We don't have abundant solar power because of financing, not science - <AUTHOR> http://singularityhub.com/2012/01/21/why-dont-we-have-abundant-solar-power-blame-financing-and-industry-not-science/

<comment><USER3> Ultimately, the problem with solar, wind, and any other "periodic" or localized generation method is storage and distribution. I live in an area with incredibly cheap power due to hydro dams that generate well in excess of what we need. However, there's only so much we can do with that excess in terms of efficiency of generation because it costs so much to send that energy long distances.

In addition, you have the obvious periodic nature of solar and wind, which mean that not only do you have the distribution problems, but you also can't just flick it on and offset a bunch of peak load or burst demand (such as when hospitals "turn on" in the morning).

You could have 100% efficient solar technology, and it wouldn't change much the economics of green energy because of the physical nature of problem. Thus, you need to change how we deal with the physical nature, and thus the economics themselves by improving the technology in other places. I work for a startup which is building a combination of efficient storage infrastructure and a distributed software system to help manage the heuristics of controlling supply and demand with this storage system and generation technology (including solar and wind, but also traditional generation as well), helping to do things like smart "time shifting" of energy supply.

Since superconductors are still a ways off, and even with them it doesn't change the nature of periodic generation, I think storage technology is likely the most important area for investment in the immediate future (and not just because that's where my paycheck comes from :) )

<comment><USER4> That sounds like a great start up. Are you allowed to clarify what you mean by efficient infrastructure? That is, do you mean the topology of the network, the routing on the links or the type of nodes? What type of algorithms do you use for load balancing? Are you storing on more efficient batteries for example? What is the chemistry of your batteries? Or are they the dual, fuel based?

Sorry, this has been a bit of a ramble just curious about your system.

<comment><USER5> I really appreciated this interview <http://itc.conversationsnetwork.org/shows/detail5059.html> with the guy who wrote the book <http://en.wikipedia.org/wiki/The_Third_Industrial_Revolution>

He stresses that financing, generation and distribution must all be improved in sync for a successful transition to occur. This is based on his experience in Europe helping them transition to distributed renewable energy.

<comment><USER3> It's funny you mention that - that book has been making its way around at work, and I've got it sitting on my desk to read right now.

I think the author is right on, though I bet we'll see some significant incremental progress in the next couple years. I also think, based on the blurbs I've seen, that he's missing out on one key part of the equation that a lot of non-energy startups can go after - intelligence in the system. We'll be building the distribution, storage and generation side, and the smart grid will continue to plug into more and more devices, but it's the smarts of the system at scale, doing things like we've all been working on in the social space for a few years now, that will take those raw materials to the next level, and do something really clever that none of us have thought about yet.

<comment><USER5> For me, the biggest surprise in the interview was the reaction of the legacy energy companies. At first, they were very unhappy with the idea of independent, distributed generation (no surprise). But once it became clear that A) It's happening with or without them. And B) There's a new role for them in distribution intelligence. They got on board and now are actually pushing progress forward.

</comment></comment></comment></comment></comment><comment><USER6> Very common problem with similar optimistic analysis is that they compare end- user price (includes taxes and distribution costs) with the price of solar panels (no installation and maintenance costs).

In reality, you have to calculate additional costs when dealing with unpredictable sources. Either you have to have 100% backup in traditional source or you have to conserve the energy (usually below 50% efficiency).

<comment><USER7> Indeed.

You have to buy land. You have to pay architects and engineers to design your plant. You have to build facilities. You have to hire people to run it. You have to maintain it. And eventually it'll be decommissioned, which works out to an effective operating cost.

</comment></comment><comment><USER8> "Researchers at Queen's University in Canada have compiled a comprehensive study of solar power plants and found that improvements in financing, and industrial streamlining could allow for the technology to become as cost- effective as traditional electrical sources. In other words, a much larger part of the globe could currently reach grid parity if cheap loans and better supply chains were available."

In other words, solar photovoltaics are not yet affordable without technological improvements in the supply chain and without subsidy in the form of below-market financing. I'm glad we've cleared that up.

</comment><comment><USER9> Solar power is a classic disruptive technology. It currently does not meet the mainstream market's needs in terms of:

      - <USER2>
      - cost per MWh
      - suitable locations (close to established high voltage power lines)

Each of these factors is being steadily improved over time. And once solar technology meets the mainstream market's expectations for energy production, incumbent producers will need to retreat their offerings into a vanishingly small market for those needs not met by solar.

<comment><USER10> I think we'll know its disruptive when it actually disrupts something. On its own, without subsidies and other crutches.

And that may have happened with special assistance, as many other disruptions have.

But its still not a sure thing. There may be other technologies that might have gotten there first. But since we've biased investment in solar so much, such alternatives may never develop.

We did something similar with the automobile in the US, giving it advantages and subsidies like free roads. Is it any wonder that more efficient ways of getting around withered?

<comment><USER11> What were the more efficient ways (of getting around)?

<comment><USER10> Mass transit is what I had in mind.

Personally, I prefer the car. But if I had to bear all of the costs of using a car directly, and urban sprawl were not so preferred by planners, mass transit would be my choice more often.

This is especially true at rush hour. Most highway construction happens just to serve rush hour traffic, a time when mass transit is at its most efficient.

If these subsidies did not exist, mass transit would be much more widely used. There'd be many more choices and there'd be no need to subsidize mass transit.

We actually have subsidies to counter the negative effects of other subsidies. Getting rid of all subsidies would be better and allow people to make the right choices for them with fewer negative side effects.

<comment><USER9> I remember reading an opinion here on Hacker News not long ago where it was suggested that in the future with self-driving cars we don't all need to own a car. Instead a car could come and pick us up and drop off at the destination. Do you think that this micro transportation (instead of mass transportation) option could be environmentally friendly?

<comment><USER10> Before you can compare things on an environmental basis, you have to be comparing things that are equivalent.

I could compare rubbing a lamp to taking the subway in environmental terms and the lamp comes out way ahead. It just takes more walking to get places with the lamp method.

If you do wish to compare two things, you probably should include the cost of your time and the environmental impact you would have during that amount of time.

You also want to consider the actual impacts of building the transportation systems, whether its rail or road.

It would be infinitely easier for you if each process involved were taxed according to its impact. Then the costs would be included in the price you pay and you could decide according to what works best for you.

</comment></comment></comment></comment></comment></comment><comment><USER12> Wrong, we don't have abundant solar power because of science, not financing. Go build something using solar power, the technology just isn't there, but most importantly neither are the physics. I spent a couple of years building an industrial product that ran off of solar power. We are in the sun belt, which is a region of the U.S. that has the most sun relative to the rest of the country. What I learned is that solar power is a joke. There just isn't enough solar energy arriving at the surface of the planet to make it worthwhile to use. It's a fantasy, get over it and invent something new, like a 600cc nuclear reactor.

<comment><USER13> Wow, what a completely misinformed comment. Start here:

[http://energyselfreliantstates.org/content/solar-grid- parity...](http://energyselfreliantstates.org/content/solar-grid-parity-101)

<comment><USER12> No, your article is misinformed. The article does not discuss the total cost of generating power from solar panels, namely, cost of batteries and their regular replacement, panel cleaning, and the cost of the amount of land required for enough panels to generate 50 Kwh (avg) per day. This also does not consider that you need 7 times as many panels to generate the same amount of electricity on a partly cloudy day as you do on a clear summer day. It is much worse in the winter months. I dare you to prove me wrong, not with an article of someone's estimation, but real field work.

<comment><USER14> Instead of dismissing people's optimism with an impossible-to-refute "argument from field experience", why not write up some of your hard-won lessons so interested people can educate themselves?

I'd be very interested in an account of real world PV solar costs and hurdles by someone who's been there, done that.

</comment></comment></comment></comment><comment><USER15> We don't have abundant solid gold toilet seats because of financing, not science, either. Now this isn't to say that there is no market for solid gold toilet seats. Surely, I'd buy one, if the cost was the same as a regular toilet seat. But it isn't, now is it? Yes yes, I know this will kill my Hacker News karma. Deduct away.

</comment><comment><USER16> Solar is not a viable means for today's energy consumption, and it certainly won't be a viable means for tomorrow's energy consumption.

The energy race has been decided already, and the only answer to fossil fuels is Liquid Floride Thoriam Reactors (LFTR). It's an alternative form of nuclear energy that has been around since the Manhattan Project. Unlike the current nuclear power plants of today, it is impossible for a nuclear explosion to occur, there is no waste generated (well, there is about 1% waste, but the waste generated is actually a very rare metal NASA uses to power deep space satellites), and Thorium (the equivalent to Uranium) is 1000x more abundant than Uranium.

LFTR will be the worlds core energy source within 30 years. China is the only country actively developing a LFTR program- if it comes to fruition, they could be the power suppliers of tomorrow.

Learn about it in 5 minutes: <http://www.youtube.com/watch?v=P9M__yYbsZ4>

</comment><comment><USER17> It's not financing. It's the fact that we don't have a carbon tax. Price carbon near the cost of sequestration and you will see plenty of money invested in alternative energy. Anything else keeps the decision making in the hands of the central planners. Ask Gorbachev how well that worked.

<comment><USER18> So, you're admitting that the problem is financing. You're just proposing one way of incentivizing financing.

<comment><USER13> I am not sure why y'all are arguing. Either a carbon tax or better financing would help.

<comment><USER17> They both help reduce climate change? Not sure. Without a carbon tax you could burn 100 tons of coal to make a "green device" and nobody would know the exact figure. With it, you don't even need to do the calculation. It's in the price.

</comment></comment></comment></comment><comment><USER19> Finance is the most important issue for solar adoption, especially for distributed generation. For residential customers there is very little reason not to invest in generating your own power from rooftop solar, unless you don't plan to be in your house for 5-7 years. Even then there are studies that show you can get your money back from increased resale value.

Think of solar like this - why would you not want to independently produce your own power and escape the clutches of your local utility company? In most states in the US, utilities are monopolies and although they are regulated, they employ thousands of lobbyists to influence those who regulate them. The result, predictably is annually escalating electricity rates. The utilities raise rates to build new plants, transmission lines, increase management and employee salaries, and lately in California, cover underfunded employee pension costs!

Unfortunately, without a finance option available, you have to come up with a big chunk of money to install a system (essentially pre-paying for 7 years worth of electricity up front).

So, if you can finance the system over a reasonable period of time so that you don't have to pay for the entire system upfront, it makes makes it much easier to pull the trigger on purchasing a system.

Of course, if you can afford to pay for it upfront, it makes even more sense.

</comment><comment><USER20> I wonder how the failure of Solyndra fits into this thesis.

<comment><USER21> Solyndra failed because its secret-sauce technology couldn't get cheap enough fast enough compared to the plummeting cost of photovoltaics. So it fits pretty well.

<comment><USER13> We've only heard of Solyndra b/c the big-oil/big-coal GOP needed a talking point. Solyndra is what they came up with.

<comment><USER21> That's only true for people who don't follow the solar industry. They got their loan in March 2009 ([http://cleantechnica.com/2009/03/21/fremonts- solyndra-wins-f...](http://cleantechnica.com/2009/03/21/fremonts-solyndra- wins-first-doe-funding/)), filed for IPO in December ([http://gigaom.com/cleantech/solar-tube-maker-solyndra- files-...](http://gigaom.com/cleantech/solar-tube-maker-solyndra-files-for- potential-300m-ipo/)) and cancelled it in June 2010 ([http://www.greentechmedia.com/articles/read/solyndra-ipo- can...](http://www.greentechmedia.com/articles/read/solyndra-ipo-cancelled)), and all three events were relatively well-covered.

</comment></comment></comment></comment><comment><USER22> A friend of mine founded a start up to finance solar power.

<http://www.clearspotenergy.com/>

</comment><comment><USER23> 1\. Bullshit. 2\. you all are better at math than I am, so I won't bother to point out the obvious.

</comment><comment><USER7> Solar power on its own cannot supply base load electrical power. Period. Full stop.

Only in combination with an extensive power storage infrastructure could such a thing be possible. Constructing such things would easily cost as much, or more, as constructing all of the necessary PV plants.

Moreover, very substantial changes to the national power grid would also need to be undertaken.

At the best possible costs this work would easily exceed what it would take to build enough fission power plants to provide all of the base load, and that isn't happening with any degree of rapidity either.</comment>


The Sad State of Happiness in the United States and the Role of Digital Media [pdf] - <AUTHOR> https://s3.amazonaws.com/happiness-report/2019/WHR19_Ch5.pdf <comment><USER2> I'm sure pg would say we just don't yet have our social antibodies for the effects of the iPhone.

Remember "TV rots your brain"? wasn't that supposed to stay a myth?

My theory is the below are critical needs:

-dependable community who loves you unconditionally -self acceptance and compassion -acceptance of others and compassion

Meanwhile we live in an era where increasingly addictive mobile consumption takes us further away from meeting these needs by making us feel inadequate, disconnected and angry.</comment>


Trump Says U.S. Should Get Slice of TikTok Sale Price - <AUTHOR> https://www.wsj.com/articles/trump-says-u-s-should-get-slice-of-tiktok-sale-price-11596479818 <comment><USER2> This is just more of the same behavior we've seen for years now, but you still throw your hands up and ask, what have we come to as a country? You get tired of doing this weekly.

That the President could even think of uttering the phrase that "we should get a cut for allowing this deal to go ahead". As if we're gangsters borderline extorting businesses because "we wouldn't want any harm to come to your very nice deal here, would we?"

Pro-business Republicans, this is what the party stands for? The party line was, benefits of economic growth and business going directly to the people, not government -- and you'll get behind a statement like this, carving out a special rule to take a percentage off the top?

<comment><USER3> It's like that TOS episode where 1950's gangsters with tommy guns run a planet.

<comment><USER4> "A Piece of the Action" [0].

[0] [https://en.wikipedia.org/wiki/A_Piece_of_the_Action_(Star_Tr...](https://en.wikipedia.org/wiki/A_Piece_of_the_Action_\(Star_Trek:_The_Original_Series\))

</comment></comment></comment><comment><USER5> "I did say that 'If you buy it [TikTok]… a very substantial portion of that price is going to have to come into the Treasury of the United States, because we're making it possible for this deal to happen.' Right now they don't have any rights unless we give it to them."

Can anyone help me understand how this would work?

<comment><USER6> ex·tor·tion

noun

the practice of obtaining something, especially money, through force or threats.

<comment><USER7> is taxation extortion?

</comment></comment></comment><comment><USER8> Full article:

[https://archive.fo/3zM7h](https://archive.fo/3zM7h)

Does anybody know of any precedent for this or similar cases? It sounds extremely illegal to target random business deals like this, but I have no clue really...

<comment><USER9> >That happened in 2012, the only legal challenge to CFIUS since it was established in 1975, when Chinese-based Sany Group's affiliate Ralls Corp. bought wind farms in Oregon. Then- President Barack Obama ordered Ralls to not only divest the wind farms, but also forced it to remove items added to the facilities, including concrete foundation, and barred employee access to the premises. Sany complied.

[https://www.reuters.com/article/us-usa-tiktok-trump- breaking...](https://www.reuters.com/article/us-usa-tiktok-trump- breakingviews-idUSKBN24Z05O)

<comment><USER8> It sounds like a different situation to me - In the Sany case the projects were simply blocked, there was no question of paying off the treasury department so the deal could happen.

</comment></comment></comment><comment><USER10> Nice place you have here , it would be bad if something happened to it.

So the US now does Mafia type of shakedowns ... what a gangsta country.

</comment><comment><USER11> This is plain and unadorned extortion of money from a foreign company by the US government, and Trump makes no effort at all of hiding it.

<comment><USER12> He does talk too much, but in this instance it was already so plain that it does not change anything.

</comment></comment><comment><USER13> Trump's association with the mafia is coming through.

</comment><comment><USER14> Tariffs

</comment><comment><USER15> Traditionally governments take a slice of any purchase and it's not viewed as extortion it's called taxes. Trump can talk all he wants but he doesn't have the unilateral power to block a sale or issue a tax on that sale.

If the comment is interpreted as a suggestion that taxes should be made then that is something to be considered as there are always positive and negative implications to any tax.

<comment><USER16> > Traditionally governments take a slice of any purchase and it's not viewed > as extortion it's called taxes.

Do you believe that's what Trump was referring to?

<comment><USER15> I believe he's referring to exactly what he refers to most of the time. Just talk. He has the power to do nothing directly in the case of the sale. So people crying "extortion" are falling in to the hyperbole trap that was set. What it might do is prompt a conversation on taxes, but likely nothing at all will change.

<comment><USER16> > So people crying "extortion" are falling in to the hyperbole trap that was > set.

By trap you mean, "pointing out that what he is suggesting is illegal?"

<comment><USER17> Sure, go ahead and point that out, loudly and often. It needs to be pointed out. (And, if and when other presidents do the same, point it out loudly then, too.)

But "suggesting" is different from "doing" or "ordering". Trump is wishful thinking out loud. True, he's wishing for things beyond his power and authority. But until he actually tries to make it happen instead of just blowing hot air, I'm content to just shake my head. I see no need to be alarmed... yet.

<comment><USER18> A "suggestion" from a person in power is considered an order by many.

[https://en.wikipedia.org/wiki/Will_no_one_rid_me_of_this_tur...](https://en.wikipedia.org/wiki/Will_no_one_rid_me_of_this_turbulent_priest%3F)</comment></comment></comment></comment></comment></comment>


America, the Beautiful (And Nutty): A Skeptic's Lament - <AUTHOR> http://www.wired.com/wiredscience/2012/03/opinion-randi-maya-skeptic/?intcid=story_ribbon

<comment><USER2> The problem is that people are very good at avoiding sources of contrasting opinion. What we need to do is force people outside of their comfort zone. Imagine if somebody rich paid for 24/7 ads on popular networks that do nothing but teach science and demystify common beliefs.

<comment><USER3> > Imagine if somebody rich paid for 24/7 ads on popular networks that do > nothing but teach science and demystify common beliefs.

That's one more reason to get rich - to save mankind from itself.

Yet, I think that, even in our skepticism, we must keep our minds open and don't forget that we must impose high standards on ourselves too. It's not enough to say homeopathy is a farce and faith cures are a joke when the more accurate statement would be that both illustrate how placebos work. Our brains are not capable of producing perfect reasoning all the time: reasoning evolved to help us elude predators. We could have ended up very inconspicuous, with better muscles, claws and teeth or being extremely allergenic - all popular ways to deal with other animals.

And, for the record, I'm all in for homeopathy and faith cures - they may help remove some undesirable genetic traits from the gene pool. OTOH, the populations presenting such traits can evolve to have better immune systems. Life has a way to perpetuate itself.

<comment><USER4>
        > And, for the record, I'm all in for homeopathy and faith
        > cures - they may help remove some undesirable genetic
        > traits from the gene pool. OTOH, the populations presenting
        > such traits can evolve to have better immune systems. Life
        > has a way to perpetuate itself.

Susceptibility to harmful ideologies really doesn't work like that. Being raised within a religion or cultural practice is an amazingly better predictor for continuing that belief in the next generation than what genes were passed along. Faith cures and placebos operate at the level of belief and culture, not the gene level.

Further, look no further than the anti-vaccination movement to see how harmful medical ideas can put the general population at a greater risk for entirely preventable diseases.

<comment><USER3> Sorry. I was half joking. I'd much rather educate people than negligently allow them to self-select themselves out of the gene pool.

<comment><USER4> Part of my point was that "self-selecting out the gene pool" does nothing to dispel harmful beliefs. That is a culture and education problem.

</comment></comment></comment></comment></comment><comment><USER5> There will always be metaphysical questions. As much as it's worth fighting against people who have their head in the sand about basic scientific evidence, I don't think it's a requirement that we give up all spirituality and resign ourselves to only caring what science can prove. Human experience is after all entirely subjective, and there's no _logical_ reason why the pursuit of objective truth should be the meaning of life for everyone.

<comment><USER6> What do you mean by "spirituality" which you think we should not give up?

<comment><USER5> The idea that there may be greater purpose in the universe.

<comment><USER6> Greater than what?

And, if you don't want to investigate that "greater purpose" with evidence, logic and rationality, how do you propose for "spirituality" to tackle the problem?

</comment></comment></comment></comment><comment><USER7> The point of homeopathy practiced today, by licensed doctors, is to administer placebo in cases where it is likely to help. Placebo is amazingly powerful--in particular when prescribed by a doctor. Funny enough, one of the most helpful medicines is seeing a doctor. Seeing a doctor has been proven to correlate very well with curing many diseases--independant of whether medication was prescribed.

Keep that in mind when spreading FUD about homeopathy. Yeah, it has no medicinal effect. But that does not make it worthless, if handled properly by a trained doctor. There aren't too many ways for a doctor to prescribe placebo...

<comment><USER8> This is just wrong on so many levels...

That is absolutely __not __the "point" of modern homeopathy... The point of modern homeopathy is to spread a lot of nonsense about water with memory and other such bunk.

Secondly, you seem to have some funny ideas about the placebo effect. Placebos are used to try and measure peripheral factors. It could be that just going outside is what is curing the patient, and not the new drug you are giving them.... Or maybe spraying __anything __up the nose will help some symptoms, not the new nose spray you are testing. That's the whole point of a placebo...if your medicine is only working as well as the placebo, it's not working at all.

It so happens that additionally, __sometimes __you can get what is called "the placebo effect" where just the idea of being treated can help somewhat...but generally only in certain cases and for __subjective __things, like pain. It makes sense that people feel a little better subjectively when they are treated.

However, not all placebos cause the placebo effect and if a placebo helps it is not necessarily because of the placebo effect. Using placebos in the way you suggest is not good medicine, they are not reliable enough and require some dishonesty with the patient, a serious ethical concern. Furthermore, you should be able to get similar or better results from a variety of real treatments!

Outside of research, there may be occasionally a reason for a doctor to dispense a placebo...but overall they are not good medicine and neither is homeopathy.

> Yeah, it has no medicinal effect. But that does not make it worthless,

Actually, yes...that's exactly what it does. That's the whole point. If something only works as well as a placebo, it's literally worthless.

<comment><USER7> Sorry, you are wrong. Placebo is astonishingly powerful. Read up about it. Clinical trials usually test three cases: No medication, placebo and actual medication. Placebo usually works really well compared to no treatment. Not for a broken bone, of course, but for a huge range of illnesses, including cancer. Of course it is especially potent for illnesses with a psychosomatic angle, which is just about anything except flesh wounds.

A healthy, optimistic mindset is tremendously efficient medicine. Feeling like you are being helped is, therefore, very important.

Don't get me wrong: I am not proposing to actively try to cure stuff using placebo. But judicious use of placebo, particularly in cases where tradinional medication has been proven to be ineffective or has too many unwanted side effects, is a valid course of action, if done professionally.

<comment><USER8> I think perhaps you are the one who needs to read up about it more.

> Placebo is astonishingly powerful

I would agree that placebo is "powerful", in that it can provide surprisingly powerful __subjective __effects...however it's mechanism is fairly well understood and it's nothing special.

Placebo is not an effective treatment __overall __, and the places where it is effective are things like say pain... in those cases it works by releasing endogenous pain relievers. Ditto for things like relaxation etc...

> Placebo usually works really well compared to no treatment

Well of course it works "really well" compared to no treatment...

Positive thinking, receiving attention from people around you, etc are all things that can have a positive impact on your health but these are not part and parcel with "the placebo effect".

Even so, I find the claim that "placebo works really well" dubious, and I'd ask you to provide a basis for support if you wish to make it again.

The fact is in the end, the placebo effect is small, unreliable, requires you to lie to your patient....and you could achieve as good or better results with real medicine.

It's just not a good practice...placebos belong in research as a control, and very rarely in certain situations yes it can be useful to dispense them...but not in an effort to "treat" people with the placebo effect.

</comment></comment></comment></comment><comment><USER9> There are two kinds of hucksters. One suckers the rubes. The other suckers those that believe themselves to be smarter than the rubes. Randi is the second kind.

<comment><USER10> Would you say Randall Monroe is the second kind?

<http://xkcd.com/765/>

<comment><USER9> I'd never call Randall a huckster. Trickster, yes.

</comment></comment></comment><comment><USER11> [http://dailygrail.com/features/the-myth-of-james-randis- mill...](http://dailygrail.com/features/the-myth-of-james-randis-million- dollar-challenge)</comment>


DOD officials say autonomous killing machines deserve a look - <AUTHOR> http://arstechnica.com/information-technology/2016/03/dod-officials-say-autonomous-killing-machines-deserve-a-look/ <comment><USER2> I find it interesting the way this was described at the end of the article. The idea that this is a necessary development in the case that some enemy uses ECM to disrupt the link between the robot and its human controller.

Because that will probably sound reasonable to most people.

"Hey, hey, hey now. We're not sending unmanned terminators out to battle to search and destroy any living thing.

This our cute little droney-drone drone. We call him Charlie the unicorn. Now if the bad baddy bad terrorists do something bad to Charlie and make it so he can't receive orders, don't you want Charlie to be able to protect himself?"

And the robot apocalypse begins. Not with an army of soul-crushing t-1000s, but with an M-79 grenade launcher dressed up as a puppy.

My guess is that by 2035, we will be mostly okay with it though. Putting AI in charge of driving cars is, by definition, letting AI make life/death choices. If we're okay with that, we are inherently accepting that these ethical situations can and will be accurately modeled.

If you can tell a car how to make a decision between hitting an old lady in the street vs. crashing into a tree and killing the passenger and get that right enough to please the public, I'm sure we can figure out how to tell a robot in a battle situation which person to shoot . . . well enough to please the public.

<comment><USER3> I would argue US should start training their AI already, in combat situation human senses becomes more suspectible for finding threats where there isn't any.

They could use the AI for real-time analysis of video feed in helicopters etc. Highly publized incident comes to mind where the poor camera man was gunned down mistakenly when human operators thought he was wielding RPG, whilte it was likely a camera he was holding. Could the AI have detected it?

<comment><USER4> An AI doesn't need to. An AI can wait, take the hit, then send in a fleet of tazer armed drones to subdue the guy, and another helicopter to extract him.

</comment></comment></comment><comment><USER5> Just playing the devil's advocate here:

* No soldiers of the side deploying armed drones need to be in danger.

* Robots do not act cruelly unless specifically instructed. Humans do have a pretty bad record of unnecessary cruelty due to racism, boredom, intoxication etc.

* If you log all descision making processes, you can justify each action taken. It's like bodycams for police officers. If you'd make all logs public after the war it would be possible to identify war crimes and who gave the order (unlike now).

* Nothing requires a machine to use lethal force all the time. Systems which have the primary purpose of capturing combattants can be considered when there's no risk of losing one of your own soldiers.

* Your robots priority doesn't have to be self-preservation (unlike a human soldier). When in doubt, don't shoot and analyze the situation.

All in all, if the military _would_ use these autonomous killing machines with the intent of minimizing covilian casualties, would this not be an improvement over the current state of warfare? Of course it won't make war per se less likely, but not using these machines doesn't either. So why not use them?

<comment><USER6> Because any technological advance is going to be countered. Then at some point, we have drones killing drones.

Currently military numbers are limited by manpower. And military units (like let's tanks) are to some degree limited by money. You don't want to pour too much money on single tank, because you then put all your eggs on few baskets. And you also don't want to put significant part of your troops in badly armored tanks with food firepower, because then you will run out of tankers in no time. Currently the "good balance" is 10 000 M1A2 Abrams that cost 6,2 million dollars a piece. Those would need 40 000 tankers, which is tolerable amount of crew. Training them is costing and going to cost lots of money. Combined price of the thing is 62 billion dollars or tax payer money, distributed to several decades. Increasing the price of tank to 10 million would be stupid, as it's still vulnerable to certain dangers, but you now lose 4 million more in single blast.

Now let's imagine full autonomous tank fleet of M1A9 Abrams somewhere around year 2050. You are no longer limited by tankers. You are only limited by price. But as you lack crew, you need less armor. Lets say we have unit price of 4 million dollars. Now 10 000 units is only 40 billion and zero tankers.

Then Russia makes autonomous tank "T17 Kursk" and produces 15 000 of them to sell to China. (Or something else, I'm not fiction writer.) They are bit crap, but as trained tankmen are not required, they can easily produce higher numbers to compete with U.S.

But U.S. is not happy with second place. So U.S. gets another 10 000 Abrams.

But China is not giving up, they order another 15 000 Kursk.

And on and on. Until tax percentages of both China and U.S. reach 70% and all of it is poured to "defense". China, India, Brazil and Russia are all likely to beat U.S. in economic growth rate in the future, because it's easier if you start from the bottom. And they are all geopolitically ambitious. We are headed towards multipolar world and that means arms races again.

TL;DR: Autonomous killing robots remove limitations of arms race. This is "destabilizing" and draining.

<comment><USER7> You do know that MBT's require a lot of day to day maitainace by the crew to keep them going - that's one reason why they still have 4 man crews.

<comment><USER8> This is a short-term issue, which is widely known; autonomous self-healing support and supportable units are a coming.

<comment><USER9> Hah I suppose you think we have self healing cars.

<comment><USER8> Appears that you don't understand how auto companies make money; hint, it's not by selling cars.

<comment><USER9> Please enlighten me with more information regarding this scam that even Tesla hasnt expunged

<comment><USER8> Auto industry makes most of it's money from enabling auto ownership, not selling the autos themselves. For example: [http://www.forbes.com/sites/jimhenry/2012/02/29/the- surprisi...](http://www.forbes.com/sites/jimhenry/2012/02/29/the-surprising- ways-car-dealers-make-the-most-money-off-of-you/)

Believe what you want, but comparing auto industry to the military systems is meaningless in my opinion.

<comment><USER9> Thank you I was not aware of this.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> "These are hard questions, and a lot of people outside of us tech guys are thinking about it." It seems to me there is an easy answer. Building Robots that can kill people without supervision is currently a terrible idea. AI, or whatever you would like to call it, should not be allowed to take a humans being's life. We make our law enforcement officers pass psych exams before they are put in situations where they need to kill someone. Until a robot can pass the same exam, I'm not comfortable with autonomous killing machines.

<comment><USER11> We've had autonomous killing machines since WW2, and nobody seemed to care until recently when everything got reframed in a scary Skynet/Terminator way.

Most people seem to get their knowledge on the subject more from movies than reality.

<comment><USER12> ...and we've already had an instance of autonomous killing machine gone wild. - [http://www.wired.com/2007/10/robot-cannon- ki/](http://www.wired.com/2007/10/robot-cannon-ki/)

<comment><USER9> Has anything like this happened to an actual superpower?

</comment></comment></comment></comment><comment><USER13> Is there any argument against autonomous guns, other than that they might go wild and cause a lot of unexpected deaths?

We shouldn't mind them sometimes making mistakes and killing innocent people because human soldiers already do that often enough. Perhaps the robots will be slightly more accurate than humans, and that's surely good for everybody except their enemies.

Maybe the real question we should be asking is why humans are allowed to kill people? When two countries fight each other, soldiers on both sides somehow decide it's OK to kill the other. They can't both be right, so in any war, thousands of flesh and bones killing machines (all soldiers on the "wrong" side) effectively go wild and try to kill lots of inappropriate people. That shows that human decision making is extremely poor, and can even unanimously agree on the same lethal wrong decision.

<comment><USER14> "Is there any argument against autonomous guns, other than that they might go wild and cause a lot of unexpected deaths?"

Yes, that a robot always obey orders. In my opinion that is the most dangerous thing about this issue.

Anyway, it's only a philosophic question because this is going to happen. "We" can talk about it, but "we" are not deciding anything.

"They can't both be right"

Not, but they can both be wrong, that is what normally happens.

<comment><USER15> Humans are not much better than robots at disobeying orders, as demonstrated in the Milgram experiments.

<comment><USER16> Milgram conducted 23 different kinds of experiments, each with a different scenario, script and actors. This patchwork of experimental conditions, each conducted with a sample of only 20 or 40 participants, yielded rates of obedience that varied from 0% to 92.5%, with an average of 43%. Contrary to received opinion, a majority of Milgram's participants disobeyed. [0]

What's the obedience rate of a robot?

[0] [http://theconversation.com/revisiting-milgrams-shocking- obed...](http://theconversation.com/revisiting-milgrams-shocking-obedience- experiments-24787)

</comment></comment></comment></comment><comment><USER17> Autonomous killing machines are a natural progression of military technology. They will certainly be created by someone at some point in the future. Thus, our military should definitely be researching this topic, and that's all that they are doing now.

</comment><comment><USER18> Is it just me, or does this seem like an Onion headline? It's the juxtaposition of the very serious "autonomous killing machines" with the casual "deserve a look", I think. Like they might have autonomous killing machines for lunch if that was offered as the special

<comment><USER19> Can't wait until a dictator uses autonomous killing machines to, you know, just take over the world.

</comment></comment><comment><USER6> Everything DoD says or does is partially American propaganda. (I say "propaganda", because "information war" is American propaganda.) And we are dealing with a U.S. hegemon. It all started with American revolutionary war, and continued as "democratization". U.S. was based on an idea of liberating people from monarchs. And as U.S. set out to do that, DoD /CIA got really good at meddling other countries business. Now the original idea has been abandoned, democratization might not do any good anymore, even cold war is over, but Yankees still keep "power projecting". Institutions tend to keep on doing what they are good at. If powerful institution loses purpose, it invents a new one. Because there is certain "survival of the fittest" even when dealing with taxpayer money. And ultimately I'm grateful for this as a whole, because U.S. set a model of democratic free market society that has been copied and improved around the world.

Back to propaganda. DoD is scared that other countries would increasingly use autonomous weapons in area denial missions. This would be really detrimental to "power projection". For example you don't wan't Chinese to use swaths of cheap autonomous boats to occupy south China sea. U.S. carrier fleet is way too expensive to deal with such saturation. Missile may cost more than entire boat. Other nasty possibility is cheap unmanned Cessnas flying around with short range Infra Red seeking missiles. That would make SEAD mission lot more demanding, as you need to kill the Cessna first and so notify everybody that "we are coming".

U.S. is technology leader. Whatever Lockheed Martin does, is copied around the world. Whatever they don't do, gets significantly less eyeballs. DoD uses this as an advantage. Most recent example is infrared search and track(IRST). USAF was lacking in this respect just recently, because USAF has radar stealth. Putting money into IRST in late 80's would have been smart move to anybody else. But as DoD didn't do it, herd mentality went with RADAR. And USAF has stealth, nobody else does.

Now U.S. employs autonomous weapons in assault missions in ground war. If other countries copy that tech, it does hardly anything to U.S. assets in air or sea. But for "short while" U.S. gets diminished casualties and even more frightening weapons. If people find autonomous weapons too inhumane in attack role of ground war, that might result in international ban of all autonomous weapons. Win-Win.

We have precedent. DoD teaching Cambodian guerrillas to set up mines. -> Ottawa treaty. I'm not saying U.S. did that on purpose. But I'm pretty sure DoD military analysts's learned from that experience.

<comment><USER9> I think you brought up a better point. Invading countries are going to have a hell of a time if sentries are set up. Booby traps and mines are one thing. But autonomous sentries are well, very hard to remove without risking harm

</comment></comment><comment><USER20> In "The Golden Oecumene" trilogy (one of the densest and greatest looks at a possible real future I've ever read), the world is run by a collection of benevolent super-intelligence AIs. One of the themes in the book is the notion of hyper-extending current technology trends and exploring what society will be like under such circumstances.

In the series, the take on the military is fascinating. Extending out the notions of precision and limiting collateral damage, orbital weapons are able to take out specific neural connections in targets and cause them to change their thinking process entirely. While the _weapons_ in this future picture are large automated robots and AIs of a type, the actual operator is human. In fact a single human is all that remains (and is needed) to provide all the judgment and justification needed to take action. But the books still posit that a human-in-the-loop is still necessary.

Great and very challenging books [https://en.wikipedia.org/wiki/The_Golden_Oecumene](https://en.wikipedia.org/wiki/The_Golden_Oecumene)

</comment><comment><USER21> If anyone believes using autonomous killing machines is inherently evil and no doubt beset with Unintended Consequences, I invite you to donate to the "Campaign to Stop Killer Robots", and hopefully make autonomous killing machines illegal by international law. [http://www.stopkillerrobots.org/](http://www.stopkillerrobots.org/)

</comment><comment><USER22> This is inevitable.

Remote controlled drones are prone to jamming, hacking and human factor.

Whoever deploys autonomous warfare systems first will have an advantage in battlespace.

</comment><comment><USER23> The first use will be for border security as in Babylon A.D.:

[https://youtu.be/MQNUvaPi4Qk?t=42m15s](https://youtu.be/MQNUvaPi4Qk?t=42m15s)

Lot of border. Fast response needed. Damage whole families trying to make it. Operate with little human input for a lot of them. Perfect thing for militarist governments to delegate to killing machines instead of people. Side benefit of dodging some responsibility for bad choices where they blame it on machine logic.

</comment><comment><USER8> Wow, surprise; no sarcasm, to me, this means they already have one and believe the public will support its release.

</comment><comment><USER24> I'm surprised there isn't currently a 'personal air support drone', that can fit into a troop's backpack. Which is little more than a flying grenade (with a video stream that can go round corners).

Such a device could be made from off the shelve components and help protect against snipers.

<comment><USER25> There's already a few.

[http://www.businessinsider.com/heres-the-tiny-drone-the- us-m...](http://www.businessinsider.com/heres-the-tiny-drone-the-us-military- is-testing-2015-6)

[https://www.youtube.com/watch?v=1tetyswGyGA](https://www.youtube.com/watch?v=1tetyswGyGA)

</comment></comment><comment><USER26> No thank you. I like my earth earth-y and not scorched Armageddon style.

Hubris!

</comment><comment><USER27> This is how it begun, robot historians will write.

<comment><USER28> If there are any left

<comment><USER29> And if they lost the knowledge of English grammar.

</comment></comment></comment><comment><USER30> They're kind of like smart land mines, we'll kill people when you're not around except this time we promise we'll try to only kill bad guys, pinky promise.

</comment><comment><USER28> Daleks!

<comment><USER31> The Daleks are not machines; there is a living thing inside of the shell.</comment></comment>


Rules That Kids Won't Learn In School - <AUTHOR> http://www.joke-archives.com/rules/rules.html

<comment><AUTHOR> _Be nice to nerds. You may und up working for them. We all could._</comment>


Massive outages across the internet right now - <AUTHOR> http://internethealthreport.com/ <comment><USER2> Looks like issues at Verizon... maybe the transition to Frontier (which is supposed to close April 1st) isn't going well...

Edit: Looks like Miami is a focal point, too, and Florida is, of course, one of the regions being acquired by Frontier in just a few days...

Edit 2: Random aside, headline is rather editorialized. These outages aren't "across the internet". They appear to affect a single operator in a couple of major regions.

<comment><USER3> 25% packet loss between Level 3 and Sprint

[http://internethealthreport.com/Main.aspx?Metric=PL](http://internethealthreport.com/Main.aspx?Metric=PL)

... fallen to 12.5% now

<comment><USER3> 10 hours later

Cogent <> Level 3 is the only problem link left with 13.33% packet loss

<comment><USER3> Savvis <> SBC is now 25% and multiple Verizon is 10%

</comment></comment></comment></comment><comment><USER4> FWIW, this site is very often inaccurate and out-of-date.

For more reliable and accurate information, the outages list is probably what you want to refer to.

</comment><comment><USER5> Oh, thought it said "outrages", that's just another day on the Internet.

</comment><comment><USER6> That "massive" outage happens to affect only one ISP and <0,003%(1, 2) of Internet users, no need to panic.

1\. [https://en.wikipedia.org/wiki/Internet_in_the_United_States#...](https://en.wikipedia.org/wiki/Internet_in_the_United_States#providers)

2\. [http://www.internetlivestats.com/internet- users/](http://www.internetlivestats.com/internet-users/)

</comment><comment><USER7> Just called a friend in Baghdad over Skype about an hour ago and I can confirm that there are massive outages of the Internet there too. We had to call each other like 10 times for a 15 minutes call. It was very tedious!

<comment><USER8> Sounds like Skype is working as normal at least.

</comment></comment><comment><USER9> Huh, I have Frontier fios, near Redmond, and it's been up and down for the last day or so.

</comment><comment><USER10> Does packet loss actually translate to unreachable hosts, or does me mean there is just going to be a slowdown due to having to send lost packets again?

<comment><USER11> Both. It slows down traffic because packets have to be resent, and because of TCP (which assumes that if packets are lost, the connection must be congested, and therefore data should be sent slower).

If enough packets are resent the connection may not complete or it may timeout (if a packet needs to be resent multiple times, for ex).

I'm the founder of NuevoCloud, and this is one of the problems we are working on. Basically, we can route connections around congestion. So for example, if your website is in dallas and the visitor is in germany, but the normal route has an issue.. then we might reroute it germany > virginia > dallas until the issue is resolved. So your website still stays up.

</comment></comment><comment><USER12> WhatsApp just stopped working for me. I don't know if it is a local server thing or some central issue.

<comment><USER13> Is it possible that you are using whatsapp web? The app updated right now. I had the same issue.

</comment></comment><comment><USER14> From Italy all is fine ;)

</comment><comment><USER15> There are countries besides US on the planet.

<comment><USER16> It's amazing if HN can recognize places outside of California, don't expect too much.</comment></comment>


Ask HN: Need an Idea for a simple Java project - <AUTHOR> Hey,
I am looking for a good idea for a simple Java project. We have been learning Java in the bootcamp for only 2-3 weeks and are supposed to write a small program. We have about 3 days for this task.
Does somebody has any idea? I can hardly guess what would be feasible.
Thank you for your ideas! <comment><USER2> This might be a little advanced, but I'm writing a Maven plugin that verifies pgp signatures on your artifacts going into your build. The motivation for me was that almost no one checks signatures! We all should be doing that to prevent hostile bytecode from getting into our systems. So this plugin automatically does it :)

I could use some assistance writing unit tests and hacking on missing features.

[https://github.com/exabrial/pgp-signature-check- plugin](https://github.com/exabrial/pgp-signature-check-plugin)

<comment><AUTHOR> I'd be glad to assist, but this sounds way too advanced for us haha.

But thanks anyway for your response!

</comment></comment><comment> mike-selmo So for your first project I would do something simple in concept so you don't get wrapped up in feature creep.

Think about what you have learned so far and how you could demonstrate those topics. I don't think it needs to be a fresh new idea.

3 days is pretty short, without knowing what topics you have covered I would pick 3 and think of a way to combine them.

Say you learned a bit of UI, a bit of sorting, and a bit of OOP. Maybe create a todo list app that sorts tasks by priority.

<comment><AUTHOR> Thanks, Your idea sounds very good. I think that we can use everything learned so far (OOP, arrays, lists, exception handling, etc.)!

</comment></comment><comment><USER3> I always like to use games as small projects. They usually require the use of a wide variety of programming concepts, and can be scaled up or down as needed.

If you know GUI like Swing or AWT, you can use that to do simple games like space invaders or pong.

If not, text based games work too. Good examples are battleship, tic tac toe, number guessing games, small adventure games, or dice and card games.

</comment><comment><USER4> A calendar library?</comment>


Feedback for MVP of my first version of website - <AUTHOR>

Hey all! I have launched my first version of product. It was tough to decide the minimum viable product for the product.
So, I have launched it soon to get early feedback instead of late launch. Link to website is http://www.passonate.com/ .
It is a platform that focus to connect passionate or like-minded people around. "Its linkedin for Passionate people" Hope you like the MVP and provide feedback that help me to iterate the product. <comment><USER2> Try this for what you're after: [http://www.criticue.com/](http://www.criticue.com/)

<comment><AUTHOR> Thanks! I will go through it. And it would be helpful, if you can give feedback on idea. Thanks for the suggestions.</comment></comment>


Ask HN: Would it be possible to code an undetectable ad blocker? - <AUTHOR> I'm lacking the technical knowledge to answer this question, but I would have thought it would be something within the realm of possibility, but since no one has ever done it yet, I guess I'm wrong and I would really like to know why.<p>My two cents: Wouldn't it be possible to just display ads in a sandbox environment invisible to the user and then display to the user an ad-free experience? <comment><USER2> As someone that has developed ads before, not really.

I mean, anything is possible, but nowadays ads are hooked into all sorts of analytics software that determines how long an ad is on screen and things like that. You could try and implement something like what you're proposing, but it would show up as weird metrics on the advertiser's side.

Ads are already in a sandbox (iframe), so you could just make a little extension that sets iframes to display: none and give it a whirl if you wanted to test an MVP.

<comment><USER3> What about visually overlaying all the ad areas with something else ... lets say whitespace or cat-pictures instead? ;-)

<comment><USER4> That depends on what your purpose is for using an ad blocker in the first place.

If you just don't want to see ads, by all means overlay them and your ad blocker will probably go undetected.

But a lot of people run ad blockers to save bandwidth or avoid being tracked or to avoid the malware that's been known to be distributed through even the most reputable ad networks. Overlays don't solve those problems.

<comment><AUTHOR> I guess we can all agree that we can't make it undetectable if ads are not loaded at all. The idea would be to load them in a sandbox environment (so it would be harmless whatever malware is attached) and then just send the webpage back to the user ad free.

</comment></comment></comment></comment><comment><USER5> Whilst It won't be completely 100% undetectable, in practice I've found Pi- hole gets close to delivering the sort of browsing experience you are looking for.

[https://pi-hole.net](https://pi-hole.net)

Rather than sandbox the ads, pihole simply kills the DNS request for the ad resources - unlike most ad blockers the vast majority of ad/tracking resources simply never reach your computer, eliminating the need to dump them into a sandbox. In practice I've found it works on preventing ads on most sites that otherwise detect ad blockers and put up a "nag wall". For me anyway it's been much more effective than the browser based solutions, and with none of the DOM manipulation overhead etc.

Also has really nice advantage of blocking ads on devices that don't support adblocker extensions - games consoles, tv streaming boxes etc.

<comment><AUTHOR> Hello giobox,

Thank you very much for your answer. I totally missed Pi-hole on HN and let met tell you, I just installed it and it's a real marvel.

That's exactly what I needed, the web is suddenly incredibly fast and ad-free, this is a dream come true!</comment></comment>


Artificial Intelligence: Foundations of Computational Agents, 2nd Edition - <AUTHOR> http://www.cs.ubc.ca/~poole/aibook/2e/html/ArtInt2e.html <comment><AUTHOR> I wonder why AIMA far more popular. As a beginner to AI, I was recommended to read AIMA but I found AI: Foundations of Computational Agents, to be far more approachable.

Now, I use AIMA as a very useful reference but for a beginner, AIMA isn't the best choice, pedagogically speaking.</comment>


How to handle different screen sizes. HTML5 Mobile Game Tutorial - <AUTHOR> http://indiegamr.com/retro-style-platform-runner-game-for-mobile-with-easeljs-part-4-adjusting-to-mobile-displays/

<comment><USER2> This is what I use:

        var ratio = Math.min(window.innerWidth/BASE_WIDTH,window.innerHeight/BASE_HEIGHT)

        document.body.style.zoom = ratio

        or

        document.body.style.WebkitTransform='scale('+ratio+')'

Resize the whole board instead of scaling every object.

* Half-baked example of what I do (Webkit only as usual)

<http://georgenava.appspot.com/demo/poker/poker.html>

<comment><USER3> that's true! and there are cases, where your way is applicable, however there are a couple issues with it when working with canvas apps(I'm not completely up to date with all the details about style.zoom, so correct me, if i'm wrong): \- the css3 'zoom' is not very well implemented, for example in FF you would have to use: -moz-transform: scale(XX); (which is a hassle, but okay - it works) , but afaik in IE9 the whole method was marked deprecated - i don't know about IE10 - maybe we have some luck there, wouldn't rely on it though :-)

\- when zooming via style.zoom, everything will be zoomed according to a base- width&height, so if the target-device has a different aspect ratio than your base-sizes, you will have to reposition certain objects by hand anyways, also you will have to set the width&height of the canvas manually - as there might be overlapping parts

\- when it comes to targeting mobile devices with canvas, you quite often want to use tools like Ludei's cocoonJS or AppMobi's directCanvas, that render html-canvas as a native WebGL-stage on mobile, and css-values like zoom or any other markup will just be ignored on those platforms

\- however when you are working with DOM-elements style.zoom can come pretty handy!

I really like your Poker-Demo btw.! Love how the animations are super-smooth! Keep it up! cheers

</comment></comment><comment><USER4> Not applicable to most games, but I did a puzzle game that uses HTML/CSS for layout, then enforced a fixed 2:3 ratio for the "content" area of the game, with each UI element using a percentage-based width/height. The great thing about this method is that the "graphics" are always crisp, regardless of screen resolution or pixel density.</comment>


Oliver Byrne's edition of Euclid - <AUTHOR> http://www.math.ubc.ca/~cass/Euclid/byrne.html

<comment><AUTHOR> This special edition Euclid is once again available and well done-- nicely printed, the colours really stand out, and it comes in a 'clamshell' binding:

[http://www.amazon.com/Six-Books-Euclid-Werner- Oechslin/dp/38...](http://www.amazon.com/Six-Books-Euclid-Werner- Oechslin/dp/3836517752/)</comment>


How to Get People to Participate in Virtual Meetings - <AUTHOR> https://hbr.org/2020/03/how-to-get-people-to-actually-participate-in-virtual-meetings <comment><USER2> > Let's face it, most meetings have always sucked because there's often little > to zero accountability for engagement

I don't think that's why most meetings suck. Most meetings suck because they're unnecessary, pointless, take too much time, and often involve PowerPoint.</comment>


NSA infiltrated RSA security more deeply than thought: Study - <AUTHOR> http://www.reuters.com/article/2014/03/31/uk-usa-security-nsa-rsa-idUKBREA2U0U620140331 <comment><USER2> The extended_random_value extension is by itself innocuous; in fact, in its historical context (2008), it's just on the edge of plausibly beneficial.

All extended_random_value does is add, to the random_bytes value in the TLS handshake, another variable-length blob of random data. The ostensible idea behind the extension is that there are protocols that want randomness proportional to key sizes, and the 28 random bytes already in the handshake are insufficient.

That is _all_ the extension does. It doesn't influence your random number generator, it doesn't change the crypto algorithms in TLS.

Now, extended_random_value is _not_ innocuous in 2014. There's a very good chance that the PKRNGs (Dual_EC and the like) are intended as cryptographic backdoors, and modern sensibilities about crypto protocols dictate that both sides of a protocol should be careful about "showing all their cards" (as it were) when it comes to random number generators. It's now thought to be risky to disclose too much state.

But that was definitely not the attitude in place in the early 2000s --- more randomness was better.

Finally, it's worth knowing that nobody uses extended_random_value. Even fewer people were exposed to it than were exposed to Dual_EC (which very few apps were --- so few that, from what I can tell, nobody has ever named such an app on HN [companies using BSafe do not equate to apps using Dual_EC, much less exploitably]). Even the Internet Draft seems quizzical about why the extension would exist, and it more or less says "you'd use this if your TLS needed to be compatible with the DoD".

PS: It's been a few months since I looked, but interesting to note: the mailing list discussions about extended_random_value were also skeptical about the intention behind the extension. Rescorla more or less said (IIRC) "the USG asked me to specify this so they could use TLS". Nobody on the TLS WG ever told an implementor that they should adopt this.†

PPS: Whatever 'pbsd says that conflicts with this comment, believe the 'pbsd comment, not mine. :)

† _I 'm a little wrong here; the mailing list discussion I'm thinking of is about OpaquePRF. But OpaquePRF is basically the same concept, and by the same authors; extended_random_value is a refinement. Neither was standardized._

<comment><USER3> The draft (the last version I've found is March 2009):

[http://tools.ietf.org/html/draft-rescorla-tls-extended- rando...](http://tools.ietf.org/html/draft-rescorla-tls-extended-random-02)

(The first seems to be "Opaque PRF Inputs for TLS" from December 2006. [http://tools.ietf.org/html/draft-rescorla-tls-opaque-prf- inp...](http://tools.ietf.org/html/draft-rescorla-tls-opaque-prf-input-00) so the process lasted more than two years)

The relevant parts from the last:

       TLS [I-D.ietf-tls-rfc4346-bis] and DTLS [RFC4347] use a 32-byte
       "Random" value consisting of a 32-bit time value time and 28 randomly
       generated bytes:

             struct {
                uint32 gmt_unix_time;
                opaque random_bytes[28];
             } Random;

       The United States Department of Defense has requested a TLS mode
       which allows the use of longer public randomness values for use with
       high security level cipher suites like those specified in Suite B
       [I-D.rescorla-tls-suiteb].

       This document defines a new TLS extension called "extended_random".

       The "extended_random" extension carried in a new TLS extension called
       "ExtendedRandom".

            struct {
                opaque extended_random_value<0..2^16-1>;
            } ExtendedRandom;

Note how they used the notation that casually looks smaller as in "there's 2 and 16 and 1" when they actually mean up to 65535 bytes (I've first thought it's fixed but it looks the length is a subject of negotiation).

Roughly 2300 times more than the default 28 bytes.

TPtacek says: "It's now thought to be risky to disclose too much state. But that was definitely not the attitude in place in the early 2000s --- more randomness was better."

I can't imagine that there was ever an attitude that it's not risky "to disclose too much state."

<comment><USER2> I'm not sure what you're trying to say here that my comment doesn't already say.

It might be helpful to note that there are crypto people --- some of the authors on the recent Dual_EC exploit paper included --- that believe TLS already discloses too much random state, even without the TLS extension.

I think it's uncontroversial in 2014 to say that _any_ more state disclosure --- 2 bytes, 200 bytes, 16k bytes --- is probably not a good thing.

It might be a little controversial to say this next thing, but I'll stand by it for the sake of an interesting argument: in 2005, when this discussion started, it was _not_ known to be a bad thing to increase the amount of random state in the handshake.

<comment><USER3> As Thomas is not sure what I'm "trying to say here that" his "comment doesn't already say," he actually wrote: "All extended_random_value does is add, to the random_bytes value in the TLS handshake, another variable-length blob of random data."

It sounds _smallish "just another random-data blob."_ It's actually _huge_ "up to additional 65365 bytes from the generator added to the default 28" before the encryption even starts.

Thomas also wrote "The ostensible idea behind the extension is that there are protocols that want randomness proportional to key sizes."

The biggest ECC key is 571 bits which fit in just 72 bytes and this thing provides up to 65535 bytes. Again, fully different impression. I quoted the draft to show the actual number. The numbers matter here. Hadn't I looked at the draft directly, I'd get the fully different impression only reading Thomas' comment.

<comment><USER2> Incidentally, here are the original requirements that these drafts were intended to satisfy:

       In a number of United States Government applications,
       it is desirable to have some material with the following
       properties:

       1.  It is contributed both by client and server.
       2.  It is arbitrary-length.
       3.  It is mixed into the eventual keying material.
       4.  It is structured and decodable by the receiving party.

_(Amusingly, this comment got downvoted.)_

<comment><USER3> That is what they appeared to satisfy then (2006-2009). We know now that if implemented it would allow them almost real-time or even real-time decryption of communication of whoever uses it, as we discussed here:

[https://news.ycombinator.com/item?id=7503287](https://news.ycombinator.com/item?id=7503287)

We also know extended_random_value is _actually implemented in RSA 's BSAFE_ library, as the paper [http://dualec.org/DualECTLS.pdf](http://dualec.org/DualECTLS.pdf) shows.

And we know [http://security.stackexchange.com/questions/43164/which- prod...](http://security.stackexchange.com/questions/43164/which-products-are- affected-by-nsas-ability-to-crack-pseudo-random-number-gener)

"the RSA BSAFE library uses Dual_EC_DRBG (...) by default (...)

I can easily find (hint: use your favourite search engine to search for the terms "This product includes" "RSA BSAFE") implementations, oddly skewed towards imaging and gaming devices: surprisingly many printer/copier/fax devices use BSAFE, though for unknown purposes.

Including Ricoh, Minolta, Océ/Canon, Brother, Fuji/Xerox, Epson ...

Your Playstation (PDF), PSP, or your Nintendo DS wifi (PDF)

Software from Adobe, Hitachi, Oracle and HP Some Nokia phones(PDF)"

<comment><USER2> Which of those products do you know to actually be using Dual_EC at all?

<comment><USER3> At least, every product which uses defaults of the library? You know, "leave the hard choices to the experts who know more."

<comment><USER2> Can we name _one_ of them that uses Dual_EC, and has been shown to do so? I know a little about BSafe, and my impression is that most programs that use it don't use it to get TLS, which their OS already provides. Feel free to correct me if you've got more BSafe experience than I do.

This is obviously a rehash of an argument that recurs on HN a lot, but just to be fair to what I'm trying to say here: that argument has (as far as I can tell) never been resolved.

<comment><USER3> So who needs, apart from the spies from other countries and TPtacek more precise list of the possibly vulnerable products than the one already here? I don't think many people see the benefits in making the list more precise. The companies mentioned have all the incentives to remain silent.

<comment><USER2> All things being equal I'd rather know more than less.

Remember, I'm not asking how many vendors keep the BSAFE default. I'm asking how many use BSAFE in a way where the RNG matters.

<comment><USER3> Isn't your company's business to discover the security flaws? I believe the fact that you don't know the details means that there isn't much interest, at least in your part of the world, to fund such a research. There are no incentives for academia to make it too. All that doesn't mean the list doesn't exist, only that there is no economic reason to publish it.

<comment><USER2> No. My company provides an engineering service for vendors to find security flaws in specific pieces of software before (and sometimes after) that software ships. You should think of us as part of the development process.

If you gave us a piece of software that used BSAFE, you could reasonably expect detailed mitigation advice on not having a PKRNG exposed in your system.

No process in the market compensates us for acquiring a Ricoh printer and digging into its firmware to find how any why it's using BSAFE. It's not an especially interesting research project either.

I'm not surprised we don't know which products actually use Dual_EC, and I don't find the fact that we don't particularly telling. I'm saying something different: that I have worked with software that used BSAFE, and it used BSAFE for idiosyncratic reasons that didn't much implicate Dual_EC. I would not, for instance, be at all surprised to find an embedded device that used BSAFE for some goofy thing, but used OpenSSL as its TLS library.

<comment><USER4> The only "process in the market" for this kind of work is individuals or companies breaking random things in public to build their reputation as auditors (e.g. homokov), or selling vulns. But as you point out it's only really awesome when you follow the Cryptography Research model: find a new class of attack, develop the countermeasure, package (potentially patent) the countermeasure, then make scary demos of the attack to get responsible parties to buy your countermeasure.

In this case the mitigation is so simple ("don't use PKRNG; avoid RSA, Inc. going forward.") that it's not monetizable, so it's really only for reputation points.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> A far bigger issue is "The NSA played a significant role in the origins of Extended Random. The authors of the 2008 paper on the protocol were Margaret Salter, technical director of the NSA's defensive Information Assurance Directorate, and an outside expert named Eric Rescorla."

Given Rescorla involvement with the TLS standard and Mozilla it's concerning that he declined to comment on this.

<comment><USER6> I'm maybe too naive/optimistic but I think the most likely is that he has been manipulated in co-authoring a document which by itself is innocuous but once coupled with a rigged prng might have disastrous effects.

<comment><USER5> Sure, he might be innocent, but he really needs to put out a statement clarifying what his involvement was and what he knew.

Mozilla should probably hire an independent auditor to review all of his code changes. It might be unnecessary but this seems to be a scenario where it's better to play it safe (plus always good to audit security related code).

<comment><USER7> >Sure, he might be innocent, but he really needs to put out a statement clarifying what his involvement was and what he knew.

Why does he need to do that? What benefit will it be to him? If he said he was unaware of any underhandedness would you believe him? Do you think that if he was aware that he wouldn't have signed NDAs about these things?

</comment></comment></comment></comment><comment><USER8> I remember when this first broke getting heavily downvoted for suggesting that RSA wasn't paid $10 million to create a backdoor for their customer's as everyone was implying at the time. Rather, they (naively) were paid to joint develop a technology that would be a marketing dream "Hey this included help from the brightest minds at the NSA so why wouldn't you use it for your own organization?!"

So I found this quote to be very interesting: "We could have been more sceptical of NSA's intentions," RSA Chief Technologist Sam Curry told Reuters. "We trusted them because they are charged with security for the U.S. government and U.S. critical infrastructure."

<comment><USER9> "We trusted them because they are charged with security for the U.S. government and U.S. critical infrastructure."

Which is true, and as examples we have SE Linux and apparently strengthening the S-boxes of DES against differential cryptanalysis, which had not yet been independantly discovered by public researchers ([https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.2...](https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design)).

However, that was then; now, we legitimately trust the NSA a lot less, but I'm not sure we should blame RSA too much for not noticing the transition.

I'd also note that I arrived at MIT a couple of years after RSA was first published, and I heard various rumors that there were rather intense _sub rosa_ interactions between the team and the NSA et. al. in that period. With a good outcome, but threats were made etc.

<comment><USER10> I've brought up the S-Box strengthening several times before, but it's important to note that the NSA pushed IBM to reduce the key length in DES. IBM wanted 64 bits, NSA wanted 48, and we all got 56 as a compromise; not entirely egalitarian work.

<comment><USER11> What I've been told is that 56 bits is pretty close to its actual effective security in the presence of differential cryptanalysis. So the key length was 'right sized' and it ended up having truth-in-labeling after all.

</comment></comment></comment></comment><comment><USER12> _" We could have been more sceptical of NSA's intentions," RSA Chief Technologist Sam Curry told Reuters. "We trusted them because they are charged with security for the U.S. government and U.S. critical infrastructure."_

PS: "We also would like to express that we believe the entire World to be a bunch of idiots."

</comment><comment><USER13> The actual analysis is available here: [http://dualec.org/](http://dualec.org/)

I don't see much cryptographically new here; authors stretched what is a simple attack into 17 pages, and noticed that some non-standard TLS extensions that increase the amount of random data on wire make the attack easier.

<comment><USER14> One of the authors of that duealec paper had this to say [1]:

>Our results <dualec.org> say nothing about whether NIST, the NSA, or anyone else inserted a backdoor into dual ec. Instead, they say that if you know the relationship between P and Q, then some TLS implementations can be broken at a given cost. The precise results are more nuanced than that. You can read the website for a summary or the paper for the details.

[1][http://www.ietf.org/mail- archive/web/tls/current/msg11730.ht...](http://www.ietf.org/mail- archive/web/tls/current/msg11730.html)

</comment></comment><comment><USER15> The NSA is now actually making US infrastructure less secure. Consider that many companies will forego association with the most advanced security agency in the country. The country has placed it's best security resources in one pot and then spoiled it.

They're a resource that could have continued to provide valuable assistance. Instead, due solely to their organizational egoism, the NSA will be shunned and their advice dismissed as suspect.

<comment><USER16> Well it's a little more complicated than that: Other than the uniformity problems dual-drbg is a secure PRNG … against anyone who doesn't know the matching discrete log for the parameters.

If you don't consider a cryptographically locked single party back-door to be "less secure" then I don't think we can point out where they've done something to make things less secure.

</comment></comment><comment><USER17> Most likely also Vasco security tokens since NSA owned Digitalnotar which Vasco owns.

CA is a flawed security model with governments wanting to read all your data. Far to easy to forge a CA either by running one covertly or hacking into one.

One subset of users will get man in the middle certificates and interception.

The other set will get normal certificates.

How many really check the certificate fingerprints and who issued the certificate?

<comment><USER11> I thought the evidence was pretty clear that Diginotar was pwned by the Iranians.

Those certs did end up on the .ir national ISP's firewall doing man-in-the- middle attacks on Gmail users within Iran.

</comment></comment><comment><USER18> It seems to me we are seeing a variant of the same problem that Ken Thompson articulated in his paper "Reflections on Trusting Trust."[1]

While not a compiler intercept of the sort Thompson is talking about, this is effectively a library intercept of critical crypto functions and it poses the same basic problem. I don't think the industry will ever be the same. I think more and more folks are going to demand source-level access to everything crypto-related, and cryptoanalysts are going to put a lot more effort into scrutinizing these things.

The NSA failed to heed the basic warning of the Greek drama: ὕβρις-ἄτη-Νέμεσις

Or in more familiar terms, "Pride goeth before a fall."

[1] [http://cm.bell-labs.com/who/ken/trust.html](http://cm.bell- labs.com/who/ken/trust.html)

<comment><USER3> I just had too look up the Greek words:

hubris [ὕβρις] 'outrage'; the opposite of dikē [δίκη]

dikē [δίκη], plural dikai [δίκαι] 'judgment (short-range); justice (long- range)'; dikaios [δίκαιος] 'just'

atē [ἄτη], plural atai [ἆται] 'aberration, derangement, veering off-course; disaster; punishment for disaster'

nemesis [νέμεσις] indicates the process whereby everyone gets what he or she deserves

<comment><USER18> In other words, the basic formula of Greek tragedy is the hubris or outrageous pride overwhelming judgement, leading to deserved disaster. There's an additional subtext btw of exceeding prudent limits in "hubris."[1]

The thing here is that the NSA has acted out of hubris and exceeded prudent limits, and the result will be predictable. The deserved disaster will come from far more routine use of encryption, and this will deny legitimate law enforcement investigations many critical tools. While this is a cost that to some extent will be borne by everyone, it will particularly hit the NSA and law enforcement really hard.

[1] See "From Religion to Philosophy" by F. M. Cornford, 1914. Some parts are dated, but the general discussion of partition and nomos/nemesis is very well done.

<comment><USER3> Thanks for the book recommendation!

> The deserved disaster will come

It's still hard for me to see that. I don't know any person who started to more encrypt. And the companies will always have to fullfill the requests of the state:

[http://www.theatlantic.com/technology/archive/2014/03/don-t-...](http://www.theatlantic.com/technology/archive/2014/03/don- t-listen-to-google-and-facebook-the-public-private-surveillance-partnership- is-still-going-strong/284612/)

There's still a lot to be done to induce the significant change.

<comment><USER18> > It's still hard for me to see that.

If nothing else, criminals will take encryption far more seriously, which is where the real cost comes in from a LEO perspective.

> I don't know any person who started to more encrypt.

I have started to encrypt more, and new businesses are springing up with more encryption built-in. It's also something which has impacted Efficito's approach to security to some extent.

> And the companies will always have to fullfill the requests of the state

Sure. However as of now, there is no requirement that they be able to fulfil the requests, so the current struggle is really with coming up with systems where the administrator/cloud provider has no access. This will lead to predictable results, and the next battle will be over whether to require such providers to retain access. To my mind, that's the legal battle we must prepare for.

</comment></comment></comment></comment></comment><comment><USER19> > _" director of the NSA's defensive Information Assurance Directorate"_

Now how many of you think dividing the NSA into defensive and offensive parts will do anything to restore trust?

<comment><USER20> One main argument for doing so has been that right now IAD has a conflict of interest.

<comment><USER21> Except that it doesn't; NSA has a conflict of interest, but they're already split internally.

Even if you split them into separate agencies they're still going to _both_ be part of the USG so while that might reduce the risk of a conflict of interest somewhat, it wouldn't eliminate it.

After all, think of the existing reaction we get when _actually independent_ agencies of the USG throw out comments in support of NSA's signals intelligence. If the NSC, Congress's intelligence subcommittees, Executive Office of the President, Department of Justice, various Inspectors-General, Dept. of Defense, FBI, and, oh yeah, _the courts_ can all be looped into what hacktivists claim is a vast conspiracy to violate the Constitution, then what defense would splitting IAD out really be?

<comment><USER19> So then, we should just accept what NSA is doing?

<comment><USER18> I think that accepting what they are doing is the first step to fighting it.

</comment></comment></comment></comment></comment><comment><USER22> > The system, called Dual Elliptic Curve, was a random number generator, but > it had a deliberate flaw - or "back door" \- that allowed the NSA to crack > the encryption

I would very clearly draw the line at the point where the NSA is deliberately weakening national security by undermining widely used cryptography. Companies or even other government agencies are now easier targets because of the doings of the NSA.

<comment><USER21> > I would very clearly draw the line at the point where the NSA is > deliberately weakening national security by undermining widely used > cryptography

There was no "threat to national security" here. Unlike what we think of as a normal backdoor, this one is and remains completely in NSA's control, as long as they're the only ones with the private key underlying the Dual EC constants. So even knowing there's a backdoor in there somewhere, there's no way for other security agencies or hackers to break Dual EC (assuming, of course, that it's properly implemented, which is _not_ a given, and NSA's changes may have made it harder to implement).

</comment></comment><comment><USER23> What's the best viable alternative to RSA SecurID?

<comment><USER24> Probably something like OATH (as used by google authenticator and similar software) or a yubikey. With yubikey you can even get your own HSM for the authentication server.

<comment><USER23> Thanks. I had heard about yubikey. will def check it out.

<comment><USER25> Might be worth to note that the YubiKey authors did mess up quite badly at one point in time:

[http://www.lsv.ens-cachan.fr/Publis/PAPERS/PDF/KS- stm12.pdf](http://www.lsv.ens-cachan.fr/Publis/PAPERS/PDF/KS-stm12.pdf)

</comment></comment></comment></comment><comment><USER26> Is there an elliptic curve that is trustworthy?

<comment><USER27> To answer that you will have to define "trustworthy". I'm personally leaning toward trusting the curves proposed by Dan Bernstein [1], since he clearly explains the reasons for choosing the specific parameters and they're demonstrably valid.

[1]: [http://cr.yp.to/ecdh.html](http://cr.yp.to/ecdh.html)

</comment></comment><comment><USER28> Does the word "NSA" still have a 60 percent upvote penalty here? It seems to be moving pretty slowly up. I understand using that sort of penalties if during a period of time the site gets flooded with those stories, but I don't think keeping the penalty forever is such a good idea, or at least not such a big one. Maybe make it "decay" over a period of time.

<comment><USER29> What is your documentation for saying that a particular word in a headline has any penalty at all?

AFTER EDIT: I guess I'm glad I asked, downvotes and all, because I see the link is to a source off HN, not to a statement from any of the HN moderators (which is what I was checking).

<comment><USER30> Scratch HN moderators, here it is straight from the horse's mouth:

> "So already for the past week TSA stories have had an automatic penalty > applied. Or more precisly, they've been _autotagged as being political, > which entails a penalty_."

> "When anything gets over a certain number of flags, it shows up on a list > that _admins_ see. They decide either to kill it, _mark it as political_ or > whatever, or do nothing."

[https://news.ycombinator.com/item?id=1934950](https://news.ycombinator.com/item?id=1934950)

So, at least as of 3 years ago, HN both "autotags" and has admin driving tagging. Penalties are given to posts that have received particular tags.

Strictly speaking, "words in titles" may or may not be involved in that "autotagging", but given PG's history with content classification... I suspect it is.</comment></comment></comment>


Please Sell Me on Vuex - <AUTHOR> I mean this post with the utmost respect for the brilliant minds that brought you Redux.  Given that React is a view handler and not a full state controller, it completely makes intuitive sense.
Vuex on the other hand I'm failing to see the use case for, but I feel dirty.  I'm coding without it just fine, and everything works great, but I have this nagging sense that I'm doing things wrong, reinforced by the infinite masses of trendy JS articles urging me to join The Church of Framework X.
Can some kind soul out there put into words what makes Vuex awesome and why it was worth it for you to use, given the nature of Vue being so darn good at two-way automagical bind handling?
Thanks for any input. <comment><USER2> Vue won't let you pass changes in data _upwards_ through the component hierarchy. Once you need to do that (and you need to do that in any non- trivial application), your only options are event passing (which quickly becomes awkward and difficult to reason about - as anyone who's ever picked up someone else's large Backbone project will attest) or a dedicated data store. It doesn't have to be Vuex, but Vuex integrates well and is reasonably easy to work with, so why not?

<comment><AUTHOR> Interesting - good point! Would having a window.x variable (traditional global) also solve this?

<comment><USER2> I mean, it might, but there are other reasons why global variables are bad practice -- especially in Javascript. Vuex (in strict mode) enforces that your data is changed only in known and blessed ways.

<comment><AUTHOR> I haven't seen anything about this in my research other than the obligatory "globals r bad nub do not use dis evr 1337"

Not to say that's wrong, just that I'm lacking on concrete rationale. If you get a few minutes, would you be kind enough to link me to further reading on maybe some of the ways Vuex provides a better approach than traditional globals in singleton namespaces? (Or just post here but I don't want to ask you to explain something that's already well documented)

Thanks for your help either way, really appreciate your time.

<comment><USER2> Globals make it really difficult to test, reuse, or repurpose code. And you can only ever have one instance of a given global, so if you want multiple instances of your widget you face really ugly refactoring.

If you google for it there should be plenty of good resources on this topic. It sounds like maybe you're relatively new to programming - it only takes running into this situation once to start to understand the reasons for avoiding them.

They're especially dangerous in JavaScript because of the way it handles scoping. If you accidentally miss a "var" or "let" inside a function you could find yourself mutating global instead of local data.

Vuex lets you scope your data to a module. It also as I described above lets you limit mutations to a known set of operations, which becomes important in a large or long-lived codebase.

<comment><AUTHOR> Thanks good points I'll keep at the research.

</comment></comment></comment></comment></comment></comment><comment><USER3> Sharing data between components without parent/child relationship is the main reason

</comment><comment><USER4> Why?</comment>


Want to contribute to SARS-CoV-2 detection? I compiled resources for a jumpstart - <AUTHOR> https://hefnawi.me/posts/detect-sars-cov-2-near-infrared-spectroscopy/ <comment><AUTHOR> I'm still working on this project but I don't have the time or bandwidth to follow up, so I compiled my resources and will keep posting updates in the hope that it supports someone else to proceed in that direction. I mean mainly in the Near-infrared spectroscopy direction.

Thanks =)</comment>


"I've spent 6 months learning type design. The result:'Marvin Visions'" - <AUTHOR> https://www.readvisions.com/marvin <comment><USER2> Hijacked scrolling site is my second-ranked peeve below the website that pops an overlay to "subscribe". Closed the tab before I could enjoy the design.</comment>


-2000 Lines Of Code - <AUTHOR> http://www.folklore.org/StoryView.py?project=Macintosh&story=Negative_2000_Lines_Of_Code.txt <comment><USER4> The other day I calculated my net contribution to the IMVU client, in lines of code. Excluding third-party libraries, I have subtracted about 100,000 lines since 2005.

Reminds me of an old presentation by Alan Kay. He was demoing some networked virtual world he'd written, including avatars, portals, and chat. He wrote it in Smalltalk, and said it summed to 60,000 lines. He said with a bit more effort, he could probably reduce it to 20,000.

There's something to be said for a complete lack of duplication in the system.

<comment><USER5> Alan Kay's current project is to implement a full operating system from bare metal to userland GUI in 20,000 LoC, using as many meta-languages as necessary to get there in a pedagogically cogent way: <http://vpri.org/html/work/ifnct.htm>

For instance, their TCP implementation is under 200 lines, implemented as a parser-expression-grammar for the ASCII-art diagrams from the RFCs: [http://www.moserware.com/2008/04/towards-moores-law- software...](http://www.moserware.com/2008/04/towards-moores-law-software- part-3-of-3.html)

<comment><USER6> Is there code I can download for this project?

I'm about to pay $1,300 so I can legally purchase a Genera system. I'd love to look at similar projects.

<comment><USER7> Right now, I wish I was you...

</comment></comment></comment></comment><comment><USER8> "Measuring software productivity by lines of code is like measuring progress on an airplane by how much it weighs."- Bill Gates.

<comment><USER9> link? I'm just curious. Would love to read more about BG's thoughts on coding.

<comment><USER10> Can't locate a source for this on google. I'm calling urban legend.

<comment><USER7> "Just because Google cant find it, doesn't mean it doesn't exist" - <USER2> Einstein.

<comment><USER10> "A witty saying proves nothing" - <USER3>

Look, this saying is by Bill Gates, should have been made in the last 30 years, it returns three pages of results, and yet none of them are mentioning a source. Some are referencing each other, and some are also including the '640k should be enough for anyone' legend. Yes, it's not 100%, but the indications are not good. The ultimate counterargument of course would be a source.

<comment><USER11> "I hate quotations. Tell me what you know."

\-- Ralph Waldo Emerson

<comment><USER12> "Famous remarks are seldom quoted correctly." -Simeon Strunsky

<comment><USER7> "Simeon Strunsky never said that" - Joe Ball

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Always remember that you are a problem solver first and a coder second. Sometimes you can solve a customer's problem without writing a single line of code.

<comment><USER9> that's a great quote. i'll probably start using that.

</comment></comment><comment><USER14> Just by including jQuery in a project I was able to shave a total of 22kb off a range of files without much trouble. But the current release version, minified jQuery is about 23kb. It's a balancing act.

EDIT: Also, in the next version of jQuery, they plan to separate out the core code such that you can include only what you need, so that 23kb will drop to only what you need.

<comment><USER15> For me at least, the main benefit by far of fewer lines of code is fewer bugs and maintainability. Code kilobytes rarely matter (though I concede "k" can be relevant on the web).

<comment><USER14> It was an easy way for me to illustrate how many lines of code I culled. I make it sound amazing, but the majority of changes involved turning 20 line functions with for loops into a simple 2 line jQuery snippet.

Also, jQuery means rarely declaring in-function variables therefore avoiding memory leaks.

Happy coders all round :)

</comment></comment></comment><comment><USER16> I remember a story (don't know from where) in which someone was hired to reduce the size of a code base. His compensation went up for each line of code deleted and went down (by a bigger amount) for each time he caused a crash.

It may not be true, but I like the story anyway.

</comment><comment><USER17> Who was that guy who suggested using lines written plus lines deleted. Was it Knuth?

<comment><USER18> All numeric metrics of programmer productivity are easily gamed, but yours is particularly so: just add and delete one line repeatedly.

<comment><USER19> That's true, when you use the metric to influence some material gain or loss for the developer. As an indicator for the state of a project (and its speed) together with other metrics, it may not be too bad.

</comment></comment></comment><comment><USER20> I'm reminded of this Google Tech Talk, where the speaker (Jon Bentley) refers to a colleague's praise of someone who "adds function by deleting code": <http://www.youtube.com/watch?v=aMnn0Jq0J-E>

Edit: Fixed quote

<comment><USER21> You know you are doing it write when you do that.

For added value combine with sloccount when removing code (I removed $200k value from our software, fixed 8 bugs, and removed that stupid limitation about green text today)...

<comment><USER22> > I removed $200k value from our software

That sounds like a bad thing...

<comment><USER21> Not when you are using sloccount to measure the 'value' of the software.

</comment></comment></comment></comment><comment><USER23> can anyone help me find a favorite of mine? Its the one where they are building a program and the employee working on it had been let go from apple, but he snuck in every day to finish it.

<comment><USER24> <http://www.nucalc.com/Story/></comment></comment>


Show HN: Functional Emoji CLI Sokoban in Node.js - <AUTHOR> https://github.com/RedNifre/fpsokobanjs <comment><AUTHOR> This is meant as an illustration of functional programming concepts: It's a Sokoban game that you can play on the command line, it uses emoji for graphics, uses currying, mapping, monads/promises and zero variables or loops. It's not meant as a tutorial; think of it as something you can look at to decide whether functional programming is checking out more thoroughly.</comment>