How the 'Kung Fu Fighting' Melody Came to Represent Asia - <AUTHOR> http://www.npr.org/blogs/codeswitch/2014/08/28/338622840/how-the-kung-fu-fighting-melody-came-to-represent-asia <comment><USER2> This tune has its own Wikipedia page [http://en.wikipedia.org/wiki/Oriental_riff](http://en.wikipedia.org/wiki/Oriental_riff) . This site has the definitive in depth exploration of the Oriental Riff: [http://chinoiserie.atspace.com/index.html](http://chinoiserie.atspace.com/index.html) .

</comment><comment><USER3> Similarly, there's nothing turkish about "Rondo alla Turca" by Mozart, as illustrated hilariously by Igudesman and Joo:

[https://www.youtube.com/watch?v=MNtYYuWILNE](https://www.youtube.com/watch?v=MNtYYuWILNE)

<comment><USER4> It's more complicated than that. Mozart was following a "Turkish"/"Janissary" style of music popular in Europe at the time. Indeed the style was pretty much unrelated to actual music from Turkey, but there's a history of how it developed that started with Turkish Janissary bands. (More obviously in orchestral "Turkish" music than in Mozart's piano sonata, where compositions used exotic instruments like bass drums.) [https://en.wikipedia.org/wiki/Turkish_music_%28style%29](https://en.wikipedia.org/wiki/Turkish_music_%28style%29)

</comment></comment><comment><USER5> For a piece of music with a similar association, see _The Streets of Cairo, or the Poor Little Country Maid_ ¹ which for many have come to symbolize ancient Egypt¹.

1) [https://en.wikipedia.org/wiki/The_Streets_of_Cairo,_or_the_P...](https://en.wikipedia.org/wiki/The_Streets_of_Cairo,_or_the_Poor_Little_Country_Maid)

<comment><USER6> Don't forget also the "circus" song: [http://en.wikipedia.org/wiki/Entrance_of_the_Gladiators](http://en.wikipedia.org/wiki/Entrance_of_the_Gladiators)

the "camping" song: [http://en.wikipedia.org/wiki/Dueling_Banjos](http://en.wikipedia.org/wiki/Dueling_Banjos)

the "end of the world" song: "O Fortuna" from [http://en.wikipedia.org/wiki/Carmina_Burana_(Orff)](http://en.wikipedia.org/wiki/Carmina_Burana_\(Orff\))

the "nautical" song: [http://en.wikipedia.org/wiki/The_Sailor's_Hornpipe](http://en.wikipedia.org/wiki/The_Sailor's_Hornpipe)

the "Italian" song: [http://en.wikipedia.org/wiki/Tarantella_Napoletana](http://en.wikipedia.org/wiki/Tarantella_Napoletana)

the "morning" song: "Ranz des Vaches" from [http://en.wikipedia.org/wiki/William_Tell_Overture](http://en.wikipedia.org/wiki/William_Tell_Overture)

Just the first couple seconds of any of those songs are universally recognizable and commonly used to set scenes.

I wonder, is there a stereotypical "American" riff used in Chinese media? The beginning of "Yankee Doodle" or something?

<comment><USER4> [http://tvtropes.org/pmwiki/pmwiki.php/Main/StandardSnippet](http://tvtropes.org/pmwiki/pmwiki.php/Main/StandardSnippet) has a long list.

<comment><USER7> Please refrain from linking to TV Tropes during work hours, thank you.

<comment><USER8> On an international site (it's currently 18:30 on Friday evening where I am, for example), populated by people who might not necessarily do 9-5 Mon-Fri, I don't think there's any such thing as non-work-hours

If you mean 'please don't link to TV Tropes', say so.

<comment><USER9> I think it was a joke.

</comment></comment></comment></comment></comment></comment><comment><USER10> mfw "the pentatonic scale." Pentatonic is a _form_ of scales. There are innumerable pentatonic scales, although practically, it's bounded by about 50!/45!. [0] And in everyday 12-tone chromatic use, there are at least 5 different versions [1]. Even in Asian scales, there are numerous pentatonic scales in use.

[0] presuming a pitch resolution of 2%.

[1] [https://www.youtube.com/watch?v=LVbGYvHd0qo](https://www.youtube.com/watch?v=LVbGYvHd0qo)

Blues music, for example, uses pentatonic scales, yet blues music does not sound like Thai music.

Now that technical matter has been cleared, I find it hilarious and symptomatic that researchers didn't look into any CHINESE MUSIC to see if there were any sounds that might have influenced Western composers. For example, just listening to music played on a Gu Chin [ 2 ] reveals a number of similar intervals (such as single step motion and parallel fourths) and stark tonality that could easily be recognized in attempts by Western composers to imitate and integrate Chinese music.

That article was less of a "how it happened" and more a "that it happened." The seething, suspicious racial tension underneath was distracting and needless. Everyone should ignore it (and probably the rest of NPR) and simply enjoy Chinese music for what it is: interesting and beautiful. sigh.

[ 2 ] [http://en.wikipedia.org/wiki/Guqin](http://en.wikipedia.org/wiki/Guqin)

<comment><USER11> you know more and have suggested more jumping-off points for further research than anyone else in this thread - so of course your comment is near the bottom. this site sometimes, sigh.

<comment><USER12> The comment is smug, unhelpful, and very misleading about the pentatonic scale.

Okay, you could call any five notes a pentatonic scale, but don't let that distract you from _the_ pentatonic scale, the set of five notes that appears in many cultures for solid music theoretical reasons.

The linked video about blues is using the _same scale_ , just with the notes in a different order. Different modes are not different scales. D F G A C is the same scale as C D F G A. We should be interested in the fact that blues and Thai music use the same intervals, not dismissive.

The comment also continues to ramble through several kinda-music-theory-esque statements whose aim is not to inform, but just to make the author appear smart.

Yep. This site sometimes.

<comment><USER10> > the fact that blues and Thai music use the same intervals

Blues and Thai music do not use the same intervals. Blues is hemitonic, Thai music is anhemitonic.

".And the Thai musical scale is indeed different -- for the intervals between all notes are exactly the same. This means that almost all the notes are slightly different in pitch from those on the western scale. Only the interval between a note and its octave, eight notes higher up the scale, is the same as in the west." [0]

[0] [http://www.thaiwaysmagazine.com/thai_article/2605_traditiona...](http://www.thaiwaysmagazine.com/thai_article/2605_traditional_thai_music/traditional_thai_music.html)

> D F G A C is the same scale as C D F G A

D F G A C is the D Minor Pentatonic scale [1]

C D F G A is the C Blues Major Pentatonic scale, aka Chinese Ritusen scale [1]

[1] [http://en.wikipedia.org/wiki/Pentatonic_scale](http://en.wikipedia.org/wiki/Pentatonic_scale)

> Yep. This site sometimes.

The problem with this site is that people don't accept information unless it's accompanied with a major dose of ass-kissing. "So, pretty please with sugar on top, clean the fucking car."

> > kinda-music-theory-esque statements > solid music theoretical reasons

Ok, you've done what you've accused me of doing. Care to back your statement up?

</comment></comment></comment></comment><comment><USER13> This is super weird, but I just saw the clip of this from Scrubs, this morning. Interesting to get the back story in such a short time span.

[1] [https://www.youtube.com/watch?v=zbXbBoRKLVU](https://www.youtube.com/watch?v=zbXbBoRKLVU)

<comment><USER14> not sure why this was downvoted, but upvoted it into the black.

<comment><USER15> I'm not usually interested in reading idle musings about what the commenter was doing today, and I tend to downvote those.

I feel like HN users increasingly treat the comments as a place to just spit out whatever is on their mind. That's great in a regular conversation, but I don't want the comments section to turn into a place for conversations. I'd rather see fewer, more informative comments.

<comment><USER14> its not off topic nor offensive. people trying to force other people what to say and how to express themselves to suit what they want is exactly the problem we have today.

however, it would make sense to give people an option to choose what type of comment they are leaving (muse, additional context, rant, etc) and allow users to filter which ones they see.

</comment></comment></comment></comment><comment><USER16> It seems to me that how it's played is almost as important as the melody itself. Playing it just now on a clean guitar and a piano, it's not all that evocative of China. Yes, maybe a little bit, but it does sound 'wrong'. Curious.

</comment><comment><USER17> OK, so it's not a Chinese tune. What would be a suitable replacement? Ideally something authentically Chinese, broadly recognizable, and somehow representative of Chinese music.

<comment><USER18> What about looking at what Carl Sagan et al. put in the Golden Record on Voyager 1 [1] ?

They put a beautiful piece of zither [2].

[1] [https://en.wikipedia.org/wiki/Contents_of_the_Voyager_Golden...](https://en.wikipedia.org/wiki/Contents_of_the_Voyager_Golden_Record) [2] [https://www.youtube.com/watch?v=_lReQHyOYgU](https://www.youtube.com/watch?v=_lReQHyOYgU)

</comment></comment><comment><USER19> Carl Douglas and Biddu are ostensibly both alive; has anyone asked them how they came upon the riff?

<comment><USER20> The riff predates the song. According to the NPR piece it's been in use to signify oriental culture since at least 1930.

</comment></comment><comment><USER21> I heard a little of the backstory on this riff on John Hodgeman's judge podcast. good stuff.</comment>


Adafruit Founder Limor Fried: Open-Source Hardware Revolution [video] - <AUTHOR> https://www.tfir.io/2019/06/04/meet-adafruit-founder-limor-fried-open-source-hardware-revolution/ <comment><USER2> I have so much respect for her. I tried to start an open hardware business and even with a big successful kickstarter I couldn't do it. I always wanted to make great products and fun easy to follow tutorials, but I failed. Seeing her company dominate was at first discouraging but has become cathartic. Even though I never made those helpful products and tutorials, someone has. It helps me feel like my failure wasn't that bad. I'm so glad Lady Ada and her team have been doing so well.

<comment><USER3> I can remember a great lot of people who managed to fail even on "hello world" level hardware businesses. Don't take this as some kind of discouragement.

The prime majority of successful small electronics businesses do very simple things like utilitarian "bare PCB" gadgets.

Olimex for example manages to get quite a lot of business despite being quite far away from Silicon valley's commotion (located in Plovdiv, a 350k people town)

I knew a teen who managed to spin a simple WiFi tester on ESP32 commercially. Also, just a PCB with a lipo battery and an MCU. He's doing great despite amateur level EE and it being a very niche product (professional WiFi installers are much the only buyers)

My own opinion, in electronics business you are always in between the Scylla and Charybdis of big and unprofitable businesses (commodity OEMs,) and niche/meme/fad products (hoverboards, vapers, and of course... the juicer)

<comment><USER4> It's a brutal space to operate in and seems to be getting worse all the time. Investment capital is scare. Product copies are rampant and hitting the market faster and faster to the point I even sometimes see copies reach store shelves before the original. Suppliers are increasingly consolidated and manufacturers can be hostile to little guys who need delivery schedules.

Anyone who finds success in such a market has my respect and the fact the Limor has managed to not only succeed, but thrive in such an environment is a testament to how incredible she is.

<comment><USER5> And things move really fast underneath you.

I was part of a team who build (one batch only of) a hardware IoT product that I'm _still_ really proud of. Our bill of materials was ~$70, maybe 50% or so of that on our cpu/microcontroller board (the kinda standard "RaspberryPi plus an Arduino" kind of design). By the time we failed to raise funding for a second production run and threw in thew towel (amongst internal infighting), we could have functionally replaced that with the at-the-time brand new ESP8266 (this was 2013/14) for a few dollars. But we already had (expensive) plastic injection moulds made up that fit our boards so we couldn't even switch our insides easily.

Hardware is hard. Major respect to anyone who get it right at small scales.

</comment></comment></comment></comment><comment><USER6> I absolutely love Adafruit tech for low-volume hardware hacking projects. Particularly the Feather nRF52832 [0]: onboard flash, Bluetooth Low Energy, a 5V-to-3.3V converter, and USB battery charging all in one little off-the-shelf board. And the runtime [1] and bootloader [2] are totally open! I'm tinkering with my own little fork to add signed updates, lock down the OTA DFU mechanism, and switch to a more secure BLE pairing mode.

By the way, if anyone knows of an alternative to the RedBear Nano V2 [3] in terms of form factor and power profile, please let me know, since Particle is sadly killing that board off after buying out RedBear. Glad I don't have to worry about that with Adafruit.

[0] [https://www.adafruit.com/product/3406](https://www.adafruit.com/product/3406)

[1] [https://github.com/adafruit/Adafruit_nRF52_Arduino](https://github.com/adafruit/Adafruit_nRF52_Arduino)

[2] [https://github.com/adafruit/Adafruit_nRF52_Bootloader](https://github.com/adafruit/Adafruit_nRF52_Bootloader)

[3] [https://store.particle.io/products/redbear- nano-v2](https://store.particle.io/products/redbear-nano-v2)

<comment><USER7> Have you looked into an ESP32? It has on board WiFi and Bluetooth.

<comment><USER6> I have! Neat little chip, and I'll keep it in mind if I need WiFi in a future project.

</comment></comment></comment><comment><USER8> When I was in high school, I somehow came across her post on building an MP3 player and putting it into an Altoids tin[0]. The post was a formative experience in my life and spurred me to pursue an engineering degree!

[0] [http://www.ladyada.net/make/minty/index.html](http://www.ladyada.net/make/minty/index.html)

</comment><comment><USER9> I love Lady Ada. But I wish I could just read this instead of having to watch a video.

<comment><USER10> [https://pastebin.com/sp6FaKGj](https://pastebin.com/sp6FaKGj)

<comment> frosted-flakes This is from the "Open Transcript" option in the menu above the subscribe button, if anyone's wondering.

</comment></comment></comment><comment><USER11> Limor and Adafruit are an inspiration.

</comment><comment><USER12> More than 10 years ago now, I built myself a few x0xb0xes, one of Limor's first projects. You could only buy the PCBs and had to source all of the other stuff yourself. I still have one somewhere, those were fun to build and had a great community. [http://blog.bityard.net/category/electronics.html](http://blog.bityard.net/category/electronics.html)

Very satisfying to see how big Adafruit has become.

</comment><comment><USER13> When I saw "Fried", I though it was going to be about RF burns and a memorial service.

Evidently, she's as OK as she ever was.

<comment><USER14> And I thought "Limor" was just an alias and they typo'd "Fired", as in the founder of Adafruit was getting fired.

<comment><USER15> She can't be fired, she owns the company. There's no VC in Adafruit.</comment></comment></comment>


Ask YC: How Big Is the HN Team? - <AUTHOR> How big is the HN team @ Y-Combinator? <comment><USER2> Best way to reach the moderators is to email firstname.lastname@example.com. They've been quiet responsive in the past. Personally I think it's one person only.

<comment><USER3> No, it is not one person. There is one paid moderator who is the face of HN. But, I know there are others who do moderation work.

I am not clear on the details. My impression is they have no plans to divulge all the details.</comment></comment>


2016 BMW i3: the best electric car this side of a Tesla – and half the price - <AUTHOR> http://www.telegraph.co.uk/cars/bmw/bmw-i3-review-together-in-electric-dreams/ <comment><USER2> I'm holding out for the longer range version.....really cool car though. Test drove one.

<comment><USER3> Looks like you'll be waiting until 2020:

[http://cleantechnica.com/2016/07/22/electric-bmw-3-series- co...](http://cleantechnica.com/2016/07/22/electric-bmw-3-series-compete- tesla-model-3/)

<comment><USER2> Ha, that's exactly what I had in mind. I'd really love an i8, but you know what...I'm cheap, practical, and I'd rather spend the money on something that has a return on investment. If I ever find myself in a position where image matters, and it has to be flashy...perhaps an i8 will be in order. Till then, I'll keep the next gen i3 on my wish list.

</comment></comment></comment><comment><USER4> If I were interested in owning a car (and I'm not, because I live in a city), I'd hold out for a model that didn't look squished the way the i3 does.

Styling that looks good in the i8 doesn't translate well to the i3.</comment>


Where Are the Brave Military Voices Against the Forever War? - <AUTHOR> http://www.theamericanconservative.com/articles/where-are-the-brave-military-voices-against-forever-war/ <comment><USER2> After returning from Iraq, I was jaded. Young when I started, I thought we were doing a good thing. My idealism was stripped away pretty quickly.

After being stateside for a while, there were rumors that our unit would be deploying to Afghanistan. A Lt. Colonel came and gave a presentation to the company about conditions there. During the Q.A., I stood up and asked, "Sir, what are we really doing there? For the life of me, I can't understand the strategic purpose of invading Afghanistan. They're not even the ones who attacked us on 9/11."

To put it mildly, that did not go well. I exited the Corps after my first enlistment and I'm a bitter old veteran now.

The point I want to make here is that the voice of integrity in the military are in the lowest ranks, and they leave as soon as they can, as the situation is intolerable for them. You don't rise in the ranks as a career officer or NCO if you don't believe in the mission.

<comment><USER3> > For the life of me, I can't understand the strategic purpose of invading > Afghanistan. They're not even the ones who attacked us on 9/11.

The Afghan government at the time offered sanctuary to Al Qaeda, refusing to hand over its members after they had declared war on the U.S., attacked USS Cole, hijacked four civilian aircraft and crashed them into the World Trade CEnter & the Pentagon, killing thousands; the strategic purpose of invading Afghanistan was to demonstrate to every country that shielding those who commit acts of war against the United States is itself an act of war against the United States — and that being in a state of war with the United States is an unhealthy condition.

What's the strategic purpose of _staying_ in Afghanistan? 'You broke it, you fix it': having invaded, having destroyed the previous government, it is our responsibility to build a functioning government. Additionally, we desire to prevent the resumption of conditions similar to those which enabled the rise to power of Al Qaeda and the Taliban in the first place.

<comment><USER2> I asked the question ~2009. What never made sense to me is that with unsecured borders, what's the point of invaded a poor country of goat farmers? Ok yeah, so Al Qaeda supposedly attacked us and they were allegedly being harbored in Afghanistan. But the guys in the planes were Saudi. Why didn't we invade Saudi Arabia? (That's a rhetorical question). If someone wants to come here and hurt us, they can do it pretty easily. Invading Afghanistan doesn't solve that problem. The whole thing is a joke.

Now I'm aware of a host of reasons for us to be there, none of them good. Of course we're in Afghanistan for some purpose.

<comment><USER4> Yeah, by '09 there was clearly no reason. When they originally sold the war they played up Al Qaeda's size, power, and level of infrastructure (specifically in Afghanistan) so, assuming you believed that[1] the original invasion kind of made sense.

[1] personally, my suspicions that the claims that this organization was so huge and capable and dangerous, yet had only just now managed anything so big and had totally failed to achieve any of the more obvious follow-on attacks, smelled a bit of BS (that is, its size and capabilities were being wildly exaggerated) were confirmed when IIRC Rumsfeld went on the news with a diagram of some GI Joe playset-style giant underground base thing that couldn't conceivably have been built in secret due to its scale and equipment, and claimed that Bin Laden had "not one, but several" of these obviously-fantasy supervillain lairs hidden in Afghanistan. That they were clearly lying about the _popular_ war that was an easy sell definitely colored how I received their later pitch on Iraq. Not that it mattered.

<comment><USER5> Here's that interview: [https://www.youtube.com/watch?v=FGhGHxw0mSo](https://www.youtube.com/watch?v=FGhGHxw0mSo)

It's shocking now to watch. How did anyone ever buy this? I remember being 18 at the time and thinking it was completely ludicrous. I wonder if anyone seriously believed it or if it was just the story that the media needed to hear to feel less sheepish about acting like this war made any sense.

<comment><USER4> Heh, we must be around the same age.

Man, I went to Wikipedia because I was curious whether the timeline and events I had in my head for the early let-the-inspectors-back-in demands and the later, infamous leave-or-die "ultimatum" Bush leveled against Hussein right before Iraq invasion was correct (there's very little about all that, and I found some material on the ultimatum itself but never the actual word "ultimatum", which is weird since that's what everyone called it at the time and a big deal was made of it) and now I'm all pissed off again that Bush & Co. aren't in prison for life, from reading all the war lead-up material, including some of the suspected-at-the-time-and-now-confirmed stuff about how they were planning to invade no matter what. Wow, there are some emotions I hadn't felt in a while. Nostalgic, I guess.

</comment></comment></comment></comment></comment></comment><comment><USER6> Colby Buzzell[0] wrote an anonymous blog when he was in Iraq which later lead to a book - it's a great read

[0][https://en.wikipedia.org/wiki/Colby_Buzzell](https://en.wikipedia.org/wiki/Colby_Buzzell)

</comment><comment><USER7> I don't protest because I don't have time, nor would I think it's effective. People are just too busy for a war that is completely separated from them to care about it. I did care, at one point, but I too have been grinded down by both my experiences overseas and the people I served with.

I enlisted in the USMC in 2005. 0311. Felt like I had been ready since I was 11 or 12.

I went to Boot Camp, and then SOI. First taste of reality is bitter. My entire generation of Marines were called the 'X-Box' generation for our complacency and lack of earnest effort. Our ranks had swelled up to ~215K in the Marine Corps, and with it, a lower of the bar to join. That's just the way it was. Kids were already getting kicked out - hardship, drugs, etc. Still didn't mind - it felt like everyone was on the same page. We were crusaders to be, and our religion was America and deliverance was provided in the form of 5.56mm. Felt good, the narrative. Felt right.

And then I joined the fleet, and that's when I realized I was a fucking idiot. This whole time, I had believed in something grand, some kind of romanticized view of war and life and how boys - no, men like me - could make a huge impact and different in the world against a nefarious enemy that struck out at all that was good. And you know how many people shared that view? Maybe 5, 10%. We were intelligent, idealistic, and had some 'reason' to be there. That is not the case for the vast, vast majority of people who enlist. It usually takes some life experience for you to join up, hit the fleet, and not be bewildered by it, and that was something virtually all of us, with the precious few best of us, lacked.

When we got in country, the shock was amplified. The aimlessness/worthlessness of my generation was reflected in both wars. I was in Iraq twice, and both times, it seemed like our only job was to just maintain the security of Ramadi, and then Al Asad. That was it. Occasionally hunt bad guys, get blown up all the time, be bullet/bomb shields by proxy for a populace that wasn't 100% sure what it wanted.

What exactly was the mission to stop foreign fighters from flooding into the country? Beats me. What exactly were we going to do to uproot and prop up a culture that is has no real concent of loving thy neighbor and working together to achieve some state of sovereignty? Beats me. How do we turn this society into a capital G Great society? How were riflemen supposed to achieve that? Would it even meet the objectives of the mission? Nah we thought, we should just keep handing out generators, heavy equipment, and speedballs (not the drug) to the populace. We were just enlisted men on the bottom, evoking smiles when we did good and hate when we accidentally kill some guy's brother because he ignored the red flag not to go down this road towards our base.

Nothing changed, day in, day out.

I knew quite a few devil dogs who were in OEF, Kandahar and Helmund, before + after Marjah offensive. The feeling was the same. What exactly, are we doing here? For an organization that prides itself on achieving objectives, even at great individual cost, we sure did a shit job at explaining what exactly our goals were to the operators.

All this to say, what CAN I say that hasn't already been said? I don't need to 'protest' anything, because I don't hear a lot of people supporting our operations over there except for chicken hawks. I'm glad McCain's son, and John Kelly's children served with me. At least they put what is most dear to them on the line for what they believe. Can't say the same for most of modern day 'conservatives'. They have nothing on the line when they send people over, and that's the best I can protest, but what's the point? Nobody else seems to care either way - it seemed like the wiser of us had realized the whole thing was bullshit from the beginning, and now just don't care and have accepted it to be the way things are, sixteen years later. To top it off, we just have too much shit going on at home. Politics is really showing how bad democracy can get when the people themselves, the vessels of power, are fucking idiots and care more about feeling good than making good decisions for the future. I've got a housing crisis here, insurance crisis there, financial security crisis everywhere, so where can I fit in some good old protesting time? If I did, who would hear me? My old friends wouldn't want to hear it either. We just want some kind of peace of mind and happiness in our life, not dwell on the pointlessness of it all.

We are the aimless generation, just trying to survive the journey through the minefield our forefathers had left us, day after day.

<comment><USER8> "We are the aimless generation, just trying to survive the journey through the minefield our forefathers had left us, day after day."

Quote of our generation. Well said.

</comment></comment><comment><USER9> a decent article until it went political at the end - almost as a "BTW..."

It failed to bring most of the wars (or "police actions") into the picture. Maybe because all of the 'major' conflicts prior to desert storm (C/WW1/2/K/V) were headed by the opposite political party than that mentioned. This is not to say other conflicts didn't happen under other parties as they obviously have.

While the reasoning is sound insofar as the 'unmentioned' conflicts were fought primarily by draftees (again - politics?), it really gives no satisfactory reason, only conjecture and opinion (politics) on the current military actions - which SPANS political parties.

Sadly, the introduction of politics into an article initially put forth as something about the "morality or war" says more about the intent of the author than the question the article brings up.

<comment><USER10> You want to talk about war without talking about politics? And do you think the level of politics where war is decided really care which party is in power at the time?

<comment><USER9> no - war and politics are always going to be intermingled. The issue is that people (especially in today's climate) are polarized, emotionally blaming one 'side' or 'the other' when both are equally culpable.

My point is that this _could_ have been a great article. The 'morality of war' is always something that should be talked about and debated, etc... but when one 'side' brings up 'such-and-such-party', that party's 'true followers' feel the need to defend them, and reply in kind and _nothing_ is resolved, everyone else (who _wanted_ an actual discussion) rolls their eyes and leaves with their shoulders slouched in defeat/despair/apathy.

<comment><USER11> I think the author purposefully included politics in there, he probably didnt care if it was a decent article or not because he was more or less expressing his views.

Sarcasm intended

</comment></comment></comment></comment><comment><USER12> The article draws a parallel between WW1 and the present conflict.

Possibly the difference between than and now is the sheer number of people directly involved in the War. With great respect to those who have been affected by the Iraq and Afghanistan conflicts, it is possible for many people (especially here in Western Europe) to ignore the conflict altogether in ways that it was not possible back then.

<comment><USER13> The reason the conflicts in Afghanistan and Iraq have gone on as long as they have, is because even most Americans have been able to personally ignore what's going on, particularly the last five or so years of it (obviously in the years immediately after 9/11, the war & terror propaganda was so overwhelming it was nearly impossible to avoid).

Around 140 US soldiers have died in Iraq and Afghanistan combined in the last four years. Most Americans will ignore conflict at that scale if they're told it's beneficial. Although Trump managed to get a lot of traction out of pointing out the financial cost while directly contrasting that with America's various domestic financial problems (such as the need to spend vast sums on infrastructure). A large majority of the US population understands very well at this point that the US can't afford the perpetual war machine any longer; we'll see what the war machine does to counter that cultural shift.

</comment></comment><comment><USER14> They're probably reviewing the transcripts from J. Robert Oppenheimers 'security review' hearing in 1954.

</comment><comment><USER15> So.. if the US hadn't supplied the Mujahideen with stingers, and brought down the soviet backed government in Afghanistan.. none of this last 30 year nightmare would have happened?

Cool. Think of all the amazing things we could have done with that surplus capital not going to bechtel...

</comment><comment><USER16> Anyone who believes that a military presence in Iraq, Afghanistan, or anywhere else outside the U.S. to fight a vaguely threatening idea of "terror" is a good idea should watch the new Ken Burns documentary about Vietnam.

</comment><comment><USER17> The author implies that a citizen army would lessen the leadership's appetite for offensive overseas campaigns.

Interestingly enough, the bulk of Israel's army to this day is composed of drafted 18 year olds, and despite that, the only time there was a major public outcry about the necessity of a military campaign was during the first Lebanon war (1982). that war was perceived by the public as a reckless regime-changing adventure by a particular general (Ariel Sharon).

I assume that the IDF's decades long policing mission (=occupation) of the West Bank along with the periodical campaigns in Gaza & Lebanon do not generate an outcry of similar size, presumably due to the much stronger indoctrination level of the Israeli public, as opposed to that of the American. There is a general consensus around the absence of a less violent path to coexistence in the Middle East.

to this day, I've been a supporter of reforming the IDF into a smaller professional army with the express purpose of making it more difficult for the state to apply foreign policy using force, with the added benefit of keeping unwilling citizens outside of the cycle of violence.

The article, however, implies that the US has achieved the ability to increasingly "project power" by detaching its military apparatus from the society as a whole..

</comment><comment><USER18> I was in Iraq in 1991. My friends and I were astounded when we heard of the cease-fire; we could easily push towards Baghdad and take care of Saddam Hussein, who was _clearly_ the Hitler of our time. "We'll be back in a decade" I thought, as it seemed as if we were leaving with our work unfinished.

I was off by a couple of years, but in 2003 when we went back into Iraq to finally take care of Hussein, I was pleased. Of course, I had long since left the Army and now it was some other bunch of soldiers sitting in a tent. When they pulled Hussein out of his spider hole, I was thrilled. Justice, right?

But Iraq didn't turn into a shining example of emerging democracy; it was a shit-show of tribal feuds, incompetence, waste, fraud and abuse that continued to kill decent American kids. The contemporary Iraqi WMDs -- the reason for our costly endeavor -- never _really_ materialized (though their historical presence and usage against Kurds and Iranians was often downplayed). It became increasingly clear that all our involvement contributed to was a power vacuum in which something nastier could breed.

Afghanistan, a seemingly more focused war due to the Taliban's sheltering and support of al Qaeda in the wake of 9/11, at this point appears to be no more productive. Different tribes, different waste, fraud and abuse, different American kids killed so career politicians can check a box on their list of accomplishments.

While I still respect men & women who join the military, my disdain for the "warrior worship" culture that has become the norm has grown. When I returned from the Gulf in 1991, I was amazed by such goodwill and support for the military; it was, I believe, a collective reaction to the infamous reception Vietnam-era soldiers received upon coming home. I would not want to deprive returning troops of the same feel-good experience, but at the same time I've grown weary of almost _seventeen years_ of "thank you for our service" and the obligatory shots of troops abroad watching the sportsball game du jour, the abuse of the term "hero", and this somehow normalized condition of young men and women being sent to shithole third-world countries "to keep America safe".

We're in the second _decade_ of this madness, with no clear goals for victory _or even to declare a statemate_. As much as I love my country, at this point were there even a hint of a draft I would be the first to drive my teenage boys to the Canadian border -- a concept that would have astounded and enraged a younger me.

Amidst the author's pious wailing and gnashing of teeth, the question _" where are today's skeptical veterans?"_ is posed.

Well, here's one. And I'm far from alone. Most of us, I suspect, aren't vocal because of one simple reason: _it will accomplish nothing._

As with other causes, such as the environment, drug legalization, investment in national infrastructure, additional funding for scientific research, our political class turns a deaf ear to the populace. We the little people have our designated role: fly the flag of Team Pepsi or Team Coke, pay our taxes, and become enraged at each other while the aristocracy does what they will.

We are largely jaded, and having assessed the impossibility of stopping the tide many of us merely do what we can to stay on higher ground and be cognizant of storm surges.

<comment><USER19> I agree with most of what you're saying, but I'm not buying that these things (peace, environmental action, science investment, etc) aren't happening because the masses are being stymied by the powers that be.

On the contrary, I don't see the masses caring about these things at all. Do you?

I don't see the majority of the people demanding action against (or even acknowledging the existence of) climate change.

Nor do I see them demanding action against endless war or illegal surveillance.

Nor do I see them begging for more money to be invested in science.

Instead I see the people sometimes arguing about a few hot-button political issues, but mostly I see the people preoccupied with pop culture and their daily lives.

We, the People, have made it abundantly clear that we are fine with the status quo. No one had to coerce us.

Remember, the Iraq War was not started over the outcry of the American people.

It was started to thunderous applause.

<comment><USER20> Well, poll people about universal healthcare. It's, what, 70% support? Poll people about legalization of marijuana. Poll people about private prisons. Poll people about police buying military weapons, tanks on streets. Poll people about asset forfeiture. Poll people about a living wage. Poll people about gerrymandering. Poll people about money in politics. Poll people about the revolving door. Poll people about student loans. Poll people about net neutrality. Poll people about the TPP. Support for the Iraq war was created by lies and propagandists, explicitly and intentionally -- public opinion was manufactured through deceit, not genuine. And there were still huge antiwar protests and massive antiwar sentiment.

You will get massive support on a wide variety of issues completely invisible to modern political discourse if you ask people. But the people asking the questions have enormous power. If you rate congresspeople by their collective votes in congress, if you let mainstream pundits who are paid explicitly to maintain the status quo ask questions, the answers will not be inspiring and most will look similar.

I don't blame people for not demanding action, for not demanding things at all, since they've been taught it doesn't work and it's a waste of time. They are resigned to being ignored, they do not consent. Most American's don't vote. The keywords here are apathy and a disconnect with the system, not agreement.

</comment></comment></comment><comment><USER21> Well, Chelsea Manning just got out of prison for leaking the collateral murder tape.

</comment><comment><USER22> This is why Tulsi Gabbard should be the 2020 Democratic Presidential nominee.

<comment><USER23> Tulsi "Maybe Assad is Actually Good" Gabbard isn't going to do too well.

<comment><USER22> I don't think she ever said he was good, just that we don't have strong enough evidence that chemical weapons were used by Syria to use military force against Assad. Chemical weapons could have been used by rebels, or even used or planted by the CIA.

If you believe we have solid proof that Assad ordered the use chemical weapons, I have some WMD's in Iraq to sell you...

</comment></comment></comment><comment><USER24> Right here. Actually did a whole ten years, E-7. Once I had to be the mouthpiece I decided it was too in conflict with my core values and got out.

</comment><comment><USER25> Is the title meant to be reference to Joe Haldeman's _The Forever War_?

The article doesn't mention it, but it is capitalised suggestively near the end. Also, Haldeman's novel is widely regarded as a criticism of the Vietnam war, and the article does discuss the lack of literature critical of recent wars.

</comment><comment><USER26> Two words - swift boat. Or maybe a few more, if you like Tom Cruise - Born On The Fourth of July.</comment>


Berkman Center's Jonathan Zittrain Named FCC Distinguished Scholar - <AUTHOR> http://www.fcc.gov/document/fcc-chairman-julius-genachowski-announces-jonathan-zittrain-fcc-distinguished-scholar

<comment><USER2> That's really great news. Hopefully, Professor Zittrain will be able to have a good influence on FCC's policies regarding mobile and the Internet.</comment>


Analyzing 443 free proxies – Only 21% are not shady - <AUTHOR> https://blog.haschek.at/2015-analyzing-443-free-proxies

<comment><USER2> Okay so yes the number of proxies is 443; it would have been nice to analyze pretty much any other number.

<comment><USER3> It was probably to catch the reader's eye - 500 proxies wouldn't have jumped out quite as much (to me, at least). Also, had they omitted the number altogether, the headline would be making a much more radical (and possibly incorrect) claim.

<comment><AUTHOR> to be honest it was a coincidence. I was pasting IPs from random proxy lists on the web and this was the number I found. I just wanted to have more than 400 proxies to test

</comment></comment></comment><comment><USER4> 21% _supported HTTPS_. 'Only' somewhere between 16.6% and 25.1%, depending on the amount of overlap between the 'Modified JS' and 'Modified HTML' categories, did the shady thing of modifying returned content.

<comment><USER5> I thought the point of the article was that even if they didn't do anything _to_ your content, they could still be collecting quite a bit of your information if everything you did was over HTTP and not HTTPS.

</comment></comment><comment><USER6> Another experiment around a spied free proxies from Chema Alonzo (DefCon).

[https://www.youtube.com/watch?v=0QT4YJn7oVI](https://www.youtube.com/watch?v=0QT4YJn7oVI)

Maybe also be possible with Tor Relay.</comment>


Ask HN: What should I study at HackerSchool? - <AUTHOR>

Hacker School is a three-month, full-time school in New York for becoming a better programmer. It's free, and there's no curricula, so it's up to me to decide what to work on.
I'm a self-taught web programmer who's skill-set is incredibly narrow: node.js, browser js, extremely basic ruby, python & PHP, comfortable with git, linux, mongodb, redis.
The question:
What would you study if:
a. You wanted to become more employable. By this I mean having a skill-set applicable to the greatest number of opportunities in the market.
b. You wanted to become the most 'powerful'? By this I mean capable of doing really novel/magical things even it means working with languages & frameworks that most people, and employers don't. <comment><USER2> Congratulations on heading to HackerSchool!

A and B seem mutually exclusive to me these days. You seem to have an interesting (and not necessarily narrow) skillset, so don't sweat "broadness" much. The greatest number of opportunities are probably in enterprise Java or C# and I would feel bad recommending you use HackerSchool for that _unless that is personally compelling to you._

For B, I scanned your webpage. You have a short posting on predictions. I have this theory that I intend to more fully explore that building up a real strong background in stats and applied modeling would be a superpower. The applied part might be great fun at HackerSchool. Maybe tackle something with Clojure and Incanter. Or really push your Python chops.

If you feel like you really want or need to build your foundations, maybe you could take a book like Concept, Techniques, and Models of Computer Programming and grind through. I wish my formal CS education had spent at least a year doing a kind of "paradigms of programming" path, studying functional and logic programming _deeply._ Ask around about this, I often think that doing this with one or two others would be better than alone.

I feel like I'm writing this comment to myself. Hopefully it's at least somewhat helpful to you.

<comment><AUTHOR> Tom - you're certainly not writing to yourself. Thank you so much :-)

</comment></comment><comment><USER3> A is something HackerSchool can answer, given that they are paid by startups to recruit (<https://www.hackerschool.com/faq>). In addition, the participants range greatly in experience, so you can a lot more datapoints there.

B. There are different types of 'becoming powerful'. Given that you are self- taught, you may want to identify and fill some holes in your knowledge. Maybe you could go through SICP, Algorithms, learn about functional programming in scala, etc. I would personally try to find something really challenging to learn on your own that I've really wanted to learn for a long time. On your website, you mention doing predictions with twitter. Maybe you could go deeper into AI / machine learning. I'm currently going through Algorithms, and it's been a really frustrating / rewarding / mind bending time, and it's definitely shown in my code.

Powerful in the sense of creating new and innovating things seems to come more from ideology / beliefs than from using a specific programming language or framework. You might want to read more into Bret Victor and Richard Reynman if you haven't already.

Bret Victor's Inventing on Principle comes to mind: <http://vimeo.com/36579366>

Richard Feynman's approach to research problems is also really enlightening. Have 10-20 hard problems floating in your head, and as you go about your day, reading, looking, exploring, match everything against those problems to see if you can make any progress on them.

<comment><AUTHOR> Jyu,

Thanks, that's a really awesome response. I'm grepping through the Victor article now. All the best.</comment></comment>


8 Web Design Mistakes That Developers (Non-Designers) Make  - <AUTHOR> http://www.wakeuplater.com/website-building/8-web-design-mistakes-that-developers-make.aspx

<comment><USER2> On the flip side, I can't stand building out a XHTML/CSS site from a designer that comes from a print background. No considerations from the design side are made for the web world. None of the front-end developers I work with would make the mistakes listed but these guys and gals think of their work like an art. To faithfully render the designers mockups into a document that can be rendered identically across browsers and platforms in the fastest way is their goal.

The points about free fonts and stock photography. Using system standard free fonts is good for several reasons including initial cost. The main reason I favor system standard fonts is being able to render headers and menus in text versus having to load up and image which is wasted bandwidth for most cases. Stock photography purchases are also tough to swallow for a developer but in a proper setting the developer for the site shouldn't worry about the cost of things because he isn't footing the bill! If it is a developers personal project, understand that he is a do-it-yourself kinda person and will want everything for inexpensive or free.

Sorry this article got me worked up a bit. I felt I fell into the developer (non-designer) category but I don't know anyone so full of themselves to make many of those mistakes. Can't we all just get along? ;)

<comment><USER3> Yea, I can't stand print designers who try to do web. They think that all web browsers are fixed width. I have vowed to never work on another project with a print designer. It's just too much work and I end up designing the site myself.

I also think its very helpful if developers learn at least basics of good design in case they have to make some minor changes.

</comment></comment><comment><USER4> Mistake #9: "I'll spend lots of time making it marginally prettier instead of building out features"

</comment><comment><USER5> As a developer who works with designers alot (cukerdesign.com), the things I have found most often in contention are 1. white space, 2. when fonts Need to be a certain way, and 3. colors matching (often with photoshop, comps and such, colors get a bit altered due to colorspaces).

That being said, I think it is much easier for a coder to pick up on what is important for designers than vice versa.

<comment><USER2> I have a suggestion on color matching problems from design to implementation. I have asked the designers at my employer to mark in the mockups the hex color values for all elements in the design. This is a small extra step on their part that settles disputes before they start. They also mark font sizes and line-height (they call it leading I think) where needed.

</comment></comment><comment><USER6> I think there is a bare-minimum design quality necessary to launch a web product. The limit depends on the audience. If your design is below that limit, users will bounce off the page. Effort to exceed the limit is probably a waste. A site just needs to look good enough to seem 'legit'.

<comment><USER7> That is a programmer speaking.

Design is just like code, there is a version 1.0 that works, but isn't great and still needs some features. So you iterate on the code based on feedback and your own ideas. Design is the same, and if you include usability I think it is more important to iterate on your design than your code.

I did a consulting gig for a semi-large online retailer where we changed the design, the flow of the site, etc. Primarily design changes. And their turnover rose by 30% because of it.

That's how important design is.

<comment><AUTHOR> This Month tip: "If you really want to know if your Web site works, ask your next door neighbor to try using it, while you watch.

(You bring the beer.)"

Taken from Advanced Common Sense (<http://www.sensible.com/>) I really recommend the book.

<comment><USER7> Wish you were my neighbour...

Mmmmm... beer...

<comment><AUTHOR> Hahahaha, drop me a line if you ever come to Lima-Peru, I'll buy you a beer. :P

<comment><USER7> :-)

</comment></comment></comment></comment></comment></comment><comment><USER8> I don't get his point. If you're an artist and not a developer, just submit your PSD to a service like psd2html.com, and bada bing bada boom you've got yourself xhtml 1.0 transitional, CSS based design, etc. If you're a developer, you're usually better off hiring some nice design company...unless of course you're skilled enough to handle both design and code? In which case...you'd probably know all this 8 tips he gives?

And if you don't know these general ideas, why not just hire someone? Learning design takes a LOT of time, more time than most math/science/computer oriented coders are willing to spend simply on artsy design.

</comment><comment><USER9> The list:

"I Know What Looks Good (and I Have Photoshop)"

"Just Use Blue and White Again"

"I'll Just Center Everything"

"Use the Free Font...It Looks Fine to Me"

"We Can Fit More Information in That Space"

"I'm Not Paying for a Picture"

"I Don't Need to Ask for Opinions"

"No Need to Get Too Detailed"

</comment><comment><USER10> Do we really need a lecture on design from a site where every link opens in a new window or tab?

<comment><USER11> I had a similar thought. Try the sites that the article links too as "good design". In nearly every case each site was clearly made by an artist in the worst sense of the word -- The designs didn't map to what the page was trying to do, it was far too cluttered with pageantry, and there was far too much frill.

If the article's writer thinks those are the _best_ designs out there, then I suspect the opinions are somewhat limited.

</comment></comment><comment><USER12> "Just Use Blue and White Again"

Screw that, this is the best rule ever! Really, why not? I have no designer ego to feed.

</comment><comment><USER13> UI != design, UI complimented by design = yes

UI designer != graphic designer

</comment><comment><USER14> Yes, this sounds just like me.

And yes, I really oughta do something about it.

One of these days.</comment>


EA Employee Chastises Company Over SimCity in Public Letter - <AUTHOR> http://www.forbes.com/sites/insertcoin/2013/03/08/ea-employee-chastizes-company-over-simcity-in-public-letter/ <comment><USER2> Why do people continually upvote forbes.com articles? A full-page ad for a fluff piece that adds zero content to the original reddit post (which happened a few days ago)

EDIT: the original post was [http://www.reddit.com/r/gaming/comments/19xb2m/a_letter_from...](http://www.reddit.com/r/gaming/comments/19xb2m/a_letter_from_an_ea_employee_to_executives/) but that was deleted. Another author reproduced the original post in [http://www.reddit.com/r/gaming/comments/19xb2m/a_letter_from...](http://www.reddit.com/r/gaming/comments/19xb2m/a_letter_from_an_ea_employee_to_executives/c8sbzg3)

The original HN post was <http://news.ycombinator.com/item?id=5346752>

<comment><USER3> If you're going to complain about it, why don't you at least link the original for those of us who haven't seen it?

<comment><USER2> Your criticism is fair. I edited my response to include the link

<comment><USER3> Thanks, I was having difficulty finding it for some reason.

</comment></comment></comment></comment><comment><USER4> I predict this employee will have a short and sweet talk with his manager on Monday, followed by a quick exit interview with HR. Optional escort out of the building by security.

"Don't say goodbye, he's just leaving early" -- Tom Waits

Which is all a shame, but nowhere near the true tragedy of SimCity. EA has /no problem/ turning out the lights on old games; they're often not even that old. If you want to play in 2018, you'll likely be doing that on a cracked version because EA will have a slightly newer version of SimCity they want to push, and if you're playing the old one they think you're taking their money. Rinse, repeat.

I'd love to see EA let people run their own servers at some point. Chances of this happening are essentially zero.

<comment><USER5> It's an anonymous letter. And does not look genuine to me either - to somebody who worked at EA it's hard to imagine there is anybody there who seriously believes in the external PR stuff. Could be a contractor though.

Nevertheless, a lot of people at EARS will be laid off. A portion of EA's bonus depends on the Metacritic score so a lot of management types right now are missing a significant part of money they already had plans to spend. The only remedy for this is a massive layoff that boosts stock prices and increases other portions of the bonus. For recent example see what happened to MOH and EALA last quarter.

<comment><USER6> Why a contractor?

I'm a contractor for two reasons: (1) money and (2) because I don't buy into the corporate PR. People who work in these places _have_ to buy into the corporate values system.

I look at corporate values with great skepticism; perhaps I'm just cynical but in big companies it always seems to end up (in performance reviews) as being a way for the company to come back and justify why your bonus, increase, etc. will fall short of expectations this year.

<comment><USER7> > People who work in these places have to buy into the corporate values > system.

Nope, it doesn't really go beyond some lip service. For most guys who do the actual work it's not even that - not shouting that the emperor has no clothes is absolutely enough to get by.

</comment></comment></comment></comment><comment><USER8> That's so cute. As if anyone at the C level believes in a company's mission statement and values. They're just there so the coffee cups aren't plain white.

<comment><USER9> At EA, this is almost certainly true. At some companies it's better. Values in particular often form a concrete axis for things like performance reviews, and offer a more useful version of the elusive "culture fit" than the usual startup bullshit of "let's hire a bunch of 20-something single white guys who have nothing better to do than hang out in the office playing ping pong after work, followed by more work".

<comment><USER8> I have no doubt that mission statements are real at some companies, and that they influence results in a positive way.

After making my comment, I made a short search, and posted this: Sex, Lies and Mission Statements. <http://news.ycombinator.com/item?id=5352298>

It's from 1997. Things may have improved, I don't follow HR research. But it's at least a description of how things can go wrong, and probably still do.

Summary: Most managers report that their company's mission statement is ineffective, and many report that it's counter productive. Employee involvement in creating the mission statement is correlated with positive influence on behavior, yet that involvement is rare. Free coffee cups for everyone!

<comment><USER9> Mission statements are usually too pithy and vague to be useful. I've seen places where more verbose expressions of values or tenets work better.

Edit: Thinking back, some mission statements worked well. "A computer on every desk and in every home, running Microsoft software" comes to mind.

<comment><USER10> _> Edit: Thinking back, some mission statements worked well. "A computer on every desk and in every home, running Microsoft software" comes to mind._

AFAIK, in management parlance, that would be a "vision statement". Mission statements seem to be a little more nuts-and-bolts. But I only remember this because the Microsoft one was held up as a vision statement in my business classes. =)

</comment></comment></comment></comment></comment><comment><USER11> Update: EA is giving a free gift for their troubles.

"Hey guys, thanks for buying our singleplayer game. Sorry that 100% of our multiplayer portion is unplayable. While we work on fixing these issues by removing game features so only some of you can play at a time, you can play the singleplayer portion we talked about earlier. It's where you sit there and watch a 30 minute timer go by and if you win, you get to play the multiplayer portion of the game. But since we made this issue and won't give you a refund for a broken game, we'll give you one free game that'd cost us barely anything. Thanks again for your understanding."

<comment><USER10> _> we'll give you one free game that'd cost us barely anything_

...because we really hope that you buy the DLC.

That's what makes that gesture really pernicious to me.

</comment></comment><comment><USER12> Pretty cutting criticism. It will be interesting to see how this pans out. Unlike noname I think some of the C level types may in fact wish those values were the values they embodied. Now, the reality of making that happen? A lot harder.

However, given the history of the company and the choices it has made. And the fact that they seem to make the same bad choices in the same situation, suggests that those values have never been internalized.

</comment><comment><USER13> "It's a bold move for this nameless employee to write something like this, but so bold he might not be nameless for long"

It doesn't really matter in the end. I'm sure this is how everyone who worked on Simcity probably feels right now.

</comment><comment><USER14> I await the unfortunate but inevitable news that this employee was terminated. If EA bans customers for speaking out, there is no hope for employees...

<comment><USER15> I think the original post states that he's not actually an employee, but that he has a very reliable source who _is_ an employee.

</comment></comment><comment><USER16> This is interesting, but the article was posted two days ago. Why is it just now making its way to the top of HN?

I was thinking it just happened, until I get to the update at the bottom stating EA now gifting a free game to SimCity customers, which also happened two days ago.

Therefore, I'm less hopeful about the impact this will have, as it seems to have gone mostly unnoticed until now.

Or am I missing something?

</comment><comment><USER17> Why is it only now that people start complaining about always-online DRM?

Whether there is some trouble due to a server being down or not, for me there is no difference. DRM that requires you to be always online for a single player game is already broken without the server being down imho.

<comment><USER18> Why is it now? If you haven't read any online news lately, as in the past few years, people have had fits about this since it was introduced. Diablo 3 for example.

More people are complaining about it now since with SimCity they didn't expect it to occur. Additionally how bad EA at keeping the game online too.

</comment></comment><comment><USER19> I have a friend who works as a QA tester on this Sim City EA game. He's demoralized about his job. I can see other employees getting pissed off enough to post on Reddit.

</comment><comment><USER20> Next headline: Former EA Employee looking for a job.</comment>


Database leak exposes 3.3M Hello Kitty fans - <AUTHOR> http://www.csoonline.com/article/3017171/security/database-leak-exposes-3-3-million-hello-kitty-fans.html <comment><USER2> > unsalted SHA-1 password hashes

Can we please get password storage built in to _databases_ as a dedicated column type already? There are N-to-infinity crappy languages and CMS's out there, but only a handful of databases. It's becoming clear that widespread standard library support for decent password hashing just isn't enough to get people moved over.

<comment><USER3> Any good tutorial on how to deal with passwords? In a site of mine I generate a salt with UUIDv4 and generate a sha512 of the passsword+salt and store both the salt and hash. When the user authenticates I regenerate the hash and check. This is good, right? I still don't know how to deal with cookies/sessions though. And have no idea how basic http auth works.

I'd search myself but I'm afraid to find a "bad" tutorial.

<comment><USER4> There's no way to beat around the bush: No, it is not good. It's better than a lot of sites, but it's still nowhere near good enough.

The key is speed: it's too fast. Far faster than you need it to be. Fast enough that attackers could attempt very large numbers of passwords per second.

What you want is something slow, to slow down the attackers.

Probably the most popular choice is bcrypt, and you can't go wrong making that decision. In some environments you may need something more standardised / accepted, in which case you want to look at PBDKF2. There's also scrypt, which is a bit stronger than bcrypt, but a bit newer.

_Any of these three are uncontroversial choices._ Using any of them is better than using just about anything else, and the gap between each of them is much smaller than the gulf between those three and schemes such as yours.

Once you've picked one you also need to tune it: make it as slow as you can bear. If your users won't be driven away by login taking a whole second, then make it take a whole second! The key is making it slow.

\---

One broader piece of advice: Don't reinvent the wheel when it comes to security things. Passwords, sessions, and so on, you should be looking for well-supported, maintained, high-quality libraries that have been vetted for design and implementation mistakes. There's libraries out there to solve these problems, if you aren't a security expert you should be using them :)

</comment></comment></comment><comment><USER5> > Update 2: Earlier this afternoon, Chris Vickery confirmed that the three IP > addresses that were disclosing user information have been secured. The issue > wasn't a hack, but a misconfigured MongoDB installation.

> The source of the configuration error isn't clear, as neither the ISP nor > Sanrio has answered questions on the matter.

A MongoDB database open to the outside world on a public IP address?

<comment><USER6> i.e. the default configuration

But yeah, that's not good.

<comment><USER7> > i.e. the default configuration

The default configuration for MongoDB is to listen on localhost only. Someone changed the configuration if it was listening on a public IP.

<comment><USER8> This is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For years the product would bind to all IP addresses. Which is insane for a default install.

Feb 2015:

Discovered 40,000 vulnerable MongoDB databases on the Internet

[http://securityaffairs.co/wordpress/33487/hacking/40000-vuln...](http://securityaffairs.co/wordpress/33487/hacking/40000-vulnerable- mongodbonline.html)

The changes were made after this, so we're only talking a few months now.

</comment></comment></comment></comment><comment><USER9> Evening project: union Hello Kitty and Ashley Madison lists.

No, some things are better left unknown.

<comment><USER10> I'm not sure what compels people to download and look at any of these leaks.

There's a real dichotomy between the mostly universal opinion on here that ad tracking is a terrible evil, but downloading and investigating people's private data that was illegally obtained and distributed is okay.

<comment><USER11> It's interesting to look at? I don't think most people looking at the leaks are trying to profit (exception of people exploiting people based on the data). Ad systems however, are always looking at the data as a way to increase profits.

<comment><USER10> So violating people's personal privacy is okay if it's interesting to look at? I guess people who put hidden cameras in bathrooms feel the same way as you.

<comment><USER11> No, I'm saying the person who did the leak or placed the camera did the breach of privacy. You want to say everyone looking at is also breaching the privacy. I'd say they are simply looking at the result of a breach not committing another one.

"There's a real dichotomy between the mostly universal opinion on here that ad tracking is a terrible evil, but downloading and investigating people's private data that was illegally obtained and distributed is okay."

What differs between these two is that the ad system is the person placing the camera, watching the video and distributing. The interested person is simply watching the video. Sure that doesn't seem fair to the victim but if they are not trying to exploit the victim I don't think it's a problem.

</comment></comment></comment></comment></comment><comment><USER12> Reuters headline:

"Hello Kitty fan site exposed, but no data stolen: web host"

"There is no evidence any data has been stolen, the Hong Kong-based company hosting the data said on Tuesday."

[http://in.reuters.com/article/us-sanrio-cyberattack- idINKBN0...](http://in.reuters.com/article/us-sanrio-cyberattack- idINKBN0U42B720151222)

</comment><comment><USER13> So, are we going to see extortion attempts like in the Ashley Madison leak? "We know you like Hello Kitty"...

<comment><USER14> This guy is worried. [http://imgur.com/RNiWGSl](http://imgur.com/RNiWGSl)

</comment></comment><comment><USER15> This is the same guy that uncovered the MacKeeper user database as well, which also used MongoDB. From what I've read, he just used Shodan to uncover these instances. This isn't meant to discredit him, but it interesting how we're calling people like this "security researchers".

<comment><USER16> I don't know who Vickery is but could he not be a security researcher who uses Shodan?

</comment></comment><comment><USER12> Found when I Googled for more information...

"Hello Kitty and Minnie Mouse arrested after fight over tip money in New York's Times Square."

[http://www.mirror.co.uk/news/weird-news/hello-kitty- minnie-m...](http://www.mirror.co.uk/news/weird-news/hello-kitty-minnie-mouse- arrested-5833387)</comment>


NIST Post-Quantum Cryptography Round 1 Submissions - <AUTHOR> https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions <comment><USER2> If you can tolerate ~1MB private keys, Classic McEliece is probably the best conservative and secure post-quantum option just now before others are analyzed more. It's old and proven.

>9 Advantages and limitations (2.B.6)

>The central advantage of this submission is security. See the design rationale.

>Regarding efficiency, the use of random-looking linear codes with no visible structure forces public-key sizes to be on the scale of a megabyte for quantitatively high security: the public key is a full (generator/parity- check) matrix. Key-generation software is also not very fast. Applications must continue using each public key for long enough to handle the costs of generating and distributing the key.

>There are, however, some compensating efficiency advantages. Encapsulation and decapsu- lation are reasonably fast in software, and impressively fast in hardware, due to the simple nature of the objects (binary vectors) and operations (such as binary matrix-vector multiplications). Key generation is also quite fast in hardware. The hardware speeds of key generation and decoding are already demonstrated by our FPGA implementation. Encapsulation takes only a single pass over a public key, allowing large public keys to be streamed through small coprocessors and small devices.

>Furthermore, the ciphertexts are unusually small for post-quantum cryptography: under 256 bytes for our suggested high-security parameter sets. This allows ciphertexts to fit comfortably inside single network packets. The small ciphertext size can be much more important for total traffic than the large key size, depending on the ratio between how often keys are sent and how often ciphertexts are sent. System parameters can be adjusted for even smaller ciphertexts.

<comment><USER3> Can't really see standardization settling on something that requires ~1,000-10,000x overhead from its competitors. 1mb public keys would mean things like IoT devices and block chain type usages, not to mention local caching taking possibly gigabytes.

Hybrid secret-sharing schemes do a lot to mitigate both future quantum risk and present broken cipher system risk.

</comment></comment><comment><USER4> One of them has already fallen victim to a key recovery attack:

[https://twitter.com/yx7__/status/945283780851400704](https://twitter.com/yx7__/status/945283780851400704)

Round2 (LWE-based) and SIKE (isogeny-based) are the particularly interesting ones to me. Both support comparatively small keys (~1kB), with Round2 seemingly winning on performance, but also patented.

<comment><USER5> I never understood how or why patenting math is a thing.

<comment><USER6> It is patenting the application of math.

<comment><USER5> How do you differentiate between math and the "application of math"?

<comment><USER6> You can't patent an S-box transform. You can patent using a specific S-box transform to encrypt / decrypt data. That's the justification at least.

<comment><USER7> More like you can patent math when it is applied via a computer. So you would not be violating the patent by evaluating the S-box with pen and paper.

It makes no particular sense, but the theory behind math patents being out of bounds is that math is a fact. Software patents, including crypto patents, do not "feel" like facts to most judges, even if they technically are (see: Curry-Howard Correspondence).

</comment></comment></comment></comment></comment></comment><comment><USER8> I like to ask dumb questions... So here is one: Are forward secrecy guarantees made by TLS valid in a post-quantum world?

Specifically, say I connect via TLS to a server that uses FS and exchange some information that will be valuable in 150 years. If the entire conversation is recorded at the wire, does quantum computing break this promise? (or have I misunderstood FS completely?)

<comment><USER9> In general forward security involves generating a new key for each conversation with Diffie-Hellman or similar.

According to [https://crypto.stackexchange.com/questions/5610/diffie- hellm...](https://crypto.stackexchange.com/questions/5610/diffie-hellman-is- post-quantum-secured), Diffie-Hellman is not post-quantum secure, but [https://en.wikipedia.org/wiki/Supersingular_isogeny_key_exch...](https://en.wikipedia.org/wiki/Supersingular_isogeny_key_exchange) is a DH alternative that is.

<comment><USER10> Which is partly why we wrote and open sourced a SIDH implementation in TLS 1.3: [https://blog.cloudflare.com/sidh-go/](https://blog.cloudflare.com/sidh- go/)

<comment><USER11> Do you have any performance numbers for SIDH vs ECDHE?

<comment><USER12> Cloudflare has a Go implementation of SIDH with p751: [https://blog.cloudflare.com/sidh-go/](https://blog.cloudflare.com/sidh-go/)

Here's an overview of the performance from a patch by Armando Faz Hernandez: [https://github.com/cloudflare/p751sidh/pull/2](https://github.com/cloudflare/p751sidh/pull/2)

</comment></comment></comment></comment></comment><comment><USER13> I'm seriously considering moving to pre-shared keys. Vernor Vinge's books (_A Deepness In The Sky_, others) talk about how much of interstellar shipping is the secure transportation of random pre-shared keys.

Although I'm unfamiliar w/ anything more sophisticated than a password manager like 1Password and S/Key - I'd like to see if I could have a go with this for my personal kit.

Can anyone recommend keywords/papers that talk about pre-shared key authentication at automated scale?

<comment><USER14> PSK isn't really a good solution, mostly because of scaling problems.

Today, all you need is a 32-byte ECDH private key, and a corresponding 32-byte public key. To talk to any of the billions of devices on the Internet securely, all you need is their 32-byte public key, and some means to verify that it is authentic (i.e. certificate authorities + certificate transparency). With this information, you can calculate a shared secret (or use a sealing API given only their public key, if you really want).

Total local storage: PKI overhead plus your own keys, under a few megabytes.

Doing PSK at scale means storing billions of 32-byte binary strings. One for each participant you intend to communicate with. They must also do this for every possible device they wish to communicate with, otherwise others can just eavesdrop on their conversations if keys are reused.

You've turned an O(n) space problem into an O(n^2) space problem.

If your n is small, you might still be tempted to make the move, but it will quickly become unmanageable as n grows.

Furthermore, if a devices loses their key, you must:

1\. Generate/share a new keypair with n devices (which at Internet scale is billions), and

2\. Do so in a way that doesn't open the door for backdoors, which probably requires digital signatures and therefore you're not actually getting rid of public-key cryptography

I think at Internet scale, we're still years away from having reliable post- quantum cryptography to even recommend let alone adopt, but that's going to be the way to go. Something something baby and bathwater.

<comment><USER15> Passwords are PSKs and are the overwhelming default authentication mechanism for Internet scale systems.

Storing, distributing, and synchronizing billions of small blobs is actually a solved problem and not that big a deal. I wouldn't be so quick to write it off, because it has a real, working, easily understood invalidation and revocation story, which PKI does not.

A system that combines asymmetric crypto public-private key pairs with the distributed-whitelist properties of simple passwords, by treating the public keys as PSKs, has a lot of compelling benefits.

<comment><USER14> > Passwords are PSKs and are the overwhelming default authentication mechanism > for Internet scale systems.

Not for HTTPS, which is what we're talking about.

For WPA2-PSK, okay, you have a small n, it might work.

For user authentication against a local database, you're not encrypting, you're using validating against a password hash and then elevating the user's privilege for the duration of their session. That's far removed from what we mean when we say PSK (pre-shared keys), where _encryption is implied_.

<comment><USER13> To be fair, that's what you're talking about. I am mostly talking about SSH access.

</comment></comment></comment></comment></comment><comment><USER16> Does NIST require submissions to be free (as in open software)?

Or is this going to be a bunch of advertising for proprietary patented algorithms?

<comment><USER17> This is to form PQC (post quantum crypto) algorithms driven by the industry. In practice, as long as quantum computers don't both work and become scalable in the interim, you have another 4 years to worry about recommendations.

<comment><USER18> That's not really true though is it? What about any of my data that is encrypted today with a non-PQC algorithm and has been intercepted? If quantum computers become functional and scalable while that data is still of value to me then I need to worry.

<comment><USER17> Yes, it's true. I spoke about future pqc recommendations from NIST at a scheduled time. I never said there was nothing to worry about, but that NIST's future pqc recommendations don't need to be worried about today.

You are making a reference to something other than the pqc future recommendations from NIST. Of course, if the agility is low, requiring a large ramp up time, a company can turn to the CNSA values today.

As you point out, working scalability is the issue. Even when there is a computer than can run grover or schor over something, the number of qubits will be the issue.

</comment></comment></comment></comment><comment><USER19> Are there any blogs that talk about what's required in a crypto algorithm to withstand quantum computing? Is a straightforward increasing the key size enough? Or are there new paradigms explored? Are these algorithms symmetric or asymmetric?

<comment><USER7> PQ crypto has to be secure against a _scalable_ quantum computer i.e. one that can be increased to attack arbitrarily large keysizes. Building a quantum computer with enough qbits to attack RSA2048 is not a problem if there is no known way to increase the number of qbits to attack RSA3072 -- but if you can keep adding more qbits, then we need a post-quantum algorithm.

The interest in post-quantum crypto is mainly in public-key systems, because for symmetric key systems you can essentially double the key size to achieve the same security level. In other words, AES256 is as secure against a quantum computer as AES128 is against a classical computer. On the other hand, quantum algorithms break RSA and DLOG (include ECDLOG), so the research has been on new approaches to public key crypto that _seem_ hard for quantum computers. For example, the Learning With Errors (LWE) problem:

[https://en.wikipedia.org/wiki/Learning_with_errors](https://en.wikipedia.org/wiki/Learning_with_errors)

<comment><USER19> Interesting. But an ec 512 bit key has a theoretically same strength as an aes 256 bit key. How is aes able to withstand it when ec and rsa can't?

<comment><USER14> AES's security reduction in the quantum scenario comes from a sqrt(n) reduction in search time. It's an optimized brute force against the key.

ECC gets broken because there is a quantum algorithm that solves the Elliptic Curve Discrete Logarithm Problem much faster than sqrt(n).

<comment><USER19> Thanks. Looks like I have a wrong understanding of quantum computing. I thought QC increases the computing power by a lot there by making it easier or practical to compute the discrete log. So are you saying that the QC paradigm lends itself to a different class of algorithms?

<comment><USER14> Yes, look up Shor's Algorithm and Grover's Algorithm.

</comment></comment></comment></comment></comment></comment><comment><USER20> This seems to have generated a lot of collaboration.

DJB is listed on 5 separate submissions.

Phillippe Gaborit is on 8!

</comment><comment><USER21> If I were you, I wouldn't be so quick to trust any cryptography standard set by a government agency. They have an obvious incentive to ensure that _any_ standard that is eventually set be open to attack by whatever means the NSA has (or will have in the near future.)

So pay careful attention to things they _reject_ , or things they modify!

I have no insider knowledge here. I'm just applying common sense...

</comment><comment><USER22> Dupe: [https://news.ycombinator.com/item?id=15981884](https://news.ycombinator.com/item?id=15981884)

<comment><USER23> I guess we'll leave this one up since that one didn't attract discussion while this one has.

</comment></comment><comment><USER24> I sure hope we can get a post-quantum version of Dual_EC_DRBG from the trustworthy people at NIST. /s

Not that I especially think any of these algorithms are going to be backdoored (though I certainly hope they get extra scrutiny just in case). I'm mostly just disappointed that there aren't any real consequences for a group like NIST for rubber-stamping backdoored things.</comment>