Another Dell root certificate discovered - <AUTHOR> http://www.pcworld.com/article/3008478/security/and-then-there-were-two-another-dangerous-dell-root-certificate-discovered.html <comment><USER2> Once upon a time I spent a couple of hours looking at the Dell update utility and found that it pretty much allowed remote code execution to any web page your browser visits[1][2]. The quality of their code, the clear lack of anyone with any security knowledge looking at it and the 'fix' they deployed[3] made me never ever trust Dell again.

Seriously, their entire security relied on 'if url.endswith('dell.com')', plus a bunch of home grown 'encryption' that was utterly ridiculous. I'm sure if anyone spent a good hour or so looking at some of the oodles of software they pre-install on laptops you can dig up some other juicy exploits.

1\. [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://tomforb.es/dell- system-detect-rce-vulnerability) (sites down at the moment :/)

2\. [http://www.theregister.co.uk/2015/04/08/dell_update_security...](http://www.theregister.co.uk/2015/04/08/dell_update_security_concerns/)

3\. They literally just updated their home grown encryption/authentication code and made it clear that they didn't understand the issue _at all_.

<comment><USER3> Is this a hardware or a software boycott? Because I have trouble finding anything remotely decent when it comes to macbookpro alternatives. Then again, I just sorta assumed most people always did clean installs and wiped the pre- installed shit that every PC vendor bundles.

<comment><USER4> Honest question: could you even do that without buying an extra copy of Windows? Back in the old days you got a CD key with your PC, so you can install a fresh copy of Windows easily from your own media.

But nowadays it seems like not all keys are equal, and I'm under the impression that short of buying your own copy you can only reinstall the OEM, hacked-up version.

<comment><USER5> The key is in the bios now so you should be able to load any OS that's the same version i.e. pro or home.

I've never tried though. I don't know if there is still a different version for OEM or VL windows like XP had different key types.

<comment><USER6> I just went through this with a new Dell XPS for my dad.

I performed a wipe/reinstall (with media created directly from a Microsoft download) and Windows 10 never asked me for a key after reinstalling it, and it reports as being activated.

Seems like they've moved away from requiring an OEM key in addition to the SLIC BIOS signature.

<comment><USER7> They went a step further. Once a Windows 10 machine is activated, a "hash" of its hardware is taken and associated with the product key. When you reinstall Windows 10, the activation service matches your hardware information with the product key. You need to enter a product key only the first time you install Windows 10 on a particular machine.

<comment><USER5> When I was building machines and asked about the OEM licence, this hardware hash is related to the motherboard. MS consider a new motherboard a new PC, everything else you should get away with changing.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> What really bugs me about this whole certificate saga is this: Ok, so you messed up. But then we get this - to my ears - absolutely bogus spiel about this being for 'improved customer service'. I find it very hard to make that link. And then, to add insult to injury, after messing up like that there is no 'all hands' inside Dell to see if that 'mistake' (let's assume it really is a mistake, to be kind to them) had been made in more than one place, which in fact it is.

Once is normal, twice may be coincidence, thrice is enemy action. Let's hope for Dell that there won't be a third, and if there is that they spot it themselves before someone else does. And I'm not buying the line about 'improved customer service' even for a moment, you can't improve customer service by allowing anybody aware of this certificate to MITM any and all connections from these machines and even if that were the case it is just a little bit too convenient that such a mistake would _also_ include the private key, which allows Dell to conveniently deny that they ever leaked the private key to anybody in particular (instead, they leaked it to the world at large).

Superfish was bad, this is in some ways just as bad or worse.

Now, Dell, can we please have a detailed technical explanation about why these _two_ root certificates _and_ their private keys were stashed on customers machines without their knowledge centering on specific functionality (as in what is that you could not do without these certificates and keys distributed) rather than some weasel worded techno babble about 'improved support'?

<comment><USER8> Crapware and foistware is always "valuable customer blahblahblah."

<comment><USER9> Sounds better to the board than "desperate measures to somehow find pennies in this awful commodity business we find ourselves in."

</comment></comment></comment><comment><USER10> I updated my online check tool and it detects both certs: [https://edell.tlsfun.de/](https://edell.tlsfun.de/)

Also updated my corresponding blog post (links to cert and key there in case you're interested): [https://blog.hboeck.de/archives/876-Superfish-2.0-Dangerous-...](https://blog.hboeck.de/archives/876-Superfish-2.0-Dangerous- Certificate-on-Dell-Laptops-breaks-encrypted-HTTPS-Connections.html)

</comment><comment><USER11> Does anyone know of a tool for Windows and OSX that will audit all the certificates installed on a machine and tell you which ones are removed, compromised, or generally unrecognized? It would be great if there was one so I can run audits because even if you install a fresh copy of the OS, the NSA and their friends can eventually sneak a cert on there. It would be great if there were an audit tool.

</comment><comment><USER12> There's a problem with their Dell Foundation Services software, too:

[http://www.theregister.co.uk/2015/11/25/dell_backdoor_part_t...](http://www.theregister.co.uk/2015/11/25/dell_backdoor_part_two/)

<comment><AUTHOR> Oh great, a javascript accessible supercookie based on the Dell service ID thrown into the mix as well. What could possibly go wrong with that?

</comment></comment><comment><USER13> A part of me wants to go "Un-freaking-believable!"

The other part is like, "You really did not see this coming?"

The worst part is that this was probably done for ridiculous reasons. If they had put the certificate on their systems to allow the NSA to spy on their customers (just as hypothetical example), planting such a certificate would probably be a reasonable approach. But in the case of Lenovo and Superfish, this was done to show f___ing advertisements to users, and I am certain in Dell's case their reason is not much better. And for _that_ , they put their customers security at risk. For freaking advertisements and (Dell's claim, I think) making life slightly easier for their support staff.

Seriously, what were these guy thinking?

<comment><USER14> I'm still unclear on why they need a root certificate with code signing privs to "make life easier for their support staff".

<comment><USER13> Me too. Either, this as was one of the worst ideas ever, or one of the lamest excuses ever. (At least in the world of software deployment.)

</comment></comment></comment><comment><USER15> Am I reading it correctly that they also included the private keys? Why are the private keys for the cert installed with the cert? That doesn't make any sense.

Is this just incompetence, or is there some other reason that I'm failing to understand?

<comment><USER16> If the article is correct then this is a major mistake on dell's part.

<comment><USER17> I would use a stronger word than "mistake," you have to have 0 understanding of what you're doing and 0 code reviews to do this.

</comment></comment></comment><comment><USER18> Maybe it's a good time to share this - I just bought a brand-new Dell XPS 15 and it runs Ubuntu like a dream. The only problem I've had is that suspend/resume (i.e. closing the lid) causes a kernel panic, but I've heard that's fixed in the next kernel release.

And the best part - no bogus certs!

<comment><USER19> Regarding the suspend/resume stuff, which version of Ubuntu are you running? I don't have a problem, but I had to do a couple of things to get it working more like a Macbook: [http://karlgrz.com/dell-xps-15-ubuntu- tweaks/](http://karlgrz.com/dell-xps-15-ubuntu-tweaks/)

<comment><USER18> I'm running Ubuntu 15.04 and I haven't tried any of those things. My suspend/resume experience isn't like that blog, though - what happens to me is that I shut the lid, the os "suspends", I open the lid again and get an unresponsive black screen and I have to reboot.

This is almost exactly what I've done to set up my machine: [http://ubuntuforums.org/showthread.php?t=2301071&p=13382949#...](http://ubuntuforums.org/showthread.php?t=2301071&p=13382949#post13382949) . This thread claimed that the kernel v4.3 fixed this issue, but it still happens for me - I was going to wait until the next 4.4 RC to give it another whirl.

<comment><AUTHOR> I've had this problem too, in my case it was caused by some clever (way too clever imo) stuff going on that tries to write a bunch of io ports to a safe place on suspend and writes that data back to the various chips on resume. This caused all kinds of trouble.

If your BIOS supports it choose 'sleep' rather than 'hibernate' for suspend/resume. It will be a bit slower but there is far less OS dependent magic going on under the hood.

</comment></comment></comment></comment><comment><USER20> I am convinced that the only thing that approaches the designed security level of an operating system is to buy a machine, completely wipe it and install your own paid for copy.

It appears that hardware vendors cannot make enough money merely selling hardware, and so they sell access, data and advertising to third parties (at least Superfish was in that area).

Being able to mod the software on your car is (I think) recently allowed (by the Librarian of Congress?). But it can be taken away at any revisiting event. I can see the day coming when it will be illegal to wipe a machine, because circumventing.

<comment><USER21> For what it's worth, Apple machines come secure out of the box, without any of this BS. They even prompt you to set up full disk encryption, and because it's well designed, almost anyone can figure it out.

<comment><USER22> This is one of the best things about the Apple eco system. Apple exists to sell you the hardware. All the software is designed to get you to love the experience so much that you will buy more hardware. They don't let anyone fuck with that.

</comment></comment></comment><comment><USER23> OK when do we restart the software liability discussion?

[http://geer.tinho.net/geer.blackhat.6viii14.txt](http://geer.tinho.net/geer.blackhat.6viii14.txt)

[https://www.google.com/webhp?sourceid=chrome- instant&ion=1&e...](https://www.google.com/webhp?sourceid=chrome- instant&ion=1&espv=2&ie=UTF-8#q=bruce%20schneier%20software%20liabilityhttps://www.google.com/webhp?sourceid=chrome- instant&ion=1&espv=2&ie=UTF-8#q=bruce%20schneier%20software%20liability)

</comment><comment><USER24> After not owning a dell for years, I just bought one for the kids to use shortly before the news of the security issue came last weekend. Frustrating!

<comment><USER25> Depending on how old your kids are, are they really going to be using it for anything that is at risk?

Edit: I'm not defending Dell in any way, but if they're watching youtube and browsing facebook, they'll probably be just fine.

<comment><USER26> anything at risk such as "browsing on the internet" and "install software"?

<comment><USER27> I think the point is that an adult mostly risks losing money from their bank account (assuming they do their banking online), credit card (if they buy anything online) or the like.

<comment><USER26> Having a compromised machine on your network serves as entrypoint. The machine may also be part of a botnet which could expose you to questioning or worse by the authorities if the botnet is used in an attack.

neither is something you'd want, even if the machine itself is not used for anything critical.

</comment></comment></comment></comment></comment><comment><USER28> Always, always wipe and clean install oem Windows installs with versions directly from Microsoft.

</comment><comment><USER29> "Dude, you're getting a dangerous, root certificate!"

<comment><USER30> Read the article again.

> Nevertheless, because both eDellRoot and DSDTestProvider are installed in > the Windows root store for certificate authorities together with their > private keys, they can be used by attackers to generate rogue certificates > for any website that would be accepted on the affected Dell systems.

It's not the certificate that's the problem. It's the installation of the _private keys_ along with the certificate.

<comment><USER29> Revised: "Dude, you're getting some MITM action!"

<comment><USER31> better than that. let's you sign software as written by Microsoft</comment></comment></comment></comment>


First-ever "image" of dark matter? - <AUTHOR> http://earthsky.org/space/waterloo-image-dark-matter-cosmic-web-2017 <comment><AUTHOR> I'm skeptical because the paper seems to make no attempt to rule out ordinary matter causes for the gravitational lensing. That violates the golden rule #1 of publishing a paper, be your own critic. One should point out and address the biggest flaws in one's argument, and these people didn't seem to do that.</comment>


Neutrinos lead to unexpected discovery about eigenvectors and eigenvalues - <AUTHOR> https://www.quantamagazine.org/neutrinos-lead-to-unexpected-discovery-in-basic-math-20191113/ <comment><USER3> Can someone explain like I am 5? I work in vibrations and often deal with real world modes and mode shape vectors which are really eigenvalues and eigenvectors. I see this might have an impact on the work that I do. But I can't comprehend what the paper says.

<comment><USER4> Particle physicist here... it's a very long article and there's a lot going on, so I'm not sure what you're seeking clarification on. But I'll take a whack at it:

As far as we know, neutrinos come in three varieties: electron-neutrino, muon- neutrino, and tau-neutrino. These particles interact weakly with the charged leptons (electrons, muons, and taus). This interaction is mediated by the weak force, and specifically by the charged W-bosons. Basically, what this means is an anti-neutrino and it's associated lepton (or a neutrino and anti-lepton) can "annihilate" each other to create a W-boson. However, the W-boson is not stable and will rapidly disintegrate. Sometimes it disintegrates back into the same particles that created it, but not always.

Anyways, the laws of physics (specifically, the quantum field theory [QFT] formulation of the standard model) are written in terms of these three types of neutrinos. Electron neutrinos ALWAYS interact with electrons, and muon neutrinos ALWAYS interact with muons, etc. Specifically, each particle type is associated with a "field", which is kind of like a function that has a value at every point in space and moment in time. So for example there is a single "electron field", which is like a function that encodes information about every electron in the universe for all time. The theory of particle physics is concerned with writing down the mathematical relationship between all the fields for different particles, which is like reverse engineering the firmware of the universe.

For reasons that we needn't get into, in all the formulas we bunch these neutrino fields together into a group that looks like a vector, [v_e, v_mu, v_tau]^T (transposed so it's a column vector). Now, from very basic principles of physics, the part of the equation that describes the mass of particles (specifically, fermions) generally looks something like m(x†)x, where x is the particle field, and x† is a particular adjoint field (kind of like a vector transpose of the field).

Okay, so if you wanted to encode in the "firmware" all the masses of the fields x,y, and z, you simply have to include terms in your "master formula" (called a Lagrangian) which look like m0 (x†)x + m1 (y†)y + m2 (z†)z, and boom now particles associated with fields x, y, and z have masses m0, m1, and m2, respectively. This part you can just take on faith, but if you've studied classical Lagrangian mechanics in undergrad, it's pretty easy to follow the connection to the quantum regime.

Well, someone got clever and realized that in fact, the most general way to write the equation is to take the whole vector of neutrino fields, V = [v_e, v_mu, v_tau]^T, and add a term like V† M V, where V† is now that fancy transpose-adjoint applied to the whole vector, and M is now a 3x3 matrix. The case where each neutrino type has its own mass would correspond the case where M is diagonal with entries [m_e, m_mu, m_tau]. However, a physicist would naturally ask why should all the other entries in this matrix be exactly zero? Of course it has since been proven experimentally that this matrix is in fact not diagonal.

Now, it turns out that in QFT the thing that governs how particle fields change over time (e.g., how they travel through space) is their energy, which depends on their mass. Specifically, a particle in state A will, at some future time, transition to state B, and the formula that describes that transition depends ONLY on the energy configuration of that state. It turns out that if that mass matrix M is not diagonal, then the particles v_e, v_mu, v_tau are not _eigenvectors_ of the mass, and therefore not eigenvectors of energy. That is to say, if you had a neutrino which was observed to have a specific, known value of energy and mass, it could not be purely one type of neutrino but instead a linear combination of v_e, v_mu, and v_tau which diagonalizes the matrix M.

So herein lies the problem: the "flavor" (electron, muon, tau) of a neutrino defines how it interacts with particles. But these flavors are not themselves definite states of energy/mass.

Therefore, if you know that an (unobserved) neutrino was created along with an electron, it must have been an electron-flavor neutrino. But in order to understand how that electron type neutrino will travel through time and space, you need to translate it into a "mass eigenstate", which is to say, the eigenvectors of the mass matrix M.

So, all of this explains why the neutrino physicists care about eigenvectors and eigenvalues. The particle beam at Fermilab produces almost exclusively muon-type neutrinos, and they want to know how many of each type of neutrino to expect when they show up at the DUNE detector 1300km away. The news is that these physicists have discovered a way to write the eigenvectors only in terms of eigenvalues, which are easier to compute. Which is pretty surprising (even to Terrance Tao!), since linear algebra is an extremely mature branch of mathematics.

<comment><USER5> What amazes me is that all this math works. This kind of tricks "lets assume this clever 3x3 matrix describes how it works" makes sense if you're reverse engineering a 3D rendering engine, because you know there is some simple math under the hood. The fact that our world obeys simple mathematical equations is surprising.

<comment><USER6> [https://en.wikipedia.org/wiki/The_Unreasonable_Effectiveness...](https://en.wikipedia.org/wiki/The_Unreasonable_Effectiveness_of_Mathematics_in_the_Natural_Sciences)

<comment><USER7> If we didn't use mathematics in science, what else could we have used?

<comment><USER8> Narrative. Like we use in history, for instance.

</comment></comment></comment></comment></comment></comment><comment><USER9> This collaboration between the three physicists and Tao actually started its life in a /r/math comment thread! One of the reddit commenters pointed the physicist (I don't know which of the three was asking the question) to a mathoverflow answer of Tao's resolving a similar question. Here's the posts and it's followups:

[https://www.reddit.com/r/math/comments/ci665j/linear_algebra...](https://www.reddit.com/r/math/comments/ci665j/linear_algebra_question_from_a_physicist/)

</comment><comment><USER10> Pretty cool. So if the eigenvalues aren't repeated, you get a formula for the eigenvectors of a matrix in term of its eigenvalues and the eigenvalues of its submatrices. It doesn't seem computationally useful, but its theoretical value is up there with Cramer's rule.

As an side, it's kind of funny to hear the physicist accent in this linear algebra paper.

<comment><USER11> The article mentions a companion paper about how this was used to speed up physics computation, so it sounds useful at least in that domain.

<comment><USER10> I believe "speed up" in this sense is really akin to how Cramer's rule lets you write down a relatively neat formula for the solution of a linear system, not that it would actually help with performing the calculation numerically.

Computing a full set of eigenvalues of a numerical matrix is pretty slow and the eigenvectors almost come for free; it seems like a very computationally backwards way to get n+1 full sets of eigenvalues only to get slightly incomplete data about the values of the eigenvectors.

I don't know anything about the physics of it, but I doubt that the researchers had numerical matrices that this formula helped with; I expect it was all done symbolically instead.

</comment></comment></comment><comment><USER12> Link to the paper: [https://arxiv.org/abs/1908.03795](https://arxiv.org/abs/1908.03795)

</comment><comment><USER13> > The identity applies to "Hermitian" matrices, which transform eigenvectors > by real amounts (as opposed to those that involve imaginary numbers), and > which thus apply in real-world situations.

This is a weird characterization of Hermitian matrices — this implies that rotations are not 'real-world'.

<comment><USER4> Rotation matrices are hermitian. It's a popular science article, but the author is alluding to the fact that Hermitian matrices have real eignenvalues. In quantum mechanics and quantum field theory, all _physically observable quantities_ of a system can be expressed as the eigenvalues of a set of a (matrix) operator associated with that quantity acting on basis states in the Hilbert space of the system. This makes sense a posteriori since we have no idea how we would interpret e.g. complex-valued energy or momentum.

Edit: electricslpnsld correctly points out that the first sentence is false, see below.

<comment><USER13> > Rotation matrices are hermitian

Is that the case? Consider

|a -b|

|b a|

with Eigenvalues lambda = a +/\- i b

a = cos theta and b = sin theta gives a rotation, so the Eigenvalues are complex.

<comment><USER14> Yeah rotation matrix are not hermitian (note that you don't need to show the eigenvalues aren't real, you just need to show it's not self-conjugate). The OP may have been confused by the fact that you can make a rotation matrix of eigenvectors of a hermitian matrix, which diagonalises the original matrix into _two_ conjugate rotation matrices with a diagonal matrix between them.

</comment></comment></comment></comment><comment><USER15> Here's Terence Tao's blog post about the identity: [https://terrytao.wordpress.com/2019/08/13/eigenvectors- from-...](https://terrytao.wordpress.com/2019/08/13/eigenvectors-from- eigenvalues)

</comment><comment><USER16> I'm a physicist and I hate to say that I'm stuck on the first equation in the first lemma. Can anybody clarify what the following notation means?

        \det(B\quad v_n)

For the determinant to make sense its argument needs to be an m×m matrix. B is an n×(n-1) matrix, v_n is an n dimensional vector.

<comment><USER17> The blog post [https://terrytao.wordpress.com/2019/08/13/eigenvectors- from-...](https://terrytao.wordpress.com/2019/08/13/eigenvectors-from- eigenvalues/) is very readable and interesting

There's a comment with your exact question and the answer "It's not multiplication, it's concatenation: stick the column vector after the last column of B to "complete the square"."

</comment></comment><comment><USER18> I feel old and decrepit when I read this. I could remember enough to mentally link eigenvalues with matrices, but that's all. It makes me sad to think of all the maths I have forgotten.

<comment><USER19> Unless you're really having cognitive decline, you can probably pick it up again if you need it much more easily than the first time. We forget stuff we don't use, so forgetting maths probably means you've been doing something else with your life. Maybe that something else was better than repeating the same maths over and over again? I have repeated some of the same maths for 10-20 years in my work and it's depressing in a different way - I'm not improving much. I'd be happy to forget the old and learn some new. Knowing about eigenvalues doesn't make me feel particularly fulfilled. Any 20-year old physics student can do that too.

</comment></comment><comment><USER20> > neutrinos come in one of three possible "flavors" — electron, muon or tau

This reminds me of the Koide's coincidence

[https://news.ycombinator.com/item?id=17961139](https://news.ycombinator.com/item?id=17961139)

So the arithmetic mean(p=1) mass of (e, μ, τ) is twice of square-root- mean(p=1/2) mass of (e, μ, τ).

the p=1 and p=1/2 are defined in "generalized mean"

</comment><comment><USER21> I propose the third generation neutrino be renamed to "tao" in commemoration.

<comment><USER22> I appreciate the pun with the Tau neutrino. I'm sure that someone could make a joke, or a trick question for a quiz, out of the homophony.

[https://en.wikipedia.org/wiki/Tau_neutrino](https://en.wikipedia.org/wiki/Tau_neutrino)

</comment></comment><comment><USER23> This could have some implications in the computational expense of trilateration for GNSS applications. "Optimal trilateration is an eigenvalue problem" <title of another paper>.

</comment><comment><USER24> TL;DR; anyone? Originally I thought this lets one calculate eigenvectors directly from matrix and its submatrices's eigenvalues, but looking at the paper, it is not exactly that good.

<comment><USER25> TL;DR: This lets one calculate eigenvectors directly from the eigenvalues of a matrix and its submatrices,

Element wise:

v(i,j)=√∏δ(k,i)(λi(A) − λk(A))/δ(k,n)(λi(A) − λk(Mj))

δ(x,y)(f):= ±1 if x=y else f

<comment><USER26> So the textbook way is:

1\. Roots of characteristic equation det(A-λI)=0 give the eigenvalues.

2\. Solve (A-λI)x = 0 for each eigenvalue to find each eigenvector x.

It seems very plausible that step 2 can be reduced to an equation.

</comment></comment></comment><comment><USER27> Is this Fields Medal stuff? If it's not, ought it to be? Or would they be considered to have come by it too easily?

<comment><USER28> It's a nice but ordinary result.

</comment></comment><comment><USER29> Math truly is the language of the universe.

</comment><comment><USER23> This could have some implications in the computational expense of trilateration for GNSS?

</comment><comment><USER30> Since Tao's Erdos number is 2, the 3 physicists are now a 3, at most :)

</comment><comment><USER31> Imagine writing an article about a new mathematical formula or equation, without including the actual formula. Peak quanta

<comment><USER32> Here it is, reformatted a bit for HN:

|vi,j|^2 ∏k=1,n;k!=i;(λi(A)−λk(A)) = ∏k=1,n-1;(λi(A)−λk(Mj))

Including it in the article wouldn't really make much difference for most readers. Those for whom it would can easily find it on the first page of the 2.5 page paper on arxiv.org that the article links to.

<comment><USER33> Ideally they wouldn't just drop the equation in as-is, but break it down and explain what all the parts mean. Then people would actually have a path to engaging with the real work being done instead of a parallel-universe pop- science version of it.

</comment></comment></comment><comment><USER34> [https://xkcd.com/1364/](https://xkcd.com/1364/)

<comment><USER35> Cute stab, but the expression isn't literal and you know that.

Explaining concepts without unnecessary jargon is a reasonable request since there are different levels of background knowledge in any audience. The parent comment to your reply is using undergrad-level math terms, how high do you want the barrier to be?

Knowledge is pointless when poorly articulated.

<comment><USER36> "if you can't teach it to someone else, you really don't know it yourself"

\-- Richard Feynman

<comment><USER37> Well, it's a research paper, not a tutorial.

<comment><USER38> Yes, but the result was simple enough in hindsight that it should probably be in every introductory linear algebra text.

<comment><USER37> Looks like it's not _that_ simple. It does _make sense_ in hindsight - <USER2> the quantity of information is the same, but that does not necessarily mean that the actual calculation or the proof must be simple.</comment></comment></comment></comment></comment></comment>


PCG – A Family of Better Random Number Generators - <AUTHOR> http://www.pcg-random.org/

<comment><USER2> The author does not indicate what sort of target the benchmarks were run on, but for comparison ChaCha20/8 which is a more modern secure PRNG compared to the arcfour that they show runs about 10Gb/s on modern hardware.

ChaCha20/20 is a more conservative choice (i.e. there are classes of attacks on ChaCha20/8 that would be infeasible against ChaCha20/20) but runs somewhere between 1/3 and 1/2 the speed of 20/8.

<comment><AUTHOR> The benchmark details are in the paper. It's a pretty ordinary Haswell PC.

</comment></comment><comment><USER3> I'd like to see more substantiation than the guy's own site. The PCG "family" is omitted from every graph that I saw. Also, from my own testing, Mersenne Twister appears to have enough randomness for non-cryptographic purposes. I've never had particularly predictable sequences from it.

<comment><AUTHOR> The graphs of failures don't show the PCG scheme because their number of failures is zero.

The performance graphs show a whole bunch of PCG generators.

You absolutely can predict the Mersenne Twister after 624 outputs (there are several blog posts out there). The Mersenne Twister is also huge (2K of state) and some people claim that as a result it's not cache friendly.

But yes, it's a new thing, so it needs people to look at it.

</comment></comment><comment><AUTHOR> Apparently, both the Mersenne Twister and XorShift (which seem to be two of the popular RNGs people use these days) can't pass all statistical tests. (The Mersenne Twister is pretty huge as well.)

<comment><USER2> Some xorshifts can and some can't; I don't think any 64-bit xorshift does.

<comment><AUTHOR> Looking at the PCG paper, it shows that a basic XorShift generator doesn't pass statistical tests as it gets bigger. Basically, there are some tests it never passes no matter how big it gets.

But a tiny change (XorShift*) is enough to get a generator that passes empirical statistical tests.

The page about other RNGs has lots of good info about this stuff.

<comment><USER2> Ah, you're right, the 128 bit xorshift* is what I was thinking of.</comment></comment></comment></comment>


The state of gRPC in the browser - <AUTHOR> https://grpc.io/blog/state-of-grpc-web <comment><USER3> My team has been using gRPC + Improbable's grpc-web [0] + Typescript for a green field project and it has been amazing.

\- Typing all the way to the frontend.

\- gRPC/protobuf forces you to describe your interfaces and are self- documenting.

\- gRPC semantics like error codes and deadlines (if you propagate them through your stack, they're particularly useful - for instance, we cancel database transactions across service boundaries if a request times out).

\- Performance is great (but we're far from seeing bottlenecks with JSON, it's not the reason we choose gRPC).

\- We use grpc-gateway which auto-generates a REST proxy for our customers. We sometimes use it for interactive debugging. [1]

\- Rather than importing database models for our management tools and one-off scripts, using the API is so frictionless that we even use it inside our backend code and for CLI utilities.

The Google API design guide is helpful: [https://cloud.google.com/apis/design](https://cloud.google.com/apis/design)

One piece of advice: Treat your gRPC calls like you would treat a GraphQL resolver - if you squint your eyes, they're very similar concepts.

Rather than specifying a GraphQL query, you specify a Field Mask.

[https://developers.google.com/protocol- buffers/docs/referenc...](https://developers.google.com/protocol- buffers/docs/reference/csharp/class/google/protobuf/well-known-types/field- mask)

Happy to answer questions on our experience.

[0]: [https://github.com/improbable-eng/grpc- web](https://github.com/improbable-eng/grpc-web)

[1]: [https://github.com/grpc-ecosystem/grpc-gateway](https://github.com/grpc- ecosystem/grpc-gateway)

<comment><USER4> lima - great points.

Questions:

1) If you have TS on the front and back end - you already have de-facto typing. Why did you opt for gRPC over just some kind of basic serialization, even JSON? I

2) If you have TS classes, then you need to maintain a set of Protobuff service definitions as well - do you find this was a lot of duplicated overhead?

3) gRPC seems to me to be a little 'internal', not quite a web tech meant to be shared between parties. Did you have trouble with authentication, especially with 3rd parties? Or other 'cross-cutting' concerns?

I'm literally looking at doing what you're doing, any feedback would be greatly appreciated.

<comment><USER3> 1) I forgot to mention - the backend is written in Go. Even if both were TS, all of the interoperability and other advantages will apply.

2) The TS classes are auto-generated and the protobuf definitions are the only authoritative definition.

3) We're using JWT for authentication (in particular, short-lived tokens issues by Keycloak, using their JS library). gRPC has request metadata and it was straight-forward to use it with the Keycloak library.

We generate client libraries for customers to use and give them the option of using the REST API if they don't want to deal with gRPC. We consider the gRPC API to be a competitive advantage - our customers are enterprises and like well-defined and typed interfaces.

<comment><USER5> Hey, sorry if this is off-topic, but how have you been finding Keycloak? This is the first time I've seen it mentioned on here, and it looks like a great auth solution at first glance.

<comment><USER3> Keycloak has been great.

\- Very complete OpenID Connect implementation.

\- Back-channel logout.

\- Short-lived tokens and lots of tooling to handle refreshing them. This solves many of the issues associated with JWT expiration.

\- Documentation is very complete.

\- Their data model allows for very fine-grained access control - you can issue sub-tokens with limited scopes, limit scopes per client and so on.

\- Easy to deploy in OpenShift/k8s.

Only pain points are the build process (Java has got nothing on NodeJS as far as number of dependencies go!), data migrations and the fact that it's written in Java (start up time in CI).

<comment><USER5> Thanks a lot, great to hear!

</comment></comment></comment></comment></comment></comment><comment><USER6> Web has come a full circle. First we disgust and hate SOAP XML and friends. Then we go to REST and realize of it's too loose! Then we invent stuff like Swagger and JSONAPI in order to put some interfacing in place. And then we bring in cripples that give similar but water downed features of SOAP, GRPC, GraphQL and more friends.

Edit: I know I might get downvotes but think for a second we could have just taken some good parts from SOAP to begin with and have all the goodness.

<comment><USER3> Yes, it has come full circle - but SOAP XML and friends were rightfully despised. The spec is a mess and there are so many broken implementations all over the place. I have fond memories of debugging the PHP SOAP client in order to build a bug-by-bug compatible Python version :-)

gRPC and other modern RPC protocols/SOA frameworks are basically "the good parts from SOAP".

<comment><USER7> I feel that the difference is that SOAP was a proper spec made by multiple parties, for better or worse. And GRPC is just a published spec from Google with code from Google. Of course it won't be such a mess and it will be good enough. Is it good to rely on Google adopting its tech as an industry standard? That's a philosophical question.

<comment><USER8> I personally use this rule to decide whether I should use a Google service/library: it has to have more than 1 billion active users or it's an important part of such services. gRpc more specifically protobuf, imo, is very important to Google. So I won't be worried about its future.

</comment></comment></comment></comment><comment><USER9> We built out our gRPC services starting about 8 months ago. I pounded my fists on the gRPC-web issue board a bunch of times. Things started moving. In the end, it was too little and the effort is too divided. Also the route for which they wanted to implement streaming was, personally, poorly designed.

We have since switched to GraphQL and haven't looked back.

<comment><USER4> We are looking at this as well.

Can I ask a question?

Seems GraphQL and gRPC are to some extent complementary: one is graph/data oriented, the other more functional/service oriented.

I know GQL has it's own ideas about transport, but would it make any sense at all to actually put GQP _over_ gRPC? And by that I mean to have some gRPC services pass GQL requests as parameters? Or have I misunderstood entirely?

<comment><USER10> GQL and gRPC are absolutely complementary. Having resolvers fan out to gRPC- backed microservices has been great at our company. We initially used protos for all of our service contracts (including server <-> web UI communication). While this was nice for all the reasons other people have stated, protos kinda ended up sucking to work with on the front-end.

Protos are a serialization contract and should remain such. Too much proto- specific logic ended up bleeding into our web codebase (dealing with oneofs, enums, etc). GQL's IDL on the other hand ended up being a perfect middle- ground. It gave us a nice layer to deal with that serialization specific stuff, while letting the front-end work with better data models (interfaces, unions, string enums, etc.). GQL's IDL and TypeScript are a great match, since GQL types are ultimately just discriminated unions, which TS handles like a charm.

<comment><USER11> Can you comment more about your comparative experiences with "logic bleed"?

I find this fascinating, because it seems that a lot of the bleed should be the same (isn't 'oneof' roughly equivalent to 'union'?)... but it sounds like something is different in practice, and I'd really like to understand what the root cause of the difference is.

<comment><USER10> I appreciate you calling me out on my wording, because you are spot on. If anything GraphQL "bleeds" even _more_ into my front-end code. I think the appropriate way to frame it is that GQL is a more targeted, holistic solution to the problem of fan-out data aggregation from the perspective of a UI client. Every UI codebase I had that depended on protos had significant chunks of code transforming the data more appropriate to our UI domain objects (that lived either in the front-end code base or one abstraction higher in a "BFF" [1]). Our UIs usually wanted to work with denormalized data structures, which was obviously in conflict with the proto models owned by small individual microservices.

GQL simultaneously addresses those two specific problems: resolution of normalized data, and giving UI consumers the power to declaratively fetch their desired data shape. It also has first-class TypeScript support through Apollo and the open-source community built around that.

I think it's important to stress the tooling support, because you are correct… oneofs and union types are conceptually the same thing. A lot of it comes down to ergonomics in how you consume those types. In code generation GQL unions represent themselves as actual TypeScript union types, which means I can write type guards or switch on their discriminant to narrow to their correct member, whereas proto oneofs use a string value to access the correctly populated property. Small things in the day-to-day, but in how it manifested itself in code, it definitely felt like an improvement.

GQL unions also give you the power to do some really cool projection declaratively in queries [2]. Once again because of the nice compatibility of TS' type system and GQL, the types returned from those queries code generate into really nice structures to work with.

I'm getting a bit rambly and don't feel like I adequately answered your question, but it's a bit late and I wanted to give you some response off the top of my head. I don't want to knock on grpc-web or anything. A good deal of it has to deal with code ownership and team communication structures, and GQL ultimately felt like a better seam for our UI team to interact with our services.

I probably should write a blog post, because I have a lot of disconnected thoughts and need to have a more coherent narrative here. I think some code examples would better illustrate what seems like non-problems from how I've described them here. I'll follow up once I've let it settle in my head.

[1] [https://samnewman.io/patterns/architectural/bff/](https://samnewman.io/patterns/architectural/bff/) [2] [https://graphql.org/learn/schema/#union- types](https://graphql.org/learn/schema/#union-types)

<comment><USER11> I didn't mean it as a call-out at all! :) I've had similar intuitions but been struggling to put a finger on it and wordsmith well on the topic. Thank you for writing!

And yes please do continue to write more, will eagerly read :)

</comment></comment></comment></comment></comment></comment><comment><USER12> Could someone explain the difference between gRPC and Apache Thrift? Even tough the Apache Thrift project is not as active as gRPC it works quite well for us.

<comment><USER13> Thrift is what xooglers at Facebook implemented when they wanted Stubby. grpc is Google's own open source edition of Stubby.

They are very similar paradigm-wise.

<comment><USER14> Wait, what? IIRC Stubby is a lockserver, used for two things: coordinated locks, and small coordinated data. You mean protobuff, don't you? Am I misremembering and/or wrong?

<comment><USER15> You're thinking of chubby. :) [https://ai.google/research/pubs/pub27897](https://ai.google/research/pubs/pub27897)

</comment></comment></comment></comment><comment><USER16> Slight off topic, but has anyone executed gRPC on a C platform for embedded? I'm willing for forgo the automatic code generation - but hell if there are any good resources I've been able to find on this.

<comment><USER17> With embedded platform you mean microcontroller with RTOS? Afaik there are no suitable implementations yet. It will generally be pretty hard to build something like this, since grpc requires HTTP/2, and that is hard to implement with no dynamic allocations and a low amount of memory. E.g. each substream requires a minimum amount of buffering, there is header decompression, etc.

For pure protobuf communication on embedded systems nanopb works fine. If one doesn't need concurrent streams, HTTP/1.1 or coap plus nanopb encoded payloads work fairly well.

<comment><USER16> The problem I have with nanoPB, is that the RPC comm between the app over BLE and the server over http is entirely up to me. There are no suggestions, standards, or even great examples of what the pb should contain and how it gets processed at each location.

It almost becomes RESTful where I have a proto that has a request field, response field, and all the optional fields for both, when the server or app sees one of these I need all custom implementation to decide what to do with these 'states'. It seems wrong and complex to make it all arbitrarily handled at each of three places.

NanoPB is excellent. But it's the handling of the data (calls, req/res, timeouts, errors, formats, patterns) that I wish there was something for.

And yea, you got it right that with no HTTP layer it wouldn't be gRPC on the device. But my app and server could still use that, if only the device could process the intention of the gRPC format changes / extensions.

</comment></comment></comment><comment><USER18> I am using the HTTP Gateway and generating OpenAPI from that for type-safe access [1]. The main downside is that this introduces an additional build step in your project and a small amount of additional run-time processing. The upside is supporting a JSON API and not requiring gPRC(-Web) for clients. Even for non-browser clients, GRPC tooling can still be heavy-weight to pull into your project. Not all languages have easy to use OpenAPI integration, but any language can always just send some JSON.

But with the HTTP Gateway you are actually supporting both, so a browser client can still use GRPC-Web if it is able.

[1] [https://github.com/gogo/grpc-example](https://github.com/gogo/grpc- example)

<comment><USER19> Hi, I'm the author of this blog post _and_ the author of this repository - <USER2> happy to hear you're finding it useful! I agree that the grpc-gateway is very useful still, but for greenfield projects I think it would be useful to consider the grpc-web on its own merits. I see the grpc-gateway as a way to integrate gRPC into existing environments.

</comment></comment><comment><USER20> One other that helps JSON/REST to remain defacto these days, is not just a web browser support. But also nice mobile clients like Retrofit.

Retrofit seamlessly converts JSON data by means of json de-serializer, into Java classes. So we get typefull semantic (but, albeit at run time only).

I have retrofit integrated with RxJava, and when I looked what it would take to 'plugin' gRPC, I found that I have to change not just my backend, but all the wiring for the mobile frontends. And, at the time it looked like too much work.

If Retrofit, would make it transparent JSON vs gRPC -- then it would be great for folks that already invested into Retrofit/JSON.

</comment><comment><USER21> gRPC is two things to me (please correct me if I'm forgetting something):

\- A specification language for services and the RPC calls they take (except RPC response primitives include single message and stream)

\- A binary object definition/packing scheme (aka protobuf)

Outside of the HTTP and what HTTP/2 makes possible, I feel vaguely like everyone is rushing to replace pure HTTP/HTTP2 (and HTTP3 in the future) with something that is less extensible and could be implemented _inside_ HTTP for the most part.

Obviously you can't do anything about the inefficiencies of headers in HTTP/1 (this is better in HTTP/2 & 3), the lack of built-in stream semantics (again only HTTP/1 though you can make do with some longpolling/SSE/websockets scheme) but outside of the HTTP stuff you can absolutely transmit your content as a stream of tightly packed bytes and let consumers do whatever they need to...

Why is gRPC anything more than a content type? It's so weird to see gRPC evolve from (in some sense, I might be wrong) HTTP + HTTP/2, and now people trying to shoe horn it back into the browser.

It's really hard to find metrics (maybe I should do a comparison and post results I guess), but like in this SO post[0]. The hype train is presenting gRPC as the _next_ thing, but it shouldn't be, IMO. Most of the improvement is from use of _protobuf_ for more efficient (de)serialization -- and I don't think gRPC is the best tool for declaring API schemas (RPC or otherwise) either.

[0]: [https://stackoverflow.com/questions/44877606/is- grpchttp-2-f...](https://stackoverflow.com/questions/44877606/is- grpchttp-2-faster-than-rest-with-http-2)

<comment><USER17> I think what you describe is the shortcoming of the initial grpc spec. It was for some reason decided to define it on top of features which are barely implemented outside of HTTP/2 and special libraries (especially: Trailers). But it would have been possible to just define things on top of common HTTP semantics. This is what grpc-web now fixes according to my understanding.

I think even streaming should have been possible with HTTP/1.1. Bodies can be streamed there just fine, if libraries support it (for browsers the issue was up to now that the APIs don't support access to bodies as streams). The only thing I'm not sure if there is an issue in HTTP/1.1 with request streams still running while the response stream has already finished.

<comment><USER21> > I think what you describe is the shortcoming of the initial grpc spec. It > was for some reason decided to define it on top of features which are barely > implemented outside of HTTP/2 and special libraries (especially: Trailers). > But it would have been possible to just define things on top of common HTTP > semantics. This is what grpc-web now fixes according to my understanding.

This is also my understanding (minus the Trailers bit) -- there's stuff like grpc-gateway[0] that I've considered using before so I know there's _a_ mapping (whether it's easy to use is another thing) from grpc to HTTP/1.1 ...

> I think even streaming should have been possible with HTTP/1.1. Bodies can > be streamed there just fine, if libraries support it (for browsers the issue > was up to now that the APIs don't support access to bodies as streams). The > only thing I'm not sure if there is an issue in HTTP/1.1 with request > streams still running while the response stream has already finished.

For streaming I was thinking mostly of the duplex streams, i.e. what Websockets brought to the table, everything else would be pretty hacky. I suspect that grpc translates to regular browser-ready HTTP/1.1 REST pretty easily (outside of trying to decide _how_ ), minus the streaming bit, since you'd have to do some sort of comet/long polling/sse/websockets approach.

[0]: [https://github.com/grpc-ecosystem/grpc-gateway](https://github.com/grpc- ecosystem/grpc-gateway)

</comment></comment></comment><comment><USER22> Has anyone considered using this or something else for IPC – that is, communicating between memory boundaries in the same application (e.g., Node/web, Swift or C# to a web container, etc.)?

Even just for Electron the built in IPC API doesn't really cut it long term since you don't get typing nor proper request/response or topic based streaming support so bugs are more likely to sneak in.

</comment><comment><USER23> The state of gRPC on the browser is the main reason why my company selected Twirp instead. Being able to natively call a simple HTTP endpoint with a JSON payload is fantastic; its the benefits of protobufs when you can use it, with a graceful fallback for clients that need normal HTTP. Of course you can get this with grpc-gateway, but now you have two things to maintain.

</comment><comment><USER24> I've had issues with npm and binaries of gRPC in firebase related to node versions and electron versions. It seems like this could be a good alternative if it was used in firebase since it's implemented in typescript - not sure I completely understand it, though.

</comment><comment><USER25> I'm quite surprised they're not using websockets for streaming. Anyone know why?

EDIT: Better question: is anyone aware of a system like gRPC but built with bidirectional streaming for the browser from the beginning?

<comment><USER26> Websockets have head-of-line blocking, which is one of the main reasons HTTP/2 exists.

HTTP/2 (i.e. gRPC) is a bidirectional streaming protocol, and you can use the fetch API in JS to use it. The reason gRPC-web exists is because browsers artificially hide some of the headers, which have been part of the HTTP standard since the beginning. If that was fixed, gRPC would just be plain XHR or fetch requests and gRPC-web would go away.

<comment><USER19> I'm the author of this blog post and one of the maintainers of the Improbable grpc-web implementation.

I don't explicitly mention it in the post, but no browser has support for fetch request streaming yet, so true bidirectionality would not be possible even if you had control over the headers. This will come eventually, and then grpc-web will have proper bi-di streaming support. It is doubtful whether it will actually have access to raw HTTP/2 frames which would be required for the gRPC HTTP/2 protocol.

</comment></comment></comment><comment><USER7> I'm surprised that streaming is not implemented for web client. Streaming seems to be a huge feature for gRPC. Why does it take so long?

</comment><comment><USER27> I'm excited this as an option in the toolbox.

</comment><comment><USER28> What's the advantage of using this over something like XMLHttpRequest?

<comment><USER29> XMLHttpRequest does not have a remote procedure call (RPC).

<comment><USER28> I meant what's the advantage of using RPC instead of XMLHttpRequest to communicate with the server.

<comment><USER30> Well, XMLHttpRequest alone doesn't cover much so you're really comparing with HTTP requests combined with JSON and whatever you use to document your JSON API.

The advantage of protobufs is basically static typing with backward-compatible serialization (you can add new fields), that's compatible with many server- side languages.

It's honestly an awkward fit for web apps, though. Basic things are different, like int64's aren't native to JavaScript.

</comment></comment></comment></comment><comment><USER31> > An efficient JSON-like message encoding

how is this still "the future"?

</comment><comment><USER32> Another team at my company developed a microservice that uses gRPC that my team depends on and it's been an absolute nightmare. Protobufs are just too limited in what they can do to make them useful except in very specific, narrow cases.

<comment><USER32> It's the repeated/oneof issue that's causing me problems right now.

<comment><USER33> You mean like:

      repeated oneof actions {
        ActionTypeOne type_one;
        ActionTypeTwo type_two;
      }

or like:

      oneof thingy {
        repeated string first_option;
        string second_option;
      }

I can see why you'd want to do either of those things, but it doesn't seem like a huge deal to me to wrap those in another message.

<comment><USER34>
      oneof thingy {
        repeated string first_option;
        string second_option;
      }

Not the most beautiful solution, but I've seen it in production and it works fine.</comment></comment></comment></comment>


Show HN: FSSB – A filesystem sandbox for Linux - <AUTHOR> https://github.com/adtac/fssb <comment><USER2>
      $ cat > nope.c <<EOF
      > #include <stdio.h>
      > void main() {
      >         write(creat("nope.nope"), "oh no\n", 6);
      > }
      > EOF
      $ make nope
      $ ./fssb -- ./nope
      fssb: child exited with 4
      fssb: sandbox directory: /tmp/fssb-2/
      $ cat nope.nope
      oh no

<comment><USER2> Lesson learned: blacklists are catastrophic for security purposes, because you will always miss something. Even if you didn't miss anything, the next kernel release will just add something new that I can exploit.

</comment></comment><comment><USER3> Use of ptrace will incur a huge performance penalty. Why not just using a mount namespace and using an overlay filesystem?

<comment><USER4> I was wondering the same thing. I guess the ptrace approach is better than LD_PRELOAD, but it's still not as foolproof as a real filesystem. While this seems interesting as a ptrace learning experience, I'm not sure it actually adds any new functionality.

</comment></comment><comment><USER5> > Run arbitrary binaries that you don't trust safely (maybe you downloaded it > from the internet).

I don't think sandboxing is an appropriate solutionto this. Especially just filesystem sandboxing. This does nothing to prevent security exploits via any means.

Also how does this compare to chroot?

<comment><USER6> It definitely doesn't make it safe, but it _does_ allow you to run a binary and see what it would do to your filesystem, without actually doing it; which is pretty neat!

chroot is completely different because it completely isolates a process from the rest of the filesystem. This is more like, well, a sandbox or overlay.

<comment><USER7> it could hardened it with seccomp filter.

</comment></comment></comment><comment><USER8> I do something like this using systemd containers based on btrfs snapshots of my current system[1]. I have also used docker to the same end. My past experience with Ptrace based things like this tells me not to trust them. Too many ways to subtly break the program executing under you, too many ways for the program to accidentally get around your filters.

[1] [https://wiki.archlinux.org/index.php/Systemd- nspawn#Use_Btrf...](https://wiki.archlinux.org/index.php/Systemd- nspawn#Use_Btrfs_subvolume_as_container_root)

</comment><comment><USER9> Interesting and cool, but I would be careful with it.

It appears to intercept a fixed list of syscalls, so it may not be intercepting all of them that are relevant. I don't think, for example, it's intercepting truncate(), so a process sandboxed in this way could still wreak a little havoc.

</comment><comment><USER10> From what I can see a process running in that "sandbox" would happily write to a file descriptor passed into it...

Like other posters in that thread I am very skeptical that this approach can be made secure and running with acceptable performance (given there are other more practical approaches to restrict processes available (namespaces, seccomp, SELinux...).

</comment><comment><USER11> See also: Firejail

* [https://firejail.wordpress.com/](https://firejail.wordpress.com/)

* [https://news.ycombinator.com/item?id=12239840](https://news.ycombinator.com/item?id=12239840)

</comment><comment><USER7> There was a project which pursue a similar strategy: [https://github.com/tsgates/mbox](https://github.com/tsgates/mbox)

</comment><comment><USER12> This is essentially the same thing as either of:

\- Linux containers on a read only FS

\- weaker specialised version of seccomp

\- some similar preload intercept as in e.g. Gentoo sandbox (insecure, used more to catch mistakes)

\- Ptrace syscall hijack (Ptrace itself is notoriously insecure)

Neither is particularly impressive. You also get support by one random guy on the Internet.

Use a real virtual machine instead please.

<comment><AUTHOR> >Linux containers on a read only FS

Not really - the child program could realize that it's on a read-only FS. But with FSSB, this is actually hidden - the program thinks it's on a regular FS (although I've recently learned that there are more advanced ways to even break this).

>some similar preload intercept

This is slightly more performant (of course, not as fast as a program without ptrace intercepts).

>Use a real virtual machine instead please

This is obviously not a full-fledged security suite ;) Just a simple, lightweight sandbox. Also this is in alpha.

</comment></comment><comment><USER13> This looks like Gentoo's sandbox. Except Gentoo is a whitelist iirc

</comment><comment><USER14> Is this somehow better than chroot?

<comment><USER13> Chroot as a lot of inherent security issues. Grsec has somr fixes for it, but iirc it is not proper to trust chroot to secure you against untrusted binaries.

</comment></comment><comment><USER15> I can't even tell what this does. I just woke up but is this like capsicum on freebsd, [https://m.youtube.com/watch?v=raNx9L4VH2k](https://m.youtube.com/watch?v=raNx9L4VH2k), or jails in the FS, or both?

Clearly I need to wake up.

<comment><USER9> It's intercepting specific system calls via ptrace() and dynamically changing the arguments passed to them. I believe freebsd has ptrace.</comment></comment>


While Nestle extracts millions of liters, residents lack drinking water - <AUTHOR> https://www.theguardian.com/global/2018/oct/04/ontario-six-nations-nestle-running-water <comment><USER2> I heard arguments like this about the nestle plant in California during the drought.

The headlines were similar, about the "millions of gallons" of water used by the bottling plant while people were affected by the drought.

I think it is a failure of mathematical reasoning. The water the plants use is of direct benefit to people, is compartively small in volume and is completely dwarfed by all other uses of water. Think plant irrigation, such as farming and golf courses.

To highlight the idea in a similar vein:

[https://www.theonion.com/geologists-we-may-be-slowly- running...](https://www.theonion.com/geologists-we-may-be-slowly-running-out- of-rocks-1819571484)

<comment><USER3> The article is not about water scarcity, it is about ownership, infrastructure and access.

<comment><USER4> Agreed. There is no water scarcity if we spend the energy required to recycle it from other sources (I include desal in this). What this means is, where do our priorities lie?</comment></comment></comment>


Wait, is Behavioral Driven Design (BDD) for losers? - <AUTHOR> http://futurefun.tumblr.com/post/36713876206/behavioral-driven-design-bdd-is-for-losers <comment><USER2> BDD is great, in my opinion, especially for working on larger projects with longer goals.

For example we're using BDD on a multi-million-dollar multi-year project with dozens of stakeholders and programmers from multiple organizations.

When we bring a new person on board he can read the BDD and quickly understand what's happening.

We use Cucumber, Selenium, and also use TDD tools like RSpec and minitest/spec, and minitest/benchmark.

</comment><comment><USER3> Chat rooms are sometimes a dangerous place to ask questions. Mobs form really quick.

There are plenty of companies doing TDD. I've been practicing it in my past few projects and have only good things to say. I probably write around 50% of tests first, the rest is written after implementation to expand coverage.</comment>


A more awesome 3D CSS digital clock - <AUTHOR> http://jsfiddle.net/amyseqmedia/8cPa8/

<comment><USER2> Very nice, well done.

Recreating the blank segments is misguided, it makes it harder to read the clock. They should just disappear if usability is a goal.

<comment><AUTHOR> I disagree on hiding the inactive segments though. I like the blank segments being still present, but because that is my opinion and not because usability was the goal. :) I could have removed the inactive AM or PM too.</comment></comment>


You do not need email confirmation in your sign up flow - <AUTHOR> https://visible.vc/engineering/signup-flow-without-email-confirmation/ <comment><USER2> I think the title is a little misleading. They still require users to confirm their email, although they postpone that. From the title it sounds like they have a revolutionary solution to avoid this altogether, which they don't.

Besides the title, this might work for their specific case, but I don't see it working in general. From my experience, lots of emails are fake. Either gibberish, or not the user's. You need an actual email to send communications and somewhat reduce spam and abuse. Postponing confirmation doesn't help with that.

The author fails to even mention the actual solution to avoiding email confirmation and reducing onboarding steps: social login.

With social login, users start using the app immediately, and site owners have a validated email (and optionally a lot more). If your app is targeted to developers, use GitHub login. Otherwise Facebook, Google, Twitter or similar, and you'll have a 90% coverage. Some people are paranoid about giving access (although IMO is safer), so also support signing up via email, but at that point it would be the "user's fault" if extra steps are required.

<comment><USER3> >With social login, users start using the app immediately

Given that 99% of the time sites implement social logins as "let's automatically fill out your username and email address in the sign up form", that's far from true.

<comment><USER2> 99% seems excessive.

That hardly happens to me.

<comment><USER3> I mean yeah it's hyperbole but still, it seems like it happens on the vast majority of sites I try to do a social registration with.

</comment></comment></comment></comment><comment><USER4> Please add a "i did not sign up for this account" link to disavow account to email links.

There is someone who keeps using my email thinking its theirs. I am tired of constant reminders to verify my email from noreply addresses, with no way to turn it off.

<comment><USER5> same here, on a daily basis. worse when my email is supplied by someone else to a party that does not confirm AND there is no way to unsubscribe (such as Best Buy's geek squad's email). my gmail delete filter list is 50+ items now.

<comment><USER6> At least in the US, CAN-SPAM mandates that emails have an unsubscribe option - are you sure you didn't miss it?

<comment><USER5> Best Buy Geek Squad does NOT offer a unsub link. Believe it or not. Verified.

</comment></comment></comment></comment><comment><USER7> Apparently in the UK at least, there is potentially legislation in the horizon requiring email confirmation for account signups.

It dropped into our roadmap recently, will see if I can dig out some info in a bit.

<comment><USER7> Completely forgot to update this.

It's apparently to do with the EU General Data Protection Regulation ([https://en.wikipedia.org/wiki/General_Data_Protection_Regula...](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)) due to come into force in May 2018. I'd imagine this is specifically linked to the requirement for data-controllers to be able to _prove_ consent.

</comment></comment><comment> tony-allan Simplifying the experience is a great idea.

Just one thing... why not do everything as you suggest except send the Welcome/confirmation email straight away so they have a record and a link to confirm and set a password.

Then timeout the first session after 48 hours.

</comment><comment><USER8> I think all users are now used to email confirmation. With mobile and notifications its much easier to just click them once.

Ill be more irritated if it prompts me to go in my mailbox when I'm in middle of something. I'll be like- 'you fool why didn't you do this during signup itself.'

Think in terms of modes. Right now Im in signup mode. Then Im in 'Do work' mode. Dont make me go from 'Do work' mode to 'signup admin stuff' mode again.

Also now I expect each site to have option for google/facebook logins. The only reason I still have my facebook account active is that it makes one click login on most sites easier.

</comment><comment><USER9> My email address is `firstname.lastname@example.com`, with my first name (common) and last initial. I receive a _lot_ of erroneous signup emails. There's nothing wrong with sending a single email, so my usual course of action is to delete them. However, I expect sites to send no more than a single email to unverified addresses. If I receive subsequent messages from the same site, I mark them as spam. Gmail usually takes care of unsubscribing for me.

</comment><comment><USER10> Slightly OT, but: would you pay for a "mail confirmation as a Service"? I'm building such product, but I don't know if it makes sense, or how to market it.

<comment><USER11> Unsubscribe as a service maybe - something that knows if an email's unsub link is legit or if the mail should just be spammed

I sign up for an absolute shed-load of products and services I can't say I've ever wished the mail confirmation part could be automated. Every damn time I wish there was a way to easily unsubscribe from their mail list though.

</comment></comment><comment><USER12> So is resetting an account that used a wrong email a CFAA violation? Seems like it can be.

I think the better option if you aren't going to verify ownership of email addresses is to have a clear and simple way to detach an address from an account (if this makes the account useless, delete the account entirely).

I say this having been on the wrong side of trying to remove my address from all sorts of services.

</comment><comment><USER13> You do not need email confirmation in your sign up flow... but you will email confirmation eventually, as the article says.

However, you may never need a password. Users can log in on other devices using another email confirmation link, or using log in with Google, GitHub, etc.

</comment><comment><USER5> what if elon signs up as email@example.com. he then fills out a personal details form, which includes a phone number. if a 2nd user comes around and enters the same unconfirmed email within 48hrs he'd get to see those personal details.

this surely only works in very specific situations...

<comment><USER14> If a second user enters the same unconfirmed email, presumably he would need to know the original password?</comment></comment>


Show HN: synchtube.com Synchronize YouTube videos - <AUTHOR>

As I write on the site: "synchtube allows you to instantly create public and private rooms where you can synchronize YouTube music and videos with up to 50 people"
I've been working on this on and off with a friend, and we just recently made a big push to make it stable and scalable. I never thought I'd say this, but I think I'm finally happy with it now. The code feels clean internally (whew), and the site presentable. That being said I wanted to show it off!
This app was inspired mostly by coincidence. At the time my friend was studying for med school and wanted to watch surgery vids with friends. I was in a long distance relationship and wanted to share YouTube videos with my girlfriend. We talked, realized we both had the same idea at the same time, and then just built it. It was definitley a interesting (and painful) experience to architect this type of app.
Please let me know what you think, feedback would be great.
Should run on most browsers, not IE7-8 though.
Hope you can check it out: http://synchtube.com <comment><USER2> Great site. I can't tell you how many times I have been on skype with a group of friends passing time codes back and forth in the chat room. Here are some things I like:

        - its not build on flash like some of your competitors products
        - public rooms are advertised on the front page
        - group modifiable playlist
        - UI is clean and functional
        - youtube search box on the same page
        - music mode
        - option not to be in sync with the group

Improvements

        - more integration with twitter/facebook
        - more discovery tools for public videos
        - the settings button seems misplaced</comment>


Human echolocation - <AUTHOR> http://www.bbc.co.uk/news/health-13539921

<comment><AUTHOR> From wikipedia:

However, in the case of human clicking, since humans make sounds with much lower frequencies and slower click rates, such human echolocation can only picture much larger objects than can other echolocating animals.

Surely this is solvable with a hearing aid and a high pitch click-making device?</comment>


The Psychology of Programmers - <AUTHOR> http://architects.dzone.com/articles/psychology-programmers <comment><USER2> I just wanted to point out that one of the points is programmers don't like useless participation that doesn't really add value. Half the article's comments(at the point of this posting) are "nice article" and "thanks"</comment>


Ask HN: Would I provide spreadsheet services? - <AUTHOR> Last week, I had to create a tiny piece of code that scrapped some pages and saved in Excel files for my partner. She works with PR and I was thinking if I could provide spreadsheet services.
It took me 1 hour and if she had done by hand, it would have taken 6 hours.
I'm sure that a big number of companies use Excel and Google Sheets. <comment><USER2> you would be surprised at how many people use Excel so things. The big challenge is finding those people as many of them may not have an online presence.

<comment><AUTHOR> Exactly. This is the biggest challenge. Focus in one "unsexy" niche because I'd be less competition</comment></comment>


I Tried to Train a RNN on Donald Trumps Tweets - <AUTHOR> https://github.com/wyattferguson/trumpbot-rnn <comment><USER2> Fine tune gpt-2 instead, you're likely to see much better results</comment>


Ask HN: Do you sneak workouts in at work? - <AUTHOR>

I used to have a pretty active lifestyle, but due to work schedule and long hours, it's really hard to be able to devote a significant portion of time to training and staying in shape.<p>What sort of stuff do you guys do at work to sneak this in if at all. Also is it socially acceptable where you work. I know people who sit on balance balls at work (certainly not at my workplace), but I'd like to hear stories and what you guys do. <comment><USER2> I schedule a "meeting" in my calendar in the middle of the day. Then I use that time to leave the office and exercise at the gym. This also tends to prevent someone from inviting me to a meeting at that time. I find it really perks me up in the middle of the afternoon when I tend to drag.

At the large company where I work it is not unusual to be elsewhere on site for a meeting. So, I have not asked for permission. However, I do know my boss does the same thing.

</comment><comment><USER3> I bike to work. I highly recommend it. It takes me about 10 minutes longer in the morning, 5 in the afternoon. The difference is a bit more with low traffic, less (or even favoring the bicycle) with high traffic. For those 15 extra minutes daily, I get 2x25 minutes of high-intensity, low impact aerobic workout. I don't pay for gas. I have a dirt cheap car because I don't care about its gas mileage, etc. I can focus much better after the morning workout. I don't have to "sneak" anything. :)

And: I can't get out of the afternoon workout. Gotta get home!

</comment><comment><AUTHOR> Just to start something, I try to sneak in stuff in the elevator, sometimes I stretch. I figure if people can take smoking breaks, I should be able to get up and walk around or stretch out a bit.

</comment><comment><USER4> This is not technically "at" work, but I recently started walking to work instead of taking the subway

</comment><comment><USER5> I workout every morning, first thing.

</comment><comment><USER6> we have a gym at work, so I just go to the gym at work during lunch. Its a really nice perk to have.</comment>


The Stanford Endowment Experiment - <AUTHOR> http://www.ai-cio.com/channels/widescreenstory.aspx?id=2147493424 <comment><USER2> Wow, what's the deal with this chart? [http://www.ai- cio.com/uploadedImages/ai5000/channel/PEOPLE/C...](http://www.ai- cio.com/uploadedImages/ai5000/channel/PEOPLE/CIO1015-Stanford-Chart.jpg)

The columns on the right makes no sense, Stanford's 9.9% is much bigger than Yale's 10%, Harvard's 8.9% is roughly the same size as Yale's 10%.

Kinda hard to take anything serious in that article when the author can't even draw a chart.

</comment><comment><USER3> The word "Endowment" in the title, combined with the phallic bell tower in the article's graphic, had me thinking this article was about something completely unrelated to finances.</comment>


Ask HN: Is there a way to be notified of HN posts that contain certain keywords? - <AUTHOR> <comment><USER2> You could easily make your own using the hn api and something like nexmo to send yourself an sms</comment>


This is why you're seeing all those Chrome extensions today - <AUTHOR> http://thenextweb.com/apps/2016/03/04/google-chrome-bans-extensions-from-the-address-bar-forcing-them-to-the-side/#gref <comment><USER2> The really bad news is for page actions.

Google made this change hoping to make extensions more visible to the user, seeking a "security by awareness effect", buts for page actions they now have the opposite effect, "extension invisibility".

If users hide a page action extension to the hamburger menu, which can be done as easily as dragging right edge of the address bar to the right, the page action icons do no appear at all, so the user cannot click them.

Google should ensure that if the page action icon is hidden to the menu, it then appear in the address bar, to greatly improve usability and "security by awareness".</comment>


The Framework Myth - <AUTHOR> http://mooneyblog.mmdbsolutions.com/index.php/2010/12/07/the-framework-myth/ <comment><USER2> "They were not built to solve a business need"

That's not quite correct. It is perhaps more accurate to say they weren't built to solve your primary business need. They certainly solve the problem of getting unskilled people to be productive at some level. And this is not a trivial consideration. It takes a great deal of effort, time, and expertise to design a system that maximizes programmer productivity, such that an ideal minimum number of 'programmer-hours' is all that is required to augment and maintain it. And when you do, it is likely that it requires 'wizard level' programmers to put in those hours. Expertise is expensive, hard to find, and presents a certain replacement risk for an employer.

The alternative is more dumbed-down systems. The code is less elegant or clever, but easier to understand and imitate. And the 'brutish' nature of such code leads to a certain amount of repetition, which requires more 'programmer- hours' to work on. Hence the need for more developers. As many folks have pointed out, programming today is very much a social activity. The systems themselves are partly responsible for this. There is a need for developers to be 'hot swappable'.

And the staffing pressures are partly what are responsible for the popularity of frameworks, for similar reasons. Frameworks are development languages that sit on top of programming languages. In many cases, you barely even need to know the underlying programming language in order to produce fairly sophisticated results. In contrast, to be productive in programming languages, you need to have a fairly deep understanding of your craft and have a good bit of experience in the quirks of that language.

Frameworks are like DSLs for a technical domain. While it can take some time to learn the framework language, you can produce more, faster than if you have to build software from scratch (or using just libraries). But what are you producing? As the author says, they are built for "20,000 or 200,000" developers. Not you. And not your problem. They may solve common problems, but they don't necessarily solve your particular problem in the most appropriate way. You may need to rethink your problem to fit what the framework can accommodate. Or face the staffing dilemma.

</comment><comment><USER3> The problem with companies building frameworks boils down to one simple fact. If a company is unable to differentiate and disentangle it's goals from the goals of building and maintaining a generalize and useful framework.

Companies can build frameworks around solid principles and know when to let them go and develop into community projects. Rails certainly developed in that manner. Likewise, Sproutcore developed for a while under Apple's care, but has also split off, as Apple's goals diverged with sproutcore's.

If you are going to build a project for developers, make sure you have the developer's goals in mind, and not your own. Same is true of building an API.

</comment><comment><USER4> Nice article. I agree 95% (I always give myself 5% in case I change my mind later about a few things ;)

I once got hired in a company where I found that a developer had convinced the management of letting him build a framework. Since our boss swore by this guy, we had no choice but to keep using his pile of garbage. I've subsequently used various frameworks and have had various frustrations that with time I think I can pin point. Here's my list of recommendations for people undertaking the next life changing framework out there:

\- Always start by asking yourself "Am I nearly as good as I think I am?"

\- don't try to fix the world with your framework. Stick to the 80/20 rule. Simple tools that solve 80% of problems efficiently and unambiguously. Leave it at that. Please, pleeeaaase don't venture in the other 20

\- provide damn good APIs and hooks to extend your base libraries.

\- make it equally easy to avoid using your libraries. If your library is meant to be used by somewhat smart and responsible people, do your very best to keep them in charge. You may recommend against certain practices, but don't you put safeguards that prevent me from implementing the occasional hack.

\- document both, how to do it your way and how to go around.

\- document your framework's capability _as well as_ limitations. I have no clue why most library authors avoid talking about limitations. They know what they are and they know people will ask about them, yet they don't document them. If your ORM lib doesn't offer a certain facility, please just tell me. Spare me the countless fruitless hours of searching google and irc. Let me know I need to go down to sql, I won't mind. Don't just hope that I will never need to use it in my life and leave me hanging. Tell me. TELL ME.

</comment><comment><USER5> There's a HUGE difference between the .NET framework, that is more a Library of classes, and for example the PHP Cake framework, that really takes all control flow out of the hands of the developer.

In other words, I'm still so old school that I prefer a good library of classes, functions and tools, than the newest I-will-write-all-code-for-you framework.

In the same way, I feel better if I write a library that can be used by any project for a very specific feature (like localization, or disk cache, or something similar) than if I write a framework where everything should be done in the framework way and most logic should be rewritten.</comment>


Remote in Tech list - <AUTHOR> https://remoteintech.company <comment><AUTHOR> Remote In Tech is a list of companies who hire remote people. This started as a GitHub repository and is now going to be much more.

A Hacktoberfest project</comment>


Google goes dark for 2 minutes - <AUTHOR> http://www.theregister.co.uk/2013/08/17/google_outage/

<comment><USER2> As usual, The Onion predicted this (almost): [http://www.theonion.com/video/google-shuts-down-gmail-for- tw...](http://www.theonion.com/video/google-shuts-down-gmail-for-two-hours-to- show-its,27610/)

<comment><USER3> I was just going to say this article read like an onion story...

</comment></comment><comment><USER4> ...probably some bot-net-master out there rubbing his hands together going 'ok, well that proves the cyber-weapon works... now time to find some paying customers :)'

</comment><comment><USER5> If you're wondering how Google along can account for 40% of all internet traffic, the answer is YouTube. Video is well over half of traffic, and YouTube has the lion's share.

</comment><comment><USER6> Can someone tell me, technically, how _every_ service Google has to offer can simultaneously be blacked out?

<comment><USER7> I'm guessing it had something to do with DNS.

If you think about it, the one thing that connects all the tubes together is their addresses. If the postal service goes down, it doesn't matter how clearly you put the zip code on the envelope.

<comment><USER8> The DNS service was definitely down at the time. One of my co-workers was on a different network using different DNS servers from the rest of us who were on Google's public DNS servers. He had full connecvitity, the rest of us could only use services we had the IP addresses cached locally.

</comment></comment></comment><comment><USER9> What I find amazing is google recovered so quickly. Extended outages are often caused by the horde of systems all attempting to reconnect at once.

<comment><USER10> At which point all the traffic causes another outage so they can't reconnect, so they timeout for a fixed amount of time and then try back again all at the same time...

</comment></comment><comment><USER11> I find it kind of disturbing how much effect it had on overall traffic. It makes me think, "What if Google did just drop off the face of the Earth?" How much of an effect would it have globally?

...Or am I just reading too far into it?

<comment><USER12> Reading too much into it. Users would adapt, moving to other services and traffic volumes would return to approximately "normal" levels.

<comment><USER13> it's actually an interesting scenario. Let's say Google search went away. What services would people flock to, and would they be able to stay up?

I guess Bing is the next closest, and it would probably go down.

<comment><USER14> I think more people (meaning non-geeks, non-tech-savvy) would still think of Yahoo before Bing for search and Google-esque services wouldn't they? I know among my family and non-geek friends they would. Some still use Yahoo mail and Yahoo news.

</comment></comment></comment></comment><comment><USER15> I believe it was time travel; possibly an irate developer trying to get back his 20% time.

</comment><comment><USER16> DNS lookup/ICMP was working for me, telnet port 80/443 was just timing out. A weird few minutes for sure. Makes me wonder is something happened with their load balancers. Very strange. Can't wait for more details.

</comment><comment><USER17> Internet Kill Switch? [http://www.huffingtonpost.com/news/internet-kill- switch-obam...](http://www.huffingtonpost.com/news/internet-kill-switch-obama)

</comment><comment><USER18> I was watching ping www.google.com when it came back to life! now I know it was a real outage and not that crappy hub in my nortel.

</comment><comment><USER19> Looks like DNS issue. Intersting read [http://www.webdigi.co.uk/blog/2013/a-single-kill-switch- for-...](http://www.webdigi.co.uk/blog/2013/a-single-kill-switch-for-90-of- the-top-ten-websites/)

</comment><comment><USER20> Maybe Google thought it was Earth Hour for two minutes?</comment>