The Hunt for 928 or Has Anyone Seen This Spy Plane? (1999) - <AUTHOR> http://www.otherhand.org/home-page/area-51-and-other-strange-places/bluefire-main/bluefire/the-hunt-for-928/ <comment><USER2> This is a great read. If I were closer to the area I'd definitely have spent some time trying to recreate the investigation and check out the site.

Also, got to plug the story of the search for the lost German tourists in Death Valley[1]. I feel like his writing in that series really gets you in the head of the lost, and is morbidly fascinating.

[1] [http://www.otherhand.org/home-page/search-and-rescue/the- hun...](http://www.otherhand.org/home-page/search-and-rescue/the-hunt-for-the- death-valley-germans/)

<comment><USER3> Reading that one now.[1] Fascinating and terrifying. (Especially having spent just enough time in that part of the country to have some context.)

[1] While looking at each of the spots he references on Google Earth along the way. An incredibly barren and foreboding area.

</comment></comment><comment><USER4> > For a while prior to this, I had been poking into the field of remote > viewing, which hadn't yet quite burst into the public's perception ... I had > contact with a couple of remote viewers and thought this might be a useful > test of this rather strange skill. The data back seemed to indicate a spot > not southeast of Leith, but southwest.

Wait - what?

This threw me off because my impression of the author was somebody who was very technical and critical.

Great read - nonetheless.

<comment><USER5> He also seems to have at least a basic interest in hunting for UFOs, even if he's rational enough to expect that most of the reports are probably false. But he seems basically open to the idea, if only to recognize the incredible difficulty of being successful. And, as he notes, the remote viewing wasn't accurate or useful.

You should not confuse people who are technically capable as being unable to believe something that isn't definitively proven.

<comment><USER6> I liked the background of remote viewing, UFOs, etc. I was a nice reminder of a very particular slice of 90s popular culture.

</comment></comment></comment><comment><USER7> Funny to see something like this here. I went with my dad on some airplane wreck hunts when I was younger, though none quite as epic as this one. You'd really be surprised how complete some of these plane wrecks are if they are hard to get to. One I recall was a F-104 thunderchief. It was just amazing to me that they didn't try to remove any of this stuff: [https://imgur.com/a/5uToG](https://imgur.com/a/5uToG)

<comment><USER8> A old friend of mine and I visited a corn field in Nebraska ten years ago in search of some wreckage left behind from a crash in 1966. With the help of a metal detector we located metal identification plates, various small pieces of metal, and an ash tray (smoking on planes was once a thing). [https://en.m.wikipedia.org/wiki/Braniff_Flight_250](https://en.m.wikipedia.org/wiki/Braniff_Flight_250)

</comment></comment><comment><USER9> [http://wikimapia.org/26461282/Walter-Ray- Lockheed-A-12-Oxcar...](http://wikimapia.org/26461282/Walter-Ray- Lockheed-A-12-Oxcart-60-6928-Crash-Site) covers this plane's crash site and some pictures here: [http://www.dreamlandresort.com/info/crash_a-12.html](http://www.dreamlandresort.com/info/crash_a-12.html)

<comment><USER10> Thanks for the Dreamland Resort link... I wonder what they're working on at the secret bases today.

One of my passengers worked at the secret bases, in the 1960's. "There's way more stuff underground at Area 12, than at Area 51." [1]

[1] [http://www.taxiwars.org/2016/01/imaginary- workplaces.html](http://www.taxiwars.org/2016/01/imaginary-workplaces.html)

</comment></comment><comment><USER11> Reading this reminded me of one interceptor variant that was canceled. Same specs as the A-12, but armed ( [https://en.wikipedia.org/wiki/Lockheed_YF-12](https://en.wikipedia.org/wiki/Lockheed_YF-12) ). The second seat was added to operate the fire control system (radar/weapons).

Very cool read though.

</comment><comment><USER12> Interesting, but there's an awful lot of UFO and remote viewing mentions in there.</comment>


Show HN: Ploi.io – Stop the hassle. Start deploi'ing - <AUTHOR> https://ploi.io/ <comment><AUTHOR> Hello everyone!

I recently started developing [https://ploi.io](https://ploi.io), my intentions when I started it was pure for private use. But colleague developers noticed it and we're very enthusiastic about the project, that I started on making it public. I am the owner and the developer of Ploi, Ploi is currently taking about 80% of my time per week. Ploi is a VPS management tool where you can provision servers in with DigitalOcean, Vultr, Linode, Scaleway or a VPS by your favorite vendor (Ubuntu 18.04).

I am looking for some feedback on the frontend and if you have the spare time, on the panel design. Let me know!

P.S. If you want some more background about this project, I wrote an article about it:

[https://medium.com/@dennissmink/why-i-started-creating- ploi-...](https://medium.com/@dennissmink/why-i-started-creating-ploi- io-f2fe16dfb09a)</comment>


Microsoft is Abandoning SHA-1 Hashes for Updates - <AUTHOR> https://www.cs.columbia.edu/~smb/blog/2019-02/2019-02-19.html <comment><USER2> The ars link is a little more detailed, specifically it points out that SHA-1 will be replaced with SHA-2, something the current article fails to mention, I was left very confused about what microsoft would be actually doing.

<comment><USER3> That article is [https://arstechnica.com/gadgets/2019/02/mandatory-update- com...](https://arstechnica.com/gadgets/2019/02/mandatory-update-coming-to- windows-7-2008-to-kill-off-weak-update-hashes/).

</comment></comment><comment><USER4> > However, given an existing file and hence its hash, it is not possible, as > far as anyone knows, to generate a second file with that same hash. This > attack, called a "pre-image attack", is far more serious. (There's a third > type of attack, a "second pre-image attack", which I won't go into.)

I think the attack just described is the second pre-image attack. The second file is the second pre-image. A pre-image attack would be to start with only the hash, no file, and create a file with that hash.

<comment><USER5> >However, given an existing file and hence its hash, it is not possible, as far as anyone knows, to generate a second file with that same hash.

Interesting...I thought google did exactly this in 2017. Although, they controlled the PDF prefix.

[https://security.googleblog.com/2017/02/announcing-first- sha...](https://security.googleblog.com/2017/02/announcing-first- sha1-collision.html)

<comment><USER6> Yeah, this is the difference between a collision and a preimage attack. A collision is, given a hash function, come up with two documents with the same hash, but you can control both documents. A preimage attack is, given a hash function and one document (or one hash), find another document with the same hash. That's much harder - you don't have the ability to force the algorithm's internal state into something convenient.

A preimage attack is what you worry about if you think the person giving you the signature might be untrustworthy, e.g., they're currently promising one thing but they might swap it out with something else later. A collision attack is what you worry about even if you don't think the person giving you the signature is untrustworthy and you're expecting _someone else_ to swap out the document before it gets to you. So there are a good handful of scenarios where you don't care about preimage attacks but you do care about collisions - e.g., if Microsoft is signing Windows Update files, presumably they don't need to conduct a preimage attack to send you a malicious update, they can just directly sign a malicious update. But you don't want other people sending you malicious updates that appear to be signed by Microsoft.

<comment><USER7> > A preimage attack is what you worry about if you think the person giving you > the signature might be untrustworthy, e.g., they're currently promising one > thing but they might swap it out with something else later. A collision > attack is what you worry about even if you don't think the person giving you > the signature is untrustworthy and you're expecting someone else to swap out > the document before it gets to you

You mean vice versa right?

Untrustworthy person: could make a collision before giving you the input and mess you around.

Trustworthy person doesn't do that (because they are trustworthy). But someone might find a second pre-image attack and do it later on

<comment><USER6> Yes, sorry. Please swap "preimage attack" and "collision" in that entire paragraph: I meant to say there were cases where you don't care about a _collision_ (as demonstrated for SHA-1) but you do care about a _preimage_ (not yet demonstrated, but certainly a risk).

</comment></comment></comment></comment></comment><comment><USER8> It's just good housekeeping at this point. Attacks never get worse, and there have been structural problems with SHA-1 for a long time. Plus, it does make sense for a company like Microsoft with a large user base to protect against malicious insiders. While I was there, employees in the Patch Tuesday program had been approached about backdooring updates. I don't think creating a colliding update would necessarily be the vector for such a thing (and removing SHA-1 doesn't necessarily protect against it) but overall its just a good idea.

<comment><USER9> > While I was there, employees in the Patch Tuesday program had been > approached about backdooring updates.

What was the general policy about working with law enforcement to prosecute such attempts, to the extent they were traceable?

<comment><USER8> Microsoft had a large amount of policy, and it could be that there were some policy that applied, but if there was some it didn't permeate the culture and daily routine in the trenches there (from my personal and limited experience).

Both backdoor requests I became privy to while there (2.5 years, circa 2011-2014) came from a certain US TLA, were law enforcement would have been an awkward step, though it seems reasonable to me that there were more requests, including from other organizations, but I was never made aware of those.

There were some foreign spies caught in MSRC in the same timeframe. More of an extradite than a prosecute type situation, though.

</comment></comment></comment><comment><USER10> I think that the more likely reason is that many corporate security standards (think PCI compliance etc etc) are starting to blanket ban SHA-1, and it was cheaper to switch away from it than continue having to carve out policy exceptions with their large customers who are on support contracts for Win7

<comment><USER11> If there is no Win7 support for SHA-2, why can't they add just add support for it?

<comment><USER12> They are: [https://www.pcmag.com/news/366610/still-using- windows-7-micr...](https://www.pcmag.com/news/366610/still-using- windows-7-microsofts-next-update-is-critical)

</comment></comment></comment><comment><USER13> Historically, NIST had provided transition guidance to Federal agencies circa March 2006 to begin migrating to SHA-2[1], officially deprecated SHA-1 for digital signature generation use between 2011 and 2013[2], and outright disallowed it with exception for the same circa November 2015[3].

FWIW, the memo from the horse's mouth[4]:

> _To protect your security, Windows operating system updates are dual-signed > using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates > come directly from Microsoft and were not tampered with during delivery. Due > to weaknesses in the SHA-1 algorithm and to align to industry standards > Microsoft will only sign Windows updates using the more secure SHA-2 > algorithm exclusively._

I'd imagine orchestrating this push is a real cluster. Would be interesting hear perspective from the inside.

[1] [https://csrc.nist.gov/projects/hash-functions/nist-policy- on...](https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash- functions)

[2] [https://doi.org/10.6028/NIST.SP.800-131A](https://doi.org/10.6028/NIST.SP.800-131A)

[3] [https://doi.org/10.6028/NIST.SP.800-131Ar1](https://doi.org/10.6028/NIST.SP.800-131Ar1)

[4] [https://support.microsoft.com/en- us/help/4472027/2019-sha-2-...](https://support.microsoft.com/en- us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and- wsus)

<comment><USER14> > updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms

> Due to weaknesses ... and ... industry standards Microsoft will only sign > Windows updates using the more secure SHA-2 algorithm exclusively.

This seems like a half step to me. I assume the used both as a transitional process: use both until all consumers of the signed content support the better, then drop the older standard. I wonder why they've not done the same and replaced SHA-1 with a more recent algorithm, so they can easily deprecate SHA-2 if/when needed at a later date?

All the code and processes already support multiple hashes/signatures so that wouldn't be a problem. Or is the next accepted standard not yet fully decided yet? Or do they think SHA-2 will last long enough that SHA-3 (assuming that is the generally accepted next step) will be supplanted at least once before SHA-2 needs deprecating so there is no point implementing that now?

<comment><USER15> > SHA-3 (assuming that is the generally accepted next step)

That's just the thing, SHA-3 isn't the generally accepted successor to SHA-2. The "go to" hash function is still SHA-2, or BLAKE2.

</comment></comment></comment><comment><USER16> For those who are paranoid, but can't move away from SHA-1 for whatever reason, consider using SHA-1DC. It's compatible with SHA-1, but will barf on the known collision attack against SHA-1: [https://github.com/cr- marcstevens/sha1collisiondetection](https://github.com/cr- marcstevens/sha1collisiondetection)

It's what Git uses by default, of course there's no guarantee that new SHA-1 attacks won't be discovered, but it's better than nothing.

<comment><USER17> To be clear, what this is doing is _markedly more sophisticated_ than just comparing to a fixed hash we know is bad and rejecting it, and so "new SHA-1 attacks" would likely actually still trip this.

The idea in all these MD-family (which SHA1 and SHA2 are members of) collisions is the same, using one or two input blocks you trap the hash function in an awkward place so that fewer state bits than normal matter, and then skewered in this way you calculate one final block that will collide it. The SHA-1DC is watching for that situation which its developers call a "disturbance vector" and so it will detect all attacks based on the same approach and "fix" the hash at a small CPU premium for all hashes.

We know for MD5 that independent (presumably nation state given the costs) elements did a similar but different attack that we only found out about after the published MD5 collision - but it trips the same detection (for MD5 in that case) because it's based on the same mathematical approach, even though none of the actual hash values involved were the same. A defence of this sort would have worked, even against an adversary with nation state resources (in this case probably Israel or the US).

<comment><USER16> All true, thanks for the elaboration. The only minor thing I'll add is that while its default mode of operation is to munge its internal state when detecting such colliding data and returning a hash that's _not_ the same as what stock SHA-1 would return, it can also be made to just return an error. That's the mode Git uses it in:

[https://github.com/git/git/blob/v2.21.0-rc2/sha1dc_git.c#L10...](https://github.com/git/git/blob/v2.21.0-rc2/sha1dc_git.c#L10-L22)

</comment></comment></comment><comment><USER18> Likely it's just a compliance thing. remove sha-1 and you can stop explaining it all the time to auditors why it's there.

</comment><comment><USER19> I might not be understanding this right... But can't they dual sign with both SHA1 and SHA2 with no loss of functionality?

New clients would use (and require) the SHA2 hash. Old clients could still use the SHA1 hash, but with the risk of a faked update, but that's probably still better than no update.

<comment><USER20> _But can 't they dual sign with both SHA1 and SHA2 with no loss of functionality?_

Furthermore, wouldn't trying to collide _both_ SHA2 and SHA1 be even more close to impossible than just trying to collide SHA2 (which is already currently regarded as practically impossible)? Perhaps newer clients should verify _both_ hashes?

<comment><USER17> No. Amateurs bring this up _all the time_. Depending on exactly what's going on, it may be no harder to attack _both_ than just the hardest of the two component hashes, plus you just wasted a bunch of effort and maybe introduced extra security bugs with your extra complexity. So don't do this.

The compatibility argument makes sense, but the "maybe it's safer" argument doesn't have any traction at all.

And the politics always ends up being "We don't want to endorse this unsafe thing, let's just remove it".

<comment><USER20> _Depending on exactly what 's going on, it may be no harder to attack _both_ than just the hardest of the two component hashes_

We have seen published collisions for MD5 (which are incidentally nearly trivial to generate these days), and I'm aware of the one for SHA-1 (which took much longer to generate) --- but have there been any dual-collisions found? According to you, they wouldn't be that hard to generate, but I haven't been able to find any examples of dual collisions, even for trivially- collidable-by-themselves combinations like MD5+MD4.

</comment></comment></comment></comment><comment><USER21> Note: This article was written by Steve Bellovin, a leading researcher in security and networking.

</comment><comment><USER19> I hope they put effort into making sure the user experience for those who don't install the update in time is reasonable.

When I did dads old laptop out of the attic and boot it up, I don't want to be faced with the inability to install new updates. At least make an error message that points to a help article saying how to resolve the issue.

</comment><comment><USER22> Isn't Blake2 the best hash function? If yes why won't everybody just switch to it?

<comment><USER23> Because the different hash functions have different trade-offs.

For example not all hash functions are cryptographic hash functions and can be much faster.

<comment><USER24> Also aren't SHAx hardware accelerated on x86 cpus?

<comment><USER15> Only SHA-1 and SHA-2 and only on current-gen Intel CPUs or all AMD Ryzen CPUs.

</comment></comment></comment></comment><comment><USER25> Why not replace it by MD-6?

<comment><USER26> MD-6 never gained popularity and was eliminated early in the SHA-3 competition since it lacked proofs that it could resist differential attacks.

Microsoft are quite correct to use SHA-2 (conservative choice) but SHA-3 would also be fine. Bringing up MD-6 at all seems arbitrary.

</comment></comment><comment><USER27> I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code to check if there is government backdoors in the code.

<comment><USER28> > I think it would be quite the day to take the hashes of Microsoft's ISO > images for Windows, and compare it with the source code

Wat? How would you translate an ISO hash into anything meaningful to compare to the actual source code (that you don't have access to, but that's beside the point) ?

Does microsoft enforce reproducible builds[0]? Even if they did, you couldn't reproduce it (no access to source). When you hash a large binary, like an ISO, you cannot deconstruct what, eh, sub-binaries it is made of, and you cannot magically decompile those, eh, sub-binaries into source code.

0\. [https://wiki.debian.org/ReproducibleBuilds](https://wiki.debian.org/ReproducibleBuilds)

<comment><USER25> Microsoft enforces reproducible builds since 2017.

<comment><USER28> Do you have a source for that (no pun intended)? Even if they did, it's impossible for anyone outside of microsoft to verify because, well, it's proprietary. So for those of us who trust microsoft as far as we can throw them, it doesn't really do much.

<comment><USER25> Yes, see [https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=97705) by Raymond Chen.</comment></comment></comment></comment></comment>


Ask HN: How to find good news analysis? - <AUTHOR> Which blogs would anyone recommend for intelligent and impartial analysis on current events? Getting really sick of mainstream media. <comment><USER2> On the media podcast and Columbia journalism review

I wouldn't call them impartial but the analysis is definitely fair and intelligent.

<comment><AUTHOR> Great thanks! Will definitely take a look.</comment></comment>


P not equal to NP - <AUTHOR> https://arxiv.org/abs/1802.03028 <comment><USER2> Just going by the first section, I can anticipate a problem here. The last paragraph of the first section suggests that the problem of finding a Hamilton cycle is not in P because some cycles are maximal solutions without being a maximum solution. However, the same could be said of the problem of finding a maximum matching -- a maximal matching need not be a maximum matching -- and yet that problem _is_ in P.

I haven't yet checked the formal conditions to see whether they'll apply to the matching problems, but I bet they will. (The fact that the paper contains no instances of the word "matching", meaning it never explains why this condition doesn't apply to the matching problem even though it looks like it should, is not encouraging.) If so this proof cannot be correct.

</comment><comment><USER3> [https://www.win.tue.nl/~gwoegi/P-versus- NP.htm](https://www.win.tue.nl/~gwoegi/P-versus-NP.htm)

Here's a link to a list of P vs NP proofs that didn't work out. "Making it to arxiv" and "sounding reasonable" are usually pretty good filters but for some reason this problem has attracted a lot of trouble.

<comment><USER2> Note that this hasn't been updated in a while. For instance Norbert Blum's attempt from 2017 (now acknowledged as mistaken) is missing.

</comment></comment><comment><USER4> The main step seems to be Lemma 2. The fact that the reductions are logspace is never actually used in the argument - so if this proof worked, it would also apply to arbitrary reductions, and the same argument would show that NP is not contained in, say, EXP.

The fact that there are no inequalities anywhere throughout the paper is the real tip-off that this is not a serious attempt.

</comment><comment><USER5> Kinda insanely difficult summary there :)

</comment><comment><USER6> Yawn.

</comment><comment><USER7> WOW!! Another one after Vinay Deolalikar's! I lack the mathematical expertise but would certainly love to hear what experts have to say on this one.

<comment><USER2> Claims of P != NP are pretty common; I wouldn't get so excited just yet...</comment></comment>


London's exodus offers a stark warning: your culture is at risk - <AUTHOR> https://www.theguardian.com/commentisfree/2017/aug/04/london-exodus-warning-uk-cities-culture <comment><USER2> What a weak start:

"For the first time in half a decade..."

Wow, it's been a whole FIVE YEARS since this last happened??

</comment><comment><USER3> Crap article, not sure what it's doing in HN?

<comment><USER4> Please elaborate why you think it's crap, or refrain from dismissive comments that contain no information.

<comment><USER3> I read it, nearly the entire thing is junk. Feel free to waste your time with it, but it's a very lazy article with an agenda, northern academics writing about a London the know little about.

</comment></comment></comment><comment><USER5> There might be a house price bubble in London. Banks move out from London due to Brexit. With that high income earners such as bank employees and lawyers move or are fired. Asset prices as a result of lack of high income earners competing for them in London drop. It is no longer as attractive for foreigners to invest in London property due to it being difficult to live there without a visa/Residence permit and price drop.

<comment><USER6> Do you think people who live or work in London are those pushing up the housing market?

</comment></comment><comment><USER7> Clickbait opinion piece.</comment>


Modernizing the DOM Tree in Microsoft Edge - <AUTHOR> https://blogs.windows.com/msedgedev/2017/04/19/modernizing-dom-tree-microsoft-edge/ <comment><USER2> Thats from 2017 which means its a completely different browser. Now Edge is Edgium, which is based on Chromium.</comment>


GitHub and Trade Controls - <AUTHOR> https://help.github.com/en/articles/github-and-trade-controls <comment><USER2> These rules are so stupid and actually hurts no one but the poor individual developer, a few years ago I used to live in Syria before the events. I had to find 3rd party mirrors or VPNs for the stupidest shit... like Nvidia graphics driver, adobe flash player, Java runtime and silly stuff like that, some ISPs had public download pages where you can find these general utilities most of it was outdated but does the job.

I guess the US is afraid that terrorists may develop weapons using Adobe flash player xD

<comment><USER3> It's also a huge waste of time for companies in the US, and to companies all over the world that use US-based services like GitHub.

> GitHub.com may not be used for purposes prohibited under applicable export > control laws, including purposes related to the development, production, or > use of nuclear, biological, or chemical weapons or long range missiles or > unmanned aerial vehicles.

Not only is this sentence an affront to the English language, but I hope you aren't trying to develop any drone software on GitHub...

<comment><USER4> If you're trying to develop any technology which requires trade secrets or IP protection -> you should not be using a public SaaS.

<comment><USER5> But there's no reason quadcopter software should require trade secrets or IP protection. It could just as easily be open source, and yet it still sounds like the rules prohibit it.

<comment><USER6> From skirmishes in the 1990s crypto wars I can assure you plenty of open source software was export controlled.

In fact this was a drive for some of Cygnus' overseas offices: not to evade the law but to do development that could not be spoiled by accidentally exposing it to a person subject to export control laws. Stupidly, we could _import_ that software into the States, but people there couldn't fix bugs in it, only file reports.

</comment></comment></comment></comment></comment><comment><USER7> It's honestly about time.

I've been sounding the alarm bells about ITAR, DFARS, EAR compliance for a while now! None of the software vendors I've talked to seem to understand that it is AGAINST THE LAW to upload customer supplied IP to their super-secure Cloud based product that they're trying to get me to switch too. "The lowest TCO, you'll get ROI in 6 months!"

Ya, but are you compliant with NIST 800-171 requirements?

"Ohhh, uhhh... I don't know. I'll ask the engineering team but I'm sure we're fine!"

Ya, ok.

<comment><USER8> I suspect this is one of the things that Microsoft has more experience with, and we might be seeing their influence here.

</comment></comment><comment><USER9> It's funny how people used to complain that code.google.com did this but github didn't, and didn't like the answer that "the difference is that Github is not compliant with the law".

I suspect people will now complain that github does this but <x new service> does not :)

</comment><comment><USER10> That's a good reminder that, given the slight deterioration of the USA strategic/diplomatic stability in the past few years, using any US-based services without a strictly non-US backup is like playing poker.

And it happens we're a lot to play poker here.

<comment><USER4> ITAR has been in place for decades...

<comment><USER11> Things had been getting better though, rather than worse. When was the last time someone had to publish cryptographic software by printing it on a stack of paper?

<comment><USER4> I don't think the lack of someone being convicted of ITAR violations means we're doing better TBH.

People are only going to complain about this after normal people start going to jail.

</comment></comment></comment></comment><comment><USER12> This is just sad. I feel for all my open source developers in these countries.

I feel for all my peers who I spent my undergrad with in Iran.

These archaic laws need to be deleted. America needs to be shamed for making it so hard for people to gain skills in these countries. Companies need to be shamed for not challenging these laws.

<comment><USER13> Shame should be directed at the sanctioned govts like that of Cuba that jail or kill people for political dissent. And shame on companies that help them. These regimes are unelected or sponsor terrorism, like Iran. They must not grow. It's a bad situation all around and there is no other peaceful alternative. Crippling these govts provides them with less resources to setup extreme surveillance grids and control, like China who has Muslims under total surveillance and has 1 million of them in a camp (they aren't trying to sneak into China). They also harvest political prisoner organs and millions of unregistered women are in hiding because of the 1-child policy (not too mention females are aborted at an extreme rate). Iran's people have a shot because it's hard for the govt to control them with limited resources. The Soviets were energized by not so bad relations with the West after WII. That gave them the build up for future proxy wars and destroying pockets of dissent, including entrenching the CPB and North Korea. And if we didn't resist and sanction, hundreds of millions would now be under the thumb of the Soviets and possibly under German Nationalist Socialists if the free world did not fight and sanction them too.

<comment><USER14> Are you sure that you know where do you live yourself? How many people life have USA ruined or ended for only it's own good? should I mention the whole Africa, Iraq, Afghanistan, Palestine, Iran, .... USA has ruined these people life only for the money and power. USA starts many of the terrorism groups, don't be blind, nobody create these groups nearby himself. It does this so it can sell it's weapons. It's like USA has made a playground way outside of his home, starting fights and selling weapon to them to fight and get money out of it and showing itself no related and sorry for all of these. Do you even understand not being able to buy a simplest drug for cancer of your close people what can do to you?

<comment><USER13> The neocons that blundered in Iraq and the neoliberals (like former Sec State HRC) that overthrew the Libyan dictatorship and targeted the Syrian autocracy, were democratically removed from leading US foreign policy. Democracy here adjusts. The 45th has accelerated the withdrawal from Syria due to anger from voters. The neocons and neoliberal have been pushing for Syrian escalation and the ousting of Assad. And there is now a peace path with North Korea, despite again extreme criticism by the necons and neoliberal.

On the other hand there is no accountability in Iran, Russia, or Syria. Russia just straight up annexed Crimea. And Putin is still in power and popular among Russians. Assad still hasn't held more than a single election in 5 decades. Again, the Bushs are out because of Iraq. And Afghanistan (that sheltered terrorist Al Queda) has a trillions in USD in rare earth deposits, yet we buy from China almost exclusively. China is not our friend anymore. We don't even own Iraqi oil.

Sanctions are just. And Nazis, Imperial Japan, and the Soviets were once embargoed, and they would be running an impoverished world today, if not for the US-led efforts. To the contrary, world GDP has increased many fold and US inventions, like the internet, lift billions out of poverty and into the drivers seats of their futures. Defeated former foes in Japan, Germany, even Russia, et all, and the defended like South Korea are doing fabulously after wisely focusing on building instead of launching an insurgency (after losing) because of "Death to Israel and the Great Satan" or whatever. Shame on the insurgents for plunging Iraq into disarray.

I have no idea what you're talking about with Palestine. The Palestine Authority pays million of dollars (from billions in US aid) a year to the families of terrorists (the longer the prison sentence, the more they pay), like someone that goes into a jewish house and stabs the entire family to death. Iran also supports terrorist Palestinian Hamas. Again, a lot of complaining and little building. Sanctions would come off if they stopped strapping on suicide vests because "Death to Israel".

Is our republic perfect? No. But more people have immigrated here than anywhere in history. We still take in more immigrants than anywhere else. And families that refuse to wait in line, risk their lives to cross desserts to wind up in temporary detention centers for a few a weeks just to get a residency court date. We have a Muslim Somali immigrant woman that's elected into Congress, and routinely disrespects our ally Israel and even the US. She is not in prison because of our freedoms. How many immigrant Jewish Americans are elected in Somalia?

Which country are you from?

</comment></comment></comment></comment><comment><USER15> > Travel in these regions may impact your account status,...

?!?@!

<comment><USER16> I believe Slack did this too; if you've ever signed-in to Slack within a country that is currently restricted, your account was just deleted without warning.

<comment><USER4> Thats a good one! One more reason not to use Slack.

<comment><USER17> Or one more reason not travel to sanctioned countries.

<comment><USER4> Fair, there's usually a good reason they're sanctioned heh.

<comment><USER18> Hegemony isn't a good reason.

</comment></comment></comment></comment></comment></comment><comment><USER19> "GitHub.com may not be used for purposes prohibited under applicable export control laws, including purposes related to the development, production, or use of nuclear, biological, or chemical weapons or long range missiles or unmanned aerial vehicles."

So anybody developing any kind of drone and hosting on github is breaking the law?

<comment><USER4> Basically yes.

<comment><USER19> That was a rhetorical question. But, yeah, wow.

</comment></comment></comment><comment><USER20> I find it awesome that they actually have a defined and documented Appeals Process.

</comment><comment><USER4> Related to this post I just made: [https://news.ycombinator.com/item?id=20527070](https://news.ycombinator.com/item?id=20527070)

</comment><comment><USER21> Reminds me of a US based PC vendor(I think it was Dell or IBM) whose web site store has a check box like : I do not use this product for nuclear weapon development.

<comment><USER22> Wow! What kind of product was it? I assume it wasn't a laptop or a general purpose server hardware.

<comment><USER23> I've had to certify that license term when I bought servers for an academic research lab that did nothing with nuclear energy. (We actually worked with infectious diseases, way more dangerous imo!)

</comment></comment></comment><comment><USER24> Seems a real shame there's no mainstream alternative not subject to the US' belligerent foreign policy. Does anyone know if Gitlab is subject to the same restrictions?

The sanctioned countries and regions fall even further behind and open source developers have to deal with the fallout of America's broken foreign policy.

<comment><USER4> Any SaaS run out of a first world country is subject to this.

AFAIK its probably not illegal to run your own Git/SVN server...

</comment></comment><comment><USER25> This page doesn't appear to have a date on it. Is this something new that GitHub is doing? If so, is this Microsoft's influence we're seeing?

<comment><AUTHOR> Yes it's new, my repos were disabled today

<comment><USER26> What was the particular reason given?

<comment><AUTHOR> Living in a sanctioned country.

</comment></comment></comment></comment><comment><USER27> How feasible is for Github to create an EU organization, which is effectively mirror of github.com? So all commits, issues,... are cloned in both. But .eu usage is not governed by US law. Also, repos can be blacklisted from .com/.eu based on rules.

<comment><USER28> I would not be optimistic about that working as any kind of legal loophole to get around US export restrictions. I don't know any reason it would. (I am not a lawyer).

<comment><USER29> What if users had the option to host repositories in EU servers run by the EU subsidiary? There's no exporting then right?

<comment><USER4> The EU has its own set of restrictions but I'm not sure of the overlap. I'm sure the US could get the other countries on that list.

</comment></comment></comment></comment><comment><USER30> OT:

> On which countries and territories are U.S. government sanctions applied?

> Crimea, Cuba, Iran, North Korea, and Syria.

Crimea? Isn't that part of Russia now, so what is the point of sanctions against Crimea? To affect Crimean policy wouldn't they need to sanction Russia, not Crimea?

<comment><USER31> Policy lets you sanction individual regions of a country by saying the port of entry or destination port is subject to sanctions.

So you can take a ship with X to Russia proper, but not to Crimea. Or you can work with a Russian bank, but not a Russian bank based in Crimea.

It's like how Hong Kong is considered a separate territory, despite being a part of China.</comment></comment>


Show HN: So, you had a productive day? Until now (brain challenge) - <AUTHOR> http://treksit.com/?thegame <comment><AUTHOR> A browser game with calming music.</comment>


Most Popular Desktop IDEs and Code Editors in 2014 - <AUTHOR> https://blog.codeanywhere.com/most-popular-ides-code-editors/

<comment><AUTHOR> Yes they are a bit, but as mentioned these are mostly Web Devs.

</comment><comment><USER2> Notepad++ and netbeans seems to high, intellij to low. At least judging from my gut</comment>


Ask HN: Review my app, UnusedCSS.com - <AUTHOR> http://unusedcss.com/

<comment><USER2> Works well, but I need it to consider the whole site.

For instance, I fed it the root URL, and most of the unused selectors it surfaced are in fact used on other parts of the website.

<comment><USER3> Indeed, this works fine for pages which just contain CSS for that specific page but I'm not sure how often that actually occurs in the wild. And if you've got just a one page site then surely managing the CSS for that isn't a big issue?

For most of the sites I've worked on, I bundle up the CSS into a main stylesheet and then often one specific stylesheet per-section. If this could spider the whole site and generate a report on that then it would certainly be more useful.

<comment><AUTHOR> Thanks for the feedback!

I halfway implemented traversing whole sitemaps, but never finished because the waits were getting so long that I would need to move away from django and towards something like twisted where I could incrementally update the results and work asynchronously.

Would you rather give a sitemap or a representative list of URLs?

<comment><USER4> I am the same

I would prefer it to work along the same lines as <http://validator.w3.org/checklink> where it just automatically spiders

</comment></comment></comment></comment><comment><USER5> It's cute but I think the ramifications for left over CSS are pretty insignificant except in some very rare edge cases.

It would be cooler if you could feed it a CSS file and have it return a better version of it, well and concisely formatted without redundant declarations, using shorthand etc.

That would take this from something that doesn't really need doing - like css minification in a world where gzip exists, such as our world - to something that would show people a better way to produce CSS and still retain that original functionality if you're convinced there's a need for that.

<comment><AUTHOR> I think there are 2 main benefits:

1.) Maintainability. Promote re-use of selectors and organization of your css files. I find that CSS gets sloppy very quickly and there will be lots of non- DRY, redundant selectors, as well as legacy selectors that no one will ever remove because "what if something is still using it?" Your css files will slowly get larger and larger, and never smaller. This leads to the next point.

2.) Smaller file size. Less bandwidth used, faster requests. Yahoo has done a ton of research on the benefits of performant web apps: <http://developer.yahoo.com/performance/rules.html>

</comment></comment><comment><USER6> It would be helpful if you could create a CSS file with only the used CSSed and allow the user to download and save it.

Maybe even optimize the file by removing all spaces, tabs, line breaks.

<comment><AUTHOR> That's a great idea! Thanks!

</comment></comment><comment><AUTHOR> I built this because the only existing solutions to finding old legacy CSS that aren't being used anymore that I could find are Firefox plugins. Dust Me Selectors and CSS Usage being the two big ones.

I found that I am often at a machine without Firefox, or I don't want to install an addon (or addon for an addon in the case of CSS Usage) just to quickly find out what CSS selectors aren't being used on a given page.

All feedback is very welcome!

</comment><comment><USER7> It would be nice if you could link to the results or query a URL with param so you can send it to someone else (like the designer who created the css).

<comment><AUTHOR> Will do, Thanks!

</comment></comment><comment><USER8> (I left this as a feedback on your site as well).

I agree... works well. But in the case of <http://inclojure.com/> it says the URL is broken.

On a positive note, I tried it on 2 other sites, and it works really well. Great job.

<comment><AUTHOR> Hmmm, you are right, it isn't working for <http://inclojure.com/> (now with a www).

I will look in to it right now, thanks for the feedback!

</comment></comment><comment><USER9> Would pay for something like this, if it was solid, always up, and didn't require a plugin.

<comment><USER2> Does this require a plugin? I missed it if so.

<comment><AUTHOR> No, it does not require a plugin.

The other solutions to this problem that I have found _do_ require a plugin in the form of Firefox addons.

This was my main motivation for creating the site; making it accessible from wherever I happen to be, regardless of my current browser and browser plugins.

</comment></comment></comment><comment><USER10> Like others have said, the ability to add multiple URLs so that it can scan the entire site (or better yet, have your code follow the links a few layers deep to discover the pages itself) would be immensely valuable.

<comment><AUTHOR> Thanks for the feedback!

Of the following, what would you prefer?

      * Ability to enter a sitemap that would be scanned
      * Abililty to enter multiple, representative URLs directly
      * Or your idea to automatically follow links N layers deep

<comment><USER10> On my site, following N layers would take you to a lot of identical pages. If you site could recognize that they are identical with respect to their CSS, it would save it a lot of energy.

<comment><AUTHOR> Identical from a CSS styling point of view or just multiple links to the same URL?

</comment></comment></comment></comment><comment><USER11> I think this is a great idea for an app.

If I could make one suggestion, it would be to ignore some common CSS reset and CSS framework stylesheets to lower the number of false positives; when I scan my site I get a lot of unused selectors from these files, and you would detect them reasonably reliably just by looking at their filenames.

<comment><AUTHOR> Things like Yahoo's CSS reset?

Right now you can click on the arrow next to a stylesheet's name to hide it. Would you want to be able to completely remove it from the results, rather than just hide it?

</comment></comment><comment><USER12> It errors out on many pages of my personal site, including the home page: <http://vi.to/>

I'd guess it doesn't like the inline data: URL I use for an alternate stylesheet.

</comment><comment><USER13> I would hide the feedback form with a display:none instead of JS. It looks odd when loading, when half the homepage hides once the JS loads (even with Chrome).

<comment><AUTHOR> I will have to think about how to do this in a nice way. Right now everything is progressively enhanced, so even if you turn off JS, you can still use everything. That's why it hides it after-the-fact. Ideas?

<comment><USER13> That is likely the best way to do it for larger, general purpose sites. I just figured since you're providing a tool to web developers, finding someone who doesn't use JS is very rare.

</comment></comment></comment><comment><USER14> just hangs forever on some sites.. Tried far too many times.

<comment><AUTHOR> Can you give me an example or two of the sites that made the app hang?

Thanks.

<comment><USER14> Try www.heymath.com</comment></comment></comment>


Ask HN: How could setting an AI's goal to be "increase human autonomy" go awry? - <AUTHOR> I read Nick Bostrom's book "Superintelligence: Paths, Dangers, Strategies" a while back and found the problems in trying to set a goal for AI to be interesting/difficult. He outlines various ways the goals could be misconstrued by the AI, which eventually leads to human extinction. I think setting the goal to be "to increase human autonomy" might get around some of these problems. I'm interested to hear how people think it could go awry though. <comment><USER2> I guess a natural question is how to define and measure human autonomy.

If it's the autonomy of each individual human, increasing it without bound will cause existing societies to fall apart quickly (which is potentially fine under some ethical theories), and could create severe danger for other humans because people can use their enhanced abilities to fight and harm each other.

If it's the autonomy of humanity as a whole, you have to define some way of aggregating preferences or determining the will of humanity as a whole -- already a significant challenge today.

</comment><comment><USER3> Humans are obviously most autonomous if they are prevented from contact with the rest of the world and then left to fend for themselves.</comment>


Drawing Spirograph curves in Python - <AUTHOR> https://www.johndcook.com/blog/2018/08/30/drawing-spirograph-curves-in-python/ <comment><USER2> These are really fun shapes to play with -- here's another little python script to draw animated hypotrochoid frames that can be stitched together with ffmpeg: [https://github.com/hecanjog/hypotrochoid.py/blob/master/hypo...](https://github.com/hecanjog/hypotrochoid.py/blob/master/hypo.py#L47)

I stole the relevant bit from here: [https://stackoverflow.com/questions/22894942/plotting- hypotr...](https://stackoverflow.com/questions/22894942/plotting- hypotrochoids-using-python/22895353#22895353)

Here's one video example: [https://vimeo.com/99493389](https://vimeo.com/99493389)

</comment><comment><USER3> When moving circle is inside, its called Hypotrochoid [https://en.wikipedia.org/wiki/Hypotrochoid](https://en.wikipedia.org/wiki/Hypotrochoid)

When moving circle is outside, its called Epitrochoid [https://en.wikipedia.org/wiki/Epitrochoid](https://en.wikipedia.org/wiki/Epitrochoid)

The difference between two is sign for radius for moving circle.

Overall this is just ploting parametric equations in 2D in Python using complex number trick.

<comment><USER4> >When moving circle is outside, its called Epitrochoid >[https://en.wikipedia.org/wiki/Epitrochoid](https://en.wikipedia.org/wiki/Epitrochoid)

The combustion chamber of the Wankel engine is an epitrochoid. (From the above Wikipedia link.)

I had read up about Wankel (and also the more conventional internal combustion) engines as a kid. Thought the Wankel engine idea was cool. It has both pros and cons.

[https://en.wikipedia.org/wiki/Wankel_engine](https://en.wikipedia.org/wiki/Wankel_engine)

</comment></comment><comment><USER5> Its mentioned at the bottom of the article, but thought its worth calling out here too: [https://nathanfriend.io/inspirograph/](https://nathanfriend.io/inspirograph/)

</comment><comment><USER6> It's not a spirograph curve unless the cog teeth have slipped and your pen has scrawled across the page taking up a bit of paper with it and you have to start again.

<comment><USER7> Agreed. As much as I like coding and generative art too, there's nothing like the effort of keeping the smaller gear inside the larger one and going fast. Much harder on the outside! I just picked up a $8 Spirograph in tin case for my three year old.

</comment></comment><comment><USER8> Did you know there's a direct correlation between the decline of Spirograph and the rise in gang activity? Think about it!

<comment><USER9> I'm going to mail one to the oval office. I think spirographs could save us from nuclear war.

</comment></comment><comment><USER10> There's been progress since the 80s when I typed in Basic code for this from a magazine -- it was quite a bit harder to follow.</comment>


All the Ways You Can Dispose of a Dead Body - <AUTHOR> https://lifehacker.com/here-are-all-the-ways-you-can-dispose-of-a-dead-body-1836055910?rev=1562106963868 <comment><USER2> Title feels clickbaity, this is about your options for your own body

<comment><USER3> Title feels clickbaity because it is missing "(Legally)" between "Can" and "Dispose"

dang (admin) or lecarore (submitter) could you please edit?</comment></comment>