of IBM and Enigma's efforts in the realm of fully homomorphic encryption - do you know of any others?

<comment><USER5> Microsoft has a thing for Bioinformatics. The only info I know is "Manual for Using Homomorphic Encryption for Bioinformatics"[1]

[1] [http://research.microsoft.com/apps/pubs/?id=258435](http://research.microsoft.com/apps/pubs/?id=258435)

<comment><USER3> This is a really good read. Thanks for the heads up.

</comment></comment></comment></comment></comment><comment><USER6> Hi, We're the team working on Google's experimental encrypted BigQuery client, also mentioned in the article. It's open-sourced and available on github: [https://github.com/google/encrypted-bigquery- client](https://github.com/google/encrypted-bigquery-client)

Happy to answer any questions or chat about cool uses of PHE!

</comment><comment><USER7> I've wondered about another system, and perhaps someone here can point me in the right direction. Fully homomorphic encryption (FHE) has total control of two operations. Partially homomorphic encryption (PHE) has one operation. We can do PHE pretty well, and we're currently very very bad at doing FHE in reasonable amounts of time.

In Craig Gentry's FHE schemes (and all current ones that I know of) are all based off of an idea of bootstrapping, where each operation performed introduces some additional noise and every so often one must work to limit the noise and re-extract the signal. But somehow, as more operations are performed, simply too much effort goes into understanding the signal and noise.

But let's say that I had a FHE scheme in which I could do a limited (and relatively small, on the order of 100) operations, but no more. I suspect this has a name, but I'm not familiar with it. If I had to name it something, I would give it the confusing name Limited FHE, or perhaps Finite FHE.

Then my question is: what sorts of things could we do with Limited FHE? Is this a question that people have thought about?

<comment><USER3> I don't see this idea of bootstrapping at all in the Enigma whitepaper: [http://enigma.mit.edu/enigma_full.pdf](http://enigma.mit.edu/enigma_full.pdf)

Enigma uses secure addition and multiplication protocols to construct a fully secure interpreter. A user throws a problem to a bunch of decentralized nodes running this secure interpreter that are incentivized by fees to perform these computations and then post the results to a public blockchain, where the validity of the computations can be verified by an auditor.

It also includes (unlike Bitcoin) a distribution protocol so that the "miners" aren't all solving the same problem in a redundant fashion, although I don't think the "network reduction" protocol is specified in the whitepaper.

This is probably the most relevant part to your question:

 _Code evaluated in our system is guaranteed not to leak any information unless a dishonest majority colludes (t ≥ n /2). This is true for the inputs, as well as any interim variables computed while the code is evaluated. An observant reader would notice that as a function is evaluated from inputs to outputs, the interim results generally become less descriptive and more aggregative.

For simple functions or functions involving very few inputs, this may not hold true, but since these functions are fast to compute - no additional steps are needed.

However, for computationally expensive functions, involving many lines of code and a large number of inputs, we can dynamically reduce the number computing nodes as we progress, instead of having a fixed n for the entire function evaluation process. Specifically, we design a feed-forward network (Figure 5) that propagates results from inputs to outputs. The original code is reorganized so that we process addition gates on the inputs first, followed by processing multiplication gates. The interim results are then secret-shared with N/c nodes, and the process is repeated recursively._

</comment></comment><comment><USER8> Article does not mention zerodb, FWIW:

[https://www.zerodb.io/](https://www.zerodb.io/)

<comment><USER9> Doesn't look like that uses homomorphic encryption.

</comment></comment><comment><USER10> I'm up voting this based mostly on the author's reference to Meatloaf songs and PEBKAC in his headings.

</comment><comment><USER11> I never understood why homomorphic encryption is too slow to be used reliably today. Does some part of the computation need more power than todays computers can offer?

<comment><USER12> So here's an analogy that might help: Today, most RSA keys are 2048 bits. You can go up to 4096, but things start to get a little bit too slow for comfort. Double again and they get much slower.

Now imagine doing RSA with a 100k-200k bit key. That's the amount of slowdown FHE incurs.</comment></comment>


The language you speak changes how informative you can be - <AUTHOR> https://qz.com/1704964/differences-in-languages-change-how-informative-you-can-be/ <comment><USER2> This discussion is probably relevant:

[https://news.ycombinator.com/item?id=20880789](https://news.ycombinator.com/item?id=20880789)

</comment><comment><USER3> The title of the article seems misleading: the actual point of the article is that all languages convey information at basically the same rate, because variations in information density are cancelled out by variations in speech rate.

<comment><USER4> It would be interesting to consider word length, as well.

Longer words would seem to convey more information.

<comment><USER3> But you can speak fewer of them in a given time, so the rate of information exchange would still be basically the same. The paper does consider the number of available phonemes and syllables in different languages, which presents a tradeoff along the same lines.

<comment><USER4> Sure, available phonemes. But that seems indirectly related at best to the number of phonemes per word, and the number of words.

Simply put: is there more information per page of a romance novel than a textbook?

The former is going to be closer to common speech. Or, if somebody speaks like a textbook, they may lack an audience.

But does Mr. Textbook convey more information?

<comment><USER3> _> that seems indirectly related at best to the number of phonemes per word, and the number of words._

I wasn't saying they were the same, just that the tradeoff presented was similar.

 _> is there more information per page of a romance novel than a textbook?_

I don't think these are even comparable since they are written for different purposes. But in any case this comparison is not the kind of comparison the article is talking about.

<comment><USER4> Not the first time I have completely misunderstood the question, then.</comment></comment></comment></comment></comment></comment>


Lessons From McDonald's Clash With Older Koreans - <AUTHOR> http://www.nytimes.com/2014/01/29/arts/design/lessons-from-mcdonalds-clash-with-older-koreans.html <comment><USER2> I can't help thinking that this problem would have been solved more amenably by hiring an overly eager teenager to relentlessly advertise to the lingering customers.

"Can I get you another coffee, ma'am? Would you like to try our french fries today, sir? How about something off of our value menu?"

If you throw a cop in my face, I'm more inclined to be stubborn, but nothing makes me want to vacate a place of business quite so much as an annoying salesman.

<comment><USER3> Who said they didn't try that?

They likely didn't "throw a cop in their face". Instead what likely happened is after months of the behavior they instituted the time limit and they probably tried to enforce the time limit unsuccessfully over and over in many different ways. At that point the police are not an unreasonable option as you can easily find out by refusing to leave any place of business anywhere -- the police will be called on you regardless of who you are.

</comment></comment><comment><USER4> I'm drawn to this story because of my aging parents. This will become more of an issue, if not already, because of the aging baby boomers. It's important/beneficial for seniors to have a meeting place they will willingly go to.

</comment><comment><USER5> At the opposite extreme, one thing I've noticed is that some cafes in London have differential pricing for take-out versus stay in. (I'm not sure if this is true in the rest of the UK)

As in, you pay a little more if you occupy a seat for some time. If you walk in and walk out, then you pay less.

On the other hand, McDonalds has kind of developed the reputation as a place where you can just stay and stay after buying something cheap. I've certainly bought a black coffee for $1 and sat there for a couple of hours with a book if I had time to pass, and no one seemed to care. But that was off peak hours and there was no demand for tables.

Not sure there's a perfect solution to this that will satisfy everyone.

<comment><USER6> "one thing I've noticed is that some cafes in London have differential pricing for take-out versus stay in"

I think the VAT levels are different - cold take away foods are zero rated.

<comment><USER7> It's common in Australia also, and GST applies to any prepared food or drink. Another common approach is takeaway only specials.

</comment></comment></comment><comment><USER8> OT: Why on earth did they decide that double clicking should change the font size? Is the NYT a front for some kind of crazy UI study firm? IIRC, they used to pop-up things when you selected text.

<comment><USER9> Doesn't happen for me. Where are you double clicking? (I tried a few different spots.)

<comment><USER10> I can't get it to occur either.

</comment></comment></comment><comment><USER11> Humph. Can't see it: " We hope you've enjoyed your 10 free articles this month. " (buy a subscription now)

I'm talking about nyt, not McDonalds vs Koreans...

<comment><USER12> Open in Chrome using incognito mode.

<comment><USER13> Use this bookmarklet and stop the page before it finishes reloading:

javascript:(function() %7Bvar s%3Ddocument.createElement(%27script%27)%3Bs.setAttribute(%27src%27,%27[http://toys.euri.ca/nyt.js%27)%3Bdocument.getElementsByTagNa...](http://toys.euri.ca/nyt.js%27\)%3Bdocument.getElementsByTagName\(%27head%27\)%5B0%5D.appendChild\(s\)%3B%7D\)\(\)%3B)

</comment></comment></comment><comment><USER14> In normal countries neighbourhoods have cafes where people go. In America they have McDonalds, and after sitting 20 minutes in there management calls the cops. There's an environment ripe for disruption. Disruption includes attitude of the locals, who will fight tooth and nail against any new establishment.

<comment><USER15> Interesting that you think this. My father eats lunch at McDonalds pretty frequently, and tends to stay for a couple hours reading the paper or taking advantage of the free wifi. There are people who go in to use the free wifi and don't buy anything; nobody bothers them.

When I was last in France, teenagers could often be found studying in McDonalds, because unlike the french cafes, they don't get kicked out of McDonalds for buying some fries and a coke and then holding the table for a couple hours.

Personally, I have no fondness for McDonalds at all, but your claim that they have some sort of corporate policy of not letting people linger seems spurious to me.

<comment><USER16> It doesn't say whether it's a corporate policy, but it _is_ in the first line of the article.

> The kerfuffle started when word spread that the police were repeatedly > evicting elderly Korean patrons from a McDonald's in Queens. The Koreans > have been milking their stays over $1.09 coffees, violating the restaurant's > 20-minute dining limit.

<comment><USER17> It's not a corporate policy. I've personally had hours-long study sessions at McDonalds restaurants with just a drink purchase.

The article also mentions a group of women taking up an 8-person sitting area for hours at a time, nursing a single $1 coffee. For a four hour visit, this averages ~$0.03/seat/hr in revenue. These customers aren't truly dining, they're just congregating under the pretext of dining (by buying the minimal amount possible). _This_ is the type of behavior that would drive an individual store into implementing a 20-minute dining limit. Chances are it's loosely enforced for actual dining customers, but provides the necessary pretext for booting these people when the lunch rush begins and actual dining customers need somewhere to dine. If customers come to eat and can't find anywhere to sit, they'll start going elsewhere for food and the store will see a noticeable decline in revenue.

While it sounds harsh, a restaurant is a business that makes money by selling food. The dining area is meant for dining. Systematically abusing it for congregating, _while providing marginally little revenue_ , is going to result in limitations being erected to discourage such behavior. Coffee shops do the same thing with time limits on wifi, which is a limitation that works well to discourage their typical customer base. This crowd is just in it for the space, so the limitation invoked in this case is a time limit on the space itself.

<comment><USER18> > It's not a corporate policy. I've personally had hours-long study sessions > at McDonalds restaurants with just a drink purchase.

Just because it is not enforced where you are, does not mean it is not corporate policy. It can also depend on how busy the McDonalds is, I can imagine when it is after lunch, and the store is almost empty, they aren't going to kick anyone out.

<comment><USER17> > Just because it is not enforced where you are, does not mean it is not > corporate policy.

While I don't have access to their corporate policies directly, at least one store owner has claimed he isn't aware of such a policy[1]:

       Roger Muselman, owner of successful McDonald's
       restaurants in Kewanee and Geneseo,
       said he hasn't heard about putting time limits on
       customers and that it will never happen here.

[1] [http://www.starcourier.com/article/20140124/NEWS/140129412](http://www.starcourier.com/article/20140124/NEWS/140129412)

</comment></comment></comment></comment></comment></comment><comment><USER19> Is access to Nytimes mandatory? it is blocked from my country and when I enacted vpn I hit a paywall.

<comment> at-fates-hands If you clear your cache of their cookies, it should let you in.

If that doesn't work, use these 5 other ways:

[http://betabeat.com/2013/02/5-ways-you-can-still-get- around-...](http://betabeat.com/2013/02/5-ways-you-can-still-get-around-the- new-york-times-paywall/)</comment></comment>


Ask HN: What Are Some Startup Red Flags from a Candidate Perspective? - <AUTHOR> I'm going to have an interview with a very early-stage startup soon. What should I watch out for? What smart questions can I ask to uncover red flags? <comment><USER2> "If it sounds too good to be true – it ain't"

I like to ask if I'm replacing someone. Why did they leave?

If the interview process to acquire talent takes too long / too short – what's the rhythm of management / hiring. If there's obvious issues in this department, what makes me think their products are any better?

I go through a methodology:

1) Do they offer routine / standard perks? If not, that tells me they're not competitive and out-of-touch. This includes things like a sane salary expectation and PTO.

2) Are they overselling on perks / mission / culture? I'm getting paid GOOD money to do this job, I really don't care if it means I get a "Free Lunch" or I get to "solve hard problems".

3) Do the people I talk to seem like people I'd work with? Would I trust these people with my money, moreover my space/time/privacy?

4) What's their presence look like? Do they open-source popular tools? Do they publish books / articles / papers? Do they maintain a healthy social media presence / blog? Do their employees do publicity?

LAST AND MOST IMPORTANT: Can they even put up a decent website?

</comment><comment><USER3> Ask about their runway/burn rate, and how they plan to raise more money (i.e. what milestones they plan to reach and how that gets them through a new round). This should be an easy question. Not being able to answer it or dissembling is a big red flag.

Ask to meet the co-founders and see if you get along with them. If not, bail. If something about them seems odd, bail. Trust your instinct on this. You'll end up spending a LOT of time with them, it's not worth it if they're jerks (even brilliant ones).

</comment><comment><USER4> Find out how many people are working for the startup and their backgrounds. This is super important to do either as research before or after, to find out if you are going to be working with truly A-players. Overlooking this aspect might be ok in the short run but as with many startups, people do get laid off at some point (or the idea fails to take off) so to get maximum benefit during your time, expose yourself to excellent colleagues who will grow your skillset.

</comment><comment><USER5> I would make sure to do your dd on the founders, especially if it is pre- funding, and make sure they can walk the talk. Do this on your own not over the phone. Also any amateurish moves like asking for NDAs. Or asking you to build their app for them as a work sample. (Literally have had this happen.)

</comment><comment><USER6> \- They have their corporate culture on the walls.

\- They do not have a one year roadmap, on what customers they plan to attract.

\- Median employee length of stay.

\- Open work desks - no, it does not mean they have an Open culture. In fact, it often means the opposite.

</comment><comment><USER7> \- employee turnover \- immaturity of hiring manager \- what experience do they have leading \- given a simple task, what is their estimate of the time required \- did they let any leadership go already \- where did the funding come from</comment>


Microsoft and Adobe Chiefs Meet to Discuss Apple - <AUTHOR> http://bits.blogs.nytimes.com/2010/10/07/microsoft-and-adobe-chiefs-meet-to-discuss-partnerships/ <comment><USER2> According to another article:

 _"and the possibility that Microsoft and Adobe could merge, according to the report, which cited unnamed sources"_

</comment><comment><USER3> An acquisition sounds really out there to me -- the product lines & culture don't seem to match up well, and it's hard to imagine Microsoft running Adobe as some sort of separate entity.

More likely: a partnership with Adobe involving Flash/AIR as a development platform option for Windows Phone 7.

<comment><USER4> I seriously doubt that, MSFT has invested quite heavily in Silverlight. I could possibly see them working on a flash player for Windows Phone 7 but MSFT wants to maintain the development mind share in their tools.

<comment><USER5> from what i've gathered, MSFT 'routinely' cans things that they've invested heavily in.</comment></comment></comment>


Meshing in a Minecraft Game (2012) - <AUTHOR> http://0fps.wordpress.com/2012/06/30/meshing-in-a-minecraft-game/

<comment><USER2> In practice you need a texture atlas ([http://en.wikipedia.org/wiki/Texture_atlas](http://en.wikipedia.org/wiki/Texture_atlas)) to reduce number of meshes. But if you use texture atlas you can't combine surfaces like in the article.

The solution is to create 1 dimensional texture atlas like this: [http://manicdigger.sourceforge.net/webgl/data/atlas1.png](http://manicdigger.sourceforge.net/webgl/data/atlas1.png). Then tile in only 1 direction. Minecraft does it and I first read about it in one of Word of Notch posts - [http://notch.tumblr.com/post/176620207/i-rewrote-the- tessela...](http://notch.tumblr.com/post/176620207/i-rewrote-the-tesselator).

It's good enough. Manic Digger ([http://manicdigger.sourceforge.net](http://manicdigger.sourceforge.net)) has great framerate at Pentium 4 and Geforce 2 MX.

But there is one problem: in mipmaps there is bleeding between individual textures. The solution is to use:

         glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, 4);

It's good on desktop, but there is no GL_TEXTURE_MAX_LEVEL on OpenGL ES and WebGL! I guess it must be done with custom mipmaps or with a pixel shader?

<comment><USER3> > In practice you need a texture atlas (...)to reduce number of meshes.

I believe you meant "to reduce number of texutre swaps"? Otherwise I fail to find how texture atlas is helping in reducing number of meshes in the drawn scene.

> But if you use texture atlas you can't combine surfaces like in the article.

Actually you can, pixel/fragment shader can be used later on to transform texture coordinates just before the texel value will be fetched (obviously this is only possible if you use shaders, but most games nowadays do).

<comment><USER2> I mean it reduces number of glDrawElements or glCallList calls.

If you have 256 different block types in 1 chunk, using texture atlas there's only 1 mesh instead of 256 different meshes.

[https://docs.google.com/viewer?url=http%3A%2F%2Fnvidia.com%2...](https://docs.google.com/viewer?url=http%3A%2F%2Fnvidia.com%2Fdocs%2FIO%2F8230%2FBatchBatchBatch.ppt)

<comment><USER3> Oh ok, I haven't thought about it this way. You are surely right.

</comment></comment></comment></comment><comment><USER4> In C&C Tiberian Sun the voxel models were stored - and drawn - from a RLE sparse array.

And we used the same data-structures in the modder voxel editors.

So its not really an 'open question' as the article says, more just an obvious step.

<comment><USER5> For anyone looking for an advanced sparse voxel data structure, there's OpenVDB developed by DreamWorks Animation:

[http://www.openvdb.org/](http://www.openvdb.org/)

It's developed for film applications which naturally have a different set of requirements than realtime game engines. But as PC performance grows, the solutions developed for film rendering will become more directly adaptable for games.

</comment></comment><comment><USER6> There's a really good writeup of that here as well:

[http://codeflow.org/entries/2010/dec/09/minecraft-like- rende...](http://codeflow.org/entries/2010/dec/09/minecraft-like-rendering- experiments-in-opengl-4/#tessellating-quads)

Less thorough on meshing (or tesselation as he calls it), but a very good read.

</comment><comment><USER7> What? Minecraft "voxels" are huge. And then the cubes on the creatures are a different size. How is it not just using meshes to start with?

<comment><USER6> Because there are order of magnitude differences between rendering each voxel in a dense landscape compared to just the borders.

Consider a cube of 10x10x10 voxels. They each have 6 sides, so that's 6000 quads to render. If we only render the sides that can possibly be visible, that's 6 sides on the cube times 10 * 10 voxels on each side, totalling 600 quads.

I'm sure the creatures are not treated like this; they're just meshes.

<comment><USER7> AFAIK culling like that is standard in any mesh-based 3D engine, and most minecraft landscapes aren't uniform enough to benefit from the adjacent-face merging described. Standard 3D engines handle landscapes with way more polys than I can imagine fitting into a minecraft screen. I don't see what the big deal is here.

</comment></comment></comment><comment><USER8> This completely ignores the problem of T-vertices.</comment>


Stati, a PHP static site generator that works on any existing Jekyll site - <AUTHOR> https://jfoucher.com/2017/09/stati-static-site-generator.html <comment><AUTHOR> Direct link to github repo: [https://github.com/jfoucher/stati](https://github.com/jfoucher/stati)</comment>


Upcoming version of SBT (Simple Build Tool) - <AUTHOR> http://code.google.com/p/simple-build-tool/wiki/090p4tour The last preview of major new aspects in 0.9.x.:<p>Aspects presented in earlier previews were a redone command system, a new task model, and a new logging and I/O system called streams. This preview introduces the new multi-project incremental compilation, redesigned multi-project dependency management, and redesigned overall multi-project support, including better control over execution vs. classpath dependencies, support for external projects. If you only ever work on single projects, the new incremental compilation should still benefit you as well as the potential future support for remote projects. <comment><USER2> SBT is awesome. It's the build/dependency management tool I wish I had in languages besides Scala.

<comment><USER3> Can it be used for Java-only projects (as a replacement for Ant or Maven)? If so, is it worth the trouble to do so?

<comment><AUTHOR> Yes. I do build completely Java projects with SBT just to keep myself sane (away from Ant, Ivy, Maven).

You need a basic understanding of Scala to write your build configuration though.</comment></comment></comment>


Announcing Testling - Automated Cross-Browser JavaScript Testing - <AUTHOR> http://www.catonmat.net/blog/announcing-testling/ <comment><USER2> Let's make an n-dimensional map of the available javascript testing environments. The dimensions are something like:

\- headless v. javascript driving browser v. full browser-level

\- js-only v. test-specific html page v. load full app html

\- local v. cloud

And the current contenders go something like:

\- Selenium: browser, full app, local

\- Sauce: browser, full app, cloud

\- FuncUnit: js-browser, full app in iframe, local

\- qUnit: js-browser, sparse html page, local

\- JS Test Driver: js-browser, js-only, local

\- ad infinitum...

The result is that you need (at least!) three different tools to do three different but required tasks:

\- unit tests that run in a quick-feedback, autotest style on the command line

\- module-level tests that require a small bit of DOM access and cross-browser testing

\- integration tests that require loading the full app and triggering events on it.

It would be better if we could come up with a convenient, simple abstraction that allowed doing all three, and sharing code for mocks across the three, and configuring in what environment and what machine they each run.

Ideally, this could be done with AMD and wire.js. Just write a test in javascript, declare its dependencies, and they get injected.

\- Unit tests depend on just one or two js files. They get loaded and then the tests run.

\- Functional tests depend on "dom," provided either by a browser or a zombie.js-style headless dom, and a variety of js and html snippets. They all get loaded and run.

\- Integration tests depend on "app", provided by actually running against one of your servers. It spins up, the tests run, maybe there is an API for telling the test server to reset itself to a known state between tests.

<comment><USER3> We pretty much have what you're describing already, except we use node.js- style require()s with browserify instead of AMD. You can write really simple unit tests and just execute them with a curl one-liner or you can write more integration-style tests for an existing app with t.createWindow() and t.submitForm().

<comment><USER2> Interesting. But how do I run tests with t.createWindow locally? Do I need a publicly-accessible IP? We are currently looking at Sauce because we can write tests against Selenium and run them locally or in the cloud, plus they make it easy to tunnel in and run against things in our internal network.

<comment><USER3> Right now, you do need a public IP for t.createWindow(). We have ssh tunnels in browserling already but they don't work with testling just yet. Stay tuned.

I think one of the biggest benefits of testling right now is that you don't have to install anything outside of curl to start using it.

<comment><USER2> Fantastic, I look forward to it. I started this post mostly frustrated by the idea of someone creating "yet another" js testing tool, but now I'm legitimately interested in seeing where this goes. Thanks for the fast and helpful feedback.

</comment></comment></comment></comment></comment><comment><USER4> Looks very useful as a github post-commit hook for catching browser-specific JavaScript errors.

Is this also meant to be used for testing usability across browsers? Like browserling but automated? If so, some specific examples on the docs page would be very helpful.

<comment><USER3> Yep you can use it both ways. To drive an existing page around you can use t.createWindow() and t.submitForm(), which give you a new window object and a jquery handle bound to that window object. <http://testling.com/docs/#an- example-test>

</comment></comment><comment><USER5> Woot! Congrats on the launch. Time to add Testling to the StackVM site, eh? :D

<comment><USER6> Thank you! Yep, got to add it there.

Edit: added! <http://stackvm.com>

</comment></comment><comment><USER7> Great products, Poor designs. The last part takes a lot away from the first, making it almost look as if this is a side project. Just saying.

<comment><USER8> I've heard people say this about browserling, and I can kinda see the point, but I thought testling's landing page was kinda pretty. Maybe I'm just weird.

<comment><USER7> You are weird. Just kidding. It just kind of hurts me a little bit to see a great product come short in design.

Edit: Best HN username goes to you.

<comment><USER8> > Best HN username goes to you.

<3

> It just kind of hurts me a little bit to see a great product come short in > design.

I do have to wonder what the design would look like were a "pro designer" to get their hands on it. I think SubStizzy did a pretty admirable job, but man design is _hard_. I know I'm pretty terrible at it anyway.

</comment></comment></comment></comment><comment><USER9> Can I run jasmine on testling?

<comment><USER3> The plan is to support other test styles like jasmine and qunit through npm modules: <http://testling.com/docs/#using-npm>

</comment></comment><comment><USER10> How do I run tests locally without using this service? If I could run these same tests most of the time with qt-webkit (phantom.js) and then run on testling before deploying I would use this.

</comment><comment><USER11> For other NodeJS JavaScript testing options, there's also Jellyfish (<http://jelly.io/>)

</comment><comment><USER11> Congrats on launching! Welcome to the arena. :-)

<comment><USER3> Hey thanks! The business of making the web a little less terrible and a little more reliable is a great space to be in.

</comment></comment><comment><USER12> Nice work.

What I would like to see is automated testing on different mobile browsers (on real devices).

Anyone have pointers for such tools? Thanks.

</comment><comment><USER13> Great news guys! I'm going to make sure my team finds out about Testling.

</comment><comment><USER14> Node.JS!

<comment><USER6> You bet!</comment></comment>


Myths of Password Security - <AUTHOR> http://www.stormpath.com/blog/5-myths-password-security

<comment><USER2> With the recent flaw (though very small flaw) in 1Password, I decided to do a little research into the tools that password crackers use today. The first big tool is the cracker itself. John The Ripper and HashCat are 2 popular ones today, but I've focused my reading on hashcat.

Hashcat is a tool who's goal is to do various hashing functions as fast as possible in both CPU and GPU (depending on what the user has available). Where the tool gets interesting is the attack modes[1] it has. Each of the attack methods has different use cases, but I would say Rule-based and table-lookup are both fairly interesting (allow for smart generating of test passwords so things it's not a full character set brute-force).

Now, you have other groups that are going out and doing analysis on database password leaks[2]. This site tries to crack as many passwords as it can from publically leaked password databases (such as Gawker ane EHarmony), then do an analysis of the passwords they have cracked thus far. People can then use this data to write rules for Hashcat or other tools to possibly crack passwords a lot faster.

As rules for passwords change and people change their password habits, the crackers will adjust their methods. While this article does bring out some interesting points about passwords, it can still be good to know what tools the crackers have at their disposal so you can think about how to craft a password that won't be easily cracked.

[1] <http://hashcat.net/wiki/#attack_modes>

[2] [http://www.adeptus- mechanicus.com/codex/hashpass/hashpass.ph...](http://www.adeptus- mechanicus.com/codex/hashpass/hashpass.php)

</comment><comment><USER3> A myth I'd like to dispel is that when login fails _not telling whether username or password was wrong_ improves anything.

Please _do_ tell clearly when username was wrong. It won't disclose anything new, because you're already disclosing this information by validating registration form (and reg form will even disclose existence of registered e-mails by forbidding duplicate registration), existence of profile URLs, all kind of "add a friend" APIs, etc.

If you're really concerned about somebody compiling list of usernames by brute force (and you've patched all other places where you disclose it) then put rate limiting on the login form (you should have it anyway to prevent brute forcing of passwords).

<comment><USER4> I humbly disagree, if you say to the user that the username was correct but the password was wrong then you have leaked information to the user that they should not have access to. i.e. If email is used as a username and I go to a porn site and type in my wifes email address and a random email and it comes back 'username right, password wrong' then I now know she has an account there which she was trying to kepp secret.

It's not only bad from that point of view, but also the attacker now knows you have a account there and so could try social engineering techniques to gain access to your account, it basically provides a attack opportunity that it doesn't have to.

<comment><USER5> I think you're missing the point, which is that that information is _already_ unavoidably leaked by the signup form. So leaking it from the log in form doesn't change anything.

<comment><USER6> Yep, the only way to _really_ leak no information is to just always say that the action (sign up, forgot password) was sucessful, which is _awful_ from a ux perspective. Don't forget to go through the motions of registration/recovery to stave off timing attacks as well.

<comment><USER5> I have actually worked on systems where the signup form allowed multiple users to have the same user name, and the log in process consisted of checking for the existence of a (username,password) pair. Needless to say, I regarded this as a major design flaw and fixed it (except for the existing non-unique users). But there is, for all the reasons it shouldn't be done, a situation where the signup form doesn't leak usernames.

</comment></comment></comment></comment></comment><comment><USER7> Saying that using random words is better than using a string of unrelated characters assumes that password crackers don't know how to combine words.

There are about 180000 words in English (but don't assume everybody knows 180000 words). That means that for three words, you have at most 5.8 _10^15 options.

For a password with mixed case and numbers, you have 62 different characters. With, 9 characters, you have 1.3_10^16 options.

I can understand that people would prefer common words to remember them, but they are not that much stronger.

The best password is the password I don't need to remember: generate long random passwords, and store them in your browser, in Keepass, LastPass or whatever system of your choice.

<comment><USER8> It depends on how many words you have in a string.

XKCD's oft-quoted comic uses 4 words. That would be 100000 times stronger than using just 3 words, and vastly superior to your example of a random 9-char password. The article's own example, "golf kangaroo crispy halitosis", also uses 4 words.

I agree with you that long random passwords are the way to go, but even in that case you need to remember at least one password: the master password to your password manager. It would be a good idea to make that a string of 4 or more words. My LastPass master password consists of 5 words with a bunch of symbols sprinkled in between, and my banking password is 4 words in a foreign language.

<comment><USER9> The problem is, if you actually choose your 4 words randomly out of the full dictionary, you won't get something like "golf kangaroo crispy halitosis" or "correct horse battery staple". It will sound closer to "capaciously endodermal remast amarantite". The set of words as familiar as "golf", "kangaroo", etc. is much smaller than 100k.

<comment><USER10> It doesn't have to be as memorable as kangaroo, it has to be more memorable than the equivalent (in entropy) number of random characters, which I think is basically any word.

$ wc -l /usr/share/dict/words

99171 /usr/share/dict/words

$ rl -c 4 /usr/share/dict/words | xargs -d\\\n

contortionists mocking Alphard soling

$ rl -c 4 /usr/share/dict/words | xargs -d\\\n

Toni's dish's mauled spillages

$ rl -c 4 /usr/share/dict/words | xargs -d\\\n

expedited tireless interneships tranquiller

$ rl -c 4 /usr/share/dict/words | xargs -d\\\n

bohemian rogering unkindliest ayes

</comment></comment></comment></comment><comment><USER11> I'd say jjjjjjjjjjjjjjjjjjjjjjjjjjjj, from a human-interpetation standpoint, has very low entropy, since there is very little uncertainty as to what will come next... This would be evident if password security checkers tried to compress passwords and compare them to the original message.

i.e. "jjjjjjjjjjjjjjjjjjjjjjjjjjjj" is 224 bits as a string. Huffman-encoded, you only need 0=j as a code to convert it into 28 bits, a compression of 87.5%. So this is a good way of actually checking the security of a password, if it _seems_ to have high entropy.

</comment><comment><USER12> >Simply put, adding length increases entropy more efficiently than replacing letters with symbols.

I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one.

Option 1) Add a lower case character. Password is _26_ times stronger.

Option 2) Replace 1 upper with 1 lower case character. Password is _1024_ times stronger.

<comment><USER13> But don't do what someone I know did and replace every single e with 3, every single a with 4, every single o with 0.

Identical entropy, extra theatre.

<comment><USER14> Not to imply that what you describe is a great strategy, but I wouldn't describe it as pointless. The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

<comment><USER5> >The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

Those do not have remotely equal entropy.

<comment><USER14> At the byte level it does, which is presumably what the OP was talking about when saying that replacing characters with digits (uniformly) does not affect entropy.

<comment><USER5> Maybe, but I would hope that's not what s/he meant, because that kind of entropy is basically irrelevant to password strength.

</comment></comment></comment></comment></comment></comment><comment><USER15> This is a bit of a fluff piece, isn't it? All five points are "true", to some degree, but not when you consider the details.

Take point #4:

> "4. MYTH: Two-Factor Auth Means Any Password Will Do" > > _This is > absolutely not a dismissal of multi-factor auth. Use it when it's available! > Two factor is on the Stormpath roadmap, and we use it for many backend > systems. Just don't consider it a substitute for strong passwords._

The example that the OP blithely cites is Cloudflare's incident in 2012, when CloudFlare's CEO explained how his GMail account got compromised despite activating 2-factor authentication. However, if you actually click through the post, you see that CloudFlare's problem had nothing to do with a weak password, but a flaw in AT&T's authentication procedures which allowed a hacker to bypass GMail's password/auth requirement with a little social engineering. It had nothing to do with the CF CEO's password, which he says was strong and 20-characters long. In his case, it wouldn't matter if the password was 8 characters long and a dictionary word, if 2-factor auth worked as it was supposed to.

[http://blog.cloudflare.com/post-mortem-todays-attack- apparen...](http://blog.cloudflare.com/post-mortem-todays-attack-apparent- google-app)

And that's kind of the whole dilemma of security, isn't it? That certain maxims ("Your password should be x characters long and contain y different kinds of characters") do not universally apply, and that the implementation of security protocols is extremely important into understanding your potential to be hacked. The OP's mythbusting is somewhat counter-productive here.

</comment><comment><USER16> Fist myth is that passwords provide security. The human brain is crappy rng so it cannot create proper high entropy passwords. No way getting around that - whatever your password is if it is "derived" from something - someone else is using it too.

The only viable security I can think of is if we have distributed public key infrastructure. Bitcoin style wallets. And securing the "PK wallets" is up to the end user. Persona is close I think - so if the app fad/insanity finally dies we will be on a good track.

<comment><USER5> >The human brain is crappy rng so it cannot create proper high entropy passwords. No way getting around that...

Yes there is: you use a real RNG to generate your password. A good option is <http://passphra.se>. Just remember that you can't go clicking "Generate Another!" until you find something particularly memorable, or you'll be sacrificing an unknown amount of entropy by narrowing the space to memorable passwords. Better to keep the phrase somewhere safe (encrypted) until you have managed to drill it into your head. I like to fit the phrase into a sentence, which adds both memorability and entropy.

For example, it just gave me: "song surprise calm task", which I might turn into "Sing a song of surprise, and resume your calm task.", which Dropbox's zxcvbn tool estimates at 141 bits of entropy. If a password form has a character limit, you can initialize the sentence, yielding "Sasos&ryct", which zxcvbn rates at a not-too-shabby 52 bits.

<comment><USER16> If we assume that English has 65535 words a four word password gives you 64 bits of entropy. Of course the real number of words that you can use for mass generation is 2k (or even less) if we search words that everyone that is standard deviation or two below the mean on the vocabulary graph can use and spell correctly. Spelling is going after the ability to memorize telephone numbers too with everyone using the crutches of autocorrect and other spell checking tools. The moment everyone uses that scheme the people interesting in reversing passwords will move in that direction too.

This is fake security trough obscurity. You can get pretty secure passwords nowadays by just concatenating your username and site domain and md5-ing them and taking the first half. It generates awesome passwords ... until you are the only one using this way of deriving passwords.

The human brain is not suited for remembering long complex passwords. Even less suited for unique for every service.

<comment><USER5> Four words chosen from 2048 possibilities gives you 44 bits of entropy (this is what passphra.se does). If you're being specifically targeted in an offline attack, that won't hold up. But in that very rare scenario, you are already in trouble. A 44-bit password will protect you from attackers trying to harvest from a big pool of stolen hashes, or from attackers bruteforcing the login form on a website. That is not the same thing as "fake security through obscurity".

As for the problem of strong, memorable passwords that can stand up to offline attacks, there is still a gap (a 253 bit password made of 11 bit words would be 23 words long), but I don't think the problem is unsolvable. A project I am interested in working on when I have time is one that produces very long, but memorable high-entropy passwords with rigorously quantified entropy by generating evocative, grammatically structured sentences, using a carefully selected word list and a set of mad-libs style templates.

So to get a ~256 bit pass phrase, you might be left to type out a 50 word poem. It would take _effort_ to memorize, but it would be reasonably doable, whereas memorizing a random 39 character password is extremely difficult for most people.

Moreover, since you'd be working with a limited set of words and grammatical constructs, the password entry form could have robust auto-correction so that typos and spelling errors wouldn't be a significant problem.

</comment></comment></comment></comment><comment><USER17> _Complexity Trumps Length_

Question for the smarter people out there. If everyone started using passwords like "donkey computer watch" would this mean that this format would then be much easier to crack as opposed to xy7*hdkSD

Security is a bit of game theory right?

<comment><USER18> It actually wouldn't, because the entropy doesn't rely on the attacker not knowing the general format - it relies on the number of words available as choices.

<comment> T-hawk English has roughly 100,000 words, so that password scheme has 10^15 combinations. Suppose the latter scheme incorporates the 96 printable Ascii characters. log96(10^15) is 7.5, so yes the latter scheme gets ahead on entropy at 8 characters or longer.

But it's not a question of maximizing entropy. It's a question of maximizing entropy _relative to the human brain's ability to remember it_. The brain handles words as single units, so it's a lot easier to remember three of them than eight or more arbitrary characters.

<comment><USER18> I go by the xkcd standard of 4 words, though that doesn't change the math, just the numbers.

</comment></comment></comment></comment><comment><USER19> With advice like this seemingly contradicting other seemingly sound advice and the debate taking place here at HN it's no wonder regular people (and geeks) have trouble deciding what is and isn't a secure password.

</comment><comment><USER13> Another myth: 20% of root passwords are now exactly "CorrectHorseBatteryStaple"

</comment><comment><USER20> I like how Myth 1 tells us long passwords are better than complex passwords then Myth 3 complains that Microsoft rate the long but non-complex password "jjjjjjjjjjjjjjjjjjjjjjjjjjj" highly

<comment><USER21> They aren't contradictory. While this is, as someone else stated, a "fluff piece", neither b4#L or aaaaaaaaaaaaaaaaaaaaaaaaaaa are necessarily secure passwords. It's a gradient.

Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.

<comment><USER12> >Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.

Here's my response to that: <https://news.ycombinator.com/item?id=5546741>

tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.

<comment><USER21> _tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker._

In the context of this discussion, of course we'll all say that. Does any actual cracker program try for that, though? Not to my knowledge.

<comment><USER12> Sorry for the back of forth here, but I'll try to make this the last comment:

 _Some_ people are using all repeating characters if they can get away with it. ESPECIALLY because articles like this keep hinting that they are decent.

It doesn't matter how small this percentage of people is. The time it takes to check against it is infinitesimal and the reward is nonzero. If I were building a cracker, I would do it and not just because it's the topic of discussion.

<comment><USER21> Clearly I'm not making the argument that jjjjjjjjjjjjjjjjjjjjjjjjjjj is a recommended password. Of course it isn't.

Use a long, complex password. Period.

However _practically_ we know the history of password crackers, and while it's easy to look at specific examples given and say "Oh I would totally crack for that", in most general cases they wouldn't be cracked. On the flip side, passwords that are dictionary words following by numbers and or punctuation are cracked because they are exactly what people migrated to once complexity rules were implemented.</comment></comment></comment></comment></comment></comment>


Turkey blocks use of Twitter after prime minister attacks social media site - <AUTHOR> http://www.theguardian.com/world/2014/mar/21/turkey-blocks-twitter-prime-minister <comment><USER2> "Everyone will see how powerful the Republic of Turkey is."

At least he is right about that. His, and by extension Turkey's, impotence will soon be there for all to see. It reminds me of "Consequences will never be the same"

"We won't allow the people to be devoured by YouTube, Facebook or others"

The people are willingly placing their heads in the mouth of these lions. It is revealing how much world leaders are freaked by the concept of really free communications. Observers of political life already know that while there may be an illusion of press freedom, the collusion between media barons and the powerful (entered into willingly or through the pressure "no interview / early access for you") has a chilling effect.

<comment><USER3> Turkey is kind of special, though. Atatürk managed to glue together the remainder of the Ottoman Empire by streamlining culture and society (by force). You have the culturally suppresed Kurds who were even prohibited from speaking their language for decades, then you have the backlash against the decades-long marginalization of religion (Islam), you have the Alevite religious minority, and then the ardent defenders of Atatürks vision.

It is hard to see how somebody could hope to "keep the lid" on all that. There will be more unrest in Turkey.

<comment><USER4> The problem is not diversification IMHO. It's - as always - lack of education and democracy. With a little bit of respect and tolerance for each other these fractions of a society could live peacefully together.

<comment><USER5> Exactly. Few nations lack these problems, but many are able to achieve stability and wealth through providing comprehensive and unbiased education, and supporting a democratic political process.

Erdogan has not been shy about his feeling that democracy is a means to an end, that it is a tool to be used for his convenience, and that such tools can be cast disposed of when their usefulness expires. This will be his downfall.

</comment></comment></comment></comment><comment><USER6> If 140 characters is a threat to your government, then most probably the problem is your governing.

<comment><USER7> Turkey is a neighboring country. Erdogan has been busy dismantling what Kemal Ataturk built (don't go into how he built it), for more than a decade under the banner of religious freedom. But he is getting more and more resistance because seems a lot of young Turks read religious freedom as "right to be as secular as one wishes" and his government has a lot of corruption going on and the West really managed to sell the whole freedom of speech ideal across the world.

So he, Putin, and all known and unknown cronies will wrestle with a lot of insubordination for years to come. The millennial all around the world see government differently. Unlike the elites. So they just cannot grasp why stuff like Gezi happens.

<comment><USER8> > But he is getting more and more resistance because seems a lot of young > Turks read religious freedom as "right to be as secular as one wishes"

What's the definition of religious freedom?

<comment><USER9> Actually the concepts of "religious freedom" and "islam" don't have the same presumptions.

Islam contains aspects that aren't "religion" from the western point of view. Many muslims will say Shariah law is an essential part of the religion, handed down by god. Shariah does not guarantee religious freedom, nor is it compatible with most constitutions.

So without restricting religious freedom to a smaller "common core" of religious practice, or a bigger part of the muslim world lowering the importance of shariah, there is always a conflict between islam and democracy.

</comment></comment></comment></comment><comment><USER10> The stream of few turkish friends I follow currently consist of little else than DNS change instructions.

[https://twitter.com/irisherself/status/446946548807524352](https://twitter.com/irisherself/status/446946548807524352)

Yet "some people" still get it wrong: [https://twitter.com/odtuogrencileri/status/44681745427084902...](https://twitter.com/odtuogrencileri/status/446817454270849025/photo/1)

<comment><USER11> This is joking about minister's son Bilal, who can't understand most of the things which his father wants on the recordings.

</comment></comment><comment><USER12> Here is english-dubed version of the leaked phone conversation between the PM Erdogan and his son, allegedly when trying to get rid of evidence:

[http://www.youtube.com/watch?v=htUIHJuDNzk&feature=youtu.be](http://www.youtube.com/watch?v=htUIHJuDNzk&feature=youtu.be)

</comment><comment><USER12> I would like to post a comment from previous discussion, explaining what is this all about:

[https://news.ycombinator.com/item?id=7439602](https://news.ycombinator.com/item?id=7439602)

\</comment><comment></comment><comment>

Background info:

This is hypothesized to be a reaction to a series of audio recordings that were anonymously released over time. These were ridiculously damning, clearly someone is tapping phones without anyone else's knowledge.

Previously:

[http://www.theguardian.com/world/2014/feb/27/turkish-pm- corr...](http://www.theguardian.com/world/2014/feb/27/turkish-pm-corruption- youtube-recep-tayyip-erdogan) [http://www.al- monitor.com/pulse/iw/contents/articles/origina...](http://www.al- monitor.com/pulse/iw/contents/articles/originals/2014/02/erdogan-corruption- audio-bilal-graft-probe-police-money.html) [http://en.wikipedia.org/wiki/2013_corruption_scandal_in_Turk...](http://en.wikipedia.org/wiki/2013_corruption_scandal_in_Turkey)

Some highlights from the "alleged" recordings so far:

\- PM calling to get news about an opposing party removed from a TV channel multiple times

\- Modifying political poll results to manipulate public opinion

\- Getting people of opposing opinions fired

\- Buying a large paper shredder to destroy documents

\- PM calling son to ask how much money there is at home, son replies saying about 1 trillion, then switches to 3-5 kurush (cents in turkish).

\- PM calling son to say "they're raiding the houses, zero out the money". Son says there's only 30 million euros left.

\- Call to order the judges to be fixed, and says that a specific person is to be imprisoned.

\- Trying to manipulate who goes on the supreme court.

\- Says "ignore the prosecutor who's running the corruption investigations". Orders documents ripped up.

(source: [http://www.hurriyet.com.tr/yazarlar/25981622.asp](http://www.hurriyet.com.tr/yazarlar/25981622.asp))

The official reason for the shutdown is that there were sexual photos of some poor citizen released on twitter against her will, and she complained but twitter refused to take them down. So they decided to shut down the entire website. Yeah, right. Of course this is ominous that at the end of this month, the local elections will take place. No coincidence. It's surreal how all this is going down. It's like watching a conspiracy theory movie. Blatant shills everywhere, media manipulation abounds, blatant lies heard on TV from the horse's mouth. We were all skeptical already, it's inevitable when you live in a third world country for years, but wow. When you hear the insiders actually talking to each other, it's a whole new level. more news on this specific event: [http://www.hurriyetdailynews.com/turkey-blocks-twitter- after...](http://www.hurriyetdailynews.com/turkey-blocks-twitter-after- erdogan-vowed-eradication.aspx?pageID=238&nID=63884&NewsCatID=338) [http://www.aljazeera.com/news/europe/2014/03/turkey- erdogan-...](http://www.aljazeera.com/news/europe/2014/03/turkey-erdogan- threatens-ban-twitter-2014320165956732467.html)

Related old post here: [https://news.ycombinator.com/item?id=7189577](https://news.ycombinator.com/item?id=7189577)

edit: Erdogan stated a few days ago that he didn't care what the world thought, and he would eradicate twitter. He said "how dare they listen to our encrypted phone conversations". It's expected that on the 25th, something huge is going to be released that might sway the elections bigtime. Whoever is posting these are doing it slowly and deliberately, a few days at a time, building up anticipation. So people think that twitter getting shut down is probably related to this.

edit2: All recordings were put on youtube by someone: [https://www.youtube.com/user/haramzadeler333](https://www.youtube.com/user/haramzadeler333)

a reply:

\</comment><comment>

I just want to add few things: Most of the leaking tapes are from the corruption investigation that was effectively blocked by the PM. His son was to be detained too but he shuffled or dismissed any prosecutor or police force that would dare to. Later he restructured the Supreme Board of Judges and Prosecutors and did everything to stop the investigation and arrests. The son of the Interior minister was arrested too but the Interior minister himself remained in power till he helped out Erdogan to restructure judiciary and law enforcement forces. The legal files were leaked too. Turns out the Interior Minister knew about the ongoing investigation,so he created a team in the police to surveillance the other policemen who were after his son. It's surreal.

<comment><USER13> Clearly, Turkey is not really a democracy anymore. As an outside observer, the Turkish "deep state" was a major problem, but having a nationalist network replaced by a conservative mafia is even worse. But if I understand correctly, this only comes out as a result of a power struggle between Erdogan and his former ally, the preacher Fethullah Gülen. If that's really the case, then it shows Turkish institutions have been infiltrated by two distinct Islamist networks, as well as the remains of the deep state network.

Isn't there any secular, non-nationalist political movement in Turkey?

<comment><USER4> I wonder which country _is a democracy anymore_. Clearly not the UK or the US, absolutely not Greece (laughable), Italy (3 PM's in row without elections whatsoever! Napolitano, Italy's President should commit suicide out of embarrassment IMHO), Spain (I think they are in a better shape?!)... Who has a democracy these days?

<comment><USER14> You talk about democracy as if it's a fantastic system. It's not. One vote per person? So a guy who has a political degree has the same voice as a guy who votes depending on which candidate has the nicest eyes?

<comment><USER15> > So a guy who has a political degree has the same voice as a guy who votes > depending on which candidate has the nicest eyes?

What is the alternative? Yes we are NOT all equal. Some of us are more rational and intelligent than others. But how would you go about determining one's intellectual and moral worthiness? (Education? IQ?) And who gets to decide the criteria for superiority?

If you were as smart as you think you are...you would have considered these issues before making such a shockingly elitist statement.

<comment><USER14> I don't consider myself especially smart. But giving everyone an equal say in the running of a country is pure madness. The better alternative is a friendly dictator, or a good monarchy.

My original comment was to point out that "Democracy" is not some perfect utopia that every country should strive for.

<comment><USER15> Democracy is not perfect, but it's the best option available.

Also, I can't tell if you're being facetious or if you truly believe we would be better of with dictatorships...because there are plenty of real-world examples to choose from and they're quite horrible.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Of one the last ripples caused by a collapsing tyrant. A shameful, a very shameful act but unfortunately just another link on a long chain of despotic measures.

There are regional elections in Turkey at the end of March. The governing party is expected to receive a major blow. Latest scandals have certainly not helped their cause.

I wish changing government were as easy as changing DNS settings.

</comment><comment><USER17> I wonder if the US will apply it's moral here this time? Seriously, if Venezuela or some other country like that did something like this the US gov would be up against the 'regime' in no time. Let's see.

<comment><USER18> I doubt they will confront Turkey now. Because there's enough confrontation with Russia already.

<comment><USER19> I doubt they will confront Turkey _ever_. It's the door to the Middle East, and there will always be "enough confrontation already" in the ME, one way or the other.

</comment></comment></comment><comment><USER20> Earlier discussion ; [https://news.ycombinator.com/item?id=7439128](https://news.ycombinator.com/item?id=7439128)

</comment><comment><USER21> They should use Twister. Try to shut that down.

[http://twister.net.co/](http://twister.net.co/)

</comment><comment><USER22> Rumor has it that a sex tape of this wanker will be spread on the 26th.

Coming to a screen near you.

<comment><USER12> Actually many people expect that it's probably not a sex tape but evidence about a political assassination and the PM himself is involved.

Since a while the whistleblowers are talking about it, giving teasers and so on.

</comment></comment><comment><USER23> Streisand effect in 3..2..1..

</comment><comment><USER24> Turkey blocks use of Twitter after prime minister attacks social media site. Why do journalists always use these kinds of titles? They seem to be so terribly afraid of pronouns that they make titles that make no sense. Which social media site was the prime minister attacking, and why is twitter blocked because of it?

</comment><comment><USER25> Turks looking to access an unrestricted Internet should install Tor[1], or where not feasible use something like lahana[2].

[1] - [http://torproject.org/](http://torproject.org/)

[2] - [http://lahana.dreamcats.org/](http://lahana.dreamcats.org/)

</comment><comment><USER26> I wish we could hold some of our politicians accountable in this fashion. A phone conversations wiki leaks type website would be a killer.

Does anyone know of websites that dedicate themselves to find corruption in US politicians?

</comment><comment><USER27> This is bizarre behaviour, can they not see how badly this will end for them?

</comment><comment><USER28> Turkish President (@cbabdullahgul) just told his opinions about the ban to public. On Twitter. Oh, I love this country sometimes.

</comment><comment><USER29> It is like he want a revolution

</comment><comment><USER30> I'm not sure how anyone can take this douche seriously after the leaks.

<comment><USER13> In other news, Nicolas Sarkozy, the former French president, was recorded talking with his lawyer on burner phones bought under a fake name, discussing about a mole they have who keeps them illegally informed of the investigations currently going on (such as having had Gaddafi fund his political campaign). The tape was leaked to the press. In spite of this, he is still the favourite would-be candidate for the presidential elections of the French conservative party.

See also Berlusconi. The wonderful thing about the combination of democracy and transparency is that the majority of the population gets exactly the leaders they deserve.

<comment><USER31> More worrying is not the BS they (Sarkozy and Berlusconi) have done, but who is the arbiter of "truth" who makes the recordings and the leaks.

Perhaps some foreign power or some large interest group, that seeks to replace them with some equally scum candidates, but who will be more willing to cater to them, and who will not have leaks on him...

Leaks are not providing transparency, but the illusion of it. You only have transparency if you either have leaks for everybody and all their ill actions (which you don't have a way to check if is the case) or if you also know who makes the leaks and why.

<comment><USER13> You have a point here. The recordings in France were made by the police as part of the investigation, as for the leaks, it's not clear. Other tapes, this time recorded by a former advisor, were leaked to right-wing newspapers and websites, possibly as a symptom of internal struggle. The police recordings being leaked may be due to the work of the Mediapart website, leaked by the current government before the upcoming elections, leaked by left-wing sympathizers in the police/justice, leaked by right-wing opponents of Sarkozy... your choice. I doubt any foreign state plays a role there.

The situation in Turkey is much more worrying though. That's different competing conspiracies.

</comment></comment></comment></comment><comment><USER32> prick.</comment>


Passive Wi-Fi: Bringing Low Power to Wi-Fi Transmissions - <AUTHOR> https://www.usenix.org/conference/nsdi16/technical-sessions/presentation/kellogg <comment><USER2> There's been a few links regarding WiFi backscatter use around here recently.

Connecting RF-Powered Devices to the Internet : [http://iotwifi.cs.washington.edu/](http://iotwifi.cs.washington.edu/)

3-D printed objects connect to WiFi without electronics : [http://www.washington.edu/news/2017/12/05/in- first-3-d-print...](http://www.washington.edu/news/2017/12/05/in- first-3-d-printed-objects-connect-to-wifi-without-electronics/)

<comment><USER3> I also remember an article about a very low power camera performing read operations in an analog way with no onboard power. I think. I can't find the article though.

Also there was [https://github.com/seemoo- lab/mobisys2018_nexmon_software_de...](https://github.com/seemoo- lab/mobisys2018_nexmon_software_defined_radio).

If you think about it, there are a lot more things that can be done with wifi if you can arbitrarily TX/RX signals. In fact I'm getting a bit scared now.

<comment><USER4> You may be thinking of this article: [https://news.ycombinator.com/item?id=16881946](https://news.ycombinator.com/item?id=16881946)

<comment><USER3> Yes, this is it.

</comment></comment></comment></comment><comment><USER5> This seems to require a near-by powered wifi device to aide in association of the passive device. For large deployments, that would require many powered units. In addition to that, there are requirements for multiple MACs, which may also lead to problems with limits in some networks. This is all clever, but it doesn't seem practical to me since the passive device depends on a near by powered device to do anything. I have worked on sensor networks with battery powered wifi devices. It's certainly tricky.

<comment><USER6> >This seems to require a near-by powered wifi device to aide in association of the passive device.

...Yes? Gateways (routers) are there anyways.

>For large deployments, that would require many powered units.

As in all deployments?

>In addition to that, there are requirements for multiple MACs, which may also lead to problems with limits in some networks.

Wot? This is a non issue.

>This is all clever, but it doesn't seem practical to me since the passive device depends on a near by powered device to do anything. I have worked on sensor networks with battery powered wifi devices. It's certainly tricky.

Then you don't understand what this is about.

Backscatter is awesome because you literally don't put energy into generating rf yourself.

</comment></comment><comment><USER7> >View the slides

Can't we have PDF.js decode and render .pptx files? I bet they're no more complex than PDF.

<comment><USER8> You're betting wrong. The office formats are horrifically complex.

</comment></comment><comment><AUTHOR> Is this system not susceptible to over-the-air attacks by malicious adversaries?

<comment><USER9> And why's it always malicious adversaries? Why can't we ever get some benevolent adversaries around here?

<comment> yjftsjthsd-h People want to defend against the latest threat.

Now, what on earth is a benevolent adversary?

<comment><USER10> I thought of something else that is not discussed often. There is a class of actors that can do good actions with bad ulterior motives.

For example in France we had a group of anti-muslim people provide free food to the homeless but the food had specifically pork in it.

Or linked to a recent HN story a vegan terrorist could infect himself with that tick that renders you allergic to meat and then go donate blood for saving children.

<comment><USER11> Those are really interesting examples although obviously stretching the definition of "benevolent."

</comment></comment></comment></comment></comment><comment><AUTHOR> Research Paper -> [https://news.ycombinator.com/item?id=17053300](https://news.ycombinator.com/item?id=17053300)</comment>


Myths about Managed Code - <AUTHOR> http://blogs.msdn.com/clrteam/archive/2009/10/02/five-myths-about-managed-code.aspx

<comment><USER2> "On the other hand, there are still scenarios in which managed code simply cannot be used today (such as building the CLR itself or the debugger)."

I thought the Mono CLR is written in C#, as is the C# compiler which compiles itself. Did I misunderstand something?

<comment><USER3> You can write a self-hosting compiler for C# quite easily. However, the core of the runtime is going to be a major pain in the ass to write self hosting.

The Mono guys came to the same conclusion, their tree contains oodles of C/C++: [http://www.google.com/codesearch?as_package=mono&as_file...](http://www.google.com/codesearch?as_package=mono&as_filename=\\.h$)

</comment></comment><comment><USER4> Visual Studio is implemented in managed code? What part(s)?

<comment><USER5> Nearly the whole thing. Visual Studio 2010 even goes as far as to use WPF (Windows Presentation Foundation) - a GUI layer entirely written in managed code.

Of course, satellite dll's & exe tools aren't all written in managed code. It's silly to re-write everything. But the main Visual Studio application has been at least partially managed since the Visual Studio 2002 days.

P.S. I don't work for MS, but I do know this for a fact.

<comment><USER3> I work for MS and do Visual Studio integration work for XNA Game Studio.

The whole of VS isn't even close to being mostly managed code. While it is true that 2010's GUI is _mostly_ managed code, thanks to WPF, the internals are entirely COM. The project system, debuggers, command system, and many other large components are all C++/COM. Even many of the components which are managed read more like C++ than like C# due to all the QueryInterface and ref counting nonsense.

Developer devision, commonly known as DevDiv, contains the VS team, programming language teams, and many other related teams. DevDiv is by far the company's largest consumer of managed code. I'd bet that there is more managed code in DevDiv's source tree than the rest of the company combined. That doesn't mean they threw out 30+ years of efforts and backwards compatibility all at once.

<comment><USER5> I was referring to GUI of Visual Studio - but thanks for the clarification. I didn't mean to imply MS replaced 30 years of code in one go. I should've written more carefully.</comment></comment></comment></comment>


Ask HN: Startup ideas for introverts - <AUTHOR> i dont get any ideas nor do i have any problems to solve. Dont quote paul grahm here. <comment><USER2> I used to have that same problem (of not having ideas) for most of my life. Now, I have more ideas than I can ever implement.

I would take a step back from startup ideas and read a book Become An Idea Machine[0]. I read it few years ago and in the beginning, it felt really stupid. Even after finishing it, I felt that it didn't really provide value. But over time, the process of forcing yourself to come up with ideas cumulates and suddenly you find yourself coming up with three ideas before breakfast.

[0]: [https://www.amazon.com/Become-Idea-Machine-Because- Currency-...](https://www.amazon.com/Become-Idea-Machine-Because-Currency- ebook/dp/B00S1PRTL4/)

</comment><comment><USER3> Building aggregators/affiliate marketing can be ran as a one man show, and can easily be automated, with minimal investment.

</comment><comment><USER4> There are an abundance of problems to solve and most all of them are not mine.

<comment><AUTHOR> for starters can you suggest some

<comment><USER5> That all depends on what you're good at. What kind of skills do you have, can you use those skills to help others or destroy them. Ideas need to be original, thats what makes them so great and makes them thrive.</comment></comment></comment>