Ireland's Health Service Open Sources Official Covid-19 Tracking App - <AUTHOR> https://github.com/HSEIreland <comment><USER2> Here's the "report card" (PDF) on the app's data-gathering and privacy features, prepared by the Irish Council for Civil Liberties: [https://www.iccl.ie/wp-content/uploads/2020/07/ICCL-DRI- HSE-...](https://www.iccl.ie/wp-content/uploads/2020/07/ICCL-DRI-HSE-App-Pre- Release-Report-Card.pdf)

The report is thorough, informative, and technically competent, IMO.

<comment><USER3> A "C+ grade", but the report seems a little nitpicky.

It loses marks for not being a "single-purpose app" as the same app also provides you a way to track your own symptoms.

It loses a lot of marks for "necessity and proportionality" on the grounds of not providing documents that prove or support such an app as being useful for contact tracing, even if it works. Surely they could give the benefit of the doubt here. And in a separate section they give it a D for "effectiveness" citing studies that it probably just won't work and will have too many false positives.

More marks lost for relying on closed Google/Apple APIs, using Twilio to send text messages, not having a Github issue tracker...

I think they make a lot of good points but when I think about what it would take for an app to move from a C+ to an A under this framework, it looks like 80% box ticking and 20% addressing serious privacy concerns.

<comment><USER3> To continue, when they actually address the privacy and security implications of the design, they call out the possibility of a replay attack "when an outsider intercepts a communication and fraudulently delays or resends it...there is no known significant mitigation for replay attacks and yet they are not identified in the DPIA."

Firstly, surely there's a known mitigation here - replay attacks involving a delay can be mitigated by including a cryptographically signed timestamp in your beacon messages. Secondly, the damage from an attacker sending false negatives and false positives seems small compared to the privacy implications of deanonymization attacks (e.g. attacker listens for the beacons in several buses, offices or shopping centres, later identifies which ones were reported covid-positive, groups those into clusters each likely associated with an individual, and cross-references the location data with identifying data from another source). Why call out one but not the other?

<comment><USER4> There isn't enough space in bluetooth IDs to include a cryptographically signed timestamp, there isn't even really enough space to include a cryptographic signature for everything ... in the the Apple/Google design the Bluetooth power level is left unsigned due to space constraints. It really is a very very small amount of space.

An alternative design involved bluetooth IDs broadcasting small 63-bit ECDH shares and devices performing pair-wise key agreement. This would raise the difficulty level of replay attacks; they'd need to be bi-directional and roughly time synchronized (within a ~15 minute window) but it had other trade- offs including reducing the efficacy of the app due to bi-directional message receipt being required, and ballooning the amount of data that needs to be distributed to detect infection risk. So it wasn't taken.

</comment></comment></comment></comment><comment><USER5> I'm an advocate that where possible all code paid for by the Irish Government should have to be open sourced under an MIT licence. Its bonkers this is not more wide spread practice.

<comment><USER6> At a minimum it should be free to the people of Ireland in some legalese way. Much simpler just to go full open source.

</comment></comment><comment><USER7> Sell it to the UK who insisted on _not_ using ExposureFramework because they knew better.

Except they didn't.

<comment><USER8> The FT reported last week that the new UK app will be based on this code, apparently.

I personally find this hilarious, but good as compatibility between the apps is really important given the existence of the Common Travel Area between Ireland and the UK.

<comment><USER7> It will be, just a shame it cost them many millions of pounds, wasted time and lives to arrive at the same conclusion that the technology industry has been repeatedly shouting at them for months now.

British exceptionalism at its finest: "Why would we do this easy thing when we can do it worse ourselves?"

<comment><USER9> Except of course, they had _reasonable_ reasons for not wanting to go the Apple/Google route.

That route is designed for applications to alert users that they may have come in contact with someone ele who was infected.

But its privacy focus means that it doesn't help health authorities trying spot geographical clusters early.

The UK government want to use the app as part of its track and trace system to identify the need for local lockdowns.

<comment><USER10> Yeah, and Singapore - which originally inspired all these Covid-19 tracing apps - is still refusing to go the Apple/Google route for the same reason. There's also a chronological issue, with the original app being well into development when Google and Apple released their approach. But fundamentally, this isn't about facts - it's about the British press having turned Covid-19 into a cynical, Brexit-related partisan football. Somehow starting development early and co-operating with countries like France and Germany on a shared approach turns into letting people die through "British exceptionalism", merely through the media carefully omitting the details that contradict that narrative and letting readers fill them back in differently in their heads.

<comment><USER11> The trust in MSM in the UK is currently very low. You've expressed exactly why this is the case.

<comment><USER7> My trust in those who blame the "MSM" for everything is even lower.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> Any reason for me not to use this? As someone living in Ireland who uses a smartphone and whose security model doesn't include worrying about targeted attacks by nation-level actors, but would like to avoid everything else.

From skimming respectable non-technical sources it's apparently not very invasive of my privacy, and won't kill my battery. But this is likely copied from the HSE press release, I'd like to hear the same from an independent reviewer.

<comment><USER8> There is absolutely no reason not to use this.

In fact, using this app will be helpful, as long as enough people do it. So you should definitely use it.

<comment><USER3> To answer my own question, the top comment from urschrei links to an analysis from the Irish Council for Civil Liberties and Digital Rights Ireland, giving it a "C+ grade" on its adherence to "experts' best practice principles regarding government surveillance technologies".

<comment><USER12> Yeah and that "analysis" is more nitpicking and cheap criticism rather than actual issues

Because complaining that a Covid contact tracing app includes symptom tracing is just ridiculous

</comment></comment></comment></comment><comment><USER13> I like their molecules, atoms, organisms approach to component organization. I hadn't seen that terminology used in an app before but it was immediately intuitive.

[https://github.com/HSEIreland/covid-tracker- app/tree/master/...](https://github.com/HSEIreland/covid-tracker- app/tree/master/components)

<comment><USER14> Think you meant to reply to [https://news.ycombinator.com/item?id=23758335](https://news.ycombinator.com/item?id=23758335)

<comment><USER13> Right you are, thank you!

<comment><USER15> We'll move it. You can edit the 'wrong thread' bit out if you want.

</comment></comment></comment></comment><comment><USER16> On a related note, anything that pushes OSS for government is IMO a Good Thing - forgive my usual self promotion here - [http://oss4gov.org/manifesto](http://oss4gov.org/manifesto)

</comment><comment><USER17> Timely reminder for everyone that there is as of yet no evidence that Apple/Google/DP3T/ExposureFramework based apps deployed in the wild actually work effectively. They've been deployed in a number of countries but there is currently insufficient available data to show that they actually work.

(of course we also know that limited disclosure apps not based on this framework developed in Australia, the UK, and France definitely don't work because of bluetooth issues)

(edited to add

See this paper out of Ireland: [https://www.scss.tcd.ie/Doug.Leith/pubs/bus.pdf](https://www.scss.tcd.ie/Doug.Leith/pubs/bus.pdf)

One of the best use cases for apps like this is public transport, except that it doesn't seem to work on buses. Hopefully it works better on trains but given the similarly complex metal environment, I wouldn't hold out much hope.)

<comment><USER18> It partially works as in it gives people who live in a technological society (like ours) the illusion and hope that technology can solve problems that don't have immediate technology-related solutions (if at all).

Tracker apps are partially what the massive TSA-implementation programme was in the States post 9/11, i.e. security theater combined with the illusion that the dominant paradigm of that time (force/projecting power in the early 2000s, technology in our present times) is a silver bullet.

</comment></comment><comment><USER19> Have any US-based health authorities deployed contact tracing apps? Back in May, they were going to be coming soon, and I've not heard anything since.

<comment><USER20> I think North Dakota has something.

</comment></comment><comment><USER5> A decent technical overview here: [https://petertanham.com/the-hses-new- covid-19-tracking-app/](https://petertanham.com/the-hses-new- covid-19-tracking-app/)

</comment><comment><USER21> Honestly, to me I feel the entire concept of 'apps' has been an abysmal failure. There's no evidence to suggest they've helped in _any_ capacity. I think any contact tracing system is _far_ more effective than using BT which was never designed to be used in such a capacity and feels more of a best-case 'hack' with current smartphone technology.

History will look at these 'apps' and will make conclusions based on their effectiveness, and the ones that are more privacy preserving will likely not rate highly on impact or usefulness.

If anything, this pandemic has enabled authoritarian regimes the capability of monitoring their populous 24/7 with wearable gadgets and apps that collect location/contact and other information.

To me, it highlights the importance of _not_ using apps where possible and further highlighting how smartphones are _spies_ for the governments around the world.

<comment><USER22> This data is intended to be used in concert with manual contact tracing, not instead of it. The problem with contact tracing, as people get more mobile, is that while you can say "I was in contact with my friend X" you probably can't tell the contact tracer the name of the person sitting behind you in the restaurant. This will help with that, potentially.</comment></comment>


College Reopening Plans: How Many Coronavirus Cases Would Close Them Again - <AUTHOR> https://www.wsj.com/articles/college-reopening-plans-include-how-many-coronavirus-cases-would-close-them-again-11596533400 <comment><AUTHOR> [https://archive.vn/5HIoA](https://archive.vn/5HIoA)</comment>


Reverse Engineering a North Korean Sim City Game - <AUTHOR> https://digitalnk.com/blog/2019/04/21/reverse-engineering-a-north-korean-sim-city-game/ <comment><USER2> "File integrity checks added by North Korean developers shows that piracy is a concern and suggests the existence a warez/cracking scene in the DPRK"

Fascinating!

<comment><USER3> > None of these options are particularly hard to implement. The first one > would allow us to generate our own licence keys and would be more elegant > but also more time-consuming, while the last two are trivial.

I like how you can tell the author is a scener b/c he still ranks a CRACK+KEYGEN higher than a simple CRACK.

</comment></comment><comment> ko-ko-ko I skimmed over a lot of the technical stuff but I found it interesting that what is basically a code review was leveraged to make analyses and hypotheses about a culture and a society at large.

Incidentally I wonder if this is not what the humanities, or at least "digital humanities" increasingly ought to be about. Rather than use algorithms to show us obvious stuff about history and literature (yay word clouds!), why not apply historiography's methodology or literary criticism to the study of computer programs and algorithms?

Computer code is almost always thought of in purely functional terms when it has the potential to tell us so much more about its authors and the society in which it was produced.

</comment><comment><USER4> There were news articles published years ago which claimed north korea trained "100 hackers per year" as part of their cyberwarfare effort.</comment>


HTML5 Deep Dive - advanced Canvas tricks and resources - <AUTHOR> http://projects.joshy.org/presentations/HTML/CanvasDeepDive/presentation.html

<comment><USER2> i shamelessly use this opportunity to cross reference to a canvas related question (from myself) on stackoverflow [http://stackoverflow.com/questions/7511321/uploading- base64-...](http://stackoverflow.com/questions/7511321/uploading- base64-encoded-image-to-amazon-s3-via-node-js) even though i'm aware of the fact that i will be un-karma-ed into oblivion. but i'm quite desperate to get some help on this. thx

<comment><AUTHOR> Load the base64 data (everything after the comma) into a nodejs binary buffer and use that knox library to upload to s3 as a binary file.

</comment></comment><comment><USER3> The inversion example only inverts the R channel, then uses the uninverted R value for G and B...</comment>


A tale of two spacecraft - <AUTHOR> http://yellowpencil.com/blog/tale-of-two-spacecraft

<comment><USER2> Thanks for posting this, jordanyeo!</comment>


How to handle? Free iPad For quality co-founder applications - <AUTHOR>

I got this idea from a scene in social network.
I was a y combinatorics applicant but did not get selected, And I feel it was because I did not have a co-founder who was a programmer and also I did not have a prototype yet.
  This  has been a huge issue for me and not sure how to access qualified programmers to interview them for co-founder position.
I was thinKing I would create a web page with application similar to Y combinatorics app page and have people apply for co founder position if they 1st meet the criteria.  I would have some sort of screening system and only  have 10-20 of those applicants qualified to be interviewed and be eligible for the drawing for the Ipad.
I'm thinking this will draw a huge resource of programmers who will apply and I can draw from for future potential jobs that will arise as my startup progresses.
I am not concerned about the expense and consider it an investment into my startup.  Also, I am in a financial position to boot strap full time until prototype is complete and can pursue more funding from investors. I am looking for thoughts and suggestions of how to make this fair to applicants and secure from spammers.
Please feel free add your thoughts on how to make tins work well.
Thanks <comment><USER2> it's certainly an interesting approach. offering a chance at an iPad could get people's attention and get them to take a deeper look at the opportunity than they would otherwise. balanced against that you'll almost certainly get a whole bunch of applications from people who aren't remotely relevant. so there may be other ways to spend the money more effectively.

in any case you might also want to combine it with in-person networking. not sure where you're living, but if there's a Startup Weekend or other similar events near you it's a great place to meet people and see if you click.

</comment><comment><USER3> seriously? You want to find someone willing to commit their time and effort to your vision for ten years or more, and you hope to achieve this by offering a free iPad?

<comment><AUTHOR> No I am offering a free I pad in a drawing from the qualified applicants that apply. the co founder may not even win the drawing. It ia just a way to get attention to the the application page and find qualified programmers i can interview.

Obviously the co-founder selected will be a true co-fo under and be vested and have equity. I am just presenting a creative way to find the right person. And not have to find.a nettle in a hay stack.

Sorta like what they are doing here at y combinator</comment></comment>


100M clear text passwords stolen from Russia's biggest social network - <AUTHOR> https://thestack.com/security/2016/06/06/vk-100-million-clear-text-passwords-stolen/ <comment><USER2> Instead of idiot questions like FizzBuzz maybe recruiters should be asking about password storage best practices instead

<comment><USER3> I've asked these questions in interviews and a lot of programmers seem to know the basics (what a hash is), but seem to fall short when it comes to things like what a salt is, modern storage techniques (bcrypt, scrypt, PBKDF2) and how rainbow attacks can be used to crack hashes.

It's a bit tricky to fail someone in an interview because they don't know security. I think the better way to handle security in a company is to hire a programmer that knows it and teaches it to other programmers during code reviews.

<comment><USER4> Is there a good article or breakdown on modern best security practices? I am a relatively experienced programmer and know what a hash and salt are, and have read the wikipedia article on rainbow tables (though I now forget what they are other than that they make attacks of certain things easier), but that's the extent of my knowledge.

<comment><USER5> Here's one. Title: How to safely store your users' passwords in 2016.

[https://paragonie.com/blog/2016/02/how-safely-store- password...](https://paragonie.com/blog/2016/02/how-safely-store-password- in-2016)

<comment><USER6> That site recommends libsodium which by default uses Argon2. The issue is that Argon2 is not very mature yet. Also if you are using python there is no good library out there. Ideally you want something well tested since it is possible for libraries to have bugs as well.

</comment></comment></comment></comment></comment><comment><USER7> Official local news: This never happened.

Slightly less advertised news: This never happened, the data is from a 2011-2012 leak, and everyone from it was forced to change passwords long ago.

The "33,236 times" password is actually mildly obscene, meaning something close to "everything went to hell". Doesn't make any special sense to me.

<comment><USER8> Does the number 0211 after it hold any significance?

<comment><USER9> My guess: someone was registering thousands of bots using common swearing words + some number as their password, and this particular spam campaign happened to be particularly large.

</comment></comment></comment><comment><USER10> I'm sorry, I hate pointing anything negative out. Was it a recent change to store passwords in clear text?

It's worrying because the founders of VK started Telegram which claims to be end-to-end encrypted.

<comment><USER11> No, in 2007 they even sent your password to email immediately after creating account: [https://twitter.com/dchest/status/739804779296219136](https://twitter.com/dchest/status/739804779296219136)

There was also "remind password" feature: [https://twitter.com/extractor/status/739801634423857152](https://twitter.com/extractor/status/739801634423857152)

Also, they used to store MD5(password) in cookies.

Yes, these are the same people who made Telegram.

<comment><USER12> Sending your password in plain text in email doesn't mean it's stored in plain text; it could be copied from memory into the email before being discarded at the end of execution of the initial request.

<comment><USER11> If you ever find a service that is stupid enough to send password by email, but smart enough to store it hashed, please let me know.

Also, you missed a part of my comment where I said that they sent passwords by email when you clicked "I forgot password".

</comment></comment></comment></comment><comment><USER13> > Almost as surprising is the 24,309 times that 'marina' is found as a > password here

It's a common name, apparently the English speakers traditionally translated Greek name Μαρίνα (Marina) to "Margaret."

</comment><comment><USER14> Clear text passwords? I thought it's 2016. If you are not using bcrypt/scrypt or similar in 2016 then you should change profession.

<comment><USER15> Just yesterday I clicked on the "Forgot Password" link on the AutoTrader.com website. I was expecting a reset link in my email and instead they just emailed me my password in cleartext. This is a huge website! Not some small business. It completely baffles me.

I wish that there was some way to shame these companies. I've seen some websites that list some of these offenders but they don't appear to be effective enough. I want news articles written about these companies in the magazines that the CIOs care about, with their photo right next to the article.

<comment><USER16> This seems to be the most popular collection: [http://plaintextoffenders.com/](http://plaintextoffenders.com/)

There should be a warning in the browser that these websites are known to store password in plaintext. This can be achieved by an extension too.

<comment><USER17> > This can be achieved by an extension too.

In the website you linked, there is a "3rd party tools" link [1] that has a Chrome extension [2] and a Firefox addon [3] that do just that.

[1]: [http://plaintextoffenders.com/tools](http://plaintextoffenders.com/tools)

[2]: [https://chrome.google.com/webstore/detail/plain-text- offende...](https://chrome.google.com/webstore/detail/plain-text-offenders- aler/ggndaknbenjhnkddgjnjjcmomgaidhmd)

[3]: [https://addons.mozilla.org/en-US/firefox/addon/plain-text- of...](https://addons.mozilla.org/en-US/firefox/addon/plain-text-offenders/)

</comment></comment></comment></comment><comment><USER18> I just logged into VK to change my password. It happily accepted a 30-character generated password (alpha-numeric with upper/lowercase and special characters). However, i was not able to login with it after changing the password. Tried using their password recovery tool that texts you an MFA code. It never came. Attempting to send another one gave me "You exceeded daily attempts limit" error message. I guess tomorrow i'm going to TRY to login to just delete the damn account all together.

</comment><comment><USER19> Better link: [https://www.leakedsource.com/blog/vk](https://www.leakedsource.com/blog/vk)

<comment><USER20> What makes "PolniyPizdec0211" such a popular password?

<comment><USER21> Probably a bot creating those users for various reasons.

</comment></comment></comment><comment><USER22> Looks like it's being sold for 1 BTC [1]. Screen Shot:

[https://www.instagram.com/p/BGUE5H2yqa_/](https://www.instagram.com/p/BGUE5H2yqa_/)

[1] [http://trdealmgn4uvm42g.onion/listing/3716](http://trdealmgn4uvm42g.onion/listing/3716)

<comment><USER23> judging from that 'gram shot, it looks like VK didn't bother actually deleting user profiles (a lá Ashley Madison). Will be interesting to see the fallout from this, if confirmed.

</comment></comment><comment><USER24> OT question: VK is the "Russian Facebook". The article claims it has 280 million users, but a quick Google shows Russia has a population of 143 million.

What gives? Russian speaking countries? Multiple accounts per user?

<comment><USER25> VK is actually available in essentially all modern languages and is very popular in Belarus, Ukraine, and Kazakhstan; and sometimes used in countries with large numbers of immigrants from those four countries (Canada, Israel, etc) to check on family members or friends.

</comment></comment><comment><USER26> What if the Kremlin asked them to not encrypt passwords, so they could be harvested?

</comment><comment><USER27> Can anyone send a download link? I'm dying to analyze the passwords

</comment><comment><USER5> Isn't this by the same folks who brought us Telegram?

</comment><comment><USER16> It's crazy how passwords are stored in these sites with millions of users. Secure password storage is one of the top priorities of mine when I am training internees or teaching someone web app dev.

<comment><USER28> There's an old saying, "the world runs on shitty code". I always think of that when I see headlines like these.

</comment></comment><comment><USER29> 'dadada' password...</comment>


A Device Could Detect Dozens of Cancers with a Single Blood Test - <AUTHOR> http://www.wired.com/2014/10/miroculus/?mbid=social_fb

<comment><USER2> No, no, no. This is a perfect example of why everyone should be required to learn statistics.

We don't need a device to do multiple simultaneous screenings. If this were important, we'd already be doing multiple manual screenings and there would already be a demand for simplifying it. But there's a very good reason we do not do mass screening for cancers and other serious diseases with low incidence, no risk of transmission, and invasive treatment regimens.

Medical tests are not crystal balls. Any test you perform has a risk of false positives and a risk of false negatives, and even if you have a test with good _specificity_ and _sensitivity_ , applying any test to any large population with a low incidence of disease guarantees that most of the positive findings will be wrong.[1]

Telling hundreds of thousands of healthy people that they have cancer and sending them through intensive workup and/or treatment when they actually do not is emotionally and financially harmful to them and the broader community.

This is why we do _not_ do population-wide CT screening for lung cancer, why we no longer stress that young women without other risk factors have mammograms (but can choose to if they are risk averse and are okay with potentially receiving unnecessary treatment), why we are moving away from aggressive PSA screening, etc.

What's the alternative? Targeted screening. If you reduce the size of people you screen to those most likely to be affected, then you dramatically improve your results. So people with symptoms (obviously), people with certain exposures (asbestos), genetic predispositions to certain types of cancers (BRCA), etc. In other words, the thing that works best is what we already do.

[1]: [http://en.wikipedia.org/wiki/Sensitivity_and_specificity#Wor...](http://en.wikipedia.org/wiki/Sensitivity_and_specificity#Worked_example)

<comment><USER3> Very well-said! Finally doctors are realizing that not all prostate cancers require a "treatment" \- so many men undergo unnecessary surgeries and so many women followed the advices from celebrities to part with their breasts as a "preventive" measure instead of, let's say, drink green tea, eat mushrooms daily, take vitamin D, glucaric acid, and a few other affordable supplements. I highly recommend the book "The Decision Tree" by Thomas Goetz, who's a former editor at Wired magazine.

</comment></comment><comment><USER3> Aren't we all having some cancers cells in our blood and lymphatic fluids, and tissues, but those with a healthy immune response have nothing to worry about? In most cases, doesn't cancer take years to fully developed helped by epigenetic factors, but predominantly by the external ones? Won't such device when massively used for blood testing lead to predominantly false positives, redundant biopsies, and overtreatment? I think this is a great device with an enormous potential if used on narrow targets and responsibly, in general. I just think focus should be on true prevention, i.e. dietary and lifestyle changes, and not developing a false sense of assurance by living unhealthily and relying on a test to catch the results of the poor habits, and also rely on medicine being advanced enough to correct our mistakes. Of course, some factors are unavoidable today, but we also have a growing arsenal of knowledge and means to counter many of them.

<comment><USER4> in general your post says that cancer is karma payback, a disease of "dirty hands". Typical attitude of a "holier than thou" type until your get it yourself.

> those with a healthy immune response have nothing to worry about?

wrong. Cancer cells are your own cells and in general immune system have no reason to target them.

<comment><USER3> No, "karma" and "payback" do not belong to my vocabulary. Also, read more - the immune system is totally capable of attacking some cancer cells [1]. Immunotherapy is what I think will cure cancer paired with better early detection and prevention with lifestyle and nutrition changes.

[1] [http://www.cancer.org/treatment/treatmentsandsideeffects/tre...](http://www.cancer.org/treatment/treatmentsandsideeffects/treatmenttypes/immunotherapy/immunotherapy- immune-system)</comment></comment></comment>


Show HN: SparrowHub – Repository of useful scripts - <AUTHOR> Hi!
SparrowHub - https://sparrowhub.org is repository of scripts to solve various tasks. Find specific script here and use it or share your script with others uploading script to SparrowHub.
Sparrow - https://github.com/melezhik/sparrow - command line client provides API to distributes/search/install/configure/run scripts in centralized manner, as usual packages of software ( like deb or rpm rpm ), it works on most any Linux platforms.
SparrowHub/Sparrow - easy way to develop your scripts and distribute them across your teams!
Will be glad to hear your feedback.
Thanks. <comment><USER2> Sparrow looks like an interesting piece of code.

For a contemporary systems scripting language, it might make sense to implement certificates and signing to go along side the scripting hub because historically, script repositories tend to become untrustworthy. In the best case this is due to code that makes assumptions and misses corner cases. In the worst case, scripts do bad things by design.

Good luck.

<comment><AUTHOR> Hi! Thanks so much for your reply.

SparrowHub acts over ssl certificate provided by Let's Encrypt Certificate Authority. It is used for account related operations. Other API related to plugins search and downloading available by http, but it's possible to switch it to https.

A plugins ownership is validated by so called tokens generated once user get a SparrowHub account, so that plugins authors do not collide in names for theirs plugins.

If this is what do you mean? or you mean something else by saying " to implement certificates and signing" ?

Regards

<comment><USER2> That sounds a lot like what I mean at the higher level of abstraction.</comment></comment></comment>


Optimal vs. Possible - <AUTHOR> https://medium.com/@timfrietas/possible-vs-optimal-91c9d0d485d5 <comment><USER2> _" Perfect is the enemy of good. Perfect is the enemy of good is an aphorism, an English variant of the older better is the enemy of good, which was popularized by Voltaire in French form."_</comment>


Continued Fraction Arithmetic (1972) - <AUTHOR> http://perl.plover.com/yak/cftalk/INFO/gosper.txt <comment><USER2> Slides from a related presentation: [http://perl.plover.com/yak/cftalk/](http://perl.plover.com/yak/cftalk/)

</comment><comment><USER3> This is by Bill Gosper who discovered the Glider Gun for Conway's Game of Life and Hashlife a way to enable huge, long Life runs to be calculated.

[http://golly.sourceforge.net/Help/Algorithms/HashLife.html](http://golly.sourceforge.net/Help/Algorithms/HashLife.html)

[http://conwaylife.com/wiki/Gosper_glider_gun](http://conwaylife.com/wiki/Gosper_glider_gun)

</comment><comment><USER4> > "If it is possible to make very long parallel adders, it should be possible > to make a high-precision, ultrahigh speed arithmetic processor based on > continued logarithms. It would be an extremely parallel device consisting > entirely of registers and having no static memory."

Did anything ever come of this idea?

</comment><comment><USER5> Anybody want to figure out the year of this?

<comment><USER6> Parent page [http://perl.plover.com/classes/cftalk/](http://perl.plover.com/classes/cftalk/) says 1972. Cited at [http://www.cs.virginia.edu/~lat7h/blog/posts/7.html](http://www.cs.virginia.edu/~lat7h/blog/posts/7.html) as well.

<comment><USER5> Thanks! 1972 added.

Looks like it was an appendix to HAKMEM.</comment></comment></comment>


A moon colony may be a reality sooner than we think - <AUTHOR> https://www.nytimes.com/2018/05/24/opinion/that-moon-colony-will-be-a-reality-sooner-than-you-think.html <comment><USER3> The author is Wilbur Ross, current secretary of commerce, and it feels like he was compelled to write this piece after this interaction:

>I can still remember when President John F. Kennedy declared that America would put a man on the moon and when Neil Armstrong took that first step on the lunar landscape. Glued to televisions, Americans were filled with excitement and national pride during the Apollo missions.

> Last month I felt that same passion as I visited the Space Symposium in > Colorado Springs with Vice President Mike Pence. "As we push human > exploration deeper into space, we will unleash the boundless potential of > America's pioneering commercial space companies," the vice president told > the crowd.

It sounds like the space industry is growing and that's a good thing for space technology. As much as we laud American accomplishes in space exploration, it can be argued that the only investor and customer was the US, and the short term value extracted out of space was negligible.

Today, there's much more market opportunities in space than previously. 15000 satellites by 2024 is an explosive growth of 20x in 5 years. Tickets selling for low orbit tourism - that didn't exist in the past. Asteroid mining - <USER2> still seems like a pipe dream, but I'm no expert, it may be more plausible than I realize.

Regardless, it's a huge indicator of a healthier space industry if a substantial part of the investment into space is coming from private companies (SpaceX notably) rather than government grants.

<comment><USER4> It's not really a space industry, it's a Low Earth Orbit Industry. It's technically space, but only on the loosest sense. It's good that we're finally driving down the price of lifting cargo to LEO, but sad that we've almost given up on anything beyond that. The total world R&D budget for everything beyond LEO would impoverish a single pharmaceutical company's marketimg budget, so we're probably far from deserving backslapping and high fives.

Most of all, we're far from colonies anywhere other than Earth, and barring a massive change of priorities as reflected in funding, that's the future. Nothing about our ability to launch satellites a few hundred miles up translates to living on the Moon, or Mars.

<comment><USER3> I'd argue that space research is a large enough expenditure that it can only be supported (as in systematically support, not a billionaire gifting their life savings) by the market. There's nothing sad about it, money has to come from somewhere.

If you're talking between NGOs, government, or the market, which one has the most well funded and successful ventures , the market wins every time. It scales better than top down funding and provides longevity and sustained results.

LEO is a great stepping stone and maturity there is a prerequisite IMO for further space exploration. The goal is not just landing on Mars - the goal is building up a space ecosystem, and this seems to be the right start.

<comment><USER4> You can argue that, but of course the only non-LEO missions have all been government projects. It's not as though Apollo missions were private endeavors after all. All of the US and European missions beyond LEO aren't the function of the market. It's also hard to see how the market would support long range probes and so much else that doesn't offer a short term monetary reward.

Still, maybe you're right, and reality is just waiting to catch up to your bold capitalist vision of market forces solving everything.

</comment></comment></comment></comment><comment><USER5> > Competition is already fierce, with Russia and China challenging the United > States for leadership

That's incorrect. Russia hardly ever pushes new things in space lately. China has carefully launched several manned flights, and works hard in government space; but no commercial revolution in space of SpaceX scale anywhere on the horizon, for good reasons.

The biggest opponent of USA in space today is USA itself.

<comment><USER6> When US officials talk up other countries in areas such as military, space, or general technology they do it because they are trying to get funding for something.

</comment></comment><comment><USER7> Move along, nothing to see here.

It is quite stunning how lightweight and meaningless this editorial is. The only real question is why NYT printed it. There is undoubtedly a reason somewhere in the bowels of the newsroom, but it is certainly not a reason to read it, much less to post a link to it.

</comment><comment><USER8> The space race to put a man on Mars is no longer international. It's completely domestic, between NASA and SpaceX. NASA's SLS (Space Launch System) versus SpaceX's BFR (Big Falcon Rocket) is an interesting comparison to examine. Both look promising despite the numerous possible setbacks. Looking forward to upcoming information regarding the manned launches to Mars.

</comment><comment><USER9> Much more info is available elsewhere. It seems like this is the _' deregulate X' for all X_ formula applied to commercial space flight.

I'm not for or against regulations; I think that you can only have a reasonable about particular regulations, and then the analysis is more complex than 'for or against' (tighten this, loosen that, fund this, accelerate this other thing, etc.). It would be great to hear an analysis of the costs and benefits of the specific changes; I'm afraid the only voices are on one side; this change as announced is all about one group's interests, big business; how will it affect others - public interest, taxpayers, science, military, small business, NASA research, astronauts, the use of space in other countries and among partners, etc.?

Here's some much better info than the parent link, though still basically only a detailed rehash of the announcement with no other points of view or analysis:

[https://www.space.com/40692-president-trump-private- spacefli...](https://www.space.com/40692-president-trump-private-spaceflight- policy-directive.html)

A lot of background from a few days ago, also all one-dimensional unfortunately:

[https://www.complianceweek.com/news/news- article/spaceregula...](https://www.complianceweek.com/news/news- article/spaceregulations-jpm)

And a timely money quote:

 _" Right now, we don't let self driving cars go everywhere although we do allow it in a lot of places," Ketcham said. "Eventually, that technology will mature (to a point) that no one will notice. And the same is true in space flight."_

[https://amp.usatoday.com/amp/640565002](https://amp.usatoday.com/amp/640565002)

</comment><comment><USER9> Lots of people on HN keep up with the space industry and news. Is there any coverage of this story elsewhere?

I'd really like to see the other side(s) of this story. I don't trust op-eds at all, especially by politicians, especially by this U.S. administration, especially in regard to it helping its supporters (big business).

EDIT: And trying to hook people with moon colonies is transparent.

EDIT: added first paragraph, to get to the point promptly, and edited the second.

<comment><USER10> See [http://spacenews.com/new-policy-directive-implements- commerc...](http://spacenews.com/new-policy-directive-implements-commercial- space-regulatory-reforms/)

I'm not sure there's really an opposing view in this case. In broad terms, everyone seems to agree that some commercial space policies are no longer serving their intended purpose and are in need of updates. Whether or not this directive will improve matters is unclear, however.

<comment><USER9> > everyone seems to agree

I haven't heard from anyone but big business, who designed the policy, and who are generally the primary beneficiaries of this administration. Have you heard from science? Small business? Public interest groups? Anyone else?

</comment></comment></comment><comment><USER11> So the government created a organization to help with commercialization of space, I don't see how this will help because launch costs are still high and they still have to go through the FAA to launch. Yes launch prices will come down but it's still it's still probably 10-20 years before costs are low enough to reach anything the size of the ISS is even feasible for anything other than governments.

<comment><USER12> > feasible for anything other than governments.

if there's profit involved, then it will be feasible for other entities than gov'ts. For example, if a useful mineral that's hard to obtain is found on the moon (unlikely as it is...), mining and processing it into goods might be the impetus for such a change.

<comment><USER13> There _is_ revenue involved, but not enough to cover the costs. You can do anything and you can sell anything, when engineers use the word feasible they often mean "the prices are right."

</comment></comment></comment><comment><USER14> An underwater colony is far cheaper and more feasible than a moon colony. When people talk about exploring outer space, they should think about exploring the continental shelf and building colonies there rather than building colonies on another planet.

<comment><USER15> Or Bruce Sterling statement in 2004: "I'll believe in people settling Mars at about the same time I see people setting the Gobi Desert. The Gobi Desert is about a thousand times as hospitable as Mars and five hundred times cheaper and easier to reach. Nobody ever writes "Gobi Desert Opera" because, well, it's just kind of plonkingly obvious that there's no good reason to go there and live. It's ugly, it's inhospitable and there's no way to make it pay. Mars is just the same, really. We just romanticize it because it's so hard to reach."

</comment></comment><comment><USER16> Pondering over the uses of such an endeavor.

\- Tourism \- Minerals \- Building a space observatory \- Launchpad for further manned planetary missions.

I did read somewhere that, just as easy it is to get off the moons surface, it's equally or more difficult to get onto it.

<comment><USER5> In addition to selenology (which is a big deal because no celestial bodies other than Earth are so far extensively explored) and places for telescopes, Moon can be a source of some metals (Al, Ti, Fe), oxygen and some other elements, perhaps hydrogen. By mass metals and LOX/LH2 could be the majority of mass transported in Moon-Earth space in near future. Other important payloads are electronics - relatively light - and humans.

So Moon can supply vast majority of material needed for operations in Moon- Earth space. You can maybe launch the materials using a mass driver (some demos here - [http://ssi.org/mass-driver-demonstration- tapes/](http://ssi.org/mass-driver-demonstration-tapes/)), but even more conventional technology will give you results.

</comment></comment><comment><USER17> I just appreciate that SPACE is a recursive acronym.

</comment><comment><USER18> The Mars Colony that people have assured me will be in operation within the next 50 years, is still 150 years away _at least_.

<comment><USER19> We could start building a Mars colony pretty much right now if we wanted to, but nobody is willing to pay for it. Check for example [https://en.wikipedia.org/wiki/Mars_Direct](https://en.wikipedia.org/wiki/Mars_Direct) for a feasible proposal.</comment></comment>


Student in tears after being kicked out of iPhone 6 queue - <AUTHOR> http://www.smh.com.au/digital-life/mobiles/student-in-tears-after-being-kicked-out-of-iphone-6-queue-20140919-10j7uq.html

<comment><USER2> Apple could have handled the lineups better but they make for such good publicity.</comment>


Flatiron Health raised $175M funding round led by pharmaceutical giant Roche - <AUTHOR> http://bits.blogs.nytimes.com/2016/01/06/roche-leads-a-175-million-investment-in-flatiron-health/ <comment><USER2> Awesome for Nat & Zach!</comment>


Ask HN: Rejected from YC? Want to try an experiment? - <AUTHOR>

If you've been rejected from YC and you still plan to carry on with your startup, I'd like to hear from you!
I think it'd be awesome to track the progress of all the other great teams that YC missed out on.
There are a LOT of great ideas that just need some exposure to take off in their own right, or even get noticed for their determination by YC next cycle.
If you would like to contribute a blog post profiling your team & idea, let me know!
Who knows, if enough teams are interested - we might be able to have a 'virtual' demo day of our own!
I'm my username on gmail.com <comment><USER2> we're a profitable company with paying users and an experienced team and we got no-sir'ed and I don't know why.

i don't know who they decided to interview over us, but i can't imagine that every single company is actually generating a profit like we are. feel free to get in touch and ask me anything.

<comment><USER3> The relationship has to work both ways - maybe they felt that you are at a place that is beyond were YC could be of extreme value? If you are making a profit, you've got some options that many startups don't have.

</comment></comment><comment><AUTHOR> I think it would be interesting if the blog name was crowd sourced.

If you plan on joining in the poll is here

<http://www.surveymonkey.com/s/Q6NGSFS>

Thanks!

</comment><comment><AUTHOR> Also it might be a good source of motivation for teams, ensuring you keep making progress on your idea if you know you've got to send a regular update out! :)

</comment><comment><USER4> If you would be interesting chronicling your journey post-YC rejection on tech.li. Let me know - email@example.com

</comment><comment><AUTHOR> Feel free to post your project link if interested, I can drop you all a mail.

</comment><comment><USER5> I'm a single founder, can I still profile my idea?

<comment><AUTHOR> Sure! Personally I think single founders get a tough time of it, no reason why they can't do better than some teams. They accept from the start that all of the work falls to them.

I was part of a UK incubator scheme as a solo founder and was able to fly through decisions that the groups often found tough!

<comment><USER6> That's really the magic of being a single founder. Its true, being a single founder is tough, I am one, I should know. No one to share the downs with you? It doesn't matter because I'm strong enough to handle that. No one to throw around ideas for brainstorm? Ain't that what your social network is for (aka potentially users).

No, I don't choose to be a single founder, I have my eyes out for a great co- founder, but I don't wanna get one for the sake of getting one. And it doesn't help that I'm a technical founder, this really mean I can do everything myself (at the start).

Oh well.

<comment><USER7> I'm one, too.

We're quirkyalone (<http://quirkyalone.net/index.php/about-2/quirkyalone/>) founders. :)

</comment></comment></comment></comment><comment><USER8> I am just curious, contribute where?

<comment><AUTHOR> To a startup blog if enough teams are interested.

The idea being that each team can showcase their idea & demo in a public place (other than on their own site)

With regular blog updates, interviews on how each startup is progressing. A community to celebrate your small successes with.

There are 2000+ teams/solo founders that YC missed out on, being part of that alumnus, people can throw problems out and get some awesome answers.</comment></comment>


8 reasons not to upgrade to Apple's iPhone 6s - <AUTHOR> http://www.networkworld.com/article/2984214/ios/8-reasons-not-to-upgrade-to-apple-iphone-6s.html?nsdr=true <comment><USER2> iPhone 6s isn't even meant to be upgrade option for the current iPhone 6 owners. Rather than that it is intended for iPhone 5 and 5s users for whom last year's version was not tempting enough to switch. And also, it is just realization of the rule: "If you don't move forward-you begin to move backward"

</comment><comment><AUTHOR> Apple announced drastic financial incentives for its new iPhone 6s line because the devices aren't much of a step forward technologically. Most iPhone 6 users won't sense a dramatic difference, and maybe none at all. It leaves Apple with not much to sell other than "new" but not noticeably "improved."

<comment><USER3> > _Apple announced drastic financial incentives for its new iPhone 6s line > because the devices aren't much of a step forward technologically._

"s" devices (4s, 5s, 6s) never are.

> _It leaves Apple with not much to sell other than "new" but not noticeably > "improved."_

Then again, they never played in the "specs" wars much. People have 2 years contract, and when they end, they upgrade their phones. So for them (most in the US) 6s is compared to 5s (2 years back) not directly to 6.</comment></comment>


Backdoor on OS X systems allows full access - <AUTHOR> https://labs.bitdefender.com/2016/07/new-mac-backdoor-nukes-os-x-systems/ <comment><USER2> Super misleading title, the article is about a piece of malware distributed as an app which creates a backdoor while the title implies a backdoor in OS X itself.

<comment><USER3> Yep, actual title: _New Backdoor Allows Full Access to Mac Systems, Bitdefender Warns_</comment></comment>


Input type="password" Needs to Grow Up - <AUTHOR> http://blog.yafla.com/input_typepassword_Needs_To_Grow_Up/

<comment><USER2> There's so little payoff to this scheme that we can safely assume it will never happen, as opposed to bickering about its merits. Here's a couple issues:

* The hashes are themselves password-equivalent, so we've changed browsers and introduced a random crypto dep to arrive at a solution that doesn't improve the security of the app itself (anyone who can see the hash can log in).

* A Gawker-style breakin under this scheme is exactly as bad --- perhaps even worse † --- as it was before, because these hashes are also trivial to crack with an iterative password cracker (of the kind that have been the industry standard since 1990).

* It's now that much trickier to implement a real password storage scheme like scrypt.

There is already a cryptographically sound proposal to improve password-based authentication on the web: SRP. I believe it's RFC 5054. SRP systems don't store trivially cracked passwords on the server and never pass the password in the clear. I don't anticipate widespread adoption anytime soon, but that's the horse to bet on if you have to bet.

† _I'm not totally sure whether DES crypt(3) is faster or slower than SHA1(salt, password), but if I had to guess, I'd guess SHA1 is faster --- speed being one of its primary design goals. Speed kills in password hashes._

<comment><USER3> The author suggests that this solves the phishing problem. Is that true, and if so, is that worthwhile?

UPDATE: I wonder if the author is wrong about this. If we start with the presumption that a user is susceptible to phishing, what can be done to prevent them from entering their password into a text field that uses JS to change their characters to little black circles? Now you'd have to create some sort of browser feature like a "key" icon that appears somewhere outside of the page when you are in a "hashed" password box, and you'd have to teach users not to put passwords in a field that doesn't display the key. If you can teach them all that, you can teach them not to be phished.

And oh yes, while you're trying to teach them that, Facebook is busy teaching them to enter their passwords into a plain text box so they can "find their friends."

<comment><USER2> In a perfect world, it would lessen the impact of phishing by disclosing only a crackable password hash to a phisher. In the real world, phishers will just construct phishing sites that appear to use the "secure" password type but actually don't.

<comment><USER4> Then a password UI that can't be forged could be used, but I agree if you're going to do it, do it right.

<comment><USER2> Have you considered how hard it would be to create a password FORM input that couldn't be forged?

<comment><USER5> How about this: if focus is in a password field, then you get a visual signal somewhere in the chrome--e.g., the color of the location bar changes. Something that HTML+JS just can't do.

<comment><USER2> We can't train users to look for a lock icon to see if they're SSL encrypted, so I'm not optimistic that something as subtle as a URL bar change is going to guide them to secure password inputs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER2> Arguing with everyone who disagrees with you, questioning their motives, and then deleting all your comments is troll behavior. I actually took the time to write the little C crypt(3) loop to make sure I wasn't crazy before making my points; the person who instigated this thread couldn't even bear to stand behind his own words.

On the off chance that anyone thought this was a graceful way to end a pointless argument: no. It's cowardly and rude.

<comment><AUTHOR> How utterly boorish. If I could delete the submission I would because I see zero productive value in it, and I'm a bit shocked at the stunning narrow mindedness of so many.

My motive was simply to have a discussion about web security as it's a recurring topic and element fraught with peril on a rapidly changing web platform.

It's telling enough that you keep pounding on the SHA1 thing (despite the fact that I repeated, time and time again, that the computational complexity of the algorithm is of course open because the implementation doesn't exist. 128 rounds of blowfish if you prefer), that you keep misrepresenting the Gawker attack, that you pretend that it's a proposal to replace SSL (no), and so on. "Argument" to you is disagreement with Thomas Ptacek, who time and time again bizarrely gets upvoted without merit or regard for accuracy.

It's a counterproductive discussion.

<comment><USER2> 128 rounds of Blowfish would still be a password-equivalent hash. You should read up on SRP. Smart people who have spent much more time thinking about this problem than we did have been studying it for over a decade. It's very elegant, it addresses exactly the problem you're talking about, and it's a standards-track technology.

It's true, by the way. "Argument" to me is "disagreement with Thomas Ptacek". It would be pretty weird if argument meant something else to me.

A long time ago, I was on a comp.security.unix thread when Daniel J. Bernstein said something that has been stuck in my head ever since. Responding to _"You appear to be absolutely incapable of realising that there are people in this world who can see more than one side to a question..."_ , he wrote:

 _On the contrary. I see both sides, and I have evaluated both sides, and I have found that one side is vastly superior to the other. This may seem ruthless, but that's how engineering works._

<comment><USER6> Google Groups link to the usenet discussion in question, in case anyone is interested:

[http://groups.google.com/group/comp.security.unix/browse_thr...](http://groups.google.com/group/comp.security.unix/browse_thread/thread/d9f5a55bd2b5181f/2c109f52f04eecdd?q=%22have+evaluated+both+sides%22)

<comment><USER2> Ahhhhh, Nick McClaren. Those were the days.

Incidentally, that's a thread that includes Tim Newsham, Wietse Venema, Daniel Bernstein, and Theo de Raadt. Read it! I do not acquit myself well on it. I miss Usenet, but I have gotten _much less_ obnoxious in the intervening decade.

</comment></comment></comment></comment></comment><comment><USER7> Really pointless. I posted this to the site:

 _The password is automatically salted with the domain and username

...which is exactly as secure as Gawker.com themselves doing a salt+hash.

Let's for a minute assume what you're proposing is what's being done. Gawker has been attacked. The hacker has the columns "password" and "username". Hacker knows the domain name. You're exactly where you left off!

Even if the password has been again hashed and salted on the server - that's just an extra round of cracking (or, more realistically, rainbow-table matching).

What you _should_ be doing is using a single, trusted and very much secure password provider (a la OpenID). Hacker attacks your site, gains nothing. And if you must do the authentication yourself, or the nature of your userbase prevents you from outsourcing the authentication (perhaps you are the OpenID provider we're talking about earlier), you need to be using something more complex than a silly MDx or even SHAx to do the hash - these are made for boiling down huge amounts of data into a small field of not more than ~256-4096 bytes - which is NOT what you want. Look at bcrypt - it's DESIGNED for this. It's a solution waiting for more and more attacks like Gawker.com so lazy and incompetent developers worldwide will use this existing, plug-and- play, simple, direct, and safe alternative to what they're currently doing._

EDIT

Regarding rainbow tables - I'm predicting that with todays resources and cloud super-computing, etc. (just look at the new EC2 GPU instances!) we're going to see a new type of rainbow tables that actually precompute the hashes for different salts as well. It's an order of magnitude larger data and more computation than last generations rainbow tables, but todays tech is more than an order of magnitude more available.

<comment><USER8> > or, more realistically, rainbow-table matching

I think that's not true - you'd have to generate new rainbow tables for each user for gawker. So this method would indeed make rainbow tables impractical.

edit: but I think the rest of what you said is fine.

<comment><USER2> You already can't use "rainbow tables" on Gawker password hashes.

</comment></comment></comment><comment><USER9> Look, the reason I use a single password for most of the sites I visit is that _I don't care_ if you figure out my password for those sites.

So yes, if you run a site that wants to steal my password, you can do all sorts of things pretending you're me, such as downloading copies of mysql, posting to a few random message boards, watching my Hulu favorites, etc. None of which are things I care about. That's why they all get the same user/pass. Because I don't want to spend even one second dealing with user/pass stuff for sites where security is not an issue.

Now, if you did somehow manage to get my Techcrunch password or whatever, you still wouldn't be able to log into my Gmail account, Bank, or anything I care about because I have strong passwords for those.

Notice how there is no technical solution to the above because there is _no technical problem_ above. For 90% of the sites you need credentials for, those credentials just are not worth bothering to secure.

</comment><comment><USER10> Right, because we've never had to upgrade our security measures, so browsers should have a set of measures built-in that can't be easily upgraded. That's a great solution.

I think it would be a LOT more useful to have a site that discusses security and the current best-practices for dealing with it. Instead of everyone taking their best guess, let most people follow along until they have an idea to make security better than standard. And if it really is better, it can be promoted to the new standard.

</comment><comment><USER11> There's already solution to phishing, remembering passwords and whatever else. Only three words: client X.509 certificates.

Well, if Google'll fix Chromium to play nice with them.

</comment><comment><USER12> Stanford's Dan Boneh has written about this quite a bit: <http://crypto.stanford.edu/~dabo/pubs/abstracts/pwdhash.html> [http://crypto.stanford.edu/~dabo/pubs/abstracts/passwordmgr....](http://crypto.stanford.edu/~dabo/pubs/abstracts/passwordmgr.html)

</comment><comment><USER13> i assume the obvious issue with this is browser support? and what about mobile platforms? and then having everyone agree on a standard method for the salt/hash? sounds nice in theory though.

<comment><USER14> This scheme has another fatal flaw: What happens when a site moves to another domain?

All accounts will go poof...

<comment><USER15> And how do you handle subdomains? Different hash, or same? They could be different sites entirely, but they're also more likely to change, so you've got the same domain-change problem.

</comment></comment></comment><comment><USER16> This scheme would break down as soon as you need to use the password not only through your browser, but also through say SSH, sudo, or Thunderbird. Also, just use a random password + your built-in password manager for the browser with a master password. No yelling into the voids of the internet required.

</comment><comment><USER17> Producing domain dependent hashes is a bad idea -- if the hash is properly created (that is, not the way described in the post, proper key-strengthening algorithms should be used) it should already be functionally one-way, meaning that passwords would be completely non-portable.

<comment><USER18> "that is, not the way described in the post, proper key-strengthening algorithms should be used"

Like what? Please correct the post, becaues it seems to be quite vague about the "key-strengthening algorithms". Secondly, non-portability of the passwords is the entire purpose.

This is my first exposure to Hacker News, after hearing nothing but good things about it, and honestly it has been a shocking disappointment.

I read the article, thought it sounded interesting if incomplete, and felt mildly enlightened.

Since then I've watched as post after post has either misreprented what it actually said, or simply posted something completely wrong. Most of the people in this discussion seemingly don't know what a hash, salt, rainbow attack or dictionary attack are.

It is very disappointing. I will continue my downward cycle of points with this post, so this shall be my swan song, but really this place is no more illuminated, or no less a circle jerk, than Reddit r/programming. Disappointing.

<comment><USER17> _Secondly, non-portability of the passwords is the entire purpose._

Non-portability of the passwords _outside of the site_ is the purpose, but what if you wish to use the same password database on either a varying subdomain or on the same network, well, that wouldn't be possible. For example, Gawker runs a number of different properties and shares passwords between them. This is impossible if passwords are domain-encoded. This also has consequences for sites like Google which also use account sharing across domains (including some of their Same-Origin Policy domains to enable cross- site interaction).

 _Like what? Please correct the post, becaues it seems to be quite vague about the "key-strengthening algorithms"._

You may want to read the Wikipedia article[1] on key-strengthening. If you have mostly been exposed to older cryptographic techniques (e.g. salting and rainbow tables), this will tell you the basics of more advanced (and modern) password cracking. The most important thing that the article screws up is encourages non-standard cryptography usage. Cryptography is ridiculously difficult to get right even if you're an expert so cryptographic recommendations should always be based around a standard written by cryptographic professionals. The RSA standard here would be PBKDF2[2], while Hacker News' own cryptography research Colin Percival wrote a utility called scrypt[3] for the truly paranoid among us. This full category of strong password negotation and verification is embodied in the SRP[4] standard, which uses similar techniques.

 _Most of the people in this discussion seemingly don't know what a hash, salt, rainbow attack or dictionary attack are._

Eh, some people it seems are misinformed. tptacek, for example, knows what he's talking about. He's correct that SRP is really the relevant standard for the full authentication system here, as well.

 _Since then I've watched as post after post has either misreprented what it actually said, or simply posted something completely wrong._

The post also spends a tad too much time coming up with "fake" solutions -- that is, solutions which take little effort to get 90% of the way there but a huge amount of effort to take to 100%.

 _It is very disappointing. I will continue my downward cycle of points with this post, so this shall be my swan song, but really this place is no more illuminated, or no less a circle jerk, than Reddit r/programming._

From my latest browsing in Reddit, r/programming seems to be a congregation of unusually determined morons, but to each his or her own I guess. One of the reasons you may have been downvoted (which has gotten a little excessive here as of late, but I digress) is that your comments actually don't contain a lot of information in them. For example, one of your posts just says "you're wrong." This _may_ just barely get by if you're an established member of the community with public credentials to back up your point but you have no history, no name, and no information. Why should we think you're anything other than an angry idiot with a keyboard?

[1] <http://en.wikipedia.org/wiki/Key_strengthening>

[2] <http://www.rsa.com/rsalabs/node.asp?id=2127>

[3] <http://www.tarsnap.com/scrypt.html>

[4] <http://srp.stanford.edu/>

<comment><USER19> _He's correct that SRP is really the relevant standard for the full authentication system here, as well._

see, this is one of the places where I get confused. i don't read this proposal as being an authentication system. i read it as being an attempt to aid users in creating strong passwords that are not shared across sites. the proposed implementation certainly isn't perfect (i much prefer the implementation provided by <https://addons.mozilla.org/en- US/firefox/addon/3282/> , but that also has problems ), but it seems to me that many of the critiques presented so far are trying to measure this proposal against the wrong metrics.

<comment><USER17> First sentence of "What is SRP?":

 _SRP is a secure password-based authentication and key-exchange protocol._

<comment><USER19> "this proposal" was meant to refer to the article, not SRP. hence my comment that we're measuring it against the wrong metrics: it's no surprise that this proposal doesn't stack up when compared to SRP, since, to my reading, it isn't meant to be compared to it.

</comment></comment></comment></comment></comment></comment><comment><USER20> I wonder how well client-side SSL certificates could aid in this process. This way servers would only have the public key of a user and as long as the user doesn't compromise their private key they'd be safe.

<comment><USER21> They're certainly available -- at least, in Mozilla -- but usability is poor. The most obvious issue is that there's no obvious way to copy a client-side certificate to another machine, making it incredibly awkward for users who use multiple computers (or, worse, who only have access to shared computers).

</comment></comment><comment><USER22> It does not solve phishing _at all_. Phishers simply won't add secure flag to the input, and will get raw password needed to create hash for every site.

Even if all password inputs were always hashed, phishers could write their own plaintext-stealing imitations in JavaScript.

</comment><comment><USER23> Like others here have mentioned, what the writer is missing is that when a single solution for creating these hashes are implemented, web-wide, browser- wide, the hashes themselves are equal to the passwords. On this merit alone, the proposal fails.

<comment><USER19> i'm not sure i understand why that's a failure. my understanding is that's the point: every user now has a password that is unique on a per-domain basis. i don't understand this to be an attempt to protect against the kind of attack that gave access to the gawker passwords, but rather an attempt to limit the scope of such an attack to only a single site.

if there's something that i'm missing here, can you please elaborate on it?</comment></comment>


Never take notes again: Chorus Notetaker, record and transcribe your meetings - <AUTHOR> http://community.chorus.ai/blog/never-worry-about-notes-again <comment><USER2> Super excited to be launching this! Next gen conversation AI</comment>


Google chief Eric Schmidt condemns Carrier IQ - <AUTHOR> http://www.telegraph.co.uk/technology/eric-schmidt/8945171/Google-chief-Eric-Schmidt-condemns-Carrier-IQ.html "We certainly don't work with them," said Mr Schmidt, describing the software as a "keylogger". <comment><USER2> "Android is an open platform which means people can makes software for it that's not very good for you," Mr Schmidt said.

"This [Carrier IQ] appears to be one [such case], he added.

</comment><comment><USER3> What I'd really like to know are the carriers who pre-installed this software. Carrier IQ is just the hammer. So who was swinging it?</comment>


Mapping Neighborhood-Level Obesity in the United States - <AUTHOR> http://www.datainnovation.org/2015/09/mapping-neighborhood-level-obesity-in-the-united-states/ <comment><USER2> Developer here, obesity is strongly correlated with race, ethnicity, educational attainment. So, yes, income and poverty play a key role, but are not the sole determinants of obesity. The obesity map doesn't look exactly like either a poverty map, or a race map, or an education map-- it's a synthesis of how those factors influence obesity. See the home page [http://synthpopviewer.rti.org/obesity/](http://synthpopviewer.rti.org/obesity/) for additional background on how the data were created and be sure to look at layers depicting significant clustering of the results.

<comment><USER3> Thanks for that writeup link, that's really helpful in understanding what you've done. So everyone saying how the map correlates with various socio- economic factors is right (in various ways) because the obesity determination is entirely derived from socio-economic variables. That makes sense, but it wasn't clear until I read the writeup you posted that that's what we're looking at.

</comment></comment><comment><USER4> Here's a direct link to the tool instead of to an article about it: [http://synthpopviewer.rti.org/obesity/viewer.html](http://synthpopviewer.rti.org/obesity/viewer.html)

</comment><comment><USER5> I just ate a full meal from McDonalds this week for the first time in a while, and realized that I ate around 1000 calories, and was still a little hungry. This was really surprising, since 500 calories of healthy food can make me feel full.

<comment><USER6> Not that surprising tbh, Satiation isn't directly dependent on calories consumed but on various markers such as chewing, pressure on stomach wall and certain chemical responses.

Junkfood short circuits most of these, it's incredibly calorie dense and is easy to eat quickly since it requires little chewing, by the time your body signals satiation you can easily consume 1300 calories or more.

I've been on a calories restriced diet for the last 4 months (1500 or less a day) and I've eaten a few times at McDonalds, I just get a quarter pounder (higher meat to carb ratio, meat increases satiety more than carbs per gram) and a diet coke and then eat is in small bites and chew it thoroughly, by the time I'm done I feel the same satiation as I would have done bolting down a big mac and fries previously.

So far I'm down 45lbs with another 10 or so to go.

</comment></comment><comment><USER7> Would be better to analyse other factors over the top of these. Income I guess is obvious, however transport probably is significant. Can you cycle/walk/get good public transport?

What about topography?

<comment><USER4> If you click through to the "SYNTHPOPVIEWER," you can see other factors on a similar map, but not overlaid. [http://synthpopviewer.rti.org](http://synthpopviewer.rti.org)

</comment></comment><comment><USER8> My cursory glance seems to suggest higher obesity neighborhoods tend to be lower income ones. Though that observation is completely anecdotal based on my life experiences living in different parts of the country.

<comment><USER9> Yeah, that divide is extremely well delineated in DC, in an incredibly freaky way. Although I was quite interested to see the diversity of the pixelation in Great Falls which is one of the wealthiest areas of Fairfax County/ DC Suburbs. I suppose if you're really really rich you either take great pains to be in incredible shape or you just let yourself go completely.

<comment><USER10> I just noticed the same (and made a similar comment in response elsewhere).

</comment></comment></comment><comment><USER11> I get the feeling they could simply interchange income maps for obesity maps and no one would know which is which.

<comment><USER12> Not exactly, Flushing in Queens is not obese, but isn't at all a rich neighborhood (assuming blue=good, red=bad, this thing doesn't have a key).

[https://en.wikipedia.org/wiki/Flushing,_Queens](https://en.wikipedia.org/wiki/Flushing,_Queens)

<comment><USER13> It's also full of east asian immigrants, which are less likely to be fat (look up the obesity rate in Korea, for instance - it's almost 0)

</comment></comment></comment><comment><USER14> In rural areas, the neighborhood squares cover individual houses. I'm seeing some where my daughter lives that cover individual people. They seem accurate, the blues and reds live next door to each other.

</comment><comment><USER15> In Los Angeles, it maps out to ethnicity pretty nicely. I don't know why, I wouldn't think it would, but it clearly does.

<comment><USER16> Yeah, even more so than income. It is kinda weird that way.

<comment><USER15> The only thing I can think of is vestigial cultural rules being a determining factor; what you eat, when, how much - what your hobbies tend to be, how much you move in life.

Every individual of course sets his or her own path, but populations taken as a whole seem to exhibit dominant patterns.

<comment> minority-one So the only thing you can think of to explain this is cultural factor?

You don't think genetics could be a factor here at all?

<comment><USER15> Sorry. I claim zero knowledge of epidemiological obesity studies or theories. In retrospect, it was not my place to conjecture at all --- I really don't know anything about this.

Although for a thoughtful and thorough analysis:

An introductory wikipedia article: [https://en.wikipedia.org/wiki/Epidemiology_of_obesity](https://en.wikipedia.org/wiki/Epidemiology_of_obesity)

Google scholar search: [https://scholar.google.com/scholar?q=epidemiological+obesity](https://scholar.google.com/scholar?q=epidemiological+obesity)

</comment></comment></comment></comment></comment><comment><USER17> Interesting. My read on this map is that it also tracks the urban/non-urban breakdown very neatly: as you get out of the urban code, obesity %s increase dramatically.

<comment><USER18> There seems to be some kind of 'periphery' effect too, in places: zoom in on Portland, Oregon, and it sort of looks like there's a red ring around the town.

I could see it being a 'rural' thing, but the ring is weird.

<comment><USER4> That could just be from gentrification pushing lower income people out of the city center. Similar things have happened in DC, Chicago, etc. This Wired article shows some of that effect. [http://www.wired.com/2013/08/how- segregated-is-your-city-thi...](http://www.wired.com/2013/08/how-segregated- is-your-city-this-eye-opening-map-shows-you/)

<comment><USER17> I don't think so, at least in Seattle. Looking at the city breakdown, it corresponds to transit coverage and (my perception) transit friendliness. It actually seems to correspond inversely against income, since the transit coverage is vaguely inverse with Seattle income.

This is, by the way, a strong conflict with East Coast cities in the US, where there's a decided "obese area" visible. I don't have insight into those from the ground level.

</comment></comment></comment></comment><comment><USER19> This map follows the income distribution in my area very closely. Neat, but sad.

</comment><comment><USER20> How do we fix food deserts? I have no idea but I wish we could solve it.

If I was a billionaire I would subsidize running Whole Foods in impoverished neighborhoods.

<comment><USER21> A big misconception about fixing food deserts is that if we could "just add healthy options", the problem would be solved. But it's not that simple ~ it's an education and cultural issue. Where I live has a lot of red dots on this map and is not considered a food desert, I've got several grocery options. The issue is folks here are deeply steeped in modern southern food culture (fried on top of fried everything. all white bread and meat. very few vegetables, if any) combined with low income and education. They simply don't want to eat "rabbit food" (I'm quoting from actual conversations). Suggest anything different to them and they are offended. My (obese with numerous health issues) neighbors think my wife and I are "libruls" because we eat normally. It's a whole different mindset that you must empathize with and understand before talking about how to fix it.

</comment></comment><comment><USER12> Where does the data come from? It doesn't say.</comment>


The Icelandic translation of Dracula is actually a different book - <AUTHOR> http://www.smithsonianmag.com/smart-news/icelandic-translation-dracula-actually-different-book-180963346/?no-ist <comment><USER2> I'm surprised the differences could have been kept out of mainstream literary research for so long. I read Dracula in my 11th grade english class. If it's taught in high school, you'd think there'd have been some sort of academic trading (foreign exchange, university collaborations, etc) between countries that noticed the differences. Sounds like they missed out on a chance to publish.

<comment><USER3> Well, it was Iceland circa 1902. It had a ~75,000 person population and was fairly isolated from the world. This run may have been as little as few (couple?) hundred books. I could see such a small run being ignored for a long time. How many of those weren't disposable weekend reads that ended up in the trash within weeks/months? I imagine once the initial novelty wore off, no one cared and Iceland's small number of Icelandic readers guaranteed that their version wasn't going far.

I also imagine some Icelandic people knew they had a different version, but Iceland, up until recently, was just a backwaters of Denmark. It may have been an amusing anecdote between Icelandics and the Danish or English who read the true version. Maybe an inside joke between a couple dozen people? Not enough to make the international press. Now its just a historic novelty on the smithsonian mag blog, not exactly the front page of the NY Times.

<comment><USER4> Up until recently? In Vampire years you mean?

</comment></comment></comment><comment><USER3> > Stoker could, for example, have sent Valdimar an older version of his story

Back in the old days, I could see happening as purely a mistake and considering how global communication worked then I can certainly see this not noticed for quite some time. Stoker's publisher could have grabbed the wrong manuscript and sent it out. Considering the Amazon reviews claim that the second half of the book is, at best, a rough outline, then I'm guessing this is probable. It sounds like an unfinished and abandoned work that somehow got into production.

</comment><comment><USER5> I believe it was actually pretty common in those days for translators to abridge and adapt much more freely than what would be considered acceptable today.

<comment><USER6> Especially if the medium was different, like publishing in a newspaper:

"originally published in serial form in an Icelandic newspaper in 1901"

I think now researches would like it to be directly based on some other version of Stoker's work, as that would give them more value, but I believe it's more probable that the translator did the adaptations himself. I guess it was for him just like today nobody expects the film based on the book to be one-to-one transcription.

Loosely related, in Italy, Mickey Mouse comics were traditionally written and drawn by Italian authors:

[https://en.wikipedia.org/wiki/Topolino](https://en.wikipedia.org/wiki/Topolino)

"The first issue of Topolino was published on December 31, 1932: it contained Mickey's first Italian story drawn by Giove Toppi.[1]"

"Nerbini hadn't correctly secured the publication rights, so when Emmanuel (Disney's representative in Italy) protested, Nerbini changed the title of the comic book into Topo Lino (Mouse Lino), replacing Mickey Mouse with Topo Lino, another mouse. When Nerbini bought the publication rights from Disney and KFS (King Featured Syndacate), he changed the title back to Topolino."

"In 1952, the comic book became a biweekly, and Italian stories increased. Italian stories were written mainly by Guido Martina"

[https://en.wikipedia.org/wiki/Disney_comics](https://en.wikipedia.org/wiki/Disney_comics)

"The number of Disney stories produced and published in Italy is far larger than in the US. Italian stories are regularly translated in other European languages (e.g., German, French, English, Greek)."

</comment></comment><comment><USER7> I have this version:

[https://www.amazon.com/Powers-Darkness-Lost-Version- Dracula/...](https://www.amazon.com/Powers-Darkness-Lost-Version- Dracula/dp/1468313363/)

It's a nice book and an interesting story. Anyone who loves Dracula, translation, or gothic stuff will probably like it.

<comment><USER8> So that's the translation back from the Icelandic that the article mentioned?

Have you read the original English version as well? If so, which do you think is better?

</comment></comment><comment><USER9> "Shorter and punchier" makes sense if it was originally intended to be published in serial form.

<comment><USER10> And the author was paid by the word.

<comment><USER11> You get Dickens-esque wordiness from pay-by-word, not short and punchy

</comment></comment></comment><comment><USER12> This sort of 'translation is basically a different product altogether' setup was still quite common in other media until rather recently. Just look how many video games were completely overhauled for other markets. Super Mario Bros 2 is the obvious and often wheeled out example, but stuff like Totally Rad and Decap Attack were absolutely nothing like the original works they were based on.

It was pretty common in anime too at one point. See Robotech, which is infamous for actually being three separate series stuck together into one.

But it's interesting to see an example where the original author was seemingly involved in modifying the story for local publication.

</comment><comment><USER13> It's about the Dracula's monster

</comment><comment><USER14> Was anyone else completely blocked from reading that article because all the ads wedged the browser?

<comment><USER15> I've started reading everything I can through a proxy that removes everything except for the text and hyperlinks.

<comment><USER16> Is this something you've set up yourself, or is there a service you can direct us toward?

<comment><USER15> I use textise.net

I tried setting up my own, but it was quite a bit harder to manage everyone's broken SSL than I first assumed.

</comment></comment></comment></comment><comment><USER17> _grins_

The Russian translation of Pinocchio is actually a different book!</comment>


Startup economy is a Ponzi scheme – Chamath Palihapitiya - 100-xyz https://www.cnbc.com/2018/10/10/start-up-economy-is-a-ponzi-scheme-says-chamath-palihapitiya.html <comment><AUTHOR> For better or worse, he is not far off although Ponzi scheme is a harsh word. It has become clock work routine for most startups to get some users, get some angel funding, hire, scale, get VC money, pour more money and get more users, ???? , then profit!

Launching a startup used to be something that entrepreneurs loved. And now I see all my acquaintances are either pounding the pavement begging for angel money or dreading the routing morning phone calls from their own startup.

Make Bootstrapping Great Again

<comment><USER2> I'm bootstrapping my current, after doing the funding thing in the past. It's a refreshing experience, like what I wanted my first attempt (c2001) to be.

You have my vote.

</comment></comment><comment><USER3> I don't understand where the Ponzi scheme aspect comes in. Can someone explain it?

<comment><USER4> Ponzi Scheme = the top takes the cream and leaves others to deal with the rotting milk. A potential bad scenario example is...Uber. Stratospheric valuations that will offer excellent payoffs to most investors at IPO but by the time public markets come in, the top value has already been actualized and the narrative "it's a giant market" collapses once the reality that it has been achieved through high CACs and unsustainable cash flow levels.

Howard Marks - a bond investor - puts it well. If you are a professional investor you cannot afford to buy into overpriced stocks because by definition they have already topped. The basic unit here is the "buy low sell high" concept. This is why seed and Series A has been most attractive to VCs - equity is cheapest, if you invest in the right companies.

Tech stock and private tech is overvalued as far as the public buy side is concerned. This has been absorbed because the market is doing well. Private tech isn't going public for this exact reason: the public demand isn't meeting the private valuations. This is bound to crash at some point, most likely when the leading companies (uber, air bnb) are put under the microscope.

I don't know what will happen to all these companies flush with cash. They could be in business for years, even decades.</comment></comment>


The Kingdom of the Dead: For post-Soviet people, Crimea was a gigantic madeleine - <AUTHOR> https://nplusonemag.com/online-only/online-only/the-kingdom-of-the-dead/ <comment><USER3> The first paragraph really spoke to me, because that is how I spent every summer for the first 14 years of my life. My family took a trip from Kiev to Yalta as a summer vacation. The joy and excitement mixed with hot, gross conditions of the train are spot on. I will forever hold onto those memories as some of my most precious.

This year I went back to Kiev for the first time in well over a decade since I moved to the US. To see my family, friends, as well as show my wife all of the places and the way that I grew up.

Due to the current political climate and overall conditions in Crimea going there was not even an option for us. A real disappointment as some of my most cherished memories were formed there.

<comment><USER4> I am pretty sure that visiting Crimea would have been a safer option to visiting Kiev. Many, many Ukrainian citizens continue to visit the peninsula even today.

<comment><USER3> This isn't something to have an argument over. However, while in Kiev I did not see a single armed person nor any signs of conflict. My visit was almost a month ago.

On the flip side, Crimean border is protected by armed forces on behalf of Russia and overall sentiment in the peninsula is not that favorable to Ukrainians.

Though I do agree that many still visit. My only point was that I did not feel comfortable.

</comment></comment></comment><comment><USER5> > They called the Tatars "heathens," "uncivilized" and "warlike," evoking old > stereotypes about the Turks.

That resonated with me. My childhood is peppered with memories of Russians, who were bused in at some point by the Soviet Union to take over administrative positions, telling me to speak a "human" language - <USER2> instead of my native language (implying I was sub-human). I always remember that and am sad for them for living with that kind of prejudice (especially when you tell that to a child).

<comment><USER6> The Tatars, 300 years ago, were excellent warriors and horsemen.

They would raid the nearby Ukrainian and Russian villages and sell the villagers into slavery. In one year, 1769, they captured 20,000 and sold them in slave markets in the Ottoman Empire.

From 1500 to 1700 or so, between 1 and 2 million Slavs were captured and sold off into slavery.

The end of the Crimean Khanate is about as distant in history as the Revolutionary War that started the USA. Of course Tatars don't do this anymore, but some people unfortunately prefer to remember old grievances and raise them again and again.

<comment><USER7> That's why when I see photos of the Syrian war, I see so many blond and blue eyed children. I assume they are the descendants of the Slavs(slaves) you are talking about

<comment><USER8> You have no clue what you're talking about. To begin with, Slavs != "slaves". Learn the etymology of the word and read up on some history: [https://en.m.wikipedia.org/wiki/Slavs](https://en.m.wikipedia.org/wiki/Slavs) Once you're done, use Wikipea or Google to look for Indo-Iranians, their physical characteristics and their movement from 4000-1000 BCE ((TL;DR blue- eyed people didn't originate in Europe). Good luck.

<comment><USER7> Origin of the word Slave : "The term slave has its origins in the word slav. The slavs, who inhabited a large part of Eastern Europe, were taken as slaves by the Muslims of Spain during the ninth century AD."

Source BBC: [http://www.bbc.co.uk/worldservice/africa/features/storyofafr...](http://www.bbc.co.uk/worldservice/africa/features/storyofafrica/9chapter1.shtml)

</comment></comment></comment></comment></comment><comment><USER9> In terms of Kingdom of the Dead, what is interesting is that the Black Plague (which would kill about 1/3 of Europe) is speculated by some to have entered Europe from Crimea due to the siege of Caffa (also spelled Kaffa) by the Tatars. The Tatar army was devastated by the Plague, and before they left, they catapulted the infected bodies into the city. In the city were Genoese traders who left the city and took the Plague back to Europe.

</comment><comment><USER10> Can someone explain what is the meaning of "madeleine" here? Is it referring to the famous incident of "let them eat cake"? I'm not familiar with it being used to refer to anything other than food.

<comment><USER11> I think it's "one that evokes a memory": [http://www.merriam- webster.com/dictionary/madeleine](http://www.merriam- webster.com/dictionary/madeleine)

That seems to be how it's used in the article and some of the comments here:

"Crimea was the ideal site for this post-Soviet reunion, since it was the place where so many children, now adults, had spent their happy summer vacations, flocking there from all over the Soviet Union. For post-Soviet people, Crimea was a gigantic madeleine."

I see others have beat me to a response. m-w also has a paragraph about it:

"The madeleine is said to have been named after a 19th-century French cook named Madeleine Paumier, but it was the French author Marcel Proust who immortalized the pastry in his 1913 book Swann's Way, the first volume of his seven-part novel Remembrance of Things Past. In that work, a taste of tea- soaked cake evokes a surge of memory and nostalgia. As more and more readers chewed on the profound mnemonic power attributed to a mere morsel of cake, the word madeleine itself became a designation for anything that evokes a memory."

I had never heard of it either.

<comment><USER12> This is also the reason that you sometimes find Madeleines flavored with earl gray tea. It's something of a literary joke about Proust, who helped make the cookies famous.

<comment><USER13> Technically, they are small cakes, not cookies.

</comment></comment></comment></comment><comment><USER14> Well, it does make me want to go and see for myself. It could be more interesting if I knew some russian.</comment>


OpenMediaVault 1.0 "Kralizec" released - <AUTHOR> http://www.nasstorageserver.com/2014/09/15/nas-openmediavault-1-0-kralizec-released/

<comment><AUTHOR> OpenMediaVault ("a next generation network attached storage (NAS) solution") has gone 1.0. Free and Open Source NAS, challenging FreeNAS.</comment>


Show HN: Review my new project - <AUTHOR>

Hello HN!
I just launched a new social iPhone game called "unun". It's like drawsomething but in a puzzle way. You can also animate your puzzle and message your friend during the game. Would definitely enjoy any feedback so I can make it better! Feel free to check out the demo video and download it from appstore.
Demo video: https://www.youtube.com/watch?v=G8aPmDej65s
Download: https://itunes.apple.com/hk/app/unun/id555254223?mt=8 <comment><USER2> This is really beautiful. Some notes.

1) Get someone to proofread your app and app copy. There are some awkward sentences in your app description and intro video and also some grammar mistakes. It's pretty late so I don't have time to do it myself.

2) Suggestion: have the player play with a bot (against the computer) in the tutorial so they understand how it works.

3) Suggestion: have the option for the player to play against a random user. Sometimes I don't want to have to invite a friend (because it's annoying).

<comment><USER3> All 3 of these are great points.</comment></comment>


Florida Teen Arrested in Twitter Hack - <AUTHOR> https://www.nytimes.com/2020/07/31/technology/twitter-hack-arrest.html <comment><USER2> Only 17 and his life is ruined... what a shame all around. A total embarrassment to Twitter, luck to the US that it seems that it wasn't foreign actors, and technical skills that probably could have been put to better use to eventually make that money legitimately instead all goes down the drain, and possibly money never returned (?) to those scammed.

<comment><USER3> I'm sure he'll be fine. They'll let him stir in jail for a few years to break him of the notion of ever doing it again, then he'll get picked up by a three- letter agency and recruited to do the same kind of work for them as a condition for getting out of jail early.

<comment><USER4> This doesn't actually happen.

<comment><USER5> Yeah call my a cynic, but if a 17 year old capable of this actually got caught, It doesn't seem that hard to do in the first place.

I wonder if someone gave them the exploit

<comment><USER6> This was phone-based spear phishing, social engineering. There was no exploit.

</comment></comment></comment></comment></comment><comment><USER7> If this teen was the person who did the hack, it would make more sense it was just a BTC scam. You could do _way_ more impactful (worse) things with the access he (presumably) had.

</comment><comment><USER8> Given my current trust level towards government I find it hard to not think it's either a sacrificial lamb or a case of a kid claiming it was him and unexpectedly found himself taken seriously. I find it easy to believe it's a PR move to delay bad publicity. Worst thing today is we can't even tell that truth will be uncovered in the future because we have no transparency and no way to tell what is what.

<comment><USER6> I'm similarly skeptical of the government, but this is no Lee Harvey Oswald. There's no dead president. These "double your cash" scams are widespread and some of the least sophisticated sorts of scams. It was poorly worded and the website that was intended to give each visitor a unique wallet address (which would have made block chain analysis difficult) was not even functioning properly. There was no exploit, it was social engineering via phone. Why would the government even bother? As others have noted, more sophisticated attackers could have caused much more damage (manipulated markets, precipitated political crises, et cetera). The guy was selling Twitter usernames on a forum that people use to sell accounts. It wasn't just boasting, there are actual transactions that occurred over Discord and at ogforums.

</comment></comment><comment><USER9> It makes total sense in hindsight that the original aim of the hackers was not some low-netting Bitcoin scam, but it still feels unsatisfying that all they were after with such elevated access was the sale of high profile usernames.

</comment><comment><USER10> [https://news.ycombinator.com/item?id=24011939](https://news.ycombinator.com/item?id=24011939) on front page

<comment><USER11> That one is blocked for Europeans.

</comment></comment><comment><USER12> How did he lose control of the $700K? If he had any clue that he was being investigated why do this?</comment>


Wikipedia: re-writing history - <AUTHOR> http://wikipediocracy.com/2014/10/12/wikipedia-re-writing-history/

<comment><USER2> Whassa matter, he caught The Mighty Wiki with its pants around its ankles, and it isn't an "interesting story" for Hacker News?

How would you like it if Wikipedia defamed YOU personally for six years?

</comment><comment><AUTHOR> For six years, Wikipedia named Boston College basketball player Joe Streater as one of the key figures in the 1978–79 point shaving scandal. Streater was innocent: he wasn't even on the team that season. Yet this spurious fact came to be quoted by Associated Press, TV networks and countless others.</comment>


Ask HN: Should companies blame a third-party for a defect/problem? - <AUTHOR>

WakeMate once blamed China when the power adapter shipped with it damaged the WakeMate. Later another Hacker News thread talked about whether Reddit should blame Amazon for the outages. What do you think? <comment><USER2> There's another situation I've seen happen where there's clearly a problem with a third party's component, and customers are looking to you to fix it, but the third party is genuinely not to blame for the problem and it would be unfair to expose them to the negative PR which would result. In my case this was with a component on a car which caused what looked to the customer to be a worrying defect (so the negative PR would have been significant), but was in fact completely harmless, and it only ever manifested in a fairly narrow range of meteorological conditions.

All you can really do then is hunker down and work together to fix the problem. There's nothing to be gained by alienating the only people who can fix something which is, at the end of the day, making _you_ look bad.

</comment><comment><USER3> I think an important corollary is whether or not disclosing the source of a problem outside of your organization automatically assigns blame to them, intended or not.

In my opinion, however, the most important trait of a press statement regarding defects/problems is who outright says "I (we) accept full responsibility" or "I (we) place full responsibility on X". If that isn't ever said in some way, shape, or form, and it's just implied, I think that shows less character than at least making a call one way or the other, and accepting the consequences.</comment>