Does academic research cause economic growth? - <AUTHOR> http://lemire.me/blog/archives/2013/02/26/does-academic-research-cause-economic-growth/ <comment><USER2> For the studies mentioned, how do you decide what leads to economic growth and what doesn't?

Take Lasers for example. The first Laser was made at Bell Labs, a commercial research lab. It would not have been possible without the maser that came before it in academia, or the work done by Einstein, also in academia. Lasers have had an immense economic impact, but do we credit them to academic or commercial research?

The answer is _both_.

Academic research is less frequently the final link in the long chain to profits than commercial research is. This is only natural since commercial research labs are motivated to invent products that will make money while academics can afford to take a longer view.

Why else might nations that spend a lot on fundamental science benefit? A skilled work-force. Scientists may publish how their experiments work in broad strokes, but the nitty gritty details are often something that can only be learned by working in a lab. If your country has a lot of labs, you have a workforce that commercial enterprise can draw upon to bring products to market based on research. A country can always lure immigrants, but having a home- field advantage is more cost effective.

<comment><USER3> The author is misrepresenting his first quoted study: 'little or no _direct_ effect', my emphasis. He takes this to mean 'no effect', which is a lot of screaming bullshit, as you say.

Another example of government research being very beneficial in an indirect manner is in things like mental illness research. Little is done privately outside of pharmaceutics, yet improved treatment of mental illness significantly improves the economy - workers are more productive, more people participate in the workforce (and subsequently fewer crimes), and of course there are a ton of non-economic benefits.

 _Similarly, the US saw a massive economic growth from its early days all the way to WWII_

The US is an _incredibly_ wealthy landscape, in terms of mineral wealth, agricultural wealth, and temperate weather. Throw in a massive population increase, successful wars of conquest, and a productive temperate climate, and the author is pushing shit uphill with a pointed stick if he's trying to make the argument against publicly-funded R&D this way.

</comment></comment><comment><USER4> I like "number theory" as a favorite example of practical reasons to fund seemingly impractical and useless academic research. A quote from Hardy (who I think was a number theorist, but could be misremembering) that I like is:

"I have never done anything 'useful'. No discovery of mine has made, or is likely to make, directly or indirectly, for good or ill, the least difference to the amenity of the world... Judged by all practical standards, the value of my mathematical life is nil; and outside mathematics it is trivial anyhow. I have just one chance of escaping a verdict of complete triviality, that I may be judged to have created something worth creating. And that I have created something is undeniable: the question is about its value."

And I can't find a quote, but I think I remember reading that he viewed his mathematical research as consistent with his pacifism, because nothing he developed could be used for military purposes.

Of course, now that we have computers...

But, given the different channels that research can become commercially viable, and given the long and uncertain time lags before new developments in research show up in GDP, a statistical analysis based on aggregate data is going to be absurdly difficult. And there are other reasons to expect that private companies will underspend (from a societal-benefit point of view) on research that has positive spillovers/externalities (really quickly: they're only going to want to spend to the extent that they directly benefit. If there are benefits that they can't profit from, as a society we'd want them to pay for the research anyway, but they'd be crazy to). So funding as much research as possible seems like a decent approach.

Incidentally, this is the first time I've seen someone claim that the US or Canada governments have massive research expenditures. Does anyone have a link for good numbers?

</comment><comment><USER5> I do not believe that the U.S. government should fund translational research. I firmly believe that private enterprise will be able to efficiently make immediate use of any important scientific breakthroughs or discoveries. Instead, I believe that the government should pore funding into basic science research.

I completely disagree with the Author's implicit assertion that the U.S. government should spend less money funding scientific research. Private industry did not discover the importance of DNA, nor was it responsible for determining the chemical structure of this nucleic acid. Many fundamental discoveries would never have occurred in private industry simply because private industry cannot afford to heavily fund basic science.

The value of basic science is not felt within a decade or two. It takes a lifetime to appreciate.

<comment><USER6> Some private organizations have very deep pockets, and it's not just industry, as non-profits can also fund research. But if industry is biased toward applied/translational research, perhaps it's not just a focus on short-term profitability or a lack of funds for large projects. One interesting idea is that patent laws are partially responsible for this bias, because they grant a temporary monopoly on inventions/applications, but not on basic science.

<comment><USER7> > as non-profits can also fund research

They can, but the reality is very few are really prepared to do a good job of it and even fewer have the resources to really fund the portfolios relevant to them in the same way other institutions (gov, some large corps, etc) do.

The non-profit sector has a bunch of hard working folks with great goals and there's a bunch of good uses for them to put money toward, but frankly I'm not sure R&D is the one that makes the best impact. I think if a non-profit is going to fund R&D they need to be really really smart, innovative and/or creative to make their money get the type of impact they could get on spending it in critical areas outside of R&D.

This changes depending on the field though. In some areas of the arts and humanities, non-profit funding is a huge and valuable source of funding.

But in tech/sci/eng? Not so much.

</comment></comment></comment><comment><USER8> It seems author goes from presupposition that economic growth is something inherently good or better than pursuit and dissemination of knowledge. Knowledge itself is valuable for society. If you don't agree, I don't want to know you.

Private companies don't fund fundamental/basic research, unless we have semi- monopolistic situation like with AT&T Bell Labs before breakup, and Microsoft Research today. If you're in highly competitive market, you simply can't fund things which don't improve your bottom line in foreseeable future.

Academic institutions provide highly trained employees for industry, without funding of academic research, quality of teaching will decrease significantly. Even if there is a problem in finding correlation between funding of public research and economic growth (which I find highly dubious, it goes against intuition and lots of examples) it definitely helps humanity as a whole, because knowledge is not locked up in borders. Although people who go with commercialization of an invention they've come up with while in academia, most commonly do it in their home country.

</comment><comment><USER9> From what I've heard, those regressions aren't totally valid. It can simply be that poor countries grow faster (leapfrogging on the research of rich countries), but don't fund a lot of public R&D.

Once the regression hits a dead end (as it doesn't distinguish the causal factors), we jump straight to anecdotes - the Industrial Revolution, and the USA. Both of these are probably outliers.

</comment><comment><USER10> It's possible that academic research causes economic growth, but that it doesn't do so on a country by country basis. A significant proportion of people trained in American research universities are not Americans. Many of these people probably return to their home country where they use their knowledge in industry. Furthermore, anyone who picks up your scientific paper can go ahead and implement what's in it regardless of where they are.

It may be that the we should fund scientific research because it benefits everyone rather than because it gives us an advantage over other nations.

</comment><comment><USER11> It's very important to remember that government research money is taken from the citizens, who otherwise would allocate it in accordance with their preferences.

Taxes in the US are actually very high, plus the government takes a lot of money via inflation of the money supply.

It seems likely to me that government-funded research is a "local maximum."

If we were to massively shift the backbone of the economy from consumption to production (i.e., letting people and companies keep more of their money), we would certainly see much more private research.

In fact, we could potentially have a "research economy," if the intellectual property issues were sorted out. In this system, research institutes would take over a lot of functionality from academic departments (including training new researchers). Such an institute my employ tenured academicians who make lower, fixed wages (as with current academicians) but are free to do basic research, plus applied people try to market the results and are paid competitively (as with current industry people).

There is also a high level of regulatory capture in most industries that punishes any attempt to transition research results into a marketable product.

<comment><USER12> Taxes are not very high in the US. We have about 26.9% total tax revenue (which I will abbreviate TTR. TTR is measured as a percentage of GDP)[0][1]. I hate seeing this statement thrown out as if it is fact. We have very low taxes comparatively, especially given our status as a highly developed and competitive economy.

We are #7 on the Global Competitive Index, behind Switzerland (29.4% TTR), Singapore (14.2% TTR), Finland (43.6% TTR), Sweden (47.9% TTR), Netherlands (39.8% TTR), and Germany (40.6% TTR) [3].

Sweden, the Netherlands, Finland and other countries that are close below the US have socialist governments. As much as hip, intellectual go-getters who read Ayn Rand would love there to be no government, it's simply not feasible. It may be great in theory, but it's not great in practice. However, I do not know much about the Ayn Rand's entire philosophy, so I wont comment on it further. I do know that most people who blindly latch on to some of her ideas don't truly understand her philosophy.

Half of that 'regulatory capture' you refer to is because of private interests lobbying for government restrictions. The will of the free market may drive such anti-competitive practices by private interests out of business eventually, but humans do not operate on the long term.

Regardless, the point of this post is that even if you thought you opened up your eyes before to the realities of the world and exactly how it should work, I invite you to take a step back every now and then and reevaluate your philosophies.

[0][http://en.wikipedia.org/wiki/List_of_countries_by_tax_revenu...](http://en.wikipedia.org/wiki/List_of_countries_by_tax_revenue_as_percentage_of_GDP) [1][http://www.taxpolicycenter.org/briefing- book/background/numb...](http://www.taxpolicycenter.org/briefing- book/background/numbers/international.cfm) [3][http://www3.weforum.org/docs/WEF_GlobalCompetitivenessReport...](http://www3.weforum.org/docs/WEF_GlobalCompetitivenessReport_2012-13.pdf)

<comment><USER13> Those who think taxes are high in the states have simply never lived outside of the states.

<comment><USER11> I'm so sick of online American-bashing, which is a fad. Please stop. Where someone has lived has nothing to do with it whatsoever.

27% of the entire economy shifted entirely to government consumption? That's a humongous amount of the economy. It's almost 1/3.

<comment><USER13> I'm not bashing America, I'm even American. I just get so tired of those of us who complain about paying so much taxes and so much for gas for our SUVs and so much rent for our McMansions. And here I am living in a country where I can't even buy a car, live in a small apartment, and pay 40% income tax, and a pair of jeans sets me back 800RMB. And you know what...it's not the end of the world, it works out.

And...our government consumes less than 1/3rd of the GDP when social spending in other developed countries is at 1/2 or more! Libertarians would have us be like Somalia.

<comment><USER11> > Libertarians would have us be like Somalia.

It's important to realize that that's not actually true. I think we should have a small government that protects citizens from force and violence. That still includes all the core functions of government (e.g. police, courts, military, I don't care if you throw in basics like roads).

That is a world apart from Somalia, or anarchism. It's actually just a return to earlier ideas of American government that served us well at the time.

To be clear, I'm not a libertarian, for reasons that aren't relevant here.

<comment><USER13> > I think we should have a small government that protects citizens from force > and violence.

How about protecting us from peasant revolts when our social services suck so much that people lose hope and take advantage of their second amendment rights? Or how about just avoiding the revolts in the first place by having a decent moral government that evens the playing field between rich and poor?

> It's actually just a return to earlier ideas of American government that > served us well at the time.

This is BS rosy-tinted glasses revisionism that has no grounding in real history. Like how everything was better in the 50s if you just ignored segregation and the 90% tax rate we had on the rich. Did isolationalism serve us well before WWI and II? Did our hands off approach prevent the dishonest greed and speculation that led to the depression? The 1800s weren't that much better, just look at all the crashes and war that went on then.

> To be clear, I'm not a libertarian, for reasons that aren't relevant here.

Good, because libertarians tend to be bad historians and have a poor understanding of human nature.

<comment><USER11> I think your viewpoints are completely inane.

For example, our current economic model is completely unsustainable. It's not going to prevent the "peasant revolts" you talk about. It's going to guarantee them. Yet you seem to be calling for more of the same.

I wasn't talking about the 1950s, but pre-WWI. And, yes, isolationism did serve us well pre-WWI, though I am not an advocate of isolationism at all, as a principle.

Now, to get to the interesting bit.

> having a decent moral government that evens the playing field between rich > and poor

Pray, tell me where you have found a rational, reason-based morality that makes you so certain that the rich need to be punished and sacrificed to the poor? Where have you found a rational, reason-based economic philosophy that can prove that doing so will be good for the economy, instead of furthering its destruction?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Economic growth encompasses _every single thing in the world_ and has no single defining factor as the "cause."

Yes, academic research causes economic growth. So does eating and sleeping. Everything on the planet affects trade.

</comment><comment><USER15> I can't agree with this article. It is very thoughtful, and looks very thoroughly to verify (or refute) a very specific thesis. However, it is manifestly causal-ly false to assert that pure scientific advances do not affect the real economy. Where would we be, economically, without silicon chips and laser beams? In a _very different place_.

</comment><comment><USER5> I looked up the Author's published manuscripts to see what his background is in research. It appears that his expertise lies outside that of physics, chemistry, or biology but is instead in algorithm design(??) and data analysis(??).

I wonder if the programming community relies on academia as much as for example the medical industry or the aeronautical industry.

<comment><USER16> I think the programming industry is interesting because my impression (I have no idea if this is backed up by data) is that there's much more mixing between academia and the private sector (i.e. people move from academic to industry jobs and vice-versa more frequently/easily) than in other fields (natural science, social sciences). I wonder if this increases the productivity of either.

<comment><USER5> I am in the Natural sciences. I see that people are trained in esoteric technologies or procedures that may only be useful to the immediate scientific question at hand. This would seem to make it hard for these individuals to transition to industry, unless their specific expertise is required.

The computer programming community has the advantage that its technologies and best practices are ubiquitous throughout the industry and academia (??). This may facilitate an easy transition from industry to academia and vice-versa.

</comment></comment></comment><comment><USER17> Remember that Google began with academic research in mining data from the web. Google created billions of dollars of value and thousands of jobs around the globe. That certainly contributed to economic growth.

</comment><comment><USER18> This is weirdly the exception to the HN rule - if a title is a question the answer is no. In this case it's a full-on, dumb-as-shit hell yes. Describe the world that did not have the useless work of that weird academic Isaac Newton - I mean he never even taught students except three times. Talk about failing to contribute.

I must stop winding up my sarcasm chip - just unbelievably stupid article.

</comment><comment><USER19> Just a minor nitpick but I believe it should be "disclosure" instead of "disclaimer" at the end of the article. Interesting read nonetheless.</comment>


Why Yahoo is worth less than nothing - <AUTHOR> http://www.cringely.com/2015/10/21/why-yahoo-is-worth-less-than-nothing/ <comment><USER2> Saying she needs to change everything, is like Nokia saying they are on a burning platform. Instead of extracting the enormous value left in their dumb phones, Elop said they needed to get rid of that market asap, and essentially told users to buzz off of it.

That was a dumb move.

The same can be said about the web portal. It's a declining market, sure, but there is still an incredible amounts of value to be extracted from it, so it would be stupid to just throw it away.

</comment><comment><USER3> Google is doing this.</comment>


"The disease of thinking that a really great idea is 90% of the work." - <AUTHOR> http://37signals.com/svn/posts/3497-you-know-one-of-the-things-that-really-hurt

<comment><USER2> A Steve Jobs quote? It sounds oddly familiar... either way, made my day!</comment>


For the Arduino and Raspberry Pi afficiondos - <AUTHOR> https://www-ssl.intel.com/content/www/us/en/do-it-yourself/galileo-maker-quark-board.html

<comment><AUTHOR> Only $60 at Amazon. Yes, more than Raspberry Pi but then it is more computer than a Raspberry Pi.

Final form factor: [https://www-ssl.intel.com/content/www/us/en/do-it- yourself/e...](https://www-ssl.intel.com/content/www/us/en/do-it- yourself/edison.html?wapkw=edison)</comment>


Amazon EC2 & S3 disaster planning (what does your disaster recovery plan look like?) - <AUTHOR> http://radar.oreilly.com/archives/2007/06/amzon_ec2_and_s.html <comment><USER2> "as an example, recovering from a failed datacenter that was hosting a petabyte of data over a 10 Gb/sec link will take more than a year"

Does it really? What if you load the data onto some physical medium and physically move it from wherever it's backed up into the failed data center? The latency of vans with disks or tapes may be high, but the throughput can still way exceed that of networks.

<comment><USER3> You're right of course. The famous quote for this is _"Never underestimate the bandwidth of a station wagon full of tape"_

It's a laughable example anyway. Very few sites use anywhere _near_ a petabyte of storage. I think he overshot a bit there. I also think he's generally right about S3.

I can only think of two scenarios where I would recommend S3:

1\. You're spending such small amounts of money that buying your own storage servers is out of the question.

2\. You don't have anyone qualified to run your storage servers.

</comment></comment><comment><USER4> _Show you how many copies of a file exists, and how quickly a file uploaded to them becomes redundant._

If I could search YC I'd point back to an earlier discussion we had on S3. One of the points that came up was how do you know when your uploaded file is "safe", i.e. not when the upload has finished but when all N copies exist so you can go back to your user and say "fear not". A simple fetch of it is insufficient; S3 is selling itself on its redundancy so it needs to prove it. Anyone know of a way to do this?

<comment><AUTHOR> It could be added very quickly adding a static textbox... eg: <http://www.google.com/search?q=site%3Ahttp%3A%2F%2Fnews.ycombinator.com+S3+uploaded+file+safe> for example.

 _"... how do you know when your uploaded file is 'safe'? ..."_

don't know. might have to find this out.

</comment></comment><comment><USER5> Funny, I was just thinking about this the other day.

I don't think most of its users could _afford_ to move things in-house, assuming Amazon would even announce in advance that S3 was shutting down.</comment>


Tiny Robotic Bee Assembles Itself Like Pop-Up Book - <AUTHOR> http://www.wired.com/wiredenterprise/2012/02/robotic-bee/ <comment><USER2> Disregarding the engineering of the bee itself (which is equally amazing) the fabrication process is brilliant. 2 things come to mind when I watch this. A. I live in the future. B. There are people out there far more intelligent than I. Consider my mind blown.

I wonder if they are working on a method to power the bee for actual flight. Of course it has no control system either at this point. Off to read more. Thanks to the poster for the link.

<comment><USER3> Look up Erik Demaine, winner of a 2003 MacArthur genius award. You may have seen him on the 'in between the folds' origami documentary. I have a feeling that this process has a lot to do with his past work in origami and algorithms.

His website: <http://erikdemaine.org>

Intro to folding: <http://erikdemaine.org/folding/>

<comment><USER4> Between the Folds is a great documentary. Amazing stuff, both artistically and in engineering.

</comment></comment></comment><comment><USER5> Beautiful work. Although, I'd recommend just reading the press release[1]. It is more in depth and better explains the accuracy and reliability they can achieve.

I especially love seeing the bee in operation. Does anyone know by what mechanism the motion is generated?

Edit: My best guess is piezoelectric actuators[2].

[1] [http://www.seas.harvard.edu/news-events/press- releases/pop-u...](http://www.seas.harvard.edu/news-events/press-releases/pop- up-flying-robots)

[2] <http://micro.seas.harvard.edu/papers/Karpelson_ICRA09.pdf>

<comment><USER6> At about 0:58 in the video linked from the Wired article, the narrator says "and two piezoelectric inserts for actuation."

<comment><USER5> Ah, yes. Thanks. I must have glossed over that when watching it.

</comment></comment></comment><comment><USER7> The Bee didn't assemble itself, nor did it look robotic to me yet as it was not even shown if it could fly or do other tasks. Very cool demo tho.

<comment><USER8> The bee is incidental. The real "product" here is is the manufacturing technique.

It has enough technology, primarily built-in circuitry to turn electric current into motive force, to show that more complicated robotics are possible.

</comment></comment><comment><USER9> There's much leftover material that looks to be wasted. Is there any reason the block has to be this size? Can't the margins be smaller?

<comment><USER10> Looks like this configuration would allow the highest density of units to be fabricated per given surface area. Notice that the hexagon is just barely larger than the wing span where they approach each other. Can't do the math now, but it's likely more space efficient to use the hexagon, than a plain rectangle. You'll need to use one of those shapes so you can tessellate without lose. The carbon fiber structure might not have to be continuous, though I suspect that it might play a role in positioning during fabrication.

</comment></comment><comment><USER11> I'd love to see video of a swarm of these

<comment><USER12> You won't, unless it's CGI.

<comment><USER13> Well, you might. IIRC, there is another group who have those micro helicopters working in a swarm like way. I assume convergence at some point in the not too distant future.

<comment><USER14> I presume you mean the Nano Quadrotors: <http://www.youtube.com/watch?v=YQIMGV5vtd4>

<comment><USER15> No, he meant the swarm of micro-helicopters as part of the same project. <http://www.youtube.com/watch?v=c8LkcgYRHdA>

<comment><USER16> Or both.</comment></comment></comment></comment></comment></comment>


Thrust: Chromium-based cross-platform, cross-language application framework - <AUTHOR> https://github.com/breach/thrust/ <comment><USER2> Quick note on comparison with node-webkit / atom-shell:

node-webkit and atom-shell embeds NodeJS along the chromium content module forcing its user to use not only NodeJS but a particular build of it.

On the contrary, Thrust embeds the Chromium content module and exposes an API on the standard IO, which makes it bindable in any language and works perfectly well as a dependency with vanilla nodeJS / Go / Python

Makes the distribution of cross-platform GUI apps through the pip/npm possible.

<comment><USER3> This would be absolutely phenomenal if you could have the entire pip ecosystem and write cross platform desktop apps in python.

<comment><USER2> pip or npm yes!

<comment><AUTHOR> As well as go get -u {urltopackage} go install

<comment><USER4> Doesn't go get already do go install?

<comment><AUTHOR> Yes. In some cases ive experienced both. Sometimes it installed sometimes it did not.

</comment></comment></comment></comment></comment></comment><comment><USER5> As a proof of concept I knocked up JankyBrowser in about 3 hours. Nagivation? Check. Tabs? Check (how long did other browser take to get those!). All in a little over 6K of JS.

[https://gist.github.com/morganrallen/f07f59802884bcdcad4a](https://gist.github.com/morganrallen/f07f59802884bcdcad4a)

<comment><USER6> ...wow! This is a really compelling

I know it's really fashionable to hate on javascript, but there's really something to be said for being able to code _a web browser_ with tools you can learn on Khan Academy.

<comment><USER7> "var webview = document.createElement("webview");"

Turns out, it's pretty easy to code a web browser in ANYTHING if one of the primitives you can instantiate is A WEB BROWSER...

<comment><AUTHOR> al2o3cr, actually no. There are a load of difficult implementations needed to achieve even the most basic webbrowser, even when building on top of the already great chromium content lib. For instance, Thrust's predecessor ExoBrowser failed where Thrust is succeeding, thankfully we have progressed to a state of composability where we can take the work of others before and compose it into something useable for the world. The 500 something commits to Thrust were no simple feat, and their are many more to come.

</comment></comment></comment></comment><comment><USER8> This is really awesome. Reminds me of [http://www.tidesdk.org](http://www.tidesdk.org)

Honestly, I'm super prepared for the world where HTML/CSS is used for all the GUIs (while HTML/CSS are not perfect, I think they've done a pretty good job being flexible enough style to millions of user-facing GUI applications, also known as web sites, for so long). I don't think many people agree, but the day I don't have to try and choose between TK, GTK, QT, and some other smaller framework is gonna be a good day.

Not quite the same (since this runs on chromium, and I'm not sure that TideSDK does also -- at least it's been around too long that it feels like they couldn't possibly have).

<comment><USER9> This is not a popular view, but I think as developers we should focus on one platform and serve it well, instead of making nearly tolerable apps for every platforms.

<comment><USER10> I'm supplying a node-webkit app to thousand of clients and I feel you.

We thought "Hey, it runs on everything!" would be nice for our future roadmap...but didn't we say the same about Java?

</comment></comment></comment><comment><USER11> As a web developer this is a very cool project. It's a very simple sandbox to develop a custom application or even customize my browsing experience. Being built on the current stable release of Chrome makes it even better.

</comment><comment><USER12> I get this error when building it. Any thoughts?

        $ go get -u github.com/miketheprogrammer/go-thrust
        package github.com/miketheprogrammer/go-thrust
        	imports github.com/miketheprogrammer/go-thrust
        	imports github.com/miketheprogrammer/go-thrust: no buildable Go source files in /Users/user/.gocode/src/github.com/miketheprogrammer/go-thrust

<comment><AUTHOR> Apologies to all, we are restructuring the application to work better with go get. You can try with the -d flag to avoid building files. this should download the application to the proper gopath. then you can use the instructions from the go-thrust repo homepage.

</comment></comment><comment><USER13> Node that there is also the same-called project: [http://thrust.github.io/](http://thrust.github.io/)

</comment><comment><USER14> Seems nice, especially with variant bindings instead of only one. One more question, how to update the whole application after distributed, including HTML/CSS/JS files and the framework binaries? Do I still have to make one updater(which is not really an easy task if you want a fancy UI), or is Chromium's update framework included already?

</comment><comment><USER15> This is great! Installed it via PIP and it just worked. I would love to see this combined with [https://github.com/enthought/jigna](https://github.com/enthought/jigna) / [https://www.youtube.com/watch?v=KHSXq5jfv_4](https://www.youtube.com/watch?v=KHSXq5jfv_4) .

</comment><comment><USER16> Awesome project. Breach is also very cool. What are the plans for the future of Breach?

<comment><USER5> It will get rebuilt on top of Thrust.

</comment></comment><comment><USER17> Can someone tell me use-case wise how this differs from PhantomJS and CEF?

<comment><USER5> Unlike PhantomJS, this is not a headless browser (though can be!), its a browser that can be designed in HTML/CSS/JS. This is to say, the navigation buttons are controlled by you, your own download manager, etc. Time and imagination are your limits.

<comment><USER18> You could write a browser in assembler. Only time and imagination are your limits.

</comment></comment></comment><comment><USER19> I think this is the first time I've seen the phrase, "requires Python 3." It's certainly the first time I've seen it on something that I want badly enough to mess with it.

<comment><USER20> To be fair the Python bindings are pretty simple, you could easily implement it in Python 2. You do need evented I/O however so you could write either gevent or twisted bindings.

<comment><USER2> Yes exactly. I started coding in Python 2 days ago so I went with what I found (asyncio) but it could be easily recoded in Python2!

</comment></comment></comment><comment><USER21> Sounds great. Just one question about the Windows screenshot - why are the fonts so jagged?

<comment><USER2> Screenshot from a remote server running on AWS. I guess the settings are screwed up on that machine!

</comment></comment><comment><USER3> So my question is what's your rationale for using Thrust vs. Node-webkit?

<comment><AUTHOR> Node-Webkit is hacky at best. Atom-Shell is a major improvement on Node- Webkit, however not quite there. Native modules need to be compiled for a completely different target.

Thrust takes it a step further, improving on the past. Thrust uses the same backing library as Atom-Shell (brightray) to expose the Chromium Content Library.

Thrust is cross-platform cross-language. Use a similar familiar api from any language you want, or roll your own. No need to use javascript on the backend if you dont want to.

For example, Go-Thrust can compile, this is a particular advantage for distributing applications.

<comment><USER22> Could one write a fast text editor using Thrust? Can one use C++ instead of Python/JS/Go?

<comment><AUTHOR> One could use c++ instead of Python/JS/Go, I would however recommend still using the JSONRpc bridge to communicate. I would not recommend using c/c++ at all, as Atom.io has proven more modern garbage collected languages have become so incredibly fast that c/c++ are primarily distractions unless you are a master of the incredibly huge ecosystem and can sling code together fast without having leaks, pointer issues, and a host of other security issues.

At a minimum, I would recommend using Go or NodeJS with a C binding for any extremely low level operations you would like to achieve, that would make everything much more suitable, you would also benefit of the ecosystem of modules.

<comment><USER22> Agreed, though I'm sure Atom doesn't steal more users from Sublime Text (C++ & Python for the plugins) due to its so-so performance.</comment></comment></comment></comment></comment>


Fracking Has Not Had Big Effect on Water Supply, E.P.A. Says While Noting Risks - <AUTHOR> http://www.nytimes.com/2015/06/05/us/epa-hydraulic-fracking-water-supply-contamination.html <comment><USER2> Most of the discussion about fracking misses the forest for the trees.

Yes, there's a rather significant amount of groundwater contamination due to poorly operated and/or improperly abandoned wells.

However, the vast majority of the contamination has nothing to do with whether or not hydrofracturing was applied. It's far more frequently due to bad casing jobs, etc.

In other words, most of the contamination is due to sloppy work. It would happen regardless of whether it was a convention or unconventional well.

There are situations where fracking can directly lead to contamination. After all, you're deliberately creating permeability in an aquitard. However, these are not anywhere near as common as the cases where a bad casing job, etc can lead to groundwater contamination (every well).

In a nutshell, we're seeing an increase in groundwater contamination because of the spike in the number of wells drilled in the areas. It's not directly related to the completion method used in the well (e.g. fracking).

However, it doesn't help that there are highly variable state/local regulations and a huge number of sloppy operators.

<comment><USER3> Where is the evidence that there are a huge number of sloppy operators? That isn't in the NY Times article.

<comment><USER4> People in the industry seem to universally agree that there are some sloppy operators.

</comment></comment></comment><comment><USER5> FTFA: _But environmental groups pointed to what they saw as holes in the report. In particular, they said, the report's authors relied on data supplied by companies and wrote that limitations in data "preclude a determination of the frequency of impacts with any certainty."_

So, i guess that report is next to worthless then if it solely relies on data that comes from a group that is interested in "proving" the safety of fracking?

<comment><USER6> Except it doesn't _solely_ rely on that data. From earlier in the article:

"In conducting the study, the agency evaluated more than 3,500 previously published reports, studies and data sources, including articles published in science and engineering journals; and reports by federal and state governments, nongovernmental organizations and industry groups.

The agency also conducted additional scientific research, resulting in more than 20 peer-reviewed reports and papers. The draft report will now be made available for public comment and peer review by an independent board of scientists before being finalized."

</comment></comment><comment><USER7> I'm a bit skeptical of what the EPA says, because it has been documented to suffer from regulatory capture.

[http://www.amazon.com/Poison-Spring-Secret-History- Pollution...](http://www.amazon.com/Poison-Spring-Secret-History- Pollution/dp/1608199266)

But lets assume the EPA is doing its job. At minimum, there needs to be more inspectors - currently there is a huge backlog where high-risk wells are not being inspected. So this problem will just keep getting worse.

[http://www.foreffectivegov.org/blog/massive-fracking- federal...](http://www.foreffectivegov.org/blog/massive-fracking-federal- lands-overwhelms-critical-inspections)

Also, just a few weeks ago from the NYT:

[http://www.nytimes.com/2015/05/05/science/earth/fracking- che...](http://www.nytimes.com/2015/05/05/science/earth/fracking-chemicals- detected-in-pennsylvania-drinking-water.html)

</comment><comment><USER8> From Aljazeera:

>the EPA was not able to legally force cooperation by fracking companies, almost all of which refused

and

>One of the companies, Chesapeake Energy, "chipped away at the scope of the plan over two years of talks, limited when and where the EPA could monitor water,"

[0] [http://america.aljazeera.com/articles/2015/6/4/epa-says- frac...](http://america.aljazeera.com/articles/2015/6/4/epa-says-fracking- doesnt-contaminate-water.html)

</comment><comment><USER9> Read "Trust me, I'm lying" by Ryan Holiday. Tracing the sources mentioned in this article is a good first exercise.

</comment><comment><USER10> Questions about the truth of the results aside, I would say that the title of the study should maybe be, Fracking Has Not Had Big Effect on Water Supply _Yet_. This stuff is still pretty new, after all.

<comment><USER11> _This stuff is still pretty new, after all._

On a geologic time scale, sure.

Fracking in one form or another goes back between 80-150 years.

</comment></comment><comment><USER12> "Worrying over fracking is like seeing an upper middle class family who are $6,000 in debt, and freaking out because one of their kids bought a gumball from a machine."

[http://slatestarcodex.com/2015/05/11/california-water-you- do...](http://slatestarcodex.com/2015/05/11/california-water-you-doing/)

<comment><USER4> You are taking that quote wildly out of context. That quote refers to the use of water as part of the drilling process, not the contamination of water- sources by fracked wells.

<comment><USER12> You're absolutely right. I guess I was misled by the title that talks about the "water supply" when they really mean "the quality of water" or something along those lines.

</comment></comment></comment><comment><USER13> Riiiiiggghht [https://www.youtube.com/watch?v=4LBjSXWQRV8](https://www.youtube.com/watch?v=4LBjSXWQRV8) [https://www.youtube.com/watch?v=7B9-tmudFg0](https://www.youtube.com/watch?v=7B9-tmudFg0) [https://www.youtube.com/watch?v=U01EK76Sy4A](https://www.youtube.com/watch?v=U01EK76Sy4A) [https://www.youtube.com/watch?v=U01EK76Sy4A](https://www.youtube.com/watch?v=U01EK76Sy4A) There are THOUSANDS of similar reports from fracked areas all over North America. That isn't the only problem either, when they do what's called "venting" there is large release of carcinogenic chemicals(although some large scale operations mitigate this by capping the vent stack to collect the gases in practice this is the exception not the rule) We are doing it in Canada as well, absolute insanity! Here is a great documentary [http://www.cbc.ca/player/Shows/Shows/The+Nature+of+Things/ID...](http://www.cbc.ca/player/Shows/Shows/The+Nature+of+Things/ID/2332883489/)

<comment><USER14> OK I downvoted this. And I'm stating that even though I know it's not kosher to have a meta-debate about upvoting/downvoting, but just to dissuade the reflexive suspicion that the downvote is because HN is secretly owned by drilling companies.

I don't necessarily disagree with the skepticism, but linking to a bunch of Youtube videos without context is not helpful evidence. And then going on to refer to a vague "THOUSANDS of similar reports" claim _without_ some kind of link to source...that's kind of lazy. I think it's safe to say that the EPA is aware of a high quantity of reports of contaminated water...and that's why they've (belatedly) undertaken this study. The critique should be focused on their assertions and the evidence they use (I mean, they did the courtesy of drafting a report to make such a point by point critique easier), not on generalizations.

<comment><USER13> They have NO evidence, I downloaded their full report in search of the "official" total of cases where drinking water has been contaminated due to hydraulic fracturing and it is omitted from the report they simply make the assertion that "the number of identified cases, however, was small compared to the number of hydraulically fractured wells" This study doesn't serve to advance our understanding of the hazards of hydraulic fracturing in the least, it's 999 pages of nothing! Down vote all you want

<comment><USER14> I wouldn't have downvoted _this_ comment...because it actually refers to the report at hand and directly critiques it. I'm not anti-anti-fracking, just anti-anti-anti-fracking generalizations.

<comment><USER13> Also this "A 2009 ProPublica investigation found that contamination was far more prevalent than indicated in the report, citing more than 1,000 cases tied to drilling and fracking that had been documented by courts and state and local governments." [http://www.sourcewatch.org/index.php/Fracking_and_water_poll...](http://www.sourcewatch.org/index.php/Fracking_and_water_pollution)</comment></comment></comment></comment></comment>


Ask HN: Which sensors can be used to detect bees and butterflies? - <AUTHOR> <comment><USER2> Depending on where you are trying to find them, a Red Edge or NIR sensor can also help. I have done this for a project way back so let me know if you like to have a conversation about it.

</comment><comment><USER3> I imagine that both image and sound recognition could be used.</comment>


Hackers Stole My Instagram Username and Facebook Doesn't Care - <AUTHOR> https://petapixel.com/2018/08/20/hackers-stole-my-instagram-username-and-facebook-doesnt-care/ <comment><USER2> The author practically says that 2FA is inconvenient halfway into the article, so he didn't use it. At this point, using a platform like this for business makes features such as 2FA imperative.</comment>


F.C.C. Indecency Policy Rejected on Appeal - <AUTHOR> http://www.nytimes.com/2010/07/14/business/media/14indecent.html?src=twr

<comment><AUTHOR> I was going to make the headline "F.C.C. Indecency Policy Rejected on Appeal. Fuck Yeah!" but thought better of it...</comment>


A Bill Allowing More Foreign Workers Stirs a Tech Debate - <AUTHOR> http://www.nytimes.com/2013/06/28/technology/a-bill-allowing-more-foreign-workers-stirs-a-tech-debate.html?hp

<comment><USER2> Many familiar themes are presented in the article, so not much to add there. However, the comments from the engineer(s) about their skills not being current do provide another useful data point about our new "autodidactism no longer optional if you want to stay relevant" era. The time when you could simply learn a skill/trade/get a degree and be set for life (and just focus on the other stuff you always wanted to do, like hobbies, friends, vacations, whatever) is long gone. Working people need to start adjusting to this new era of hypercompetition (which will necessitate a greater focus on career in general - in addition to the aforementioned constant learning - and that means sacrificing time spent on other things), as distasteful as many find it.

Another article that was previously posted on that subject:

[http://www.nytimes.com/2012/09/22/business/to-stay- relevant-...](http://www.nytimes.com/2012/09/22/business/to-stay-relevant-in- a-career-workers-train-nonstop.html?pagewanted=all&_r=0)</comment>


Stop Fetishizing Failure - <AUTHOR> http://creativeintelligencebook.com/post/41570210573/stop-fetishizing-failure <comment><USER2> The choice of words is telling. Serious entrepreneurs (even unsuccessful ones) are not "fetishizing" failure at all. To be an entrepreneur is to live and breathe execution, and fetishizing something is not effective execution under any circumstances.

The "cult of failure", as the author puts it, is nothing more than entrepreneurial common sense; an inevitable reaction against the status quo of safety-seeking behavior that causes people to be so failure-averse as to avoid risking anything. Such common conservatism is of course anathema to the essence of entrepreneurialism, and therefore it gets a lot of ink in the echo chamber.

But don't confuse this budding nugget of conventional wisdom as the cause of a wholesale exodus from common sense. The whole article is setting up a giant straw man that could only be applicable to people who are so hopelessly mired in the mythology (and/or tabloidism) of the startup world as to be effectively impotent in actual execution, and thus unworthy of any serious consideration to begin with.

In other words, no one seriously believes that failure is an end unto itself.

<comment><USER3> I agree with you fully. My experience has taught me that the people I want to associate with have a narrow definition of risk and are not willing to fail.

I have met "entrepreneurs" who have said things like, "if this fails, we will just do another project! No big deal, failure is part of the process" conversely I have met people in corporate America who assume that any financial or personal risk is completely ridiculous to take.

The 3rd group I have met are entrepreneurs who are willing to take a personal and financial risk while assuming success will be there's despite the odds. They never talk about failure because it simply isn't an option until it is inevitable. They stay consistently focused on execution and do not worry at all about the potential for failure because at their core it doesn't matter.

People in the 3rd group are the people I want to work with every time. They take well calculated risks naturally and deliver results.

<comment><USER4> Care to fill in the explanation of how people who ignore assign 0 probability to failure take well calculated risks?

<comment><USER3> The basic idea is that people who assume things will work out make better decisions. If you think you will be successful, individual interactions take on less importance, and you can execute in an efficient way.

</comment></comment></comment></comment><comment><USER5> It took me a long time to learn that if you aren't failing occasionally, you probably aren't pushing your own capabilities.

It's dangerous to be scared of failing. Yes, you can and should learn from both succeeding and failing, but continue to work hard and push yourself either way.

</comment><comment><USER6> I found these lines curious:

 _Get labelled a "Failure" and it can ruin your life. As a pedagogical methodology, embracing failure is the last thing these kids need._

So rather than telling these kids that failure isn't a bad thing and that they can learn from failing and grow we should continue telling them that failing sucks and makes you a failure? Or, if not telling them, at least letting them keep the mindset? And that's supposed to be the better alternative? How does that work?

</comment><comment><USER7> No one likes failing

If we seem to be fetishizing failure, it is only to push back against the fetishizing of success that has developed here. I think we have a tyranny of being afraid to fail in America. Our culture of meritocracy and achievement has made most of us hypervigilant about avoiding failure, to the point of being neurotic.

Fear of failure only hurts us collectively because it means we take fewer risks. Fewer risks => less innovation, less diversity in the marketplace.

Fear of failure hurts all of us. If being labelled a failure can destroy your career, it's not really helpful to further stigmatize failure by saying it's a "fetish", right? You're just making failure into an even worse word.

<comment><USER8> From what I have read of entrepreneurs in Europe, one of the greatest things about starting a company here in The States, is that failure does _not_ carry the same stigma here.

</comment></comment><comment><USER9> Maybe the saying should be "fail early, fail often, but never the same way twice".

If you're failing in different ways then that shows you're learning. If you just keep failing -- making the same mistakes -- well that's a real problem and not something to be celebrated.

</comment><comment><USER10> Hmm... not sure where this article is coming from (maybe it's some kind of satire?) but the premise that we're "fetishizing" failure and somebody needs to defend that "we learn from success too" sounds pretty comical to me.

</comment><comment><USER11> except every single good thing we have is built upon failure. got a gsm phone? broadband? how about a modem? a pc? basic chemistry? cryptography? the very notion of cryptography is embracing the failure of having private data leaked.

did you know 802.11 was initially made for infrared? do you remember how much it sucked? maybe if would have progressed faster if it was out in the wild faster. that's how it's progressing now.

yeah, you may not like it. and every now and then I hear the idea that "when you're dealing with critical things, like healthcare where someone's life may depend on it, you cannot afford failure". except that's not true. those systems actually embrace failure more than anything else.

google reliability engineering.or look at this:

[http://www.ashgate.com/default.aspx?page=637&calcTitle=1...](http://www.ashgate.com/default.aspx?page=637&calcTitle=1&isbn=9781409445517&lang=cy- GB)

there is a nice talk on failure from richard cook at the velocity conf:

<http://www.youtube.com/watch?v=2S0k12uZR14>

<comment><USER4> <http://www.wi-fiplanet.com/tutorials/article.php/2110301>

Haha wow. I do miss IrDA though.

</comment></comment><comment><USER12> The title of this article led me to believe it was going to make a certain argument, but went ahead and made a completely different one based upon a strawman. For me, there is a real argument against the whole "failure movement", but it's not this one.

The problem with the startup-meme that failure is to be embraced is that it can cause people to lose sight of the fact that failure is a state you reach only after you make a real, concerted effort and have lots of corroborating evidence that you truly have no product-market fit. It's much more fun to build new projects than to go through the slog to get through the trough of sorrow. This being the case, it's very temping to quickly write off projects that seem to be going nowhere since it's now acceptable to fail, since it drops you back into the exciting mode where you are building stuff again and your imagination is the limit, both for the product and for the prospects of success.

In other words, I think there needs to be a clearer explanation of what "failing fast" really means. It means fail fast, but not too fast. You really need to be sure you're actually in a true failure mode and not just a few bug fixes and enhancements away from exiting a local minima. One of the biggest challenges is figuring out a way to determine if you are in hitting your head against a thick wall or a thin one.

I think this is one reason why it's very important to have very detailed metrics and data, and build in an experimental approach to product development so you can see just how much leverage you have when it comes to making incremental improvements. 10x'ing a 0.001% conversion rate doesn't really get you much, but 10x'ing a 0.1% conversion rate could make the difference between success and failure. Also detailed metrics can help reveal if there are certain breakdowns in your funnels that you would not be aware of if just looking strictly at inputs an outputs. A 0.001% conversion rate may mean that your product has no market, or it might mean you fucked up your Javascript on your credit card submission form. The only way to know is to measure.

</comment><comment><USER13> Stop fetishizing low-contrast grey fonts: <http://contrastrebellion.com/>

</comment><comment><USER14> I thought it was more scientific than entrepreneur focused... the competing goals of "science" are to think up a prediction generating falsifiable model, and to break someone else's model. Classic computer science analogy: Nothing get crypto CS more excited than proving some algorithm fails.

Some hard sciences are more open to failure than others. Good luck publishing a negative result chemistry paper, with the unusual exception if the purpose is to disprove someones previous published positive result paper.

Cranking it back to the article, although a "failure based curricula" would be brilliant for teaching history, especially history of sciences, its a complete waste of time for background stuff for average people. Its important for a historian of chemistry to know people used to be really "into" the four elements air water fire and earth, but probably not a good use of limited teaching time to test everyone on it.

</comment><comment><USER15> The author is conflating two different meanings of the word "failure": the act (as in not succeeding at something) and the label (as in being labeled a failure). The whole post is based on this fallacious logic.

The concept of "embracing failure" is precisely about learning that if you fail at something, it doesn't mean you are a failure.

</comment><comment><USER16> I am a little surprised we are not hearing the points from this article more often.

Yes, we can learn from failure and so on, nobody is disputing this. The problem however is way too many people are taking a way too permissive and lax attitude towards failure instead of trying to figure out how to succeed. Permitting yourself to fail is the easy way out to avoid doing lots of hard and gritty work. The best learning happens before you actually fail at something, when you figure out you are ON THE PATH to failure and make a course correction to avoid it.

The overall capital formation ecosystem is probably to blame for this lax attitude. When the financiers make the most return from a few biggest winners taking crazy risks they do not care about mean failure outcome in their portfolio.

Remember, people who tell you it is OK to fail are not the ones who will have to live with the consequences of you failing.

<comment><USER17> > The problem however is way too many people are taking a way too permissive > and lax attitude towards failure instead of trying to figure out how to > succeed.

Who are these people? I don't know anyone that is happy to fail.

> Remember, people who tell you it is OK to fail are not the ones who will > have to live with the consequences of you failing.

I'm not sure if that is true. Plenty of parents are affected if their kids fail at things.

</comment></comment><comment><USER18> Anyone agrees with what he says in the article? I think I actually agree with him somewhat. Statistically, the best predictor of future behaviour is past behaviour. If you have always failed in the past, the probability of you succeeding in the future would be low but not impossible.

<comment><USER4> I bet you do great in the stock market.

</comment></comment><comment><USER19> I think what most of written world writes is to remove yourself from failure thinking be result thinking instead - extract valuable information from what underwater stones have you had encountered. So next time you can recognize those.

So in general most of the promotion of failure is about learning and keeping your mind open to be faster and more brazen next time - because you already know where those traps are.

Usually complete failure consists of multiple failures - which is why it is important to remove yourself from the situation whatever it is and give the situation that caused it a complete analytic run down of the situation.

</comment><comment><USER20> There is a big difference between failing intelligently (being able to learn from it) and failing recklessly (doing anything to avoid finding and doing the things that matter).

The difference in recognizing this subtle but huge difference is a little bit of maturity and constantly evolving one's ability to self-reflect.

Otherwise, it's easy wasting your 20's on ideas other people may cheer you on but are a low percentage play, whereas you could spend the same time learning what value, and creating measurable and verified value is.

</comment><comment><USER21> My own sense of failure is in the purely scientific sense:

In order to have a meaningful idea, it has to be falsifiable. In other words, it has to be a hypothesis, and testable.

Then you apply the test that would falsify it, and if the idea fails, you have _learned_ something, and are able to focus your next hypothesis in a more useful direction.

It sounds like the objections like this article completely miss the point of that. It's not like we're telling people to go and do something random and stupid and then trumpet about it.

</comment><comment><USER22> Has no one thought to ask what people mean by failure? I for one feel that there could be a lot to be gained by decreasing the emotional impact of failing, without going so far as to reduce people's desire to succeed.

It could be quite possible to fail (in objective terms), learn from your mistakes and try again, without suffering the social stigma or emotional impact of failure as that word tends to be understood.

</comment><comment><USER23> This post reminds a lot of a post by 37 signals' Jason Fried one time about startups and failure. This days failure just seem sexy. Its never good and cool to fail and will not. At no time should you plan or consider the option of failing. Its like preparing for divorce on your first day of marriage and then again I could be wrong.

</comment><comment><USER24> The Play mode he brings up at the end sounds like "fail fast" without the structure of figuring out why you failed. There's no control over the failure, just a lot of inputs and hoping you've targeted what's working.

Fail often / fail fast is just the scientific method made iterative.

</comment><comment><USER25> The trick isn't to fetishize failure. The trick is to move forward in spite of the natural fear of failure.

</comment><comment><USER26> No.</comment>


Elon Musk and the rise of Silicon Valley's strange trickle-down science - <AUTHOR> https://aeon.co/essays/is-a-mission-to-mars-morally-defensible-given-todays-real-needs <comment><USER3> Oy. Nothing real bad's gonna happen? Zero chance? That's not even trickle down science.

Next, Elon didn't come up with the idea that dispersal throughout the Solar system is necessary as a safeguard to ensure humanity has a future - <USER2> eminent physicist Freeman Dyson did. And probably many before him. I believe that was published in NYbooks, many years ago now.

It seems even Elon's opponents have tunnel vision - but just seeing the problems directly ahead of us such as housing and only paying attention to them, is how we got into the present environmental fix. Shortsightedness may be good politics but it's bad policy.</comment>


Internal FBI risk assessment of Bitcoin network [pdf] - <AUTHOR> http://www.wired.com/images_blogs/threatlevel/2012/05/Bitcoin-FBI.pdf <comment><USER2> Given that Bitcoin records all transactions for posterity, and given the ongoing rise of "big data" analytics, I'd say Bitcoin is likely to be _harder_ , in the long run, to use for shenanigans. A government currency has forms in which transactions create no paper trail. Bitcoin does not.

Really the big disruption Bitcoin could cause if it becomes well established, is to act as a stable reference frame against which the other currencies can be compared (versus now, where they all float against each other). No government owns the Bitcoin printing press. It cannot be used as an instrument of fiscal policy, and it weakens the ability to use government currency as an instrument of fiscal policy.

<comment><USER3> _Really the big disruption Bitcoin could cause if it becomes well established, is to act as a stable reference frame against which the other currencies can be compared_

What would make it any more (or less) stable than the traditional reference currencies of gold, ammo, and canned baked beans?

<comment><USER4> The supply of bitcoins used as currency is fixed while the supply to all other reference currencies are variable in some way or another.

Fiat is obviously variable on the whims of the issuing government.

Gold may be taken out of circulation to make jewelry or electronics (or another use not yet discovered). Ammo and baked beans can be consumed. Bitcoin has no utility value and cannot be used for anything other than as a currency.

Similarly, the supply of these other items can be expanded. An asteroid full of gold could be mined, a new ammunition factory built, or a bean farm planted. Bitcoin has no physical identity, it cannot be reproduced, counterfeited, or grown outside of the well defined properties laid down in the original protocol.

Bitcoin is truly the first pure reference currency. Manipulative games can still be played with bitcoin markets, but the risk of external non-economic events affecting your money supply is removed. A political party can't decide the world needs more bitcoins, a new vein of bitcoins cannot be discovered, and nor can a new use for bulk bitcoins be invented.

</comment></comment></comment><comment><USER5> Unless I misunderstand Bitcoin more than I think I do, this is flat-out wrong (~1/3 of the way through the document):

      (U) What Users Can Do To Increase Anonymity
      ...
      • (U) Combine the balance of old Bitcoin addresses
            into a new address to make new payments.

Combining balances just means you have a bunch of disparate nodes in the network which may not be related, and you are _intentionally_ connecting them. So if you combined anonymous nodes A-Y with Z which was linked to you, A-Y are now logically linked to you because Z tainted the whole pool. (edit: or at the very least, all the money in A-Y)

Yeah, there are ways to make it true/er, but I'm arguing against the principle of the suggestion. And I have doubts that combining (only your) addresses will _ever_ increase anonymity.

<comment><USER6> Actually, I think the suggestion in the report is correct.

I _think_ that what they are getting at here, is the following scenario:

Imagine that you have several addresses, with different balances, _in the same wallet_. If you do a payment using the normal client, which requires the total balance from all those addresses, this will create a transaction with all those addresses as inputs. In the Bitcoin protocol this provides unambiguous proof that the input addresses are all controlled by the same user. (With some provisos: obviously wallet services overlaid on the network complicate this; as do some other more sophisticated uses of the protocol; but in general, at a protocol level, this is true).

So, that then shows any passively listening third party that all those addresses were under control of a single user. This knowledge can then be applied transitively, to consolidate ownership of large quantities of accounts. (We tried explain this in our paper: <http://arxiv.org/pdf/1107.4524v2.pdf> Fig 1.6)

What the report is probably getting at, is that an alternative thing to do, would be to instead send all the payments to a new account, in separate transactions. This would introduce a lot more ambiguity for a passive attacker - passive ownership assumptions become a lot less clearcut. You can still try make deductions, but its going to be much larger to do at large scale, and require more statistical assumptions.

Its not completely obvious that this is what the paper is suggesting, but thats my reading of it, and I think that makes sense.

<comment><USER5> Yeah, it's not a clear-cut connection if you do it in multiple steps. Hence the caveat that there are ways to make it (more) true. But what _improvement_ in anonymity does it provide over leaving them separate? If they can't infer that X belongs to you, then if you don't send it to account Y (linked to you) you certainly don't leak that X belongs to you. If you _do_ , it's not proof, but it certainly doesn't improve matters.

Don't take it to extremes - this can clearly be stretched to include running the whole process through mixers and back to a single address while improving anonymity. It doesn't say that. In principle, is combining addresses better for anonymity than not?

<comment><USER7> I think what you're looking at is something more like, if someone employs this tactic, they can't identify that addresses X, Y, and Z belong to the same person, whether or not they know who that person is.

Linking together abstract pieces like that can be one of the first steps to figuring out a very anonymous network.

<comment><USER5> I can't tell if you're agreeing with me or disagreeing...

And yes, those links are basically all you can use in an anonymous network to deanonymize actions. So how is linking things _better_ than not?

<comment><USER7> Now I think I'm just confused by the way you're describing things. I'll hope someone else is better able to understand.

<comment><USER5> Hah, sorry if I am :) Not sure how I can significantly improve things without writing a blog post or something :|

Anyway. Thanks for chiming in :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Since Bitcoin does not have a centralized authority, law enforcement faces > difficulties detecting suspicious activity, identifying users, and obtaining > transaction records

Yeah. Difficulty obtaining bitcoin transaction records. Good on you, FBI.

<comment><USER9> Hang on, aren't the transaction records public and stored by the whole network?

<comment><USER10> I think that's the point.

</comment></comment></comment><comment><USER11> Nice document. It shows well the way of thinking of our governments.

"detecting suspicious activity, identifying users, and obtaining transaction records is problematic for law enforcement." - That must deeply hurts FBI people :)

"Despite the virtual nature of Bitcoin, users value the currency for many of the same reasons people trust Federal Reserve notes: they believe they can exchange the currency for goods, services, or a national currency at a later date."

People do not trust "Federal Reserve notes" (or any other official currency) - they are forced to use it, since they must pay taxes in it.

But it is good, that at least some people realize that there is no such a thing like US dollar, only those "notes" printed by Ben Bernanke and his pals.

If one day Bitcoin gets truly popular governments will be in trouble. How to tax that beast? I wonder if there is any other solution then poll tax.

<comment><USER12> > People do not trust "Federal Reserve notes"

Really? There I was thinking foreign governments liked holding their reserves in US dollars...

> that at least some people realize that there is no such a thing like US > dollar, only those "notes" printed by Ben Bernanke and his pals

Wake up, SHEEPLE!

<comment><USER11> "foreign governments liked holding their reserves in US dollars"

Yes every government _has to_ keep dolar reserve because this is the only currency you can buy oil with. USA managed to force oil suppliers to accept only US dollars.

This is the source of the dollar power and enable FED to print as much dollars as they want. People all over the World must purchase dollars.

<comment><USER13> Minor snark, but 'the Fed', as in 'The Federal Reserve Bank of the United States of America' is an abbreviation, not an acronym. If you really want to use a TLA, 'FRB' (Federal Reserve Bank) might work, but 'FED' is meaningless. This undermines the credibility of your pronouncements on monetary economics.

</comment></comment></comment></comment><comment><USER14> This was leaked quite some time ago and determined to be genuine. Wired's original article: <http://www.wired.com/threatlevel/2012/05/fbi-fears- bitcoin/>

</comment><comment><USER15> > FBI assesses with high confidence that [...] malicious actors can [...] use > botnets to generate bitcoins.

As far as I understand bitcoin (which isn't too far, admittedly), the generation of bitcoins is actually encouraged, and only possible within some well-defined boundaries which basically just ensures that bitcoins are put into circulation up until it hits the fixed limit. Maybe someone could clear that up for me? In that case the "malicious actors" would actually be performing a useful service for the bitcoin ecosystem.

<comment><USER16> Interestingly botnets are probably a month away from being unprofitable for mining Bitcoins, in fact GPUs will be unprofitable for mining Bitcoins all- together. ASIC devices are being shipped over the next six months which will increase the mining difficulty substantially.

<comment><USER17> The benefit is that the electricity bill goes to the owners of the infected computers.

What does a botnet cost?

<comment><USER18> I think the comment is referring to opportunity cost, since botnet's can also be used for other profitable activities, which may bring in more money than bitcoins (such as renting them to interested parties).

<comment><USER19> Generating Bitcoins is CPU or GPU bound. There's a lot of profitable things you can do with botnets that don't compete for those resources.

</comment></comment></comment></comment></comment><comment><USER20> I like the presentation style.

The particular phrasing of "assesses with low confidence" took a bit of twisting to understand, though. Its just a convention you have to get use to in these kind of reports, I guess.

</comment><comment><USER21> Interesting that they don't address whether there are concerns about it eroding tax revenue or if it is a threat to federal reserve notes.

<comment><USER22> I'm guessing it's because that's not something the FBI cares about. The FBI is just a police force; it ain't the Federal Reserve.

<comment><USER21> but you need a police force to enforce fiat :)

<comment><USER9> You need a police force to enforce contracts and there is no system of exchange that can survive without contract.

<comment><USER23> No...you need a _justice system_ to enforce contracts: contract law and dispute resolution pre-dates the idea of a police force by hundreds of years. Breaking a contract is a purely civil matter.

The police usually don't investigate tort law, only criminal law. When the police _do_ get involved in civil law disputes it can get quite controversial.

<comment><USER24> >> contract law and dispute resolution pre-dates the idea of a police force by hundreds of years.

So does centrally controlled currency...

</comment></comment></comment></comment></comment></comment><comment><USER25> Impressively crafted document. Found it to be very concise and educational.

</comment><comment><USER26> I would love to participate in this discussion, but I feel like I don't know enough about the economics of currency to make any real contribution.

Does anyone know of some good resources (online courses, books, etc)?

<comment><USER27> This is always a contested subject because economics has so many competing branches, many of them with more or less overt ideological overtones.

IMHO, you should listen to economists that (a) emphasize looking at the operational realities of what actually happens in the monetary system, and (b) tell you that banks matter for what happens in the economy.

(If you find it hard to believe that a majority of economists ignore banks in their models of the economy, good for you and your common sense!)

This means you should read what Steve Keen writes and listen to what he says (he blogs at <http://www.debtdeflation.com/blogs/>), and what the Modern Monetary Theory crowd write, as they explain such basic things as what role reserves and bonds play, from first principles (start here: [http://neweconomicperspectives.org/p/modern-monetary- theory-...](http://neweconomicperspectives.org/p/modern-monetary-theory- primer.html)).

More generally, "endogenous money" is an important keyword to look out for, because our monetary systems are endogenous in the sense that money is mostly created by banks, not by the government.

If you venture into online economics resources, you will run into a lot of (economic) Austrians. I believe this is mostly because of the Mises institute, which is well funded by people with an ideological ax to grind. It's good to reflect on their messages occasionally, but they should be taken with a grain of salt. (And since they are hardcore gold bugs, they don't get endogenous money, which means that much of what they say simply doesn't apply to our current economic framework.)

<comment><USER26> Thanks, I'll take a look. I am definitely more interested in case study, and reality than an idealogical system.

</comment></comment></comment><comment><USER28> Another part of the global anti-cybermoney-publicity-campagne that we can see right now starting is a study of the European Central Bank on "Virtual Currency Schemes", Oct. 2012.

Read it: [http://www.ecb.int/pub/pdf/other/virtualcurrencyschemes20121...](http://www.ecb.int/pub/pdf/other/virtualcurrencyschemes201210en.pdf)

Edit: BTW, if you are interested in international monetary policy you can find many important publications on the ECB site:

<http://www.ecb.int/pub/html/index.en.html>

<comment><USER27> I suspect you may be overreacting with the tinfoil-hattery. Obviously those institutions like the ECB and the FBI are interested in virtual and new currencies. That's part of their job!

But if you actually read those publications, you'll notice that they aren't very urgent at all. Their stance is basically that they want to keep up with the development, but don't see a reason to act right now.

</comment></comment><comment><USER29> pdf: [http://www.wired.com/images_blogs/threatlevel/2012/05/Bitcoi...](http://www.wired.com/images_blogs/threatlevel/2012/05/Bitcoin- FBI.pdf)

<comment><USER28> Thank you very much for the direct pdf link, I hate does sites that try to simulate ell established office tools like a pdf viewer in a browser, fail with this and still want to collect your data like email address to give you the real thing. Unfortunately too many people out there are using this crap sites.

<comment><AUTHOR> Yeah, sorry about that. I submitted the actual link to the pdf, but HN turned it into a scribd link.

<comment><USER30> only the [scribd] part is to scribd. the rest of the link goes to the original pdf. this is how hn has handled pdf links for a long time now.

</comment></comment></comment></comment><comment><USER31> What does the "(U/FOUO)" that keeps showing up mean?

<comment><USER32> Unclassified/For Official Use Only. Basically means that it's not Secret, but still can't be distributed without permission. Different organizations have different discipline structures around leaking FOUO material, but I don't think there are any legal implications.

</comment></comment><comment><USER33> "In July 2011 FinCEN revised the definition of money transmission service to mean the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds or other value to another location or person by any means."

Sounds like if you make a market for gift cards you need to be a licensed money transmitter FYI.

</comment><comment><USER34> "All Bitcoin transactions are published online and Internet Protocol (IP) addresses are linked to the public Bitcoin transactions."

How are IP addresses linked to the block chain?

<comment><USER35> Well, presumably if you infiltrate the P2P network, you can catch the transaction at its source?

<comment><USER34> Sure, but surely the block chain doesn't contain _Source IP Address_ fields.

<comment><USER35> That is correct.

</comment></comment></comment></comment><comment><USER36> "For instance, child pornography and Internet gambling" - So, me playing the UK National Lottery online is illegal? o.o

</comment><comment><USER37> s/Bitcoin/cash/ and all the negative arguments about propensity for criminal activity are quite amusing.

<comment><USER24> It's a bit harder for someone to take over your computer to create cash.

It's pretty hard for someone to hijack your wallet with a Trojan and if they _do_ get into your bank account that way then the police and the bank might take an interest.

I know this is a meme in the BTC community - any criticism of BTC as a payment method is met with the claim that "it's just like cash" and any criticism of weaknesses of BTC as a currency is met with the claim that "it's a payment method and a commodity". To me it pretty much fails at all of the above.

There's no doubting it's good for purchasing contraband though.</comment></comment>


Show HN: Crypto Central – Bitcoin and Cryptocurrencies Portfolio - <AUTHOR> https://cryptocentral.ai/ <comment><AUTHOR> Hey Crypto lovers,

We have worked the past few weeks on the new version of Crypto Central. It's now available on Web, iOS and Android.

Our aim is to create an all-in-one platform to track your investments on the crypto market. From your mobile to your Mac, it was never so easy to see your profit!

More features to come: Sync with exchanges, buy and sell (shapeshift integration?), ... If you have any feature requests for us, just let us know by commenting the thread here

Enjoy your crypto day!</comment>


Disqus Security Alert: User Info Breach - <AUTHOR> https://blog.disqus.com/security-alert-user-info-breach <comment><USER2> This is a good time to remind everyone to use a password manager and to have each password generated. Each service should have it's own password so if it gets compromised, your exposure is limited to that one service.

It is clear this is going to be a staple of internet life, so might as well be prepared.

<comment><USER3> Can you suggest a good password manager?

Ideally, I'd really like something that's deterministic - ie, I can provide a seed, and then that seed plus the domain name becomes the basis for the password.

That way, it's trivial to recover passwords when sitting at a new computer. And I imagine if the seed is sufficiently long (say, a 10-word sentence that includes 2 or 3 non-dictionary words) then it'd be highly impractical to force.

Right?

<comment><USER4> A better argument against deterministic password generators than the current replies to your post is that if you have to change your password on a given site - due to password expiration, 'forgot password', security breaches, etc. - you have to change the seed, and remember which seed you're using for which site.

There are some others:

[https://tonyarcieri.com/4-fatal-flaws-in-deterministic- passw...](https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password- managers)

But if you want to use one anyway, that blog post links to a bunch of them.

<comment><USER3> Ahh, thank you. This is the kind of refutation I need. I'll read up and decide.

As for your specific qualm: I have to imagine that this can be solved by adding a numerically-determined nonce (so that I can say, "this is my 2nd password on disqus", etc) without having to fashion a new key.

edit: OK, so I have read the article. Here are my reactions to the author's four concerns:

* #1: Password schemes

> Unfortunately, sites have wildly varying and often conflicting password > requirements: non-alphanumeric symbols are mandatory! Passwords must be > alphanumeric only! Capital letters required! Passwords must be lower-case > only! Passwords must be at least 12 characters long! Passwords must be at > most 8 characters long!

> While many of these requirements seem silly and in a perfect world all sites > would adopt the new NIST password guidelines, reality is messy and there is > no single deterministic password generation scheme which can accommodate the > password policies of all sites.

There aren't _that_ many different schemes. Maybe a grand total of three dozen? I think that the program can simply have a user-updated registry (perhaps that's shared) of schemes, and the generator accounts for this. This seems like... maybe 150 lines of Python.

#2) Revocation and new passwords

> We could ask the user to remember the site-by-site counter and input the > correct counter value to derive the correct password. But I think this is > silly.

Umm, that's a strange argument. I don't think that's silly. I think it's highly practical. Currently, users remember a shitload of different details for different domains, including different usernames (this one was taken here, that one didn't meet the scheme there, etc) and often slightly different passwords.

Making them remember an integer that will rarely be larger than 3 instead of a password seems awesome. Worse case scenario, they can keep trying until they get the right one.

> You can't store credit card numbers or bank account numbers in such a vault.

> You can't put arbitrary cryptographic keys in such a vault.

> You can't store randomly selected answers to security questions in such a > vault.

> I consider this to be part of the basic functionality of a password manager.

I don't know what to say except that... I don't. I'm happy to have a password manager literally just manage passwords and allow me to use other tooling (like form memory in a browser) for this other stuff.

> Exposure of the master password alone exposes all of your site > passwords...If you accidentally type or paste your master password into > email, IM, or social media, an attacker can leverage that alone to derive > all of your site-specific passwords.

Yeah, I get it - that's the same argument the others in this thread are making.

But I'm not going to accidentally type along seed, like a 10-word sentence with punctuation, into any of those places. This seems like a completely absurd argument to me.

<comment><USER5> That's effectively no different from changing the seed data (say, going from "password1" as the seed to "password2"), you still have to remember which iteration you're on on each site as part of the seed data.

Edit: and this point is actually made in the article the GP linked.

</comment></comment></comment></comment></comment><comment><USER6> I just learned about this thanks to an email from [https://haveibeenpwned.com/](https://haveibeenpwned.com/) alerting me that my account info was leaked.

<comment><USER7> I got an email too. The thing is, I don't have a Disqus account. The only mention of Disqus in my gmail account is the haveibeenpwned email. Any idea what's going on?

<comment><USER8> Same happened to me. I think I may have used the social media login via Google, which I'm guessing could get your email into the leak without any password being present.

</comment></comment></comment><comment><USER9> _Right now there isn't any evidence of unauthorized logins occurring in relation to this. No plain text passwords were exposed, but it is possible for this data to be decrypted (even if unlikely)_

Where by "unlikely" we mean "with almost complete certainty".

<comment><USER10> That was my first thought upon reading that. Someone at Disqus should take those lists of hundreds of millions of hacked passwords, hash 'em with SHA1, and see how many _aren 't_ in their own list.

<comment><USER11> You mean, like Troy Hunt, of "haveibeenpwned" fame?

</comment></comment></comment><comment><USER12> We just have to concede centralization is a dark pattern online. Its creates incentives for obsessive profiling, surveillance and makes a complete mockery of privacy.

In many ways the old world of dispersed forums were much better and are still better content wise than anything Reddit can throw up.

You can share photos and remain connected to family and friends without needing anything like facebook. This kind of centralization only favours self promoters and exhibitionists and shifts tremendous personal data patterns to entities who have no business having or analyzing this data. No one should have access to this kind of data as the consequences can only be negative.

</comment><comment><USER13> This highlights an important aspect of Data Security that is often never talked about

Data Minimization.

It seems they had a old copy of the database, likely a backup, just sitting around somewhere. The question is why did this old copy, from 4 years ago, still exist. Why was it not deleted under a standard data retention policy.

Companies not only need to spend time on how they will secure data, they need to spend time on how they will age out and delete old data.

<comment><USER14> We really need to get companies to see user data as a liability, rather than an asset. Our incentivisation system is completely backwards for this.

</comment></comment><comment><USER15> The rate at which these security breaches are happening is very alarming to me.

I don't know what the effects are of them (including this one), but my gut tells me they'll only increase over time; perhaps the severity of them as well.

It's honestly making me re-consider my use of the internet, technology, and electronics.

What's the future hold with regard to security, breaches, and keeping our data and information safe?

<comment><USER16> > The rate at which these security breaches are happening is very alarming to > me.

It is the rate at which they are being published that is alarming to you, the rate at which they are actually happening is much higher still.

</comment></comment><comment><USER17> SHA1..... That's bad

Current gpus can hash tens of millions of passwords per second with SHA-1.

<comment><USER18> Some back of the envelope calculations...

[A GTX 1080 can do ~8.5 billion hashes/second][1].

An 8-character, truly random password with mixed case, numbers, and symbols has (26 * 2+10+32)^8 possible combinations.

That means an attacker with a single GTX 1080 could crack such a password ((26 * 2+10+32)^8/2) / (8538.1 * 10^6)) seconds ([approximately 4 days][2]) on average. And most user's passwords are most certainly not truly random (i.e. they're significantly weaker than that).

[1]: [https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...](https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40)

[2]: [https://www.wolframalpha.com/input/?i=((26*2%2B10%2B32)%5E8%...](https://www.wolframalpha.com/input/?i=\(\(26*2%2B10%2B32\)%5E8%2F2\)+%2F+\(8538.1+*+10%5E6\)\)+seconds)

</comment></comment><comment><USER19> I am always puzzled when a company reports a breach and says "X account details were compromised, and Y passwords were obtained..." when Y is a smaller percentage of X.

I would assume that there is always a 1 to 1 relationship of user account details to passwords, or that the passwords are stored within the user table in the DB, so at best, X=Y at all times?

I can understand if it is a current breach and the DBAs managed to stop a transfer of data mid query, but in a 4 year old database (in this case) where only hackers only have partial data for passwords, but full data for user accounts?

<comment><USER18> Disqus provides options for single-sign-on. So it's possible that some of the accounts breached didn't have a password associated with them, only OAuth tokens.

</comment></comment><comment><USER20> How can an independent security researcher be aware of such a breach ?

<comment><USER10> One guy in particular, I can't recall his name (Chris Vickery, maybe?), has been behind _A LOT_ of these "discoveries"; specifically, a bunch of Amazon S3 buckets that are misconfigured (WRT permissions) and wide open to anyone who wants to download the data. (I'll admit that I'm kinda curious as to how he enumerates all of them!)

Based on the little information published, it sounds like that's what has happened in this case as well.

The same guy has also found tons of wide open MongoDB instances and such.

The guy you're referring to, Troy Hunt (HIBP) , writes about these cases but, AIUI, doesn't typically find them on his own. He's usually notified by the actual "researcher" \-- this Chris guy in a lot of recent cases -- and they share the info with him.

<comment><USER21> You can enumerate S3 buckets (and other cloud operators) by DNS bruteforce, or looking at how the company name them on their website and working through some common name.

Did this recently and found 1000's of public buckets.

</comment></comment></comment><comment><USER22> All these leaks are making me feel anxious to go around deleting anything I no longer use and be more careful about signing up for anything without FB/Google login. It seems like only giant companies have the competence to maintain security BUT even then, Yahoo proves me wrong on that one.

That said, I'm sort of happy 1password switched to subscription billing - hopefully this lets them pay top dollar for the best security experts.

<comment><USER23> Someone posted on HN fastmail includes a very unusual and nice way to stop spam using alias, basically it's mailinator baked in: [https://www.fastmail.com/help/receive/aliases.html](https://www.fastmail.com/help/receive/aliases.html)

<comment><USER24> I pay for FastMail for this very reason. When I transferred off my Google Apps email account, I set up a unique ___@ for every website. If my email ever leaks, I'll know who leaked it (or sold it).

<comment><USER25> Same here. I simply set up a catchall alias so <anything>@somedomain forwards to foo@regulardomain; very convenient. The fact that FastMail supports multiple custom domains, at least with standard accounts, is also nice -- even more so since you can (optionally) use their own nameservers and set up whatever DNS records you want (I use that for some personal websites), while they make sure SPF/DKIM records are always correct.

(Having a separate domain is not really necessary, but I registered it through nearlyfreespeech.net and use their WHOIS privacy service; at least J. Random can't easily figure out my identity based on the email address alone).

</comment></comment></comment></comment><comment><USER26> It's not just your passwords of course but also email and sometimes phone and credit cards you have potentially stored at sites as well.

</comment><comment><USER27> Is the info available online somewhere? I'm curious what my password was in 2012.

</comment><comment><USER10> Sounds like somebody left an S3 bucket wide open yet again.

</comment><comment><USER28> SHA1 hash? You've gotta be fucking kidding

<comment><USER29> It's from a database from 2012. Wasn't that cutting edge in 2012? What kind of sick shit will we be encoding our stuff 6 years from now, that bcrypt will seem laughably ill-suited.

<comment><USER9> The most popular post that ever ran on Matasano's security blog was the one where I encouraged people to migrate to bcrypt. In 2007. Bcrypt, of course, is much older; Niels and David invented it as the standard password format for OpenBSD back in 1999 --- and bcrypt was a response to FreeBSD's _iterated_ salted hash format, which also had a work factor, and is years older still.

Today, in 2017, bcrypt remains a sound recommendation. You can do better, but for password databases on websites, not _materially_ better.

Salted SHA-1 hashes (salted SHA-anything hashes) were malpractice in 2012.

<comment><USER27> > _You can do better, but for password databases on websites, not materially > better._

Do you mean using scrypt? What do you mean by _materially_ better?

<comment><USER9> No, I mean bcrypt.

Scrypt is better than bcrypt, but mostly not in ways that make much of a difference in 2017.

PBKDF2 comes close to being materially worse than bcrypt and scrypt, because it's especially straightforward on modern hardware, but _even PBKDF2 is fine_.

For the most part, as long as you're using anything with a KDF-like design for your password hash, a compromise of your password database is going to reveal the very terrible passwords and only those passwords; the rest will be too costly to crack.

Right now given the choice I'd use scrypt and go slightly out of my way to get it (if there was a good 3rd party library for it and bcrypt was in the standard library and I was like a "yarn add" away from having it, I'd take that step), but I would _not_ convert a bcrypt site to scrypt.

<comment><USER30> Considering that PBKDF2 has adjustable difficulty parameters would you still say it's worse if very high difficulty parameters are chosen?

<comment><USER31> It has to do with defender's vs attacker's costs. PBKDF2, which is usually instantiated with SHA-2, even with huge amount of rounds is still a lot cheaper for the attacker than for the defender, since the attacker can use GPU/ASIC, requiring fewer transistors, running many calculations in parallel, while defenders usually use CPU. On the other hand, bcrypt, scrypt, Argon2 don't provide a lot of advantage to the attacker compared to CPU, since GPU and ASIC implementations are expensive and memory-bound.

PS My measurements show that pure JavaScript implementation of scrypt is better than fast native PBKDF2 provided by WebCrypto API or Node.js at the same running time.

PPS But yeah, if you can't use bcrypt/scrypt/Argon2, but can use PBKDF2 with high number of rounds, sure, do it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> Was the salt leaked?

<comment><USER24> Another important question: Did they use a unique salt _per password_? Their announcement is ambiguous.

<comment><USER18> That's the general idea of a salt, yes. I'd argue that a salt which isn't unique per-user isn't really a salt at all.</comment></comment></comment>


Footage of San Francisco's Market Street in the '60s - <AUTHOR> https://www.sfgate.com/sf-neighborhoods/article/archive-san-francisco-market-street-footage-15082399.php <comment><USER2> This probably dates to 1966, given when the film "Doctor Zhivago" was in theaters.</comment>


One year on: The state of Chrome OS - <AUTHOR> http://www.extremetech.com/computing/115053-state-of-chrome-os

<comment><USER2> This article is pretty far off the mark, IMHO: Shortly after releasing the initial Chrome OS, Google has been completely mum about it- Also, no new Chrome OS laptops are appearing. This suggests to me that it's only a matter of time before Google discontinues the project altogether. The best that could be hoped for is that Chrome OS is reinvented as a small extension to their Android OS.</comment>


Ask HN: Does anyone else have the sense that "the good bit is over"? - <AUTHOR> Looking ahead, it feels like there's less interesting things and less opportunity and less potential.
Consumer hardware, phones and computers seem to be "good enough" so demand is falling.
There seem to be fewer obvious ideas for changing the world with the Internet, as evidenced by the things like home food delivery being big news.
Dunno.  It just feels like the future of technology isn't so exciting.
Does anyone else feel this way? <comment><USER2> People so bummed out on a Friday? [http://motherboard.vice.com/read/its-2016-and-the-promise- of...](http://motherboard.vice.com/read/its-2016-and-the-promise-of-the- internet-is-dead)

Well, I remember a time when it "felt" like everyone with an ounce of ambition, a computer, and the most rudimentary know-how should feel entitled to spin up something with an impact.

I don't know if that was every _really_ the case. But it's clear that it's certainly not the case now.

Also, the Internet (remember when you used to capitalize it?) is not the end- all of technology. And when it came out, most folks didn't realize how powerful it would be until much after. So what's next? Maybe we just have to try harder to define our own success - find something you care about contributing to. It's not "disruption" in the way it's portrayed in the tech- tabloids, but in the end it's about how you choose to spend your time and energy before you die.

</comment><comment><USER3> In general it's safe to assume that the world will default to thinking that you, I, and technology are all irrelevant. Like, people will say that it's important in the same way that politicians say that voters are important.

So when it isn't irrelevant, it's because things have snuck in to change the status quo. The internet, I think, is a big enough idea that it's still not really seen it's full impact yet - today we just see the waxing phase of the second attempt to lock down the network under the thumb of a few centralized players. (the first one being AOL et al.) but networks are really quite powerful, and I have faith that the pendulum will shift again.

</comment><comment><USER4> Synthetic biology seems like a pretty exciting area of study to me. Maybe get a copy of "The Machinery of Life", or "Regenesis".

[http://www.amazon.com/Machinery-Life-David-S- Goodsell/dp/038...](http://www.amazon.com/Machinery-Life-David-S- Goodsell/dp/0387849246/)

[http://www.amazon.com/Regenesis-Synthetic-Biology- Reinvent-O...](http://www.amazon.com/Regenesis-Synthetic-Biology-Reinvent- Ourselves/dp/0465075703/)

<comment><AUTHOR> Holy heck. Not something I can build from my lounge room with nothing but a computer, an Internet connection, time and determination.

</comment></comment><comment><USER5> Oh my goodness no: I don't feel like that at all! Life just keeps getting better and better for humanity, year after year, and technology drives a lot of that. No reason to think it's gonna stop now...

</comment><comment><USER6> I think there could be some amazing opportunities in the future with a combination of 3D laser scanners, 3D printers and the Internet.

</comment><comment><USER7> Artificial intelligence, reusable rockets, and cryptocurrencies looks pretty interesting to me.</comment>