Scientists are transplanting faeces into obese people with type 2 diabetes - <AUTHOR> https://www.walesonline.co.uk/news/health/scientists-transplanting-faeces-obese-people-15725826?_ga=2.61629100.1888045544.1548445055-1170985165.1548445054 <comment><USER3> For those who just read the beginning of the article

"It's in liquid form and injected through a tube in the patient's nose. There is no smell or taste associated with it – it's all very purified."

</comment><comment><USER4> FMT transplants have a very high success rate for treating C Diff infections that don't respond to antibiotics. Something like 70-80% success.

<comment><USER5> Source?

<comment><USER6> Fecal Transplantation for Recurrent Clostridium difficile Infection in Older Adults: A Review - [https://onlinelibrary.wiley.com/doi/abs/10.1111/jgs.12378](https://onlinelibrary.wiley.com/doi/abs/10.1111/jgs.12378)

Fecal Microbiota Transplantation for Clostridium difficile Infection: A Systematic Review - [https://annals.org/aim/article-abstract/2288521/fecal- microb...](https://annals.org/aim/article-abstract/2288521/fecal-microbiota- transplantation-clostridium-difficile-infection-systematic- review?doi=10.7326%2fM14-2693)

I just cribbed these from the Wikipedia article at [https://en.wikipedia.org/wiki/Clostridioides_difficile_infec...](https://en.wikipedia.org/wiki/Clostridioides_difficile_infection#Stool_transplant) so I don't know if there's better or more recent studies.

</comment></comment></comment><comment><USER7> This is interesting. I was wondering if anyone is working on something similar meant for nasal area? Chronic sinus infections, thick mucus and various other annoying nasal afflictions could possibly be solved by something like this?

<comment><USER8> I wondered the same thing, and came across this guy who has been documenting his experimentation and purported success with self-administered bacteria from kimchi... [https://lactobacto.com/2019/01/17/what-else-can- lactobacillu...](https://lactobacto.com/2019/01/17/what-else-can- lactobacillus-sakei-treat/) :)

</comment></comment><comment><USER9> No shit, this has been going on for a while I thought? The idea being the gut microbiome is partly to blame for obesity.

<comment><USER10> The main source of obesity is to high calorie intake.

<comment><USER11> Thats like saying the main source of famine is to low calorie intake. It may be technically true but it misses almost every part of the problem.

<comment><USER10> If you want go down that road I will say that reason of high calorie intake is not gut bacteria. In majority of cases it's bad eating habits. Too much sugars, too much fats. Education is the greatest weapon against obesity that we have.

<comment><USER11> >Education is the greatest weapon against obesity that we have.

Yet the most educated societies have the worst problems with obesity. A fair statistical case could be made that Education causes obesity, albeit it too would miss most of the problem.

>reason of high calorie intake is not gut bacteria [majority of cases]

Most research I've read, especially around epigenetics, the thrifty metabolism and the Dutch hunger winter studies, all show a strikingly different biome of gut bacteria in [an overwhelming majority] of obese individuals compared to average bmi non-thrifty metabolic people.

</comment></comment></comment></comment></comment><comment><USER12> Still looking for donors..

<comment><USER13> Never go ATM

</comment></comment><comment><USER14> It was my understanding that T2D is due to Insulin Resistance and the reason most folks gain weight is that an excess of Insulin will do that. Doing a Fecal Transplant seems more like a band aid solution for T2D since unhealthy eating habits will just kill off the good bacteria over time.

I'm curious if these folks tried to lower sugar intake in all forms and reduce their eating window to 8 hours and whether that would have lowered Insulin Production and caused an increase in Insulin sensitivity.

How difficult it is for people to change lifestyle habits to fix their hormonal unbalance when it comes to obesity.

<comment><USER15> "How difficult it is for people to change lifestyle habits to fix their hormonal unbalance when it comes to obesity."

Sadly, evidently, very.

Annecdotally, most ppl don't seem to connect what they consume with their health. There's no sense of garbage in...feel like garbage.

I'm not sure what they're tbinking but when I look at their bodies and then at their shopping cart (at the super market) disconnect wins 9 of 10 times.

Furthermore, abnormal has been normalized. Humans are naturally wired to assume the norm. They see what's around them and naturally presume it's okay. Obesity is the new black. Soda, cookies, etc. (and the advertisement there of) is ubiquitous. Honesty is now called "fat shaming."

I understand there are people who have health issue the cause them to be obese. The rest a simply negligent. Sadly, it's not PC to say such truths.

p.s. Editorial: How is it, in the face of the obesity crisis (which directly contributes to increased healthcare costs), that the adults who lead the Girl Scouts are still pushing cookies. The hypocrisy and absurdity boggles my mind.

<comment><USER16> TL;DR I know what I should be doing, do mostly the right things, but still am obese.

—

Speaking as an obese person that knows the dangers and generally does the right thing re: diet and excercise- it's crazy hard.

I entered freshman year of HS 6'2" 275lb, graduated Senior year 6'3" 290lb. I'm 36 now and my weight has pretty much been in that same window my entire life.

I played very high level high school athletics (4 sport varsity, all star teams, etc.), still play competitive "A" league rec sports all year every year, and still do cardio and weight lifting 3-5 days a week. I hike at least 6 miles a week rain or shine with my bow and hunting pack in the woods outside my house for practice. I'm very strong and shockingly flexible- but I still have the physique of a beer league bowler (of which I also am).

I don't drink soda or eat fast food for the most part, and my diet throughout the week is mostly veggies and proteins. My diet is definitely not perfect and I must be consistently eating more than I output, but...

The weight will melt away until I get to 275 and then my body turns into an always hungry eating machine. Or If I have pizza (or something carby) for lunch I'll be craving carb food the rest of the day.

My will power is strong, but there is no such thing as just one bite. It's zero bites or all the bites and it's a crazy pull. It's also infuriating because this is the one part in my life where I've never been able to just will it so. Sports, work, kids, outdoor adventuring: I have never faced a situation that I couldn't just grit my teeth and make it through.

Not the weight though. There are too many little unconscious failures that stack up through a day or week that will hinder progress. The conscious ones take a toll even more because now you get to think about "I shouldn't have..." the rest of the day.

It's a weird deal, luckily it doesn't take an emotional toll on me like I've heard it takes others. It's a thing, it's my thing I try and work on (that and being generally nicer), I just keep plugging and monitor the hell out of my health. BP, glucose, A1C, cholesterols, etc. all paint a picture of a man healthier than I look on a BMI chart.

<comment><USER17> I was in a similar situation. What I found is very slow diets work well. Eat more or less the same thing every day for a while to so you get a feel for what a matence level is then cut just enough calories so your losing ~2 pound a month.

I still got stuck at my old normal, but it's now easy to maintain. Maintain that for a year or so and you can start cutting things again without awakening that ravenous hunger.

So what if you only lose 40 lb in 4 years that's still real and sustainable progress. At 38 it's the end of January and even with plenty of indulgence I weigh what I did before thanksgiving, that's huge IMO.

PS: I am still heavy, but dropping your BMI by 5+ and keeping it off while also bulking up just feels so much better. Remember, a net gain or loss of even 1 pound per year adds up.

</comment></comment></comment></comment><comment><USER18> Fecal microbiota transplants are more pseudoscience than science. Research should be done to identify the most relevant microbes within fecal transplants, which could then be isolated and manufactured via industrial fermentation; such standardized products would be more scalable, would reduce the risk of infections from unwanted microbes, and would improve the scientific study of the approach, since the same substance would be administered each time. [https://en.wikipedia.org/wiki/Fecal_microbiota_transplant#Re...](https://en.wikipedia.org/wiki/Fecal_microbiota_transplant#Research) This would remove many unnecessary and correlated variables associated with feces transfer, especially when it is being transferred "with the liquid injected through people's noses"! This could benefit from either a medical ethics review or an editorial review of the article.

<comment><USER19> Why not send them a note? I'm sure they'll be grateful for your input - <USER2> like it could save them a lot of time.

<comment><USER18> I do not appreciate the sarcasm.</comment></comment></comment>


A new platform that gets rid of "Likes and Followers." (Pre-launch) - <AUTHOR> http://WWw.PIVIT.me <comment><USER2> there is not really information on what this is... the page simply ask for some information which i can imagine people wouldn't hand out if there's not any clear information on the page what will happen to them or some example of how the platform works / what it's benefits are opposed to other platforms etc. etc.</comment>


Ask HN: Nowadays, should I make my js use callbacks, promises, or other? - <AUTHOR> Say I'm making javascript library that needs to do some asynchronous work. What is the current modern best practice?
getusermedia and jquery use callbacks, but it seems like that fell out of favor a while ago (or have callbacks come full circle and are preferred again?).
WebCrypto uses promises. Is that now what everyone is using for new libraries, or have people grown tired of promises?
XMLHttpRequest uses listeners (or whatever they are called: .onreadystate, etc.) which I guess are kind of like callbacks or events? Has that technique started to gain favor again?
Inter-iframe communication (postMessage) and bootstrap (for CSS transitions) use event listeners. Are events now a better way to signal when an asynchronous task is done?
I haven't kept up with all the latest preferred way to do this. <comment><USER2> Between callback functions and promises, I've seen a general shift toward preferring promises, as you said, even for native DOM APIs. Using then/catch/finally or async/await is easier to work with, I think, especially for a series of async actions.

Event emitters are for a different range of use cases, I'd say: when you're expecting to send/receive a number of events, or multiple event types - for a duration of time, possibly open-ended like AJAX or WebSocket connection.</comment>


Show HN: Reddit "The button" flair chart - <AUTHOR> http://thebutton.divshot.io/

<comment><USER2> The graph-lines are the same colour for each flair colour? Is this intentional?

<comment><AUTHOR> It's a spider chart, not a bar chart. I don't think spider charts are drawn in multiple colors</comment></comment>


You're infected—if you want to see your data again, pay us $300 in Bitcoins - <AUTHOR> http://arstechnica.com/security/2013/10/youre-infected-if-you-want-to-see-your-data-again-pay-us-300-in-bitcoins/ <comment><USER2> You can work to prevent this by creating a group policy that disallows

         %AppData%\*.exe

and

         %AppData%\*\*.exe

A good discussion of this happened here: [http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...](http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_your_cryptolocker/)

sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

<comment><USER3> Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non- administrator.)

<comment><USER4> _Doesn 't Google Chrome run under %AppData% in a default (non-MSI) install?_

Yes, and from a security point of view it should be treated as hostile accordingly.

There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism.

It's long past time that Google were called out on this one. Not only is it a potential security risk, it also interferes with backups of %AppData%, which is generally an area of Windows PCs that you do want to save regularly in case of disasters.

<comment><USER5> Installing into %AppData% is, iirc, Microsoft's intended approach with ClickOnce installers (which Chrome uses). The difference is that ClickOnce installers have a far more restrictive permissions model than old MSIs.

ClickOnce-installed applications are limited to "Internet Zone" permissions. This can make them immensely frustrating to develop with, actually, since many of MS's own development frameworks fail miserably in Internet Zone even when they have no reason to do so (mostly they generate temporary files in places they aren't allowed).

I'm not sure how Google Chrome gets permissions to save files into your documents and whatnot from there - I don't recall Chrome requesting a permissions escalation during install or anything.

<comment><USER4> Fascinating. Thanks for sharing this information. I had no idea this was actually a sanctioned installation option, but clearly it is if you know what to look for[1]. That's actually rather disturbing, from a security point of view...

[1] [http://msdn.microsoft.com/en- us/library/142dbbz4%28v=vs.90%2...](http://msdn.microsoft.com/en- us/library/142dbbz4%28v=vs.90%29.aspx)

</comment></comment></comment></comment></comment><comment><USER6> I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes.

Pull-only backups were the savior here, although because we didn't notice until the next day, the pulled backups on that system were also overwritten with encrypted/corrupt files. Luckily we had VSS versioning on the pull-only backup location. There was a close call in that the 2 TB or so of "new" data ended up pushing VSS over quota and we almost lost our good versions of the files that way. If not for the VSS versions, we would've had to resort to cold backups which would've been a bit older. As it stood, no file recovered was more than a few hours old.

Auditing on the file share indicates which workstation was infected. Pertaining to that: it surprises me that in 2013, a default install of Windows will not log any useful information about shared folders by default. You must enable object auditing in Group Policy and specifically declare which users or groups are subject to said auditing on a share-by-share basis. In a world without logrotate, I suppose a sensible default is to just let a bunch of shit happen without recording it.

What gets me wound up most of all is the amount of engineering involved for an average home user to protect themselves. I thought a Mac with Time Machine was enough, but a similar virus would easily corrupt those backups if they were available to it over a mapped drive.

It is the goddamn 21st century, and users are still losing work by overwriting documents by accident, or opening a document as an e-mail attachment and not being able to find the actual file they edited. Should people really need an IT guy with ten years of experience to be protected from simple mistakes? Google has made progress on that front with the Chromebook, I suppose.

<comment><USER7> Something like CrashPlan provides good protection against this sort of thing for home users. It includes versioned, off-site backups -- either on their servers for around $6 a month, or on a "friend's computer" for free. Either way, the backups are saved via crashplan, not with direct drive access, so it should be safe against this kind of thing.

No affiliation, just a user.

<comment><USER6> Thanks! I am looking at BackBlaze, Arq + Glacier, and now CrashPlan as relatively cheap additions for extra peace of mind.

</comment></comment></comment><comment><USER8> I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account.

One trivial solution would be OS level automatic versioning of files (ala Dropbox or Sparkleshare) - the original files would be written to location that is read only to the user and only accessible via the OS, hence, backups could always be restored from it, but never destroyed without admin rights.

Of course, with people having great internet and whatnot, an automatic cloud based solution would be much more likely and useful.

I think with Windows 8.1 and onwards, Microsoft are automatically doing this by setting up the "Documents" type folders in SkyDrive - a great think moving forward.

Backups are, obviously, a much better solution but require extra storage and usually cost money.

So there might be a niche for a freeware product that runs as an admin that automatically versions files - perhaps even as simple as having an admin-owned .git repo for the Documents folder.

The worrying thing about this attack is that targeting user data is trivial on all OSs, because of the way we think about privileges - it could be done to us Linux users through something nasty in our shell rc using GPG or whatever. There is no need to compromise anything.

<comment><USER4> _I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account._

You make an excellent point, but there is a second and perhaps even more sinister side to it. Encrypting your data and holding it hostage is one thing, but even if you have indestructible backups, there are probably still many sensitive pieces of information that can be acquired by a blackmailer with only user-level privileges: bank details, company trade secrets, personal mail/photos/videos, etc.

Having a back-up of these is important, but probably so is ensuring that they aren't distributed to people they shouldn't be. This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet.

<comment><USER9> > This requires a very different model of access control and user/application > privileges, and unfortunately I don't think any mainstream OS is even close > to solving this one yet.

I'm not sure it does require a different model of access control. It just requires people to _actually use_ the access control mechanisms that exist already.

You should not access banking details or any other sensitive information in the same user-level context as you use to generally browse the internet. The privileges needed for each task ("browse the internet" vs. "check bank statements") should be different. I personally have a separate user account on my machine set up specifically for "sensitive" tasks.

Separation of data access via privileges is nothing revolutionary, nor is it something that can't be done on any modern OS. Unfortunately, online services are still behind. For example, I would probably switch to an online banking provider that let me create one account for viewing balances and another for transferring cash. But these services will get there in time.

User education is a different story.

<comment><USER4> Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do.

On the other hand, if only explicitly authorised applications can create outbound Internet connections at all, and if applications like browsers and e-mail clients need explicit permission to read a general user file (as opposed to, say, accessing their own designated configuration or data files), then you significantly decrease the degree of vulnerability a user has to data leakage attacks (among other types).

<comment><USER10> >Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do.

        $ sudo -u banking gnucash &
        $ firefox &

Done. My banking files and my Firefox session are now separated.

<comment><USER8> Interestingly, you may have just fucked yourself, because the sudo session is maintained whilst launching Firefox.

If we create a script 1:

       #!/bin/sh
       echo "I'm doing something secure"

And then script 2:

       #!/bin/sh
       echo "I'm doing something insecure".
       sudo echo "I'm doing something malicious".

Then run:

      $ sudo ./script1.sh; ./script2.sh

Looks like Firefox has access to your banking user :)

<comment><USER10> Not if sudo is set to only allow gnucash! :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" \-- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music.

Well, it doesn't. This is a problem that should have been solved at the level of OS permissions/UI long ago. Why does a modern OS include UI functionality allowing a standard user to run an uninstalled executable in a non-sandboxed environment? There's no good reason for it.

In some cases the problem been solved (e.g., restrictions that allow only signed apps to be executed). But I guess none of those cases include Windows, its standard UI, and popular e-mail programs. :-(

<comment><USER12> The best solution would be the one used by Linux: Separate Data and Software.

On Linux there is a specific flag that has to be set and is not set per default to make a file executable.

So if you run something, you know that you are running it as a program and not opening it as data.

Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com

<comment><USER13> Except in this case (original article) it was an executable inside a zip file.

In the normal case, unzipping a file on linux will result in the executable bit being restored if it was included on the original file.

This is normally what you want - imagine an app that was distributed (over https) as a zip file where you then had to go and manually add the executable bit to each relevant file.

But a zip file that was opened as an email attachment is largely indistinguishable from one that was opened from an HTTPS download (it need not be that way, but it is), so the OS has no reliable way to allow you to run executables you download in a zip, but not ones you received as an email in a zip file.

There are certainly ways around it, but the executable bit isn't really the solution here.

</comment></comment></comment><comment><USER14> In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick.

Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do snapshots at 6am,noon and 6pm and then keep the 6pm one for 7, 14 and 30 days.

<comment><USER15> In about any corporation you look, crucial data will be in a Windows server (no ZFS available, sorry), and backed up on intervals that are some integer multiple of 24 hours.

Or, better, the above is the best case scenario that IT dreams of achieving some day. In practice, a huge share of the crucial data sits on people's machine, with no backups, and go on vacation every year.

<comment><USER16> Most corporate windows file servers (since 2003) use shadow copy, which saves previous versions of files every couple of hours. Any decent IT dept will use folder redirection, which redirects deskop, my documents to the local file server.

</comment></comment></comment><comment><USER17> Victims don't even get the enjoyment of having to make their payments in some far flung corner of an MMO, like the plot of Reamde.

[https://www.goodreads.com/book/show/10552338-reamde](https://www.goodreads.com/book/show/10552338-reamde)

<comment><USER18> That's the first thing I thought of, too. This is just about exactly the model of the Reamde crew.

<comment><USER19> Which means the Islamic terrorists coincidentally live upstairs (which I believe is one of the stupidest coincidences of any book I have read and enjoyed.)

</comment></comment></comment><comment><USER20> A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

<comment><USER21> _I then turned on DKIM and enabled quarantining non DKIM emails via DMARC._

Translation for techies who aren't familiar with email's many acronyms?

<comment><USER22> All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.

<comment><USER23> The ten thousand readers of HN who don't know these acronyms can use a search engine to look them up, or someone can ask a question and someone else can answer it and save 9,998 other readers the bother.

1 Google search = 1/35 of a boiled kettle.

So asking the question just saved about 285 boiled kettles of carbon footprint.

([http://green.tmcnet.com/topics/green/articles/216400-google-...](http://green.tmcnet.com/topics/green/articles/216400-google- defends-its-carbon-footprint.htm))

<comment><USER24> And having a flamewar on how people should google things for themselves wasted how many kettles? Anyway, if you don't want to tell people things, then don't tell people things, but going on and on on how OP should just google things themselves, is reaching 4chan levels of elitism. It's a really shitty kind of elitism.

<comment><USER22> A single-line comment is not going on and on.

</comment></comment></comment></comment></comment></comment><comment><USER25> Everyone is talking about post-infection. However - this passage from [http://www.bleepingcomputer.com/virus- removal/cryptolocker-r...](http://www.bleepingcomputer.com/virus- removal/cryptolocker-ransomware-information) seems fairly key also:

"This infection is typically spread through emails sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain a zip attachment that when opened would infect the computer. These zip files contain executables that are disguised as PDF files as they have a PDF icon and are typically named something like FORM_101513.exe or FORM_101513.pdf.exe. Since Microsoft does not show extensions by default, they look like normal PDF files and people open them."

I haven't got a Windows box handy to try this on but I assume there is at the very least an extra warning dialog when opening an exe - even a zipped exe?

Not that that mitigates this at all. The inability to distinguish executables from data files - and although that doesn't apply in this case - the ability of data files to hide executable payloads either via design or error - is a major and currently uncorrected flaw in the system.

<comment><USER26> Why doesn't MS Windows use magic numbers to establish file types, or does it now?

<comment><USER27> It does (I think), but even if it doesn't, it uses the file extension to determine it. However, EXE files are free to set their own icon. In this case, the icon of the EXE was a "PDF" icon.

The silly bit is the fact that the file extensions are hidden by default, and users can only use the icon to check the file type.

</comment></comment></comment><comment><USER28> Ah, I guess it is time to send the annual email to mom, dad, and the in-laws to be very wary of downloading anything or clicking on links in suspicious emails.

I find this is good insurance against the inevitable phone calls I receive as the only computer-literate member of the family: "Hey Cory, all my documents disappeared and I can't get them back. Do I have a virus?"

</comment><comment><USER29> I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get.

Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.

<comment><USER30> While you're technically right - we are responsible for our security, and we should lock down our networks just like we lock our front doors - this is basically blaming the victim.

<comment><USER29> In a nice neighbourhood one could probably leave the door unlocked, but unfortunately internet is more like Gangland than Wonderland.

This said, I'm not blaming home users, but IT folks who failed to secure corporate data and should have known better.

</comment></comment></comment><comment><USER31> I've been trying to raise awareness in my social medias, since my family, friends and co-workers might not spend time on HackerNews.

If you want, copy my message and share with your family, friends and co- workers:

"Hi folks,

There's a new virus out there that I want to raise awareness of, it's called CryptoLocker. Basically what this virus does is that it tracks all your files - hard drives, flash drives, usb sticks, network drives/shares - then it encrypts the files it finds.

The only way to unlock the files again is to pay $300 to get the key used for the encryption. The encryption used is RSA with a 2048 bit key which makes it extremely hard to crack, I'd say impossible with the time span and todays computers.

You have 72 hours before they trash the key making it impossible for you to get your data back.

This can be extremely devastating if you are running a business and all your files are gone. If you sync your files to the cloud, you're still not safe, it syncs the encrypted files as well. If you are able to restore to previous versions of your files in the cloud - great.

Let your friends, family and co-workers know about this.

Here are some simple ways to avoid getting a virus in general:

1\. Don't open e-mails from people you don't know

2\. Don't open attachments in e-mails unless you were waiting for the attachment

3\. Don't go to websites/click links that you don't fully trust

4\. Don't download and execute files that you don't fully trust

It might seem obvious to the most of us to don't do the above, but to a lot of friends, family and co-workers it might not be.

Imagine waking up and having to pay $300 to get your data back. However, the police tracked down one of the servers that serves the keys and shut them down which means the keys were not delivered and the data was lost, this means even if you do pay the $300, there is no guarantee that you will get the data back.

Raise awareness of this and avoid having your files lost."

<comment><USER32> 5\. Consider alternatives to Windows so you won't have to deal with these silly things that have largely only been affecting Windows users for the last decade+.

<comment><USER31> Sure, I'll ask my 70+ year old relatives that have been using PC with Windows since they first got their computer to download an Ubuntu ISO, burn that and re-install their system.

Joking aside. I'd love for everyone to just jump on a virus free OS, but as soon as that OS is mainstream there will be viruses.

The problem isn't the OS, the problem is that people trust everything that is for instance sent to them via e-mail. Users need to be educated on security, no matter the OS.

<comment><USER33> You should, actually. Ubuntu has an it efface 90% close enough to windows these days, and back in 2010 I did exactly what you say - got my mother to start using Linux instead. It's filled her needs perfectly and my support calls have dwindled to near-nothing.

</comment></comment></comment></comment><comment><USER34> Central to the plot in the book Reamde but these guys don't offer a 'pay in WoW gold' choice.

Given the cost of computers these days, at least in business a separate 'browsing' machine and 'business' machine seems to be the best solution. I wonder if you could provide wireless for employees to bring their own laptops which had no 'office' connectivity (but internet connectivity) and machines that were hard wired and MAC filtered to the 'business' network.

</comment><comment><USER35> Since the Bitcoin blockchain is public, couldn't you follow the money? Make a list of all wallets that accepted these funds initially, and then do graph analysis, either to see where the money went or provide others with a tool to avoid transactions with those wallets?

<comment><USER36> Yes, but this is somewhat like saying you could mark the banknotes used to pay off a person that's blackmailing you. If you catch someone with a marked note that doesn't prove they are the perpetrator; it just means that they received your money somehow.

</comment></comment><comment> ryan-c I've gotten a few copies of this, all to an email address that was only ever given out to AT&T, and is not guessable.

<comment><USER37> Would you consider posting a screenshot of what the initial (infection) e-mail looks like?

<comment> ryan-c Wouldn't be particularly meaningful since I use mutt.

</comment></comment></comment><comment><USER38> This scenario - minus the Bitcoins - was a plot device in Neal Stephenson's "Reamde".

</comment><comment><USER39> The only new thing about this ransomware is that the payment method is through Bitcoin, right?

<comment><USER40> yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 USD, this idea would make hundreds, if not thousands, a month. Change the binary every once in awhile so its signature doesn't match popular anti-virus databases and you got free money coming in for... well ...forever[1]

1\. Educating users to stop running random programs in zip files attached to emails, is apparently impossible. Maybe email-clients should scan the contents of any zipfile it receives and if it finds any kind of executable, put up all kinds of warning dialogs saying _" You really don't want to run this. There's no reason to get a program in zipped email attachment nowadays. Please go consult your IT-admin or somebody who knows about computers for a 2nd- opinion"_

<comment><USER41> the bitcoin pseudo-anonymity is a plus, but i feel the real value in this new round of ransomware is that the unlocking actually _works_. Its possible for the ransomware app to verify payment and unlock itself, with no contact or control from the ransomware author, greatly reducing the author's risk. Actually, its easier for the victim too - rather than wiring funds to some bank account in far off lands, a quick anonymous digital payment instead. Im speculating but its possible for the app to query blockchain.info for a deposit for a given address, or (less likely) for the app to download the blockchain itself, and then unlock after a certain balance. If there is high confidence that the data will actually get unlocked, that swings the balance of fight the app or pay the app towards the pay the app side. The author sits back and waits for those wallets to fill up.

<comment><USER42> That won't work, it could be prevented by a man-in-the-middle attack on the victim's own computer. Just spoof the blockchain signatures required as if the payment was sent on an ad-hoc network and the program would unlock itself.

<comment><USER40> If blockchain.info was queried over ssl, the spoofing would be a bit harder to pull off.

</comment></comment></comment></comment></comment><comment><USER43> I wonder if amount of $300 was determined via A/B testing as optimal for bringing maximum profit.

<comment><USER44> The article mentions that there is a $100 variant floating around.

Makes me wonder whether they use the $100 variant in markets that $300 would be too much to pay.

If, is as reported, this virus is pulling in around ~$5million / annum, then that is a great basis for setting up a professional organisation to run the virus and extract maximum value from it.

</comment></comment><comment><USER45> This is one of the scariest forms of attack on computing since viruses became prevalent in the nineties. The fact they were up until recently relatively undetectable adds another eerie dynamic to the situation. It highlights the aged old problem of people not pro-actively backing up their data offline until it's too late. Go out and buy a couple of cheap 1tb external drives and back your data up now and keep doing it, there are even tools and drives that handle this automatically for you.

While ransomware isn't anything new, the fact that the authors of such software are using currencies like Bitcoin make it that extra bit harder to track and stop these people from extorting data. I sense a new wave of ransomware is about to hit the scene now that Ars have revealed specifics about potentially making millions a year from such a racket. It's hard informing people about these things without encouraging others to go and try writing their own ransomware and expect Bitcoin as payment.

This really worries me.

<comment><USER46> The first thing I thought when I read the $5 million dollar figure was "Oh shit, imitators are coming..."

</comment></comment><comment><USER47> Called it in July. Read more...

[http://blog.kinnaird.us/the-coming-age-of-ransomware- cloud-s...](http://blog.kinnaird.us/the-coming-age-of-ransomware-cloud- services-meet-bitcoin/)

</comment><comment><USER48> When I first saw the title, I thought it went like this:

1\. Your machine is infected, and it encrypts everything it can.

2\. The 72 hour countdown begins, and during that time your machine has been re-purposed to crunch BitCoins.

3\. All you have to do is wait 72 hours, and everything will un-encrypt and uninstall, leaving you perfectly fine.

Creators profit by having millions of machines crunching BitCoins in their name.

<comment><USER26> These machines were probably already crunching BitCoins for years but now that's not profitable ...

<comment><USER48> Even if you had millions of infected machines crunching on your behalf it wouldn't be profitable?

</comment></comment></comment><comment><USER49> While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers.

Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

<comment><USER50> Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

<comment><USER51> I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.

<comment><USER50> It's funny you mention that.... I implore 'cperciva to consider a glacier- level service. It is hard to compete with backblaze, but capping network bwdth is proly one way to skin that cat.

</comment></comment></comment></comment><comment><USER52> This is the difference between crime and organised crime. People would not hand over the money to the burly visitors each month if their shop was burnt down anyway.

Evidence that paying the ransom actually results in the files coming back is the most troubling aspect here - these people are looking to establish a longer term criminal enterprise.

</comment><comment><USER53> I got a similar virus once but it was before bitcoin was popular. It just asked for money via credit card. The virus hid my files, and I needed them for work too.

Fortunately the virus did that by some filesystem driver level hack, because after I booted into Linux I was able to mount the partition and get my files back.

</comment><comment><USER54> And than the police shut down the ransomware servers and dooms data from many infected victims to garbage, brilliant!

<comment><USER7> Unfortunate for those folks, but if it can prevent many more people from being infected, then still worthwhile.

<comment><USER30> Would it actually help? Does the ransomware contact the servers prior to encrypting everything?

<comment><USER7> Even if it encrypts regardless, preventing the perpetrators from profiting will remove their incentive to keep spreading this stuff. Once antivirus catches up to the copies in the wild, the problem would be solved. Of course, whether it's actually _possible_ to shut down enough servers to prevent them from profiting is another question. But it seems to me anything that makes it more difficult is a good thing, even though it does suck for those who lose data.

<comment><USER55> This wouldn't really prevent them from profiting - an unsuspecting user could still pay the ransom, and then never receive a decryption key, so would be both out of the money and lose their data.

<comment><USER7> Sure, it wouldn't prevent it completely, immediately. But 1) many users will do a search beforehand to see whether paying actually works. The less often it has worked for others, the less likely they will be to pay, and more importantly, 3) it would prevent them distributing new versions of the malware, which would prevent them profiting once antivirus caught up to the existing versions.

</comment></comment></comment></comment></comment></comment><comment><USER56> The article didn't mention, what systems does this ransomware primarily target? Is it cross-platform?

<comment><USER57> That i know, only MS

<comment><USER58> But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that user can get a hold of.

(One of the little problems with the UNIX-style user permissions is that it is designed to defend the OS, not the user. Sure, that little executable may not be able to corrupt "the system", which may amount to 5 or 10 GBs of easily- replaced code, but it will have its way with the 2TB of the single user's media files.)

The only faint defense Linux/UNIX can claim is the slightly higher probability that you'll be on a checkpointing file system and can roll back, and I say only "slightly" because they still aren't very popular yet compared to conventional file systems.

<comment><USER59> OS X defaults to only running applications that have been signed with a valid developer ID. It's not difficult to get such an ID, but Apple can also blacklist them, which would prevent the malware from running once Apple notices it. So I think the Mac has a good defense against this kind of attack.

<comment><USER60> Malware developer can make 256 valid developer IDs, compute 256 signatures and switch them automatically and randomly during the propagation of malware. Once Apple blacklists one developer ID, another one pops out, and so malware continues to propagate.

<comment><USER61> That would cost $25,600 and require 256 valid Social Security or DUNS numbers.

<comment><USER62> Alternatively, it would require compromising the machines of 256 Apple developers. Guess what kind of person is likely to be capable of doing that.

<comment><USER61> Still, it's not as easy as the person I was replying to made it sound.

How many Macs would you have to compromise before you randomly stumble upon a registered developer, let alone a registered _Mac_ developer (of which there are far fewer than iOS developers)? And how much more secure is a developer's machine likely to be, and how much less is the user of such a machine likely to fall for common email attachment-based infection attempts?

At some point, the feasibility is low enough not to bother. That's what all security ultimately is, since nothing is foolproof.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER63> People on here are talking about attachments and being smart enough not to fall for sham downloads, but this isn't how most of ransomeware is spread to its victims. They use exploit packs and 0 days. Visiting a website that's been hijacked with an Iframe or a proxy that embeds an Iframe or any other data to the HTML that is returned could get you infected. There is no full proof way around this unfortunately.

</comment><comment><USER64> You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

<comment><USER15> Or the police could just investigate the wallet, because it there is a feature that Bitcoin does not have, it's anonymity.

<comment><USER65> Which police? The guys behind this virus may as well be somewhere deep in China or Russia, good luck reaching them. It's not a terrorism or child pornography to get serious international attention.

</comment></comment></comment><comment><USER66> Wow what a scheme. I mean it's almost the perfect situation for whoever wrote the system. It creates an extortion mechanism with a sense of urgency. Normally, users just carry malware around on their machine for weeks or months. The most frustrating part of this whole thing is that if you don't get the private key back and you're not backing up; you're toast.

</comment><comment><USER67> "you need to pay 300 USD / 300 EUR / similar amount in another currency"

How about 300 VND? Seems similar to me. :)

</comment><comment><USER68> This happened to someone I know (really, it wasn't me). Not only did it encrypt the local drives it also hit all of their network drives. As reprehensible as it is to pay the ransom they really had no choice since the encryption happened the prior night before the last backup.

</comment><comment><USER69> Our company was hit by this yesterday, caused a lot of issues. Thank god we had backups, but they were 2 days old (frustratingly enough, the backup failed the previous day - first time in months...)

</comment><comment><USER70> This is why a RAID setup is not a backup.

</comment><comment><USER71> For hacker having both an original file and the encrypted version that file should be relatively easy to retrieve the key? Especially if the virus XOR all or a part of the file. Otherwise a hacker may look at the random function that generate the key in the source code of the virus it may be weak and take values from the computer and time of infection.

</comment><comment><USER72> How is this any different from a virus that _wipes_ (not just deletes) your data? It takes the same amount of time (actually wiping data would be faster) and the result is the same: No data.

Maybe the psychological part of "Oh God the file is there but I can't use it" or the fact it's ransomware?

</comment><comment><USER73> It's a pity to see that Windows haven't died off yet and things like this are still happening. Using Linux / Mac for years, never looked back.

And for those who say "my mother can't use Linux", don't be a cheapskate, get your loved ones a Mac - they will definitely know how to use it.

<comment><USER74> Keep in mind this is not a virus in a traditional sense. The user has to explicitly run the executable to run this malware.

</comment></comment><comment><USER75> I know a customer that got hit by this Tuesday morning. Unsurprisingly, Avast did nothing. I just told her the bad news and clean-installed Windows.

I have tried to find the private key with sample files, using known file byte headers, the public key and brute force on the private key. Sadly, no luck yet.

<comment><USER76> That's assuming the private key is even reused. If they're generating a new key for each user (which they very well could be), you're boned.

</comment></comment><comment><USER65> I imagine that this combined with virus capabilities (so it can spread itself via network) would be an overkill. Strange that they didn't do it, once you have an access to the local network (as soon as the initial victim runs .exe received by email) it shouldn't be too hard.

</comment><comment><USER77> Finally viruses are doing what they're supposed to - wreck your computer instead of staying under the radar as long as possible. If people are motivated to protect themselves from this they'll also be preventing botnets and doing good to the rest of the internet.

</comment><comment><USER78> Huh , that is pretty scary add a physical packet snooper on all the traffic sent from my computer , it might be possible to mitm the private key as it is sent to the server. That way i might have a fighting chance against this.(if the traffic was unencrypted that is )

</comment><comment><USER79> What I find funny is that this piece of software actually tells you more about what it does than software you pay money for and even uninstalls itself, after it is not needed anymore. It's kinda weird how malware is better quality than most other software.

</comment><comment><USER80> I talked to a small shop owner just the other day that had been hit by this. They said they spent the $300 on a new PC instead - but I'm pretty sure they lost a bunch of irreplaceable data (mailing lists, supplier details etc). Pretty heart breaking.

<comment><USER20> Crashplan is really easy to setup. Won't save their data in hindsight, but they should have it or something like it.

</comment></comment><comment><USER81> Never heard of ransomware before, but the trend is alarming: [http://www.google.com/trends/explore?q=ransomware#q=ransomwa...](http://www.google.com/trends/explore?q=ransomware#q=ransomware&cmpt=q)

</comment><comment><USER82> Nasty stuff. Fortunately for me, this would set off the "why the heck are my fans running so loud right now" alarm that I have in my head (that honestly, I wish I could turn off sometimes ... curse you trustedinstaller.exe!!).

</comment><comment><USER83> Has anyone attempted to run this using Wine?

As long as you keep all drives (/ or ~/) unmounted, I assume it would be `safe' to test it.

Might be a simpler environment to analyze CryptoLocker in, as apposed to a full Windows install.

<comment><USER15> I'd try it in a virtual machine just in case.

</comment></comment><comment><USER84> "When the receiver clicked on it, he saw a white box flash briefly on his screen but didn't notice anything else out of the ordinary"

What email client automatically unzips AND executes any containing .exe files?

</comment><comment><USER5> Well that's moderately horrifying. I've dealt with ransomware before, but mostly it just used scary messages, not literally encrypting all your data.

<comment><USER85> but this one seems to do what it claims to do. it's pretty scary for people who don't have decent backup system. but these same people live with the risk of losing their data due to a drive failure, so...

<comment><USER5> A lot of "decent backup systems" would be vulnerable to this too. Say you back up all your local stuff to a RAID that you've mapped as a drive, as well as a mapped Google Drive?

It's still all toast.

That level of backup would handle any kind of physical failure - a dead drive, the destruction of your house, the failure of Google... but still, this thing would kill it.

There's only so much you can expect from a person when it comes to keeping their personal documents and family photos.

I mean obviously, if you're running a company you need a _real_ backup solution, but for family files or a one-man-show business? There is no reasonable precaution.

<comment><USER86> Firstly _RAID is not a backup_.

This type of thing only works because the backup user has identical permissions to the backup contents as the user being backed up (because they're the same).

It wouldn't work on any system where the backup user is a separate, privileged process that is the only one with write access to the stores of backed up files.

ZFS with a snapshot script is a good way to implement this for a networked drive on Samba, since it's implicit, automatic, and the point at which it hits would be really _really_ obvious since your snapshot sizes would suddenly explode. The same story is true of volume shadow copy (but MS idiotically limits the user's ability to set a known and trustworthy shadow copy schedule).

</comment></comment></comment></comment><comment><USER24> Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?

<comment><USER87> Problem is, the prompt doesn't appear until the encryption has ended, the key has been sent to the servers (it's kind of complicated, it apparently tries to find servers on its own, I wonder if it can be fooled) and that key has been locally destroyed.

So, by the time the user is notified that there is malware on their PC, it's too late. People who know to detect viruses while they're running don't run attachments in the first place.

<comment><USER88> According to the KernelMode thread¹ the keypair is generated on the server. The public key is retrieved from it, but its private counterpart will never be on your machine. No key is sent to the server.

¹[http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945](http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945)

</comment></comment></comment><comment><USER89> I have a question regarding this, does anyone know what happens if your data is already encrypted ? will it encrypt the encrypted files?

<comment><USER90> Yes.

</comment></comment><comment><USER91> The wave of the future. Why break computers when you can just have the user pay you to avoid breaking it.

</comment><comment><USER92> Is it the case that Mac OS default security setting would prevent an unsigned app like this from running?

</comment><comment><USER93> Disabling or limiting your use of JavaScript and Java in the browser will go a long way towards protecting against delivery of this as it is likely delivered by an exploit kit. If you do hit an exploit kit, Microsoft EMET (free) will probably mitigate the exploit/s.

</comment><comment><USER94> How long will it take until the FBI gets rid of these guys?

<comment><USER95> just run it at NSA once. 24hours I bet.

<comment><USER94> Naw. One of their assets built it

</comment></comment></comment><comment><USER96> This is what Venti (of the Plan 9 fame) is for!

</comment><comment><USER97> It looks like the patent trolls have finally found their true calling.

</comment><comment><USER98> REAMDE

</comment><comment><USER99> or dont use windows...

</comment><comment><USER57> Stop using Windows, is a good start.

<comment><USER100> I primary use linux, but even I feel threatened by this. This is Sony's rootkit all over again.

edit: never mind, I thought this was novel. Never heard of ransomware before.

</comment></comment><comment><USER101> Get a Mac.

<comment><USER102> Running Windows just became a lot more expensive

</comment></comment><comment><USER103> Who are the creators? Are the FBI going to take them to federal-pound-me-in- the-ass prison?</comment>


Books on Real Estate Investing? - <AUTHOR> What's your recommended reading for learning about investing in real estate? <comment><USER2> Check out the Bigger Pockets Real Estate Podcast- imho- it's one of the best produced podcasts out there and worth listening to even if you have minimal interest in real estate investing.

They are also publishers and their books are great primers depending on where in RE you're looking learn.</comment>


Learning the Programmer's Craft - <AUTHOR> http://blogs.zdnet.com/BTL/?p=9953

<comment><USER2> "Finding a mentor" is good advice. So is the other advice, but most of it has been stated many times by many people (read code, write code, think about code you have written, etc).

I personally have had two people that I would call "mentors" in the time that I've spent learning about programming. One was my high school comp-sci teacher - we learned using C++, but he did not teach the language, he taught general concepts - and did a very good job at it.

The other is a friend of mines older brother. He's one of the smartest people I know, and a brilliant coder although he doesn't really code much anymore. I have a printout of code he wrote for a TI graphing calculator that is a 2d rpg engine, including NPCs that have semi-generative text dependent on "important" plot points, and smooth-scrolling. A lot of the code is code-writing code and memory management - it's incredibly impressive given the limitations of the platform that it's written in. This guy is one of the only people I'm around on a semi-regular basis that I can really "nerd out" with, and he's always got good advice on improving system designs and performance - mainly because the vast majority of his experience is building non-trivial systems really close to the metal.

A mentor can come from anywhere, I suppose that people on newsgroups or forums would work as well if you work well with that sort of communication / exposure. There is something to be said for face-to-face conversation with someone who is a _lot_ more experienced than you are though.

I remember one time I was playing around with a sort of image transformation algorithm, and this guy took a look at what I was doing, picked up a pad of paper and scribbled out about 20 lines of psuedo-C which did the same thing, did it faster, and did it with constant memory use. I probably would have arrived at the same solution after a while of thinking, but seeing someone identify something that they've seen before and spit out the optimal solution can be a very enlightening (and humbling) thing.</comment>


Ask HN: Please review my weekend project - <AUTHOR>

Create a direct URL to a quote on a Web page.<p>URL: http://bquot.com <comment><USER2> Hey fellow hacker, the web app is cool. My suggestion a good value add would be writing browser extensions. You can start with Google Chrome since its all HTML + JS. You might want to think about Safari, IE and Firefox later.

</comment><comment><USER3> This is awesome! However, I'm using IE right now (I'm at work, there's no way I would use IE on purpose) and the button doesn't drag to the bookmark bar. Is the button necessary? Maybe after highlighting, the share dialog just pops up. Maybe it can be enabled/disabled for when users need to highlight for other reasons.

Great job tho. I like the idea and I'll be using it when I get home.

<comment><AUTHOR> I'm afraid to ask what version of IE you use, since I succeed to drag the bookmarklet in IE9 :) I've found the following workaround for IE users:

1\. Right-click on the link

2\. Select "Add to Favorites"

3\. Click "Yes" on security warning

4\. Select "Favorites Bar" from the "create in" dropdown

5\. Click "Add" button

<comment><USER3> I'm using IE8 on XP and I'm afraid the work-around doesn't work for me. Thanks for the reply, I'll let you know how it goes on my home system (latest chrome, linux)

</comment></comment></comment><comment><USER4> It's very good. Maybe you can add comments to the quote (similar to the Diigo comment highlight). So your friends can , comment direct on that quote.

</comment><comment><USER5> That is very cool. I don't think I'll ever use it personally because i dont share much on the web, but I hope it becomes popular for those that do.

</comment><comment><USER6> Looks simple and useful (I don't see me using it, but I know a few people who actually may). Start by sending it to all quote website admins ;)

</comment><comment><USER7> Another similar project: <http://awurl.com/>

</comment><comment><USER8> Very nice! Possible revenue stream by letting folks track their bookmarks, etc.

</comment><comment><USER9> That's pretty nifty! I can see it being used favorably by journos and bloggers.

<comment><USER9> Jeez, I'm using it already: <https://twitter.com/#!/acron/status/78057196830732288>

</comment></comment><comment><USER10> easy to click: <http://bquot.com>

</comment><comment><USER11> Looks useful, but I can't drag that bookmarklet.

<comment><AUTHOR> Are you using Opera? In this case, try to right-click on it, and select "Add Bookmark"

<comment><USER11> Ok that worked, but I'm on FF 4.0 on Ubuntu.

<comment><AUTHOR> Fixed for FF. Thanks for feedback!</comment></comment></comment></comment>


Using Gradle Plugin with Real Devices on Cloud - <AUTHOR> http://testdroid.com/tech/using-gradle-plugin-to-get-your-builds-tested-on-real-devices

<comment><USER2> Gradle users often get confused about whether or not to use an equals-sign, e.g. in your example...

        cloudUrl    = 'https://cloud.testdroid.com'
        projectName "Project 1"

The XML in Maven is more consistent.</comment>


Minimizing FPGA Resource Utilization - <AUTHOR> http://zipcpu.com/blog/2017/06/12/minimizing-luts.html <comment><USER2> Great post. I see a lot of constructs like this:

         always @(posedge i_clk)
    	     A <= A + 1'b1;
         always @(posedge i_clk)
    	     C <= C + 7;

What's the upside to breaking these nonblocking assignments into multiple always blocks?

<comment><USER3> Readability. Just like you can cram a whole bunch of code on a single line for a regular program it doesn't help a person trying to understand the code.

Like this the steps required to build your mental model of what is going on are smaller, and so this makes it easier to construct that model. And hopefully with fewer errors between what you think it does and what it actually does.

The repetition establishes local context, it also allows you to make changes later that will affect the one but not the other construct without making a larger change.

I find myself being extremely skittish when changing FPGA code and I tend to play it safe until stuff works and then I'll remove that short of pattern when I'm sure I won't be inserting / removing bits or changing the conditions. Initially it helps me to write out the various conditions without any kind of optimization in mind (and besides the real optimizations are usually done by the toolchain).

This is one of the main problems I have with FPGA work, I've done so much software that it is hard to get back into the mindset of programming a device and small steps really help. I also find it considerably harder to read FPGA code (my own or someone else's, of any flavor) than to read a program and to figure out what it does.

<comment><USER4> >Readability. Just like you can cram a whole bunch of code on a single line for a regular program it doesn't help a person trying to understand the code.

Language syntax is also a major problem. For example, if the author chose to join those two always statements he/she would have to use begin/end keywords which are ugly and cause visual "clutter". VHDL is not better in that regard, I'd say it's even worse (e.g. converting back and forth between std_logic_vector and signed/unsigned).

The only drawback I see in the author's code is that using (lots of) multiple always blocks may slow down simulation, but that's a fair price to pay if the code is more readable

</comment></comment></comment><comment><USER5> All sound advise. Much of this is covered by Jan Grey's great blog [1].

However I'm disappointed seeing the ancient Cyclone IV compared to a the current seven series. A fairer comparison would refer to Cyclone V, which uses the ALM, kind of a LUT6+ (that is, can sometimes even be a LUT7 or 8). This has an important impact on the optimization considered.

[1] [http://fpgacpu.org](http://fpgacpu.org)</comment>


Comparison of Many Different Parse Trees, Visually (Google Image Search) - <AUTHOR> https://www.google.com/search?q=parse+tree&tbm=isch <comment><AUTHOR> Point: Some things that are infinitely overcomplexified by arcane and overly verbose CS tomes -- can be understood visually, _intuitively_ , by looking at the right pictures, the right images for understanding.

Think of it as a shift in which brain hemisphere is being used for understanding.

Case in point: Compiler Parse Trees.</comment>


Instagram Django site admin - <AUTHOR> https://instagram.com/django/

<comment><USER2> Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).

We're also part of Facebook's bug bounty whitehat program ([https://www.facebook.com/whitehat/bounty/](https://www.facebook.com/whitehat/bounty/)), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.

<comment><USER3> Out of interest, would something as easy to find as this qualify for the bug bounty?

<comment><USER4> I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

<comment><USER5> Off the top of my head I can't speak to Facebook's program, but Google's terms include "substantially affects the confidentiality or integrity of user data". A login page that shouldn't be exposed is a marginal finding and might not qualify.

Also: obviously I don't speak for either Facebook or Google, but I strongly recommend against brute-forcing login prompts to try to prove the point that an exposed console is a real finding.

<comment><USER6> "Report a bug that could compromise the integrity of Facebook user data, circumvent the privacy protections of Facebook user data, or enable access to a system within the Facebook infrastructure"

^That's Facebook's. Theoretically, an exposed login page "could...enable access to a system within the Facebook infrastructure", but to be fair, I doubt they had that in mind.

</comment></comment></comment></comment></comment><comment><USER7> it may be a honeypot. I sometimes set up a bogus form under /admin/ which logs attempts. adrian holovaty on the other hand, redirects /admin/ to django docs [http://www.holovaty.com/writing/admin-easter- egg/](http://www.holovaty.com/writing/admin-easter-egg/)

//edit: oh, now I see somebody thought of my idea too [https://github.com/dmpayton/django-admin- honeypot](https://github.com/dmpayton/django-admin-honeypot)

<comment><USER8> Given that they don't seem to have any automatic tests or similar for their APIs (check out their Google group and you'll see that stuff have been broken for a long time for all users without attention. When stuff has been broken in the past, Instagram people will ask "is this still a problem?", like they have no way of checking their own APIs...), I wouldn't expect them to be that crafty.

</comment></comment><comment><USER9> Pinterest and Instagram are both using Django. Then again, when you are scale like these sites, you start to build new architecture around existing stuff. Reference: [http://highscalability.com/blog/2013/4/15/scaling- pinterest-...](http://highscalability.com/blog/2013/4/15/scaling-pinterest- from-0-to-10s-of-billions-of-page-views-a.html)

<comment><USER10> Makes me wonder why there aren't more jobs for Django; Ruby on Rails still seems to be far more popular for new startups!

<comment><USER11> i believe it's because Rails is as easy as grabbing a shovel to dig a hole for yourself.

</comment></comment></comment><comment><USER12> And they're not alone: mixpanel Django site admin: [https://mixpanel.com/admin/](https://mixpanel.com/admin/)

</comment><comment><USER13> How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. [http://www.truffle.io/admin/](http://www.truffle.io/admin/) Any suggestions?

<comment><USER14> Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.

<comment><USER13> Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.

<comment><USER14> That's a normal HTTPS cert, I'm talking about this:

[http://www.ibm.com/developerworks/lotus/library/ls- SSL_clien...](http://www.ibm.com/developerworks/lotus/library/ls- SSL_client_authentication/)

Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes.

Also, don't serve any pages over plain HTTP, login pages even less so.

<comment><USER13> Thanks, I guess I ll explore the option that you described above. Also there is one more thing I am curious about, so heroku does gives a free SSL certificate but that only works for their domain meaning something like truffleapp.herokuapp.com, it doesn't work for the custom domain. Do you know any way where I can save money on buying SSL certificate and rather use heroku's certificate. All the certificates put atleast a 1000$ hole in the pocket but eventually in a week or so if I can't figure out how to use heroku SLL, I have to spend that money

<comment><USER15> If you are just using ssl on your admin site; you could roll your own.

      openssl req -new -x509 -nodes \
            -out /nuxeo/certs/server.crt \
            -keyout /nuxeo/certs/server.key \
            -batch

you will get a warning about the certificate being suspect; but at least the traffic will be encrypted

</comment></comment></comment></comment></comment></comment><comment> workhere-io I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on [https://www.djangoproject.com](https://www.djangoproject.com).

<comment><USER16> I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

<comment> workhere-io I understand. My point was that it would be better to alert Instagram rather than direct a lot of HN users to a page that offers no value.

<comment><USER16> I agree. (Already fixed?)

</comment></comment></comment></comment><comment><USER17> Although it's been a while since I've done anything in Django, seeing this still gives me a warm feeling.

</comment><comment><USER18> I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

<comment><USER19> A post or code snippet that does this would be great, seems like a really simple but useful people others may like

<comment><USER20> Simple browser-side CSS does the trick. I use Stylish[1] for Chromium. I believe there is also a Firefox version.

[1] - [https://chrome.google.com/webstore/detail/stylish/fjnbnpbmke...](https://chrome.google.com/webstore/detail/stylish/fjnbnpbmkenffdnngjfgmeleoegfcffe)

</comment></comment></comment><comment><USER21> admin:admin doesn't work.

<comment><USER22> file a bug report "login is broken"

<comment><USER23> This is the best idea in this thread.

</comment></comment></comment><comment><USER24> Would love to see the inside. If they use special dashboards etc.

Maybe someone can give some insight.

<comment><USER25> It would actually be quite interesting to see how large enterprise clients modify/utilize the Django admin... if at all.

Other than Grappelli, I've historically used the admin pretty much as-is. Creating admin functions is one thing, but lots of custom screens is quite another.

I also think that's one thing really lacking from the Django documentation, really great customization of the Admin.

<comment><USER26> Most of the Django projects I've worked on, people tended to make their own admin panels with things like Bootstrap and Foundation. Django's core team have made their goals clear for the next admin, extensibility and adaptability. [https://github.com/twoscoops/django- admin2](https://github.com/twoscoops/django-admin2)

</comment></comment></comment><comment><USER27> BlackJet Django admin: [https://www.blackjet.com/admin/](https://www.blackjet.com/admin/)

</comment><comment><USER28> Did you inform Instagram first before posting it to HN?

</comment><comment><USER29> It seems to have (just) changed to a non-standard (different to the rest of Instagram's) 404 page.

</comment><comment><USER30> Has anyone taken the snapshot of it ? As instagram has fixed it and i have missed a chance to see it.

<comment><USER31> It just looked like the default Django login - [http://www.djangobook.com/en/2.0/_images/login.png](http://www.djangobook.com/en/2.0/_images/login.png)

</comment></comment><comment><USER32> They removed the link to the admin page.</comment>


Blizzard is looking for devs to Revive Classics: Starcraft, Diablo 2, Warcraft 3 - <AUTHOR> http://www.gamespot.com/articles/blizzard-looking-to-revive-these-classic-games-upd/1100-6431991/ <comment><USER2> __" Compelling stories. Intense multiplayer. Endless replayability. Qualities that made StarCraft, Warcraft III, and Diablo II the titans of their day," Blizzard said. "Evolving operating systems, hardware, and online services have made them more difficult to be experienced by their loyal followers or reaching a new generation. We're restoring them to glory..." __

Wondering if the best strategy wouldn 't just be porting to Unity?

<comment><AUTHOR> I totally agree with you. And in my case what I would do is learn from the great success of these versions and apply them to the present. It is not healthy to walk with undead</comment></comment>


No More JavaScript - <AUTHOR> http://www.nomorejavascript.com/

<comment><USER2> I don't _disagree_ with the site, however, I currently lack any sort of well- formulated plan (just like the author) to change the future in such a way that this sort of thing is possible.

if I were capable of bending the universe to my will (or any portion thereof), I would end javascript in a heartbeat and make python the master scripting language for browsers.

However, I'm not, so JS is safe for now.

(And I would smite anyone who suggests that it's fine to transpile languages to JS for use in a browser. It's not elegant and they would all die painfully and inelegantly.)

Be glad that I am not your god.

Even my cat is just pretending to worship me until he can take over.

<comment><USER3> >Be glad that I am not your god.

Significant whitespace is the Devil's palimpsest.

</comment></comment><comment><AUTHOR> OP here - I don't agree with the premise of this website but I thought it was worth posting.

<comment><USER4> No idea or plan is put forth to replace JavaScript.

Just another whiney kid putting up a web page.

<comment><USER5> Yeah, it look like it.

The "create a javascript replacement" reveals they the author has no plan to achieve what he wants. Does he want a new language? Use a known language? Does he want to create an fast V8-like engine for this new/old language?

Although I haven't used JS too much, I dislike it (it has too many warts) but it is so ubiquitous in the web that is insane to try to replace it in the blink of an eye.

Anyway, if this actually goes on ahead, I propose Lua.

</comment></comment></comment><comment><USER6> If this guy loves Ruby so much then he could just use this [http://opalrb.org/](http://opalrb.org/)

Or alternatively, he could stop being an idiot.

</comment><comment><USER7> The camel casing comment confuses me? There is nothing stopping anyone from using

        var x = my_function();

instead of

        var x = myFunction();

if that's what they want to do?

<comment><AUTHOR> True. Though the convention in JS is generally camel case so as soon as you use a library you're going to end up with some disgusting horror with mixed code styles. Ruby's libraries generally adhere to the underscore style. I don't consider it a reason to mount a holy war mind you.

</comment></comment><comment><USER8> Is this some kind of parody or something?

<comment><AUTHOR> Sadly I don't think it is. The creator of the site speaks up in the comments at the bottom:

> no joke. This is the real deal and we are doing everything in our power to > make it happen. Please share to your social networks to get more signatures. > It's time for change :)

> I know right! It seems like everyone has been thinking it, but no one doing > a thing about it for so long.

They've also spammed it on a few different forums and mailing lists.

</comment></comment><comment><USER9> where can I sign for nomorevisualbasic.com and nomoreperl.com ?

</comment><comment><USER10> "How quaint." \-- ClojureScript

</comment><comment><USER11> Quite charming, I think.

</comment><comment><USER12> this feels like satire.</comment>


The Creative Phase - <AUTHOR> http://www.avc.com/

<comment><USER2> This URL points to the front page, and the article will be replaced in due course. The submission here ... <http://news.ycombinator.com/item?id=1850763> ... points to the item in what will most likely be its permanent home. Comments are best directed there.

</comment><comment><USER3> this was already submitted. Different url.</comment>


Universal basic income?: A mapped community argument - <AUTHOR> http://en.arguman.org/a-universal-basic-income-is-the-best-way-to-eradicate-economic-inequality <comment><USER2> In a Universal basic income system, will the government give extra money (or provide extra free service) to people who need more money?

<comment><USER3> Maybe, maybe not. Usually, advocates of universal (or more commonly, "unconditional") basic income favor using it to, ultimately, replace existing means-tested aid programs. Whether they would also have supplemental, non- means-tested, programs based on special needs (e.g., medical conditions) or whether they would address those some other way (or not see them as public responsibilities) varies considerably between _which_ source of need you are discussing, and which UBI advocate you are discussing it with.</comment></comment>


List of Screw Drives - <AUTHOR> https://en.wikipedia.org/wiki/List_of_screw_drives <comment><USER2> A carpenter friend of mine is an evangelist for Robinson screws which are time savers for carpentry rough or fine.</comment>


Otto Warmbier Is Released from North Korea - <AUTHOR> https://www.nytimes.com/2017/06/13/world/north-korea-otto-warmbier-rodman.html?_r=0 <comment><USER2> The North Korean regime is vile. This is in effect an assassination, and the only way to avoid it is to not go there.

</comment><comment><USER3> Rather amazing the young man has been in a coma for a year. What were the North Koreans waiting for? Just a sad case

<comment><USER4> That's what they are saying. Don't be surprised if he is fine in a few days. Pinochet was too sick to stand trial when he was arrested in London in 2000; he miraculously recovered upon his return to safe Chilean soil.

<comment><USER5> I'll be very surprised if it's propaganda that he's in a coma... it's difficult to keep a lid on a op like that. NK could just release a vid of him (not in a coma) leaving their custody.

<comment><USER4> I didn't mean propaganda, there are more cases of people being very ill until they get home. I think it allows both parties to save face or can be a cover for something else ($$$)

<comment><USER5> Interesting. Thanks.</comment></comment></comment></comment></comment>


Cryptographic filesystem for the cloud - <AUTHOR> https://github.com/cryfs/cryfs <comment><AUTHOR> A number of HN anecdotes vouched for this project (and it is used for the new- ish KDE Plasma Vault utility), but after further review I can not recommend it for heavy usage. There are multiple open issues reporting lock-ups (re-mount works; no data loss):

> > [https://github.com/cryfs/cryfs/issues/64#issuecomment-285968...](https://github.com/cryfs/cryfs/issues/64#issuecomment-285968655)

Here is a comparison of several similar options:

> > [https://nuetzlich.net/gocryptfs/comparison/](https://nuetzlich.net/gocryptfs/comparison/)

</comment><comment><USER2> Since the strategy here is to split the files up into equal-sized pieces, I wonder if the encryption key of each piece could be encrypted with a public key rather than a symmetric key, a-la the experimental (and now apparently defunct) One-way encrypted File System[0].

[0] OweFS discussion thread on HN: [https://news.ycombinator.com/item?id=10911913](https://news.ycombinator.com/item?id=10911913)

<comment><USER3> Sure why not?

</comment></comment><comment><USER4> How does this differ from _encfs_ [1]? Has it had the same level of security vetting?

[1] [https://en.wikipedia.org/wiki/EncFS](https://en.wikipedia.org/wiki/EncFS)

<comment><USER5> [1] says "A probably even larger issue with EncFS is a security audit from 2014 that attests EncFS to deviate from established security standards and also found some vulnerabilities in the current EncFS implementation."

[1] [https://www.cryfs.org/comparison](https://www.cryfs.org/comparison)

</comment></comment><comment><USER6> Better links to get an introduction to what they're offering: [https://www.cryfs.org/](https://www.cryfs.org/) and [https://www.cryfs.org/howitworks](https://www.cryfs.org/howitworks)

</comment><comment><USER7> The #1 rule of computer/data security is physical security. If you have data/information you don't know anyone to access, don't put it on the cloud. Store it locally somewhere with no or limited internet connection.

<comment><USER8> I mean, that's true, but it's also very limiting. Everything is a tradeoff between security and functionality; the only perfectly secure computer is one turned off and embedded in a concrete block.

In particular, a whole lot of people want to be able to use cloud storage for the synchronization/offsite benefits, yet not expose all their data to $ARBITRARY_CLOUD_HOST.

</comment></comment><comment><USER9> Browsing through the website I came across this:

> VeraCrypt runs on Windows, Linux and Mac, and is believed to be a secure > encryption tool to encrypt your files locally. It keeps your files > confidential, but does not protect the integrity, i.e. a hacker can't read > your files, but they could modify them without you noticing. [1]

Veracrypt encrypts an entire container. I would love to know what they mean by a hacker being able to modify my container's files without being able to read them. Encrypted is encrypted, so this is either PR fluff or the maintainers truly do not understand how encryption works, which is concerning when they are shipping a security app themselves.

      [1] https://www.cryfs.org/comparison

<comment><USER10> I believe they talk about authenticated encryption (AEAD schemes, like GCM which CryFS uses).

VeraCrypt uses XTS, which is not authenticated. AFAIK, if attacker messes with some bytes of your encrypted disk, you'll get some garbage but you won't know it's not the correct data.

<comment><USER9> But that doesn't really give the attacker much, if they just scramble an encrypted container no? They can't really do much by doing that.

<comment><USER10> Well, there was a problem with CBC, where an attack exists that malicious party may flip specific bits by somehow XORing inputs (I'm not a cryptographer and haven't grokked the details properly). If attacker has a good idea what the plaintext is, they may alter it, like, replace my ~/.ssh/authorized_keys with theirs - and that would be really bad. Such attacks is AFAIK not possible with XTS, though, so irrelevant to VeraCrypt. Just an example.

All I've got is that this stuff is not as simple as "it's either encrypted and safe or not". There are tons of different algorithms (cipher modes etc) with different properties, assumptions about their use and possible attack scenarios.

While this may not give much, I still don't want anyone to mess with my files without me (or, better say, my software) noticing until it's too late and backups are also corrupt. And remote storage knows exactly where I'm writing to (with block-level granularity), so the encrypted blob isn't completely opaque.

</comment></comment></comment></comment><comment><USER11> This was already done long ago by the Tahoe-LAFS project:

[https://tahoe-lafs.org/trac/tahoe-lafs](https://tahoe-lafs.org/trac/tahoe- lafs)

<comment><AUTHOR> Does Tahoe-LAFS help with this project's intended use case, local encryption of files stored on various commercial cloud providers?

It looks like it is an off-label use, circa 2012: [https://bitcartel.wordpress.com/2012/10/21/rbic-redundant- bu...](https://bitcartel.wordpress.com/2012/10/21/rbic-redundant-bunch-of- independent-clouds)

> _Tahoe doesn't directly support online storage providers as remote back- > ends, but we can work around this problem by using sync folders, at the > expense of local disk space_

I noticed mention of a Windows virtual drive as a client; I believe CryFS requires "real" FUSE (aka not Windows).

<comment><USER12> DokanY (LGPL) provides a FUSE-compatible API on Windows.

</comment></comment></comment><comment><USER13> from [https://www.cryfs.org/howitworks](https://www.cryfs.org/howitworks): > _The current version protects the encrypted blocks from being modified by an attacker, since it uses an authenticated encryption scheme like aes-256-gcm. However, it doesn 't prevent an attacker yet from rolling back the filesystem by replacing blocks with an earlier valid version of the same block._

GCM only retains its security properties when nonce/IV & Key combinations are never repeated. If these repeat under a specific key, the algebraic ability to completely break the scheme is drastically heightened. Therefore, this implementation appears to be broken. Is there an expectation for when this will be fixed? It's very serious, and the scheme seems somewhat well-planned in other ways.

Also, with this implementation of GCM, what is the practical limit before reuse happens, given the blob/block difference and nonce size? I call this out, as this is disk encryption not file encryption.

<comment><USER14> As far as I can tell, the IV is randomly chosen, as you would expect: [https://github.com/cryfs/cryfs/blob/master/src/cpp- utils/cry...](https://github.com/cryfs/cryfs/blob/master/src/cpp- utils/crypto/symmetric/GCM_Cipher.h#L40). Did you see something different?

Assuming the 128-bit IV is indeed randomly chosen, after encrypting a trillion blocks, you would have roughly a 1.5E-15 (on the order of a quadrillionth) chance of hitting a collision.

Unless I'm mistaken, even if you hit that one-in-a-quadrillion lottery, the result is that the two blocks encrypted with the same IV are more crackable (because you can XOR them together), not that the key itself is easier to obtain, right? (My understanding is that AES is resistant to known-plaintext attacks.)

</comment></comment><comment><USER15> Cryptomator is another alternative. [https://cryptomator.org/](https://cryptomator.org/)</comment>


Debugging a Live Saturn V - <AUTHOR> http://www.zamiang.com/post/debugging-a-live-saturn-v <comment><USER2> If you like these kinds of stories, Boris Chertok's memoirs have a lot more from the Russian early launches during the space race. He was in charge of electrical systems in many of the Russian rockets.

NASA history has an excellent four volume translation of his memoirs. In volume 2 he describes the development and testing of the R7 (Soyuz) rocket:

[https://www.nasa.gov/connect/ebooks/rockets_people_vol2_deta...](https://www.nasa.gov/connect/ebooks/rockets_people_vol2_detail.html)

<comment><USER3> That makes me remember some interesting things I read that explains how much of the space race went:

In the immediate post-WWII era, the US had lots of experience with long-range heavy bombers, and plenty of air bases close-ish to the USSR. So the US focused on delivering nukes via aircraft and neglected rockets at first. The Soviets weren't real into long-range heavy bombers, and didn't have many air bases near the US anyways, so they went in on long-range rockets sooner and harder. Their nuclear program was less developed too, so their bombs were bigger and heavier. This means that their long-range bomb delivery rockets were big and powerful enough to double as orbital rockets with minimal changes. US bomb delivery rockets were significantly smaller, so we needed to develop all-new rockets to start launching things into orbit.

The Soviets were also behind on electronics and automation. When they wanted to do orbital surveillance and intelligence gathering, they put actual humans in their satellites to do it. The Americans decided that it was better to use electronics to do the same job. It was indeed better to use electronics for the purpose of surveilence, but that also meant that the Soviets racked up a lot of experience in running manned space stations that we didn't start to touch until much later on.

Source: [https://selenianboondocks.com/2019/05/amistics-of-human- spac...](https://selenianboondocks.com/2019/05/amistics-of-human-spaceflight- or-how-autonomy-and-miniaturization-can-be-the-enemies-of-human-spaceflight- part-1/)

</comment></comment><comment><USER4> They were given permission to take that long list of risks because of the urgency of the space program. I don't think anyone would dream of sending people into a flammable, toxic atmosphere for electrical work these days. And that's how we got to the moon.

<comment><USER5> > And that's how we got to the moon.

With only three dead (due to the use of flammable atmosphere!) and the narrow escape of another three. Better results than the average WW2 bombing mission, I suppose.

<comment><USER6> Honestly I think you would find thousands of volunteers to do space exploration with a much higher risk than we are willing to entertain today.

I sometimes wonder just how much we are handicapping ourselves as a civilisation with the risk averseness we take to some tasks while being pretty blase about others where the reward is nowhere near as high.

<comment><USER7> I would argue the bigger handicap is the resource constraint for large projects - from lack of funding as well as lack of resources since the major sources Of taxable income (Amazon, Apple, etc) don't pay tax.

<comment><USER5> Resources are a choice. Nobody ever did a cost-benefit assessment for the trillion dollars of Iraq war.

(Arguably the space programme worked as a proxy war with the Soviet Union; America didn't want to let the Russians ""invade"" the moon first.)

<comment><USER7> Apologies - not sure I understand. But I think I agree that societies choose how to distribute their resources?

</comment></comment></comment></comment></comment></comment><comment><USER8> Switching a relay in a flammable atmosphere is ... bold. Does anyone know what voltages were used?

Edit: Seems like 28 volts DC unregulated supply ([https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/197400...](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19740021163.pdf)), which was regulated to 5V and 56V depending on where it was used ([https://en.wikipedia.org/wiki/Saturn_V_instrument_unit#Power](https://en.wikipedia.org/wiki/Saturn_V_instrument_unit#Power))

<comment><USER9> Was it a flammable atmosphere? Liquid oxygen would have been venting, but there shouldn't have been any significant fuel in the air.

<comment><USER10> -Given sufficient oxygen levels, anything is fuel - including engineers...

<comment><USER9> Well sure, but a tiny spark in a relay isn't going to ignite the engineer.

<comment><USER11> It might ignite the metal in the relay, before igniting the engineer.

</comment></comment></comment></comment></comment><comment><USER12> This reminded me of a recent post about how we can't do anything fast anymore.

[https://news.ycombinator.com/item?id=21848860](https://news.ycombinator.com/item?id=21848860)

This kind of daring/insanity that can only be justified as part of something as important as the space race is possibly part of the reason.

</comment><comment><USER13> "We resealed the cabinet, signed off on all the paperwork and got the out of there without any more sight seeing."

That's the NASA spirit!

</comment><comment><USER14> Now I think of it, _of course_ they used switching relays in the 1960s. But...I am astonished that they worked in such a high-vibration (and extreme temperature) environment.

The entire enterprise remains incredible, and the more I learn about it the more incredible it seems.

<comment><USER5> I thought "NASA will have a spec for this", and sure enough a bit of Googling finds this from 1973: [https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/197300...](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19730014020.pdf) which references "Teledyne 422" relays. That is [https://www.teledynerelays.com/Datasheets/420422.pdf](https://www.teledynerelays.com/Datasheets/420422.pdf) , which claims 30g at 3000Hz. Apparently by using strong fields over short distances.

(The first PDF is worth scrolling to the end for a full set of neat hand-drawn mechanical and circuit diagrams. No CAD back then!)

<comment><USER15> Latching relays don't need to rely on field strength to hold contacts in place. Then it's just a mechanical design problem.

<comment><USER14> In launch phase they presumably had plenty of power; I was thinking of mechanical chatter (rising) in the contacts.

</comment></comment></comment></comment><comment><USER16> OK, men, you're about to service a fully fueled Saturn V rocket that is spewing all sorts of nasty gases and is an active spark away from blowing up itself, and you, over a 5 mile radius.

Do you all have your plastic safety helmets?

</comment><comment><USER17> Amazing story, a once in a lifetime experience for sure!

<comment><USER18> One in a lifetime, in a GOOD way.

</comment></comment><comment><USER19> I love stories like these. Are there any more from engineers of the time? Perhaps, are any more of his stories published anywhere?

<comment><USER20> The best place to start is Apollo by Murray/Cox: [https://www.goodreads.com/en/book/show/282086.Apollo](https://www.goodreads.com/en/book/show/282086.Apollo) Rather than focusing on the astronauts, this is very much a story of the engineering and management that made the project possible.

From someone who helped develop the lunar lander, there's Thomas J. Kelly's "Moon Lander: How We Developed the Apollo Lunar Module": [https://www.amazon.com/dp/1588342735/](https://www.amazon.com/dp/1588342735/)

Another good book (so I've heard - I own a copy but haven't made time to read it yet) is Sunburst and Luminary by Don Eyles, who worked on the guidance system at MIT: [https://www.sunburstandluminary.com/SLhome.html](https://www.sunburstandluminary.com/SLhome.html)

For deep technical details (but light on first-person stories), there's How Apollo Flew to the Moon: [https://www.goodreads.com/book/show/2323178.How_Apollo_Flew_...](https://www.goodreads.com/book/show/2323178.How_Apollo_Flew_to_the_Moon)

Finally, not strictly related to the space race, but for some truly wonderful first-hand tales from the development of rocket propellants, you can't beat John D. Clark's Ignition!: [https://www.amazon.com/Ignition-Informal- Propellants-Univers...](https://www.amazon.com/Ignition-Informal-Propellants- University-Classics/dp/0813595835/)

</comment></comment><comment><USER21> What a wonderful story - and a great way to honour and remember your grandfather.

</comment><comment><USER22> One of the best stories this year. Thanks for sharing</comment>