It's Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013) - <AUTHOR> http://www.27months.com/2013/10/its-always-sunny-in-iceland-or-how-i-nsa-proofed-my-email/ <comment><USER2> Hi, Iceland checking in here. While we appreciate you hosting here, we're by no means any safer than other countries now. First I'll note that this posting is from 2013, so quite a bit has changed here since that time. IMMI (immi.is) is still being hashed out in parliaments and making slow progress. Meanwhile we've had some particularly ridiculous public spectacles regarding ppl hosting data here in Iceland thinking it was safe. Here's a few:

Silk Road Iceland [http://www.wired.com/2014/09/the-fbi-finally-says-how-it- leg...](http://www.wired.com/2014/09/the-fbi-finally-says-how-it-legally- pinpointed-silk-roads-server/)

ISIS domain name take down [http://english.alarabiya.net/en/media/digital/2014/10/18/In-...](http://english.alarabiya.net/en/media/digital/2014/10/18/In- Iceland-s-freedom-of-expression-ISIS-propaganda-crushed.html)

Iceland ISP's block TPB [http://grapevine.is/news/2015/09/16/icelandic-isps- will-bloc...](http://grapevine.is/news/2015/09/16/icelandic-isps-will-block- access-to-pirate-bay-and-deildu/)

Iceland BGP route attack [http://www.internetsociety.org/deploy360/blog/2014/02/bgp- hi...](http://www.internetsociety.org/deploy360/blog/2014/02/bgp-hijacking-in- iceland-belarus-shows-increased-need-for-bgp-security/)

Rememeber that ashley madison hack? our prime minister had credentials on it! [http://icelandmag.visir.is/article/icelandic-minister- financ...](http://icelandmag.visir.is/article/icelandic-minister-finance- registered-ashley-madison-icehot1)

Iceland seeks to ban porn [http://www.theguardian.com/world/2013/feb/25/iceland- seeks-i...](http://www.theguardian.com/world/2013/feb/25/iceland-seeks- internet-pornography-ban)

I won't even get into our limited internet connectivity and resulting high IP transit rates. I'm not saying don't host here in Iceland, but do some research first.

<comment><USER3> Also from Iceland; can confirm that the Icelandic govt. has taken a 180 on online civil liberties and privacy since the early days of the IMMI, which also never really made it into law.

<comment><USER2> Well, it goes both ways with that one, the PPI (full disclosure here, I'm one of the founders) is keeping them on constant scrutiny which is good, imho. IMMI status is a mixed bag, the parliamentary committee is still convened however. As of todays date 5 out of 13 law proposals have succeeded. Like all law proposals it takes time and political will.

</comment></comment></comment><comment><USER4> I think the author is extremely misguided.

1) Iceland is not a safe harbor from the NSA. Iceland is fully within the U.S. orbit. Iceland, actually does not maintain a standing army and its defense is the responsibility of the U.S. In addition, banking is a significant portion of Iceland's economy, and thus vulnerable to the U.S. cutting of access to SWIFT. Basically, if the U.S. really wants something from Iceland, it will be able to get it.

2) By making the front page of HN, the author is sure to have been noticed by somebody at the NSA. Because, the NSA has pretty broad authorizations for intercepting and decrypting foreign messages (that is actually why they exist), there is a very good chance that they are probably reading the author's email right now. If the email server had been in the U.S., there would have been at least some political/legal considerations about reading the email. By being in Iceland, there are none, and I am sure the author's email presented a very easy challenge (and probably is the butt of an inside joke about how this naive person thought their setup was NSA-proof)

<comment><USER5> > Iceland is not a safe harbor from the NSA

A lot of crypto nerds have this fantasy of "NSA-proofing" themselves or their information.

That's near impossible. If the NSA cares enough about someone specifically to use, say, tools from the TAO catalog, they will be able to find out what they want to know. (See [http://www.spiegel.de/international/world/a-941262.html](http://www.spiegel.de/international/world/a-941262.html) ). The FBI also has powerful targeted surveillance tools.

Targeted surveillance is often legitimate, anyway. Authorities have suspicion that someone is, say, planning an attack or running a cartel, or someone is a suspect in murder case. It's good that powerful tool exist to find the truth.

I think the right goal is to stop _mass surveillance_. Mass surveillance the continuous monitoring of whole populations at a time. Mass surveillance is illegitimate and a threat to liberal democracy.

That leads to a totally different approach. Moving your own personal email server to Iceland does nothing at all to prevent mass surveillance (and honestly doesn't protect you from targeted surveillance either, as others have pointed out).

To roll back mass surveillance, both in the US and around the world, we need tools that are clean and simple and easy to use, even for people who have never heard of a "key" or a "cipher" and don't care what those are. We need to make things like end-to-end encryption, forward secrecy, and metadata security available by default.

Signal and WhatsApp are the biggest success stories so far. Moxie is the boss.

</comment></comment><comment><USER6> How do you prevent mail that you send from going to recipients whose mail is not hosted in your magical Icelandic data bunker?

End of the day, all of this stuff is nonsense. The only thing standing between your stuff and unauthorized access is your contract and the actions of the third party running the datacenter. The only way you can exert any meaningful control over your data is to host it yourself... as in have computers and storage that hold your stuff running in your home.

Even then, making a statement like "I NSA-Proofed my email" is either self- delusional or clueless.

<comment><USER7> Then you have to make sure all your hardware wasn't Carly Fiorina'd through an NSA shipment interception.

</comment></comment><comment><USER8> The idea that putting your server in Iceland somehow makes it NSA-proof seems questionable. If anything, Google's servers in the US are likely better protected both legally and by Google's resources.

The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police.

<comment><USER9> > The FBI had little trouble getting access to Robert Ulbricht's servers, with > the help of the Reykjavik Metropolitan Police.

Notably in that case, the Icelandic police did not even seek a court order, as they didn't need to since the server was owned by a US citizen. They just got a letter from the US police and decided to perform a raid. So you're absolutely right.

I'd question the technical compentency of anyone who would claim to have "NSA- proofed" anything without expounding further on the threat model.

<comment><USER10> Europe is a safer place than Iceland to host data and it will be interesting to watch how the "Microsoft" case plays out in the Irish courts over the coming months.

<comment><USER9> Safer for whom, and from whom?

If your adversary is the NSA, you need to determine how interested they are in you. If you're on the shortlist, I doubt any national borders or legal frameworks will protect you - TAO doesn't respect them.

If it's law enforcement like in the Ulbricht case, some countries may have stricter requirements for a local search warrant to be issued. But I doubt you can make such a sweeping generalisation about "europe".

</comment></comment></comment></comment><comment><USER11> "Server software and all packages are open source."

From what source and how were they validated, both from a secure checksum perspective and code audit? Was a full application pen-test done on each package after installation and configuration? Additionally, what controls are running server-side to audit memory execution and modifications on disk? Is Tripwire being used as an example? How about Wireshark? Is it being used to monitor all traffic from the host NICs with alerts sent out if it spots any non-encrypted traffic or traffic to IP addresses not explicitly white-listed? How about ongoing monitoring for zero-days for each of the packages used?

Nothing I read in the article leads me to believe there is any NSA proofing here whatsoever. Making something secure isn't about finding a "secure" data center and hosting a solution yourself. In fact, self hosted solutions can be some of the toughest to secure because you must have a broad and deep knowledge of security as it relates to the entire environment and then keep up with package changes in a way which results in auditing each and every future change. Honestly, no one has time for that and even if secure at x point in time, it won't be at y point, say when a Hartbleed level vuln is announced for a package used while the author is on vacation and can't reach his servers to appropriately mitigate.

</comment><comment><USER12> SMTP authentication is broken. Don't rely on it for confidentiality. There is no cert-pinning RFC for STARTTLS afaik, so stripping attacks on STARTTLS are still possible. And, by far the most important: most of the world uses a large E-mail provider. So, if you send a mail to someone using Gmail/Yahoo Mail/Outlook, your "confidential" data is leaked. And don't forget metadata leakage. Metadata is _by far_ more interesting for the NSA than then the content of your mails.

I use Gmail + GPG (almost nobody uses GPG) in Thunderbird. When I truly need confidentiality over internet communication, I use Signal.

SMTP is just plain broken in a sense of security.

</comment><comment><USER13> No, e-mail was not originally designed for you to host it yourself. E-mail was designed for a system operator to maintain a server for many other users.

Aside from the many maintenance problems of hosting e-mail yourself, the biggest problem here is the distance: Iceland is far away from the user in the USA. Latency doesn't matter so much for e-mail, but connectivity does, and if there's a problem with a transatlantic link (which does happen on occasion) there goes your most important communications medium.

Finally, the biggest fallacy with e-mail is that it is ever secure. It's never secure. The mail on your client devices is unencrypted, and if you ever reply, forward, or send an e-mail to anyone it's very likely for the whole thread go over an unencrypted relay and be stored temporarily, not to mention the logs, and the unencrypted storage on the destination, etc.

Your physical mail isn't secure in the postal service, and neither is your virtual mail in the e-mail service.

</comment><comment><USER14> In marketing speak "NSA proof" is the new post-Snowden[1] "military grade encryption"

Email is hard to secure and identified personal accounts are difficult to keep private.

The "better" answer is to do what those on Wall St figured out after various scandals and Sarbanes-Oxley - if you want something to remain private keep it off email.

[1] Sorry.

<comment><USER15> >Email is hard to secure

Email is trivial to secure. Just need to be able to exchange OOB one RSA key.

But being able to securely communicate with "firstname.lastname@example.com" don't give you much when LEO knows that you are communicating with each other.

Nowadays you need security, anonymity and usability - which are often with contradicting requirements.

<comment><USER14> We're talking past the difference in email, the protocol, that _can be_ secured - and email, the worldwide communication network, that is largely insecure[1] [2]

[1] [https://www.nicta.com.au/pub- download/full/8943/](https://www.nicta.com.au/pub-download/full/8943/)

[2] [https://www.google.com/transparencyreport/userdatarequests/?...](https://www.google.com/transparencyreport/userdatarequests/?hl=en)

</comment></comment></comment><comment><USER16> Seems like a pretty superficial take on the topic. In particular:

\- No mention of reputation, the hardest part of self-hosting email

\- Advises using StartSSL, so he hasn't purged his trust store of root CAs under the NSA's control (given StuxNet and the relationship between the US and Israel, Israel isn't a country that's free from NSA influence)

</comment><comment><USER17> > ... on vastly more secure servers with every connection under SSL/TLS for > end-to-end encryption.

I wish people would stop using the term "end-to-end encryption" to simply mean using encrypted channels. It really does confuse people who have heard that end-to-end is great, but don't actually understand/appreciate the differences between the two.

</comment><comment><USER18> The NSA used to certify systems as highly assured by exhaustively analyzing and pentesting them for years. Had to beat their pentesters to be approved. Then, they'd try to restrict their export. It was a whole system process that applied from bottom to top to minimize complexity, reduce leaks, and enforce security policies. Here's a description of a superset of that I used in private work:

[http://pastebin.com/y3PufJ0V](http://pastebin.com/y3PufJ0V)

So, let's just compare the author's email to that list. A strong TCB at OS/firmware/trusted-component level like with EROS, INTEGRITY-178B, or GenodeOS? Nope. Components or apps made in a manner to reduce complexity, be type/memory safe, use static analysis, analyzed for covert channels, and so on? Probably not given names I saw. Do the underlying projects use a subversion-resistant development process and SCM security that assumes a number of them are malicious w/ independent auditing? Virtually nobody does that despite Myers (1980) showing subversion the most powerful attack. Has the crypto and its implementation been tested by experts in that? Don't know. Has the overall system and configuration been pentested by TAO-grade hackers? No.

So, it's far from NSA-proof as the underlying properties necessary for NSA- proof operation don't exist here. They exist only in a handful of defense- oriented products with some traits existing in other security-focused projects (esp in academia). This, at best, will slow down nation state attackers who are probably uninterested in his system anyway. A good configuration and 0-day mitigation tech might make this build survive typical blackhats and snoops. A real, threat profile along with more reasonable goal.

Won't stop the NSA, though. You can put money on that. Assume it's true every time you hear it, too. You can't stop nation-state attackers until you know how (see framework) then apply that to every level and user/machine interfaces. Even then, it might work and might just be an obstacle. So, include monitoring & logging on top of it.

</comment><comment><USER19> A former coworker of mine has made a lot of contributions to a project called sovereign: [https://github.com/sovereign/sovereign](https://github.com/sovereign/sovereign)

> "Sovereign is a set of Ansible playbooks that you can use to build and > maintain your own personal cloud based entirely on open source software, so > you're in control."

It makes use of all the techniques described in the article for e-mail, including dovecot/postfix, DKIM, encfs.

I decided to give it a try a few weeks ago. I went and bought a $10/month linode instance and a domain name. By the end of the day I could send and receive e-mail. letsencrypt was a big help here, because it allowed me to get TLS for free.

I always assumed that hosting your own e-mail was virtually impossible but my friend has been hosting his personal e-mail and the e-mail for his company for around two years now, with linode and sovereign. He says that the server requires maintenance about once every six months.

This doesn't really protect you from the three-letter orgs, as other commenters here have mentioned. But it does put you in control of your own data, and prevents analytics of your own inbox by corporations like google.

</comment><comment><USER20> I'm really surprised this could be NSA-Proofed without the use of true end-to- end encryption tech. There is no mention of PGP for instance.

Using PGP (with a locally stored private key) is one of the best option I'm aware of to secure emails and continue to use email cloud clients like gmail or yahoo.

The only caveat is that you loose search which is one of the requirements in the article.

<comment><USER18> I have doubts about PGP but GPG is a great choice. One of best given it's specifically mentioned in the Snowden leaks as a problem for NSA. Only a few tech like that, which didn't include the PGP/GPG alternatives everyone was crowing about. Apparently they weren't much of a problem for NSA. ;)

</comment></comment><comment><USER21> On the other hand,

> _Google has most of my email because it has all of yours_

[https://news.ycombinator.com/item?id=7731022](https://news.ycombinator.com/item?id=7731022)

[https://news.ycombinator.com/item?id=10229928](https://news.ycombinator.com/item?id=10229928)

</comment><comment><USER22> My biggest gripe is not the server (I run my own), it's the client(s). Currently I use Trojita on the desktop and K-9 on my mobile. I never managed to get PGP to play with Trojita, so for signing/encrypting/decrypting I have Claws installed as well. Trojita often randomly hangs and needs to be killed. K-9 is functional, but is to mail what Gimp is to painting..

Mailpile (I'm a backer) might be interesting, but is still unstable and the future isn't certain for happy reasons (i.e. 'paternity leave'). Stumbled upon Whiteout from the references in the mailpile blog, only to learn that the company behind that effort is dead. No clue if or how this project will continue.

I regularly see (new) mail clients mocked as 'unnecessary', but I'm still waiting for a decent one. Mail as a medium works incredibly well for me, but it feels unpolished to use whereever I am.

<comment><USER23> I'm curious - have you ever used a text/curses based email client ? It's amazingly fast and you can forget all about browser security since you do it over SSH. It's an extremely efficient workflow (albeit with some hacks required to get modern functionality).

I switched to pine in ... 1993 ? I've never used anything else (except for brief stints of corporate email account and consulting, many years ago).

You'll note that in the "screenshots from famous developers"[1] that Brian Kernighan (Unix legend, the K in K&R and AWK) is using alpine in his 2015 screenshot...

[1] [https://anders.unix.se/2015/12/10/screenshots-from- developer...](https://anders.unix.se/2015/12/10/screenshots-from-developers-- 2002-vs.-2015/)

<comment><USER22> Yes. I was using (al)pine for a while. It's bearable, okay even.

But I guess I don't see how you could turn that into a 'mobile' client. For the time I used pine I was ssh-ing into a box of mine for most of the day, while I was in front of a computer. I didn't care much about mail notifications on the go.

Now I do. If there's some (reliable! I don't care about the initial one-off effort) way to make that work with emails on the go, I'd be glad to learn about that.

<comment><USER24> _But I guess I don 't see how you could turn that into a 'mobile' client_

Solution to this is to remember what the purpose of email actually is. It's supposed to be asynchronous communication, with the expectation that it may be checked, at most, 1-3 times daily. If you need communication immediately and in any location, instant messaging covers that use case much better.

<comment><USER22> We have to disagree about the purpose here.

For me mail is for async, coherent exchanges. IM is not a replacement: It is usually a conversation, usually short and short-lived and synchronous.

Async doesn't have to imply that I don't get a notification about your mail. It just means that I probably won't answer right away - or at least on my time.

Anyway: Mail plus ~instant~ notification is a thing for me and I don't want to give that up.

</comment></comment></comment></comment></comment><comment><USER23> In his "overview of features" he is missing one very interesting and valuable security gain when you host your own mail server:

\- local mail delivery does not traverse any network

So if you are user A on a mailserver and your wife/friend/uncle is user B, when you send mail to them that mail is simply a local copy operation (provided they don't POP or IMAP it to a local mailtool).

That's pretty interesting, I think.

It may interest you to know that no piece of rsync.net company email has _ever_ traversed a network - everyone logs in via SSH and uses (al)pine and all internal mail is just local copy ...

<comment><USER25> Well, its going over ssh which uses networking. If you're viewing the email on a networked terminal connection, its still traversing a network as it displays it in pine and that data gets sent over ssh. I don't see why using ssh suddenly makes you immune to these concerns. This is no different than using a rich webmail client over SSL.

<comment><USER26> Maybe SSH has better cryptographic properties (say, around forward secrecy and key management) than the common options for delivering e-mail remotely over the network. (You could choose the key types and key lengths yourself and choose how authentication keys are stored and when they need to be changed, and you don't have to rely on an external naming or CA mechanism if you distribute fingerprints and authentication keys directly to the users.)

</comment></comment></comment><comment><USER27> This is a post from 2013, any pointer as to how this could be improved in this post-CISA world? The part about the location seems to still be relevant.

As for spooky23, while most your email recipients might be NSA accessible, maybe not _all_ of them are. If you manage to keep your email account confidential, then peeping toms only have a partial view of your social graph (the part that is in your compromised correspondent inbox).

</comment><comment><USER28> Most of the article is about his host in iceland. That can't be working out very well for him these days:

[https://www.greenqloud.com/greenqlouds-public-cloud- services...](https://www.greenqloud.com/greenqlouds-public-cloud-services- close-but-our-qstack-future-is-bright/)

Thor is no more

<comment><USER2> Greenqloud as a VPS provider is no more Thor data centre run by Advania is still alive and well here. We also have a few more VPS providers like Orange, 1984, Icehost and Datacell.

</comment></comment><comment><USER29> Maybe you would like to fix your crypto a bit too? [https://starttls.info/check/27months.com](https://starttls.info/check/27months.com)

<comment><USER22> So, your link lead me down a rabbit hole to improve my score on a random site, until I came here [1] and read the Postfix opinion on starttls.info.

For anyone else trying to 'fix' unbroken things: Hold off for a minute, read the link here first.

1: [http://postfix.1071664.n5.nabble.com/Disabling-Anonymous- Dif...](http://postfix.1071664.n5.nabble.com/Disabling-Anonymous-Diffie- Hellman-tp67965p67978.html)

</comment></comment><comment><USER30> No advantage hosting in Iceland. Why not just encrypt all data on the VPS? If the VPS provider was required to provide a copy of the VPS, it would be useless to requestor.

<comment><USER31> Encrypting data _on_ a VPS, for example using LUKS encrypted volumes, does not provide any meaningful security if the host can take a memory dump of the running machine.

<comment><USER32> And just to clarify: taking a memory dump of a virtual machine is trivial. Just click on the 'snapshot' button.

On a physical machine, you have to plug in a dumping device into a DMA-capable port, cool down the RAM and move it to another machine as fast as possible, or reset the machine and boot it from another medium (hoping the BIOS didn't override anything useful). In many jurisdictions you also have better protections in regards to required warrants and such for your own hardware.

</comment></comment></comment><comment><USER33> Why isn't Switzerland on that list of "safe countries" ?

<comment><USER24> Ever since .ch violated their own bank secrecy laws to make Uncle Sam happy, they are the same as everyone else in their insatiable quest to please their American masters.

</comment></comment><comment><USER34> I feel like this title is kind of like waving a red flag in front of a bull.

<comment><USER35> You can do so with impunity, as a flea.

</comment></comment><comment><USER36> Adorable.</comment>


Ask HN: What web hosting do you use? - <AUTHOR> I am looking for fast, cheap hosting provider. <comment><USER2> I use hostgator for my business and it's ok. I bought a 5 year plan so it was quite expensive but I don't know what their month to month plans cost.

If you are looking for fast, cheap hosting you should look at the free tiers of Azure, AWS, etc. Depending on how much traffic you get you should be able to host for free for at least a small period of time.

</comment><comment><USER3> I think that it really depends on what you're going to be doing. database backend? Some small VPS plans might not work. Lots of traffic? same issue.

What are you looking at doing?

</comment><comment><USER4> +1 for AWS (you can do it even cheaper with an S3 public site), but if you're not looking to manage the server(s), check out 1and1.

</comment><comment><USER5> Do you need full access or just simple web hosting? I run a few VPS' on OVH and never had any problems.

</comment><comment><USER6> Digital Ocean (vps)

</comment><comment><USER7> t2.nano on aws is under $5 a month</comment>


Ask HN: Do you expose your Kubernetes API servers publicly? - <AUTHOR> <comment><USER2> Hell no, lock that down hard

</comment><comment><USER3> Anything exposed publicly should have been done so intentionally through an ingress.</comment>


The Reassuring Science of Salt Consumption - <AUTHOR> http://www.bloomberg.com/view/articles/2016-06-06/the-reassuring-science-of-salt-consumption <comment><USER2> The entire field of research around salt is a colossal fuckup, for a fairly simple reason: sweat is salty. If you sweat, due to exercise or high temperatures, you lose about 1g/L of sodium. So right off the bat, all the research that's trying to find a population-wide correct amount of sodium to eat is on a wrong track, because there's no such thing.

But it's even worse, because most of the research doesn't measure the amount of sodium people take in through food, it measures the amount of sodium they lose in urine. This isn't their intake, it's what's left after losses, so it's confounded by exercise.

And it's even worse than _that_ , because while the actual studies indicate that there's no benefit from cutting salt intake, some high-status organizations once said there was, and are acting as though they can't take it back without losing face.

The overall result is that there are a bunch of people shouting "less salt!" and a bunch of people shouting "the same amount of salt!" and no one has any model of how much salt they actually need, so they occasionally end up deficient.

<comment><USER3> > The overall result is that there are a bunch of people shouting "less salt!" > and a bunch of people shouting "the same amount of salt!" and no one has any > model of how much salt they actually need, so they occasionally end up > deficient.

Dr. Brewer's pregnancy diet calls for as much salt as the patient wants - "salt to taste". One of the things I had to help my girlfriend with was getting her over her salt phobia - she definitely wasn't getting enough.

There is a disconnect between medical science and the actual findings of physiology. Medical students are indoctrinated with lots of facts and a little dogma. The incorrect ideas stunts the progress of their field.

Veterinarians know to give animals as much salt as they want.

<comment><USER4> Humans need salt licks

</comment></comment></comment><comment><USER5> I always find it fascinating how much nutrition as a science is clearly in its infancy. It's true that rigorous science in medicine is relatively recent compared to other fields of study but in nutrition we're still seeing major changes to the consensus and guidelines.

My favourite example is probably cholesterol. Nearly everyone instinctively knows that eating too much cholesterol will raise your cholesterol levels and puts you at risk of heart disease. Don't eat too many eggs or you'll go to an early death. The thing is, that view, which has been informed from the advice from authorities over the past few decades, is completely wrong.

As the panel determining the Dietary Guidelines for Americans concluded in 2014 - "Cholesterol is not considered a nutrient of concern for overconsumption," and as a result, warnings about cholesterol has since been removed from the guidelines.

Obviously the link between dietary and blood cholesterol is more complex than initially thought but it's still staggering to me that such a simple recommendation could have been so wrong and how government guidelines can lag the scientific consensus. It's interesting to see that much the same can be applied to salt and the solution is the same. Eat a variety of food and try to avoid as much processed food as possible.

<comment><USER3> > Eat a variety of food and try to avoid as much processed food as possible.

"Vegetable oil" is the most processed of all food ingredients. Almost all cheap vegetable oils are extracted with solvents (Hexane) and steam-treated to remove odors and lighten the color.

The only appropriate use for these oils is as biodiesel.

Coconut oil can be refined to safely remove odors without causing the oil itself to go rancid. [1]

[1] [https://www.mountainroseherbs.com/products/coconut-oil- refin...](https://www.mountainroseherbs.com/products/coconut-oil- refined/profile)

<comment><USER6> Hexane is used as the solvent and it's evaporated away after oil extraction, leaving behind oil. What's the issue here?

</comment></comment></comment><comment><USER7> One thing easily overlooked is that recommendations for sodium intake depend on individual considerations. Sodium restriction may be important in conditions other than hypertension.

For example, people who excrete too much urinary calcium are at risk of kidney stones and bone loss. Reducing salt consumption is usually necessary to decrease calcium depletion and prevent bad outcomes.

As I've observed it, the chances of people getting too much dietary sodium far exceeds getting too little. The FDA's idea to reduce sodium content of foods is most likely a constructive step forward.

</comment><comment><USER8> I always wonder why things that taste salty don't seem to have that much sodium. I was eating a bag of salt and vinager chips and could just taste all the salt. I figured I'd be getting 150% of my dv of sodium but no only 9%.

<comment><USER9> I couldn't find it wth a quick search but I remember an article about how the food industry was voluntarily reducing the amount of salt in things. One interesting part was reddenbocker lowering salt in popcorn. They did this by realizing that it was actually the amount of surface area of salt on your tongue not the mass of the salt that mattered. They had therefore gone to ultra-fine ground salt and had reduced the total salt content of their popcorn by like 70%. Wish I could find it but there were some interesting things by googing "food industry salt reduction".

<comment><USER10> Similarly the orange dust on highly-flavored snack chips is superfine, to give an extreme blast of flavor for very little ingredient investment.

<comment><USER9> Also for maximum finger pore saturation!

<comment><USER10> One day we'll learn it is a health hazard, like talcum powder.</comment></comment></comment></comment></comment>


What it was like to fly the baddest airplane - <AUTHOR> https://arstechnica.com/science/2019/09/what-it-was-like-to-fly-the-baddest-airplane-the-world-has-ever-known/ <comment><USER2> Definitely worth your trip to Dayton Ohio at the National Museum of the Air Force to see this plane in person. It's on the floor so you can see it up close. I believe the other one at the Air and Space Museum is hung above.

The Air Force Museum is just an all around one of the best aviation museums to go anyway.

<comment><USER3> Yup. The Air Force Museum is probably one of the best aviation museums anywhere in the world, perhaps second only to the Smithsonian. So many unique, one of a kind aircraft are preserved there.

If you're an aviation geek who likes to linger and read, plan on two days. I went a couple years ago. I got there when they opened and spent the whole day there. I had to blitz through the last hanger because they were closing and I didn't even get to see any of the outdoors exhibits or a movie.

</comment></comment><comment><USER4> I haven't been there in several years, but Norton Sales[1], an aerospace surplus shop in North Hollywood, used to have a couple X-15 engines for sale[2][3].

1\. [http://www.nortonsalesinc.com](http://www.nortonsalesinc.com) 2\. [https://www.flickr.com/photos/wallofhair/4595764150/in/photo...](https://www.flickr.com/photos/wallofhair/4595764150/in/photolist-7QQa2N-7ULjUL-7ULmJN-83HWJi-817uyW) 3\. [http://www.wendingourway.com/space/norton.htm](http://www.wendingourway.com/space/norton.htm)

<comment><USER5> wow, thanks for sharing. A couple years ago I was curious about where to find surplus, old/retro gauges, panels, etc... a didn't find much. I had the idea to build some retro cockpit-like setup into a tree house for my kids. There's no pricing on their web-page, but this would be a treasure trove for something like that.

</comment></comment><comment><USER6> "Hey bud, we've got a new airplane for you to fly. Well, it's not really an airplane, its really more like a cockpit strapped to a rocket engine. Actually, it's more like a tiny cabin bolted to a super soaker of chemicals so explosive that we didn't bother to include an igniter.

It has some tiny wings for you to control it but we couldn't include any landing gear so we gave it some flimsy skids instead. We were hoping you would at least find them cute even if they aren't particularly useful.

We included a diaper in your pressure suit that will be helpful if you get scared. You also don't have to worry about taking off, but when you try to land please make sure that you descend at the right angle so that you don't accidentally take a joy ride to Alpha Centauri.

Please be careful with our flying bomb with tiny wings and cute little skids. While it may be just a cockpit strapped to a flamethrower, it still cost $999 million to build, so no dents, please and thank you."

Best regards,

Uncle Sam

<comment><USER7> fyi the first 20-so flights of the X-15 burned LOX/alcohol, similar to the X-1 or V-2. Later flights burned LOX/ammonia. I'm not sure about the ammonia, but LOX/alcohol is not hypergolic.

</comment></comment><comment><USER8> The X-15 has always intrigued me, even more so than the SR-71 as a kid, when I found out that it could travel at nearly Mach 7. That is more than twice as fast as a standard .308 bullet muzzle velocity.

<comment><USER9> Wow, see now that made the speed more graspable for me (hunt with a .308), cheers mate!

</comment></comment><comment><USER10> > Three decades later, he still misses it like hell

I can't imagine what it must be like to go to space as a profession, and then need to leave or retire. A bittersweet thing, to be sure.

<comment><USER11> Would you like to read some moving fiction about it?

_Phases of Gravity_ by Dan Simmons takes it head-on with an astronaut whose days flying are over.

More obliquely a national loss of space capability is taken on by Norman Spinrad in _Russian Spring_.

Both great reads, and sad.

</comment></comment><comment><USER12> Not the same plane, but this reminded me of the amusing "my planes faster than yours" ground speed check of the Blackbird pilot.

[https://oppositelock.kinja.com/favorite- sr-71-story-10791270...](https://oppositelock.kinja.com/favorite- sr-71-story-1079127041/amp)

</comment><comment><USER13> This comes from place of ignorance, so please be kind: why "speed record" is considered Mach 6.2 when ISS ground speed is like Mach 22? There are humans there, they got up to speed and regularly come back. How it is different than going to similar velocities in thin atmospheres over 50km?

<comment><USER14> > the world record for speed by a piloted, powered aircraft

It literally says it right there. The ISS is not a piloted, powered aircraft. Also it was Mach 6.7, not 6.2.

Incidentally, the speed record for a crewed vehicle was set by Apollo 10 at 11.08 km/s - almost half as fast again as the ISS.

<comment><USER15> > It literally says it right there. The ISS is not a piloted, powered > aircraft. Also it was Mach 6.7, not 6.2.

But aren't the Soyuz capsules that dock with the ISS piloted and powered ?

<comment><USER16> I would assume that Soyuz capsules aren't considered aircraft. They don't really fly, per se, they get launched on a rocket and then fall like a rock back to earth.

You could make a stronger argument for the Space Shuttle, which re-enters at about Mach 25, IIRC, and is gliding. But it's not doing so under power.

<comment><USER17> > Soyuz capsules aren't considered aircraft

While I suspect you're right, Soyuz capsules do use aerodynamic lift to control descent rate and steer to the landing site. In some ways they are very, very (very) inefficient gliders.

<comment><USER18> I'd expect the definition of a powered aircraft to include the ability to maintain some given flight altitude and speed for some appreciable amount of time.

It is possible to do something sort of like this in a space capsule returning to Earth, where you muck up your entry vector and come in at too shallow an angle. You can then (depending on the circumstances) bounce off the atmosphere, and gain altitude briefly. And then you probably come back in the atmosphere on too steep an angle, and die due to g-load or overheating.

</comment></comment></comment></comment></comment></comment><comment><USER19> The X-15 was awsome, and "bad" is being used in the informal North American sense that means "good" or "excellent".

If you want some planes that live up to the other sense of "bad", here is an amusing article about several planes you might enjoy [1].

[1] [https://www.cracked.com/article_18839_7-planes-perfectly- des...](https://www.cracked.com/article_18839_7-planes-perfectly-designed-to- kill-people-flying-them.html)

</comment><comment><USER20> Was fun making X-15 model rocket kits as a kid

</comment><comment><USER21> Okay, the X-15 was pretty great, but speed alone doesn't make it "the baddest airplane the world has ever known". When I read the title, I immediately, unhesitatingly assumed it would be this: [https://en.wikipedia.org/wiki/Gee_Bee_Model_R](https://en.wikipedia.org/wiki/Gee_Bee_Model_R).

<comment><USER22> Yeah, calling the X-15 the most badass plane ever is a bit silly. If it counts, then why isn't the Space Shuttle "the most badass plane"? It went faster & higher, after all.

Anyway, I'd assumed it was going to be the SR-71, but yours looks awesome & I enjoyed the article either way!

</comment></comment><comment><USER23> From the article:

> "I honestly can say I was so terribly focused on flying those profiles as > closely as possible that I didn't really have time to look out the window > and see how pretty it was,"

Joe Engle, describing the X-15

</comment><comment><USER24> > And, remarkably, it also went on to fly into space more than a dozen times.

Only twice, according to the standard everyone else uses. Saying the X-15 has been to space a dozen times is like weighing yourself in kilograms to make the number smaller. Certainly helps the ego of those Air Force pilots, and Blue Origin, though!

</comment><comment><USER25> didn't see this in the article but I recall an x-15 story I read as a kid. seems after a landing the plane was being inspected and engineers noticed a burn hole that took out part of a real stabilizer and all the way through the airframe and fuel tank. Fortunately, the fuel tank was already empty when it happened.

the story may just be X-15 folklore but my child self was impressed haha

<comment><USER26> This was on flight 188. Shockwaves from a scramjet mockup impinged on the ventral stabilizer and local heating caused a burn through.

</comment></comment><comment><USER27> I'm in awe of the balls that those guys had in that era--to strap one of those beasts to their ass. How surreal that.

</comment><comment><USER28> An example of a reusable rocket vehicle. Some versions had throwaway extra propellant tanks.

That road was not really taken until now potentially with SpaceX. (The Space Shuttle had design / political issues that made it operationally very expensive.)

</comment><comment><USER29> The s/baddest/worst experience ever?

<comment><USER30> No, in this case "bad" is a synonym of "rad".

</comment></comment><comment><USER31> Made me want to read the "right stuff"

<comment><USER32> Or watch _First Man_ which opens with Neil Armstrong having an interesting flight in the X-15.

<comment><USER33> There's also an old movie called "X-15" which I enjoyed a lot as a kid.

<comment><USER32> As a young kid here in the UK I had a Ladybird book with a picture of an X-15 - almost 50 years later I can still remember my fascination with that machine.

99% Certain it was this one:

[https://www.arranalexander.co.uk/exploring-space-vintage- lad...](https://www.arranalexander.co.uk/exploring-space-vintage-ladybird- book-achievements-series-601-first-edition-dust-cover-1964-2513-p.asp)

Now I have to find one!

</comment></comment></comment></comment><comment><USER34> This is hilarious

</comment><comment><USER35> Guinness World Records recognized NASA's X-43A scramjet with a new world speed record for a jet-powered aircraft - Mach 9.6, or nearly 7,000 mph.

<comment><USER36> Unmanned.

<comment><USER37> The concept of both piloted and powered seems to be really elusive.</comment></comment></comment>


Flash: An efficient and portable Web server (1999) [pdf] - <AUTHOR> http://www.cs.princeton.edu/~vivek/pubs/flash_usenix_99/flash.pdf

<comment><USER2> Googling around for the "Flash" server I also came across this page: [http://read.seas.harvard.edu/cs261/2011/debox.html#fn:1](http://read.seas.harvard.edu/cs261/2011/debox.html#fn:1)

</comment><comment><USER2> Interesting approach. using mmap + mincore is a bit racy; but about as good as you could do at the time.

I wonder how it compares to linux async io?

<comment><AUTHOR> > I wonder how it compares to linux async io?

Well there are two kinds - the POSIX API provided by glibc that just uses threads in userspace to offload IO (so its basically no different to running your own thread-pool), and the kernel provided io_* async routines that bypass the page cache so are of limited use.

FreeBSD provides better async block IO...with read completion events popping of the end of your kqueue alongside all your other events (socket, timers, signals etc).

I partially came across this article after researching the claims made in this nginx blog post [https://www.nginx.com/blog/thread-pools-boost- performance-9x...](https://www.nginx.com/blog/thread-pools-boost- performance-9x/). I thought it was cool that someone was delving deep into to the heart of the matter 15 years earlier.

</comment></comment><comment><USER3> Might be a good product, but the name "flash" is a little burnt regarding web and web-development.

<comment><USER4> Not in 1999.</comment></comment>


A simple breathing trick can change your life - <AUTHOR> https://www.bbc.com/reel/video/p08bl6tl/how-a-simple-breathing-trick-can-change-your-life <comment><USER2> Breathing (techniques) seems to be a semi-regular theme on HN, but I must admit I have never given it any more than skimming the articles.

Just curious - has anyone seen significant positive changes from introducing something like pranayama?

<comment><USER3> Hi,

I am 38 and started simple 5min meditation sessions through controlled breathing around 6 months ago just to "see what comes out of it".

I can't say it solved anything and I didn't start this in the middle of some personal crisis, in my opinion.

Still, I kept doing it and after a few sessions, I started reaching a state of mind that I enjoyed enough to keep repeating the exercise. Now I enjoy longer sessions (~10 minutes), either in the morning, or sometimes in the middle of the day while hidden somewhere secret at my office.

I wouldn't tell you to do it because "it will be awesome". Still, I thought it as a life experiences worth giving it a try, and I might actually enjoy it while not losing much.

I started simply: I put any device around me into silent mode, I set up a timer for 5 minutes on my wristwatch, then sit on the floor comfortably. I close my eyes and begin breathing just a little bit slower and deeper than I'd usually do. Here comes the challenge: I try to focus my attention on my respiration and to keep anything else out. You would be amazed at how many times your brain literally, and relentlessly, tries to focus your attention on anything else but your respiration. At the beginning, 5 minutes felt so long that I would even open my eyes to check whether I had actually started the timer...</comment></comment>


Shut up and ship - <AUTHOR> http://blog.jgc.org/2010/08/shut-up-and-ship.html

<comment><USER2> We are having reports of man-in-the-middle attacks on gmail on some ISP's. However, main focus of goverment is not spying on people and decrypting stuff, but to censor opposition websites.

Now, this is much more simple to do. They use l7 to drop https connections. Some of us who are lucky to have a vps and the simple knowledge of ssh stuff are able to use simple ssh tunnels.

However, the days in which we had protest, they simply dropped all encrypted connections, which included ssh tunnels.

I hope that little information gives you a little insight about whats going on here.

</comment><comment><USER3> Elliptic curve cryptography? That sounds a bit suspect - if its true, its _way_ more than is needed, since the Iranian government isn't going to have the capability of breaking something like 2048bit RSA, or 512bit Public Key.

Elliptic curve cryptography is a very interesting academic subject, but implementations are slow (so not so hot at being on all of your internet traffic). Given that its also of ludicrously unnecessary strength, either the author is misguided or lying.

<comment><USER4> 1\. The NSA says that RSA 2048 should only be used to protect information that need to remain secret for at most a few years. Nobody should be using RSA 2048 to protect information that could get then jailed/hurt/killed 5 or 10 years from now.

2\. The main advantage of ECC is that it is generally faster than RSA, especially for security levels that would require RSA keys larger than 2048 bits.

3\. It is meaningless at this time to say that ECC is unnecessarily strong compared to RSA. It is possible to match the security of ECC using RSA at every level. But, a linear increase in ECC key size requires the RSA key size to increase exponentially. For example, to match the strength of AES-128 you need a 256-bit ECC key or a 3072-bit RSA key, whereas to match the strength of AES-256 you need a 384-bit ECC key or a 15,360-bit RSA key.

<comment><USER5> Nobody should store information that could get them jailed/hurt/killed 5 or 10 years from now.

</comment></comment></comment><comment><USER6> There is absolutely no relation between the openness of a source code and its security.

Debian is open source and yet this bug was introduced and nobody made any remark:

<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166>

Windows is closed source and yet security researchers manage to study it and find security holes.

The reason for that is that you don't really need to the source code to find security holes, it's better, but it's far from being mandatory.

So what matters?

IMHO, a strong influence on the security of a solution:

\- Awareness (of security issues generally speaking)

which needs...

\- Competence (of the maker(s) and really you don't need the whole world, a couple of outstanding engineers is enough)

which needs...

\- Solid process (e.g. auditing, tests, validation, management)

which in turns needs...

\- Time

<comment><USER7> _There is absolutely no relation between the openness of a source code and its security_

I think that's overstating the case a tad.

Take a look again at JGC's very nice summary of the case in question:

 _Worryingly, Haystack's only 'technical' detail is the following: "We use state-of-the-art elliptic curve cryptography to ensure that these communications cannot be read." Fair enough, but frankly that means nothing. They could be using AES, or RSA, or pretty much any good algorithm and I still wouldn't care. Two reasons: their implementation might be rubbish and enable attacks or their cryptography might be irrelevant because another technique (traffic analysis?) might make breaking Haystack possible. After all, all the Iranian government needs is a list of people running the software._

In this specific case, having the source open would permit cryptography researchers (of sufficient skill and aptitude) to analyze whether or not Haystack is actually doing what it needs to do. Put another way: how do we know that Haystack isn't including a back door to capture all the information passing through their system, to sell on to the Iranian government for a hefty fee? We don't.

I'm not arguing that open source is inherently more secure than closed source; I'm just saying that in some specific cases, there are clear benefits to having the source available for inspection.

<comment><USER8> Elaborating on your point further: One of those "a little knowledge is a dangerous thing" errors that a security dilettante (like me!... though I'm at least far enough to know about this) can easily make is to assume that because you're using encryption, you're done. You're secure! Hooray!

But of course it's not that simple. You have to consider your entire attack surface, and when dealing with a government that doesn't care if it disappears you for no good reason, there's one hell of an attack surface here. (Note: I neither know nor for the purposes of this post care if Iran is that cavalier, what matters is the existence of governments that are, somewhere, sometime, which I consider pretty likely.) They don't have to prove you've sent subversive stuff behind that encryption. They don't even have to prove you're using the subversive software. They just have to _suspect_ it. Even if we assume the encrypted stuff is perfect, what other tells are there? Characteristic ports? Characteristic communication patterns? Characteristic headers? And even quick solutions to those problems, "oh, we make it look like HTTPS" can have problems of their own, ad infinitum. Are you doing HTTPS to sites that obviously don't serve a website? Are you trying to fake a website in a way easy to characterize? What will you do when the ISP straight-out bans websites on your home computer, making it impossible to mask your traffic that way? (And how suspicious is it for two home users to hit each other's "websites" every few seconds, anyhow?)

These are all issues that a government won't have a problem answering, and there are yet more that they won't have trouble answering. The hostiles here have it easier because their threshold for deciding they have enough information to act is very low. The only way anybody should feel even remotely confident about this is if it is reviewed. (Whereupon it'll probably be discovered to be impossible, IMHO, but that's for reviewers to figure out.)

</comment></comment></comment><comment><USER9> > Ship an open source version of your code and let's take a look at it. Let > the Iranian government have a look at it.

Skype is famous for being a black box.

<http://www.secdev.org/conf/skype_BHEU06.handout.pdf>

<comment><USER10> Skype is not promising to protect human rights.

</comment></comment><comment><USER11> many companies build up the hype before they ship. isn't that just marketing?

i call hypocrisy. jgrahamc is involved with causata: check out their website.

<http://www.causata.com/>

count the number of times you read:

"This has to change. Stay tuned for more details."

where are the products? what have they shipped?

<comment><AUTHOR> Causata shipped our software in January 2010. It's not something you can just download, but we would be happy to sell it to you.

<comment><USER11> which machine learning algorithms is causata shipping to customers? i could not find this (nor the fact you were shipping) from the causata website.

you wrote:

Alas, the Haystack web site has zero technical details.

the causata web site appears to be equally placed.

</comment></comment></comment><comment><USER12> On the subject of personal encryption I recently found some interesting plausible deniability software [1] in Phrack [2] for protection against "give us the password or you're going to jail" laws

Different passwords decrypt different plaintext from the same cyphertext

[1] <http://www.winstonsmith.info/julia/elettra/> [2] [http://phrack.org/issues.html?issue=65&id=6#article](http://phrack.org/issues.html?issue=65&id=6#article)</comment>


The second operating system hiding in every mobile phone (2013) - <AUTHOR> http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone <comment><USER2> Is there any working being done to modernize those protocols? I'm sure Apple can demand that by a given timeframe, a new standard has to be supported or else new iphone won't work on the carrier's network (and which carrier would not want iphones to work on their network?). It's not like Apple is afraid of such things. I'm sure if apple implemented them, google/samsung would follow within 1 or 2 years.

In the meantime, is there a refactor/rewrite of that '90 code bash that is full of bugs and unused functions? And if so, do any phone manufactures use that improve "firmware"?

<comment><USER3> As noted in the article, Apple/Google have nothing to do with this problem and little reason to care until widespread reports of spoofed towers hacking people's phones start making the front page.

This is on the RF manufacturers: Qualcomm, MediaTek, Spreadtrum, Samsung LSI & HiSilicon (Huawei).

</comment></comment><comment><USER4> The author posted it to HN after publication (in 2013), it got 262 comments: [https://news.ycombinator.com/item?id=6722292](https://news.ycombinator.com/item?id=6722292)

<comment><USER5> I don't know since when, but there is a "past" link which search for past news with title. Thanks HN :)

<comment><USER6> Looks like it's an annual tradition!

</comment></comment></comment><comment><USER7> It's very important to understand this risk, but also to keep it in perspective.

Both the two major phone vendors --- Google and Apple --- have teams of people who are acutely aware of the baseband thread, many of whom are equally as talented as RPW.

Further, though the article seems carefully written enough to avoid the misconception, the basebands on modern phones don't get direct access to AP memory, but are instead connected over a high-speed serial connection with a limited command set.

<comment><USER8> > Further, though the article seems carefully written enough to avoid the > misconception, the basebands on modern phones don't get direct access to AP > memory, but are instead connected over a high-speed serial connection with a > limited command set.

That's good to know; for some reason I had an idea that it was all done via DMA.

Any idea about how exploitable that command set is?

<comment><USER9> Have a look around for one oldish implementation in Linux kernel: [https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/hsi) . If you're more interested in exploiting something on the baseband side, that source code is more difficult to come by and supposedly protects quite well from unexpected traffic from AP side.

</comment></comment></comment><comment><USER10> Note that plenty of the security holes are actually required by major carriers to be present. Just sayin'.

Also, for trust to be thrown out the window, a lot of changes would probably need to happen both in baseband software and in the networks themselves. Not seeing that happening anytime soon.

</comment><comment><USER11> Isn't that how Samsung hides Absolute Computrace rootkit/spyware in the hidden partition ?

I read that it can not be removed not even by reinstalling the OS. But it looks like PC manufacturers like Lenovo found a way to hide the same rootkit in their BIOS.

[https://security.stackexchange.com/questions/53698/detecting...](https://security.stackexchange.com/questions/53698/detecting- and-removing-absolute-persistance-technology)

</comment><comment> awinter-py I assume that when the hardware becomes available to run an open source GSM baseband, the software will follow shortly afterwards. (Or if qualcomm ever releases docs for their closed hardware).

The FCC will require signed builds on radio hardware shortly after that.

Best outcome is to have a vetted open source baseband project with reproducible builds so we can verify our signed binaries.

</comment><comment><USER12> Funny the author calls the code little understood with no peer review, yet when has the baseband processor on your phone crashed? Not nearly as often as the OS. Just because he does not grasp it does not mean it is poorly implemented. It goes through very extensive reliability and interoperability testing.

They aren't understood since standards such as LTE are very complex, tying in RF hardware, DSP in ASICs, and software.

<comment><USER13> He means peer reviewed from a security standpoint. Reliability and interoperability may be related to security but they aren't the same thing.

</comment></comment><comment><USER14> this article left all those that read it... speechless?</comment>


On Loneliness and Solitude - <AUTHOR> https://www.pa-mar.net/Lifestyle/Solitude.html <comment><USER4> As this essay does, it always helps to dig deeper into what a word such as loneliness actually means.

I've written about this a bit below[1,2]. I'm interested in what the ingredients of these deep relationships are, both emotionally (eg. interests, vulnerability) and logistically (eg. time, proximity) so that we can better create and maintain them. I think that if we can influence these factors, we can have better control of our natural degree of loneliness (and to emphasize, some amount is completely natural).

\---

 _I think the word "loneliness" is loaded with a ton of baggage, so maybe a better way to frame it is as "a lack of deep relationships." I have a couple of thoughts here.

First, defined in this way, you can have one close friend and not be lonely. You can have a ton of "friends" and still be lonely. This seems much more intuitively correct.

Second, deep relationships are hard, and things which are hard are generally rare. It's hard to get out of the house, leave what is comfortable and go meet strangers. On top of that, we've all had times where we meet new people, have a lot in common - and yet, nothing "deeper" materializes. And on top of that, strengthening and maintaining a relationship takes a lot of work. Without investment of time or effort, relationships atrophy. Deep relationships should necessarily be uncommon._

[1] [https://alexpetralia.github.io/2018/04/02/NL-2018-04-02.html](https://alexpetralia.github.io/2018/04/02/NL-2018-04-02.html)

[2] [https://alexpetralia.github.io/2018/03/19/NL-2018-03-19.html](https://alexpetralia.github.io/2018/03/19/NL-2018-03-19.html)

<comment><USER5> Interesting thought, which seems logical, but I'm not sure it's enough. People can still be lonely around family or close friends, so to some degree it is seems situational. How do we explain the apparently inexorable rise of loneliness across the globe? Have deep relationships become less common or more difficult to achieve in the last half century? If it were that simple wouldn't we find it easier to resolve?

> Deep relationships should necessarily be uncommon

I don't think this follows. It's not _that_ long ago that people most often lived in a small town or village and had deeper relationships with just about everyone. Partly because life and work constrained numbers and proximity and you knew most for much of your life.

<comment><USER6> I think it needs more than a close friendship. The true solution to loneliness is a lasting and intimate relationship with a romantic partner. That is something I believe has become truly hard to find.

</comment></comment></comment><comment><USER7> Interesting read.

When I was in my twenties, loneliness, when it came, felt like the absence of another. Nobody specific, just a gap where _somebody_ should be when you're travelling alone etc.

Now in my thirties, loneliness rarely surfaces. Company is great but there's never a need for it. I guess as you get older you become more replete and that 'gap' disappears.

It also seems that a feeling of _saudade_ replaces loneliness as one ages - <USER2> longing for a place or a person that perhaps cannot be satiated. But unlike loneliness which you describe as "a specific type of sadness", saudade is less sad than it is bittersweet. Beautiful even.

> > [https://en.wikipedia.org/wiki/Saudade](https://en.wikipedia.org/wiki/Saudade)

<comment><USER8> It's an unpopular notion in these times, but it might even be said that this arises from a deep-seated awareness that one is separated from one's true source or even (gasp) "God."

<comment><USER9> That's how cults get their claws into you.

<comment><USER8> Don't drive, you'll die on the road.

</comment></comment></comment></comment><comment><USER10> I don't know that picking apart a single word is a worthwhile pursuit. Clearly, the author of the book seems to think that it is.

I get the impression, from looking at what else Lars Svendsen has written about - that he chooses a word with strong cultural baggage and yet no clear definition, and spends a great deal of time, viewing the word through many different lens.

The interest and need to do this falls away, as you gain a strong enough sense of what your life is about, as you divorce yourself from cultural (including parental) expectations and start to figure out what works, and doesn't work, for you.

Once you're on the path of deciding what works for you, loneliness, boredom, fear, work, freedom etc - they're just not that interesting. You're simply living out your life. You cease being so incredibly insecure, because either you find a small group of people who share your values and that's enough, or you find that living with minimal human contact is actually quite alright :)

ps. most people fit within society's expectations and embrace them and are not bothered by them too much to begin with, and hence don't have this problem. This is for those who feel like they don't belong on some level.

</comment><comment><USER11> I think loneliness gets worse when we see "perfect friendships" on TV that last for years, like in Harry Potter or Scrubs. It makes us feel that we are missing something very important to human feelings - complete or near complete trust on another human being.

<comment><USER12> Movies and TV shows are naturally biased towards social relationships and friendships because it's hard to present a first person point of view. Yet I assume that's where the future of entertainment lies, in first person virtual reality. _Peep Show_ with David Mitchell and Robert Webb is the only exception I can recall but the humour there is fairly dark and nihilistic so it's hardly an endorsement for solitude (besides, they're flatmates). A counterexample from literature I can recall is _Robinson Crusoe_ , who is alone on the island for the first time in his life but not lonely because of a new-found relationship with God.

</comment></comment><comment><USER13> Roughly speaking, loneliness and solitude are the negative and positive aspects of 'being alone'. So I guess 'being alone' is a much bigger topic than either loneliness or solitude or both.

Second, I'm much more interested in the topic of being alone in the internet era. And what I mean by that is that you're not being alone in the pre- technology sense, which would resemble going out into the woods and living there, or stuck on an island. Instead, you live in your home, don't have roommates, or an SO, etc. But you have access to internet!

You might think it's worse to be alone and see people on the internet hanging out and having fun. I'd say you're looking at it the wrong way. If you see people hanging out, you're in a sense hanging out with them (you're living vicariously through those people). If you watch a serious of videos of people having fun, people talking in podcasts, interviews, you had a pretty stimulating social experience. It's not physically social, but it's social nonetheless. But maybe you want interaction. Well, you can interact in online forums, chat rooms.

So, in my opinion, being (physically) alone in the internet era is a lot more self-sustaining and a doable lifestyle than being along without internet.

</comment><comment><AUTHOR> Author here - I had submitted this a couple months ago and HN's asked me to resubmit to see if it fared a bit better.

 _" Ask me anything..."_

<comment><USER14> Thanks for putting together this summary of the book "A Philosophy of Loneliness" by Lard Svendsen and adding your reflections on it. Lots to think about there. I especially liked the picture of the person with the guitar by the seashore.

And the David Foster Wallace quote you requoted was insightful: "Lonely people tend, rather, to be lonely because they decline to bear the psychic costs of being around other humans. They are allergic to people. People affect them too strongly."

You write near the end of your review: "The book clarified for me an important point, though: Solitude is something that we actively seek, while Loneliness is something that we try to escape. Apart from that, they are exactly the same thing: being alone (which in turn is something that happens quite often - <USER3> fact, humans are "alone" most of the time)."

Given that, what are your thoughts then on the phrase "alone in a crowd"? For example: [https://www.psychologytoday.com/us/blog/the-introverts- corne...](https://www.psychologytoday.com/us/blog/the-introverts- corner/201211/introverts-and-the-loneliness-loop) "We know loneliness may or may not be related to being alone. Introverts can be perfectly happy alone, or terribly lonely in a crowd. But if introverts are at any particular risk for loneliness, it could be because we set a high bar for friendship. We desire and require deep connections and would rather be lonely alone than in a crowd. But realistically, those deep connections are not easy to find, and if we get caught short and our only choice is superficial socializing or nothing, we can get lonely."

Also, you say the book suggests: "Another of the prevalent journalism theories (internet and social media will result in an increase of individualism and loneliness) seems not to be supported by empirical studies: those who use social media report having a more active social life and more frequent personal interaction with other (outside of social media itself, of course)."

I wonder about that, given the notion of narrowly focused "supernormal stimuli" and how super-fascinating (anti-)social media can potentially displace more holistic human interactions especially over meals. But websites that arrange meetings of people with common interests can counter that trend, so obviously that's not a black and white thing. A related book on that if you are looking for something to summarize next: [https://en.wikipedia.org/wiki/Supernormal_Stimuli](https://en.wikipedia.org/wiki/Supernormal_Stimuli)

<comment><AUTHOR> "alone in a crowd": the book's author argues that actually this is the most natural human experience - we are "always alone", even with loved ones, even while having passionate sex, because our own concept of self is not shareable (barring some sci-fi trope): what I am feeling now while composing this answer is different from what the person sitting to my side (I'm on a bus) is experiencing. Same with me towards her, of course. There are maybe 50 people in this bus, and we are fifty individuals travelling _alone_ towards a specific German town... everyone has different stories and different reasons and probably different hopes or expectations about what happens when we get there. And trying to make an info dump to another person to make him/her understand my situation so that I am not _alone_ anymore would take hours if not days... and probably further distance each other, because the girl sitting to my side would then be unable to share how it feels to get a stranger twice her age to start describing his feelings about this trips, in English, too, which is not mine or her native tongue. ;)

<comment><USER15> Lots of crossroads on that bus.

When I was on one, in the exact same situation, it was impossibile not to think about the staggering quantity of humans in this world, each of them separated by language, culture, beliefs, needs, space. Suddenly, communication and building bridges becomes one of the really important questions.

</comment></comment></comment></comment><comment><AUTHOR> Coincidentally, Charles Chu just posted his own take on the same book: [https://medium.com/the-polymath-project/loneliness-is-not- ab...](https://medium.com/the-polymath-project/loneliness-is-not-about-being- alone-343d2be67643)

(The person who suggested it to him was ... me, just like I did with my I-Ching piece: [https://www.pa-mar.net/Lifestyle/I-Ching.html](https://www.pa- mar.net/Lifestyle/I-Ching.html) )

</comment><comment><USER16> " I am no more lonely than a single mullein or dandelion in a pasture, or a bean leaf, or sorrel, or a horse-fly, or a bumblebee. I am no more lonely than the Mill Brook, or a weathercock, or the north star, or the south wind, or an April shower, or a January thaw, or the first spider in a new house." (Thoreau)

</comment><comment><USER17> O solitude, my sweetest choice. Places devoted to the night, remote from tumult and from noise, how ye my restless thoughts delight!

This wonderful song was composed by Purcell on a translation of a French poem which was popular across all Europe in the XVIIth century. If you excuse the anachronism, solitude was already romantic.

\--

After reading these summaries of the chapters of "A Philosophy of Loneliness", I'm not at all convinced of the quality of the book. Here is a sample of critic that I hope will be judged constructive.

1\. First of all, this definition of loneliness is too convoluted. Being alone is objective, while being lonely is subjective, it is a feeling. That talk of "quality" of relationships and "life meaning" may have some truth in some cases, but it is not a generic principe: for example, I remember discussing with someone who avoided deep bonds and openly thrived for quantity. Some persons will never feel lonely as long as they know they have people they can chat with. I also feel it is rather pointless to introduce categories for something that has no clear boundaries, and varies so much across societies and individuals.

The "devastating effects that Loneliness can have on health" are a tautology, since loneliness is defined as the negative feeling of solitude. Any extended negative feeling may have a bad impact on the health. But, as far as I know, there is no proven correlation between chosen solitude and health problems. Considering the intrinsic experimental difficulties (how to measure "chosen solitude"? etc) I doubt anything conclusive can emerge.

6\. Maybe the rejection of living with a partner is increasing, but the numbers of single persons and solo households are very misleading. Detailed investigations rule out that chosen solitude could be the main factor in their evolution. For example, in France (INSEE 2014), 16% of the households are made of a single person. But these 16% are the sum of 9% for people aged less than 65 and 7% for those above 65. It looks like the main factor for solo households is the raise of widowhood caused by longer lives.

\--

I was much more interested by the personal comments in the right column. Some resonated with me: I looked for total solitude during most of these summer holidays, to the point my own voice surprised me when I had to speak again. Now that I'm back to work, I'll have to endure "the psychic costs of being around other humans". These past years, I've told my friends and family that I am more and more reluctant to endure that cost. But I don't feel really concerned by the rest of the quote: "They are allergic to people. People affect them too strongly."

Like the OP, I'm interested in the artefacts that have been used to fight loneliness. Rituals are one of those, as pointed by the excellent novel "Friday, or the other island" (M. Tournier) where Robinson Crusoe uses work, rituals and religion to keep his mind occupied and avoid loneliness or questions on the meaning of life.

</comment><comment><USER18> it burns really bad now

</comment><comment><USER19> When I saw the title and when I saw "1 comment" below it, I had to just chime in. Now we are 2 comments.

<comment><AUTHOR> I must admit I was counting on someone to do this, but I am happy this is actually igniting some interesting discussion, I will update my piece later and link to this thread.</comment></comment>


Ask HN: I'm opensourcing all of my money. What are the implications? - <AUTHOR> <comment><USER2> So, I can take the source code of your banknotes and compile my own? O_o

</comment><comment><USER3> not sure what you mean by this?</comment>


Shitty url shortener, emoji and ai powered - <AUTHOR> http://xn--7biv418msua.ws <comment><USER2> Perhaps this is relevant, and was released just this week by ICANN: [https://www.icann.org/en/system/files/files/sac-095-en.pdf](https://www.icann.org/en/system/files/files/sac-095-en.pdf)

"Finding 1: Emoji are disallowed by the IDNA standard; domain names with emoji will not be accepted or processed consistently by applications.

Finding 2: Emoji are not required by design, standard, or convention to be visually uniform (one code point displayed the same way in all circumstances) or visually distinguishable (different code points displayed in ways that permit them to be disambiguated regardless of context). As a result, a user will be exposed to problems of confusability and accessibility. Different code points that are rendered the same or one code point that renders differently to different users will lead to inconsistent results depending on the display or rendering technology used.

Finding 3: Emoji modifiers and "glue" arrangements allow for a potentially much larger set of composed multi-codepoint symbols with even greater rendering variation and potential for ambiguous interpretation.

Finding 4: A fundamental property of the DNS is that it is an exact-match lookup service. For a given query, either there is a single name that matches or there is no match. When two domain names are identical in appearance except for ordinary typographic style variations (which, at present, have no equivalent for emoji), but have different underlying code points, they identify two different DNS domains.

Finding 5: It is unrealistic to expect that just because a code point is included in Unicode, it should be used as part of a domain name."

<comment><USER3> This is definitely the beginning of an ongoing debate: [https://medium.com/@Emoji_Domains/ssac- response-d8d2ad6e800c](https://medium.com/@Emoji_Domains/ssac- response-d8d2ad6e800c)

<comment><AUTHOR> At least it just works. Nobody knows how. It's fun.

</comment></comment></comment><comment><USER4> Funny, these emoji urls just broke my whatsapp for desktop.

Edit: Confirmed on Apple and Windows. I formatted one as [http://](http://) and one without. Restarting the application didn't fix it. Deleting the urls on Android, then relaunching the desktop application worked.

</comment><comment><USER5> Interesting, it does seem pretty shitty lol I gave it [https://projectpiglet.com](https://projectpiglet.com) and was sent to [https://anduintransact.com/](https://anduintransact.com/)

Pretty fun though!

<comment><USER6> That's interesting, I got projectpiglet despite giving a github url

<comment><USER5> lol sounds like something is broken with hashing.

<comment><AUTHOR> Yep, you got it. Somebody try to redirect loop with shitty url shortener. I impressed but I didn't delete the records. I accept if anyone wants to help. Maybe the shit in the future could be nice.

</comment></comment></comment></comment><comment><USER7> Seems to be broken. With a https url got redirected to [http://https%20//Google.com](http://https%20//Google.com)

With a http url it just redirects back to the shortener homepage.

(Google Chrome on Mac)

</comment><comment><AUTHOR> Url shortener evolved. Has new ui, Less buggy code :) [https://github.com/cagataycali/url- shortener](https://github.com/cagataycali/url-shortener)

</comment><comment><USER8> I love it.

I was trying to think up an emoji project (especially with URLs) a little while ago, but didn't come up with anything. I wish I'd thought of this.

</comment><comment><USER3> Fun! Love a quick, dumb emoji URL project.

</comment><comment><USER9> It is a shitty shortener - www.google.com gets shortened to a link that points at wwww.google.com.</comment>