New React website - <AUTHOR> https://reactjs.org/?new <comment><USER2> As an aside, I hate the official React tutorial and am disappointed that there are no revisions to it with this significant redesign and React version update. It is the embodiment of the "how to draw an owl" meme, requiring you to have a strong JS frontend background in the first place, and the resulting demo application doesn't give much insight in how to use React for standard websites. (Unfortunately, this isn't unique to the official React tutorial; many React tutorials are like this)

Contrast with the official Vue.js tutorial ([https://vuejs.org/v2/guide/](https://vuejs.org/v2/guide/)), which goes through things step by step with normal HTML syntax.

<comment><USER3> As the person who designed most of the tutorial, I'm sorry to hear this. My goal was to give people practice building a few simple components and connecting them together.

It's true that we assume preexisting JS knowledge, but your other point about how it doesn't give much insight into using React is one I haven't heard before. Can you say more about what you mean?

Anecdotally in my experience, most people seem to find the tutorial pretty helpful, but we can think about more options. Maybe there's space to add one that assumes less about JS. (And really -- thank you for complaining about this, or else we wouldn't have known.)

<comment><USER2> Thanks for replying. With respect to the insight in using React, I assume that the majority of React users are using it to build websites/SPAs, with concerns such as client/server data flows, templating/styling, and URL routing. While the tutorial does demonstrate a good demonstration _how_ React works, it doesn't provide much practical knowledge for building websites, and worse, doesn't provide info on _how to start_ building a website. (which just leads me to look at _another_ tutorial)

<comment><USER4> They tried to add routing to to docs/tutorials. react-router devs hijacked the effort, ground it to a halt with claims of copyright to their code, and the pull request to docs got rejected in the end

<comment><USER5> Link?

<comment><USER4> Relevant comment is here: [https://github.com/facebook/react/pull/8848#discussion_r1055...](https://github.com/facebook/react/pull/8848#discussion_r105542575)

Full pull request is here: [https://github.com/facebook/react/pull/8848](https://github.com/facebook/react/pull/8848)

As a result one of the React contributors ended up apologizing to react-router [https://github.com/facebook/react/pull/8848#issuecomment-285...](https://github.com/facebook/react/pull/8848#issuecomment-285915316)

</comment></comment></comment></comment></comment></comment><comment><USER6> To add a bit of context: the React docs were previously a Jekyll site that was hosted at facebook.github.io/react/. The new site was rebuilt using Gatsby.js (a React-based static site generator), uses the Glamor CSS-in-JS library for styling, and has a bunch of nice tweaks and improvements overall, like the live component editors on the front page.

<comment><USER7> Gatsby is great but it has issues generating sites with a large number of pages. There are performance issues and generation fails if the number of pages goes above a certain threshold.

I had to abandon it for a project that was generating static SEO pages, it was something on the order of 2000 pages and Gatsby couldn't handle it. Hopefully they resolve that soon!

<comment><USER8> > _Hopefully they resolve that soon!_

Or, hopefully, they don't. SEO pages suck users time.

<comment><USER9> Could you fill me in? Why do SEO pages suck users time? I'm a newbie.

<comment><USER8> SEO pages are crap meant to make a site with otherwise no interesting content (else it would have used that) rank higher on Google.

</comment></comment></comment></comment></comment><comment><USER10> This is very timely for me - I was just looking for a new static site generator and so far I've tried out Hugo, Hexo and Jekyll but I didn't like any of them because they're so configuration dependent. I'd rather write my static pages using tools that I already know how to use.

Searching for a static site generator that uses React, I found Phenomic first then Gatsby. I was already leaning towards Gatsby since Phenomic is still in alpha. Now that Facebook is using it, my decision is easy. Phenomic looks like it can do a lot more than Gatsby, so maybe I'll give it a second chance in the future.

<comment><USER11> >a static site generator that uses React

Does this mean the HTML is constructed by rendering components to strings using ReactDOMServer, or that the frontend scripts use React? Or both?

<comment><USER12> Both. Checkout gatsbyjs.org, the tool the site was built with. But basically Gatsby renders each page to HTML and writes it out to disk similar to other static site generators. And then when the HTML loads, it pulls in JavaScript to make the site "live" so that from then on out it acts like a normal React web app.

Gatsby is an attempt to blend the best aspects of static site generators and web apps.

</comment></comment></comment><comment><USER13> The most amazing thing, to me, regarding React, is that it's a pretty awesome framework, from the perspective of a developer.

...and yet, I go and try to use Facebook, and the experience is totally fucking repellent.

Even in a closed third-party testing loop, when you control for social variables and human factors, by populating your circle with only fake test accounts you control and have created yourself, for which no one else has the password. (e.g. staging a hypothetical sequence of events, to model an expected experience)

Just trying to do anything is met with the most bizarre and byzantine behaviors and switcheroos.

<comment><USER14> Do you have specific examples of what makes "the experience is totally fucking repellent"? We can work on trying to fix them :)

<comment><USER13> I'm not trying to be disrespectful, and I fully understand that there's a huge, huge ream of people working to deliver Facebook, but honestly, I could fill multiple volumes of multiple books with the things that Facebook does wrong, and some of it is surely deliberate dark patterns, with specific behavioral objectives, but other aspects are not.

Nevermind whether or not one agrees or disagrees with the all-encompassing nature of Facebook's grip on so many social circles, or whether one has an opinion about Facebook's policies and business practices, the website itself is pretty bad. Bad enough that, had I my druthers, I'd be able to create something that out-competes it, if a creation I put forward could clear the sheer gravitational inertia of the network effect that Facebook enjoys. And I realize that's no small claim, but here I am making it anyway.

It's not your fault, specifically that shit sucks on Facebook all over, and I sincerely doubt you'd have the clout necessary to enact change.

Since it'd be a lot to write up, and this is simply yet another peanut gallery web forum, I'll say this much: as a user, I am clueless about the decision tree I'm offered when I log into Facebook, furthermore, so much of Facebook is mystery meat links and who knows why I see half of any of it. Then as soon as a snippet of user-created content appears, it's buried. Go in to check the settings to see what the hell this system is trying to do for me, and I see trashy icons leading to incomplete features that don't even work as advertised, and I never get what I want, when used as directed. After about 30 some-odd clicks per any given session, and maybe 100 sessions of trying and retrying various combinations from a clean cookie, learned helplessness kicks in, I shut down my computer and find something better to do.

BTW, this cuts across several assets and UI's throughout Facebook's offerings as a whole, for all devices.

<comment><USER13> Addendum: for an example of how it's done right, look at Slack. Slack has a completely different business model and general objective in serving the user, but divorcing this conversation from that fundamental idea, Slack (without being pretentious) gets it right 85% of the time, in that I'm able to do what I want, and get what I need. Facebook, on the other hand, is stepping in shit 75% of the time, and waxes manipulative when not seeming generally confusing and disorganized.

And to return to the original subject at hand, compare Facebook (right now, today) to React's general website and documentation facelift. The comparison turns out to be surprisingly different in quality. (hint: facebook rates lower)

</comment></comment></comment></comment><comment><USER15> It looks like Gatsby generates a static site as a SPA? What's the advantage of that approach over multi-page sites generated with Jekyll, Hugo, etc.?

<comment><USER12> Part performance and part developer experience.

Gatsby generates HTML pages for each page so it loads as fast or faster than other static site generators but is way faster when clicking around the site as it prefetches pages and renders them in the client so the site feels like a local or native app.

It's also fully setup for building with leading modern web development tools like React, webpack, all CSS options including css-in-js, code splitting, PWA techniques, etc. so the development experience is excellent and you get production quality code without any setup.

Gatsby's ambitions are much higher than simply transforming markdown into HTML. See the writeup of the talk I gave recently describing Gatsby as a website compiler [https://www.gatsbyjs.org/blog/2017-09-13-why-is-gatsby-so- fa...](https://www.gatsbyjs.org/blog/2017-09-13-why-is-gatsby-so-fast/)

</comment></comment><comment><USER16> Huh. Does Gatsby not support RSS or Atom feeds? Can't find any for the site or blog.

<comment><USER17> Gatbsy supports RSS (and Atom?) as a plugin. Probably not enabled for this site.

<comment><USER18> The plugin output a feed in the Atom standard, proof : [https://www.gatsbyjs.org/blog/rss.xml](https://www.gatsbyjs.org/blog/rss.xml)

</comment></comment></comment><comment><USER19> What's with the blip/FOUC?

<comment><USER20> Looks like it's related to their use of TypeKit for fonts.

I haven't used TypeKit in a while, but it looks like they had this issue a year ago [1]. Unclear if it has been fixed or what. A lot of people I know simply embed the font in the page (ugh)

[1] [https://blog.typekit.com/2016/06/03/regarding-the-flash- of-u...](https://blog.typekit.com/2016/06/03/regarding-the-flash-of-unstyled- text-in-chrome-50/)

<comment><USER21> We're looking into it, sorry about that.

</comment></comment></comment><comment><USER22> Interesting that they use the

      this.handleChange = this.handleChange.bind(this)

example over the simpler lexical declaration.

      handleChange = () => {}

Is the reason for them not using the latter due to the spec not being finalized yet?

<comment><USER23> The spec is final (arrow functions were in ES2015), could be they just still have IE11 users they expect to support.

<comment><USER21> No, these are "class fields" rather than arrow functions, and are not part of ES2015. This is why we're not using them in the docs yet. Indeed they would make everything a bit nicer :-)

<comment><USER23> Ah, okay, that's what I missed from the example out of context.

</comment></comment></comment></comment><comment><USER24> Is it possible to use React with a custom canvas-rendered UI? Is it in any way benefitial to do so compared to not using React for the custom canvas-rendered UI?

<comment><USER25> Text selection is generally a pain in canvas. That's pretty important for docs and examples. HTML is specifically made for displaying text and text is basically all the React site does. No need to fight an uphill battle when you already match the ideal case.

</comment></comment><comment><USER26> Pretty cool how you can edit the examples.

</comment><comment><USER27> Gatsby is dope!

</comment><comment><USER28> wooooo, almost as sexy as [https://angular.io](https://angular.io)

<comment><USER29> That's an absolutely beautiful website by a framework I hope to never use again.

React feels so much nicer and it's use of Vanilla JS makes it so much easier to debug. It's a breath of fresh air.

<comment><USER28> Angular is better for larger applications, I like it.

</comment></comment></comment><comment><USER30> Slow news day.

</comment><comment><USER31> The framework and language of champions

        this.handleChange = this.handleChange.bind(this);

<comment><USER21> Which is our colleagues at Facebook worked on the class fields proposal that addresses this elegantly :-)

[https://github.com/tc39/proposal-class- fields](https://github.com/tc39/proposal-class-fields)

Changes to the language take time, but then they benefit everyone and not just a particular library.

<comment><USER4> The proposal does nothing to remove the awkward binding everywhere, unless I'm mistaken. Here's the verbatim quote from the proposal:

\--- quote ---

With the ESnext field declarations proposal, the above example can be written as

        class Counter extends HTMLElement {
          x = 0;

          clicked() {
            this.x++;
            window.requestAnimationFrame(this.render.bind(this));
          }

          constructor() {
            super();
            this.onclick = this.clicked.bind(this);
          }

          connectedCallback() { this.render(); }

          render() {
            this.textContent = this.x.toString();
          }
        }
        window.customElements.define('num-counter', Counter);

\--- end quote ---

this.onclick = this.clicked.bind(this); etc. are all still there

<comment><USER32> It does, you can write this with a Babel preset supporting this feature:

        class Foo extends Component {
          state = {
            foo: '',
          };

          // The arrow function here is what you're looking for.
          onChange = ({ target }) => {
            this.setState({
              // You can of course use `foo` directly as the key if you just have the one input.
              [target.name]: target.value,
            });
          };

          render () {
            return <input type="text" name="foo" value={this.state.foo.value} onChange={this.onChange} />;
          }
        }

<comment><USER4> Then either the readme in the proposal is wrong or the unknown babel preset is wrong

Also, your example is not equivalent to either the complaint in the original comment or to the code snippet I quoted

Also: React has been binding event handlers to `this` since forever without presets (update: only in React.creatClass though)

<comment><USER21> The proposal README is written for TC39 and not React users, so it doesn't address the problems React users face.

Yes, with public fields you can write

        handleClick = () => {
          // ...
        }

and it works like if you bound it in the constructor.

Hope this helps.

<comment><USER4> It's not just React-specific. I was correct: the proposal does exactly nothing to make sure class methods are bound to class instances.

      handleClick = () => {...}

This is a shitty workaround that abuses class fields and arrow functions

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> This web site doesn't follow best practices of not saying what it is, not giving any examples, not letting you see it in action, making users have to read through outdated, long manuals that if you follow directly you get unexplained error messages you have to Google, needing to watch and follow along with a 15 minute youtube video whose first 10 minutes talk about the different choices of IDE's that you have, how to download and save a file from the Internet, and finally whose last 5 minutes do something obscure and contrived, that is the the wrong way to do something.

In fact, if you go to reactjs.org, within the first 7 seconds you can see live examples. (By scrolling down.) If you click the prominent "get started" button prominent at the top of the page, you get taken to a page that says "The easiest way to get started with React is to use this Hello World example code on CodePen" and a single click gets you there. The intro tutorial itself quickly walks you through everything, gearing up from basics to an advanced summary quickly in a well-structured way. It has a "help I'm stuck!" section that tells you exactly what you need to do if you are stuck.

This needs to die.

Someone needs to go about writing some half-assed documentation and putting it up on github without any usable links.

Information is meant to be hidden, and the role of documentation, such as reactjs.org, is properly to hide the nuggets of usable information among false starts, unexplained terminology, long flowing paragraphs of flowery prose that reduce to "", important notes that can only affect people who already know everything else about the thing in question, such as information about upgrades and transitions, and just generally give the sort of impression you get when you read through useless government paperwork.

Take note, people. if you make a site like this, then you can end up being the best-adopted and most popular solution in your entire industry - that's no way to program. Documentation is meant to be a hurdle, a kind of euthanasia program that takes enthusiastic new visitors and tears out their enthusiasm, destroys their will to live, and grinds them down with prose.

<comment><USER33> Just a note that in the parent post I was being ironic: the web site and tutorial are truly great and a model for what other projects should be doing.

<comment><USER12> Looks like Poe's law struck again :-)

[https://en.wikipedia.org/wiki/Poe%27s_law](https://en.wikipedia.org/wiki/Poe%27s_law)

<comment><USER33> yes :)</comment></comment></comment></comment>


Google: Security Keys Neutralized Employee Phishing - <AUTHOR> https://krebsonsecurity.com/2018/07/google-security-keys-neutered-employee-phishing/ <comment><USER2> For those interested, I recommend reading how FIDO U2F works. There's more in a security key than just FIDO U2F, but FIDO U2F is easily the most ergonomic system that these security keys support. Simplified:

* The hardware basically consists of a secure microprocessor, a counter which it can increment, and a secret key.

* For each website, e.g., GitHub, it creates a HMAC-SHA256 of the domain (www.github.com) and the secret key, and uses this to generate a public/private keypair. This is used to authenticate.

* To authenticate, the server sends a challenge, and the security key sends a response which validates that it has the private key. It also sends the nonce, which it increments.

If you get phished, the browser would send a different domain (www.github.com.suspiciousdomain.xx) to the security key and authentication would fail. If you somehow managed to clone the security key, services would notice that your nonces are no longer monotonically increasing and you could at least detect that it's been cloned.

I'm excited about the use of FIDO U2F becoming more widespread, for now all I use it for is GitHub and GMail. The basic threat model is that someone gets network access to your machine (but they can't get credentials from the security key, because you have to touch it to make it work) or someone sends you to a phishing website but you access it from a machine that you trust.

<comment><USER3> It's also tremendously more efficient to tap your finger on the plugged in USB than it is to wait for a code to be sent to your phone or go find it on an app to type in. I've added it to everything that allows it, more for convenience than security at this point.

Most places that allow it require that you have a fallback method available.

<comment><USER4> One thing I don't understand is why are apps like authy or google authenticator not using push notifications to allow you to directly auth via unlocking or touchID instead of having to go through the app. If you really want the user to type something then you can still use push notitication for easy app access

<comment><USER5> TOTP is designed to be usable even while offline.

<comment><USER6> But is that trade off worth it? Is the ability to work offline worth giving up a simple prevention of phishing attacks?

<comment><USER2> Full circle here, since FIDO U2F has phishing-resistance like push notifications and lets you work offline like TOTP. "Offline" in the sense that everything besides whatever you're authenticating against can be offline.

<comment><USER7> Push notifications offer no phishing resistance. The attacker can present a fake login experience and conduct a real login behind the scenes at the same time. If you think you're logging in, you'll approve the push for them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> U2F is fantastic. I wish Apple supported it in Safari (hoping!).

Also, YubiKey 4 is a great device. Set it up with GnuPG and you have "pretty good privacy" — with convenience. I recommend this guide for setting things up: [https://github.com/drduh/YubiKey-Guide](https://github.com/drduh/YubiKey- Guide)

The great thing about YubiKeys is that apart from U2F, you also use them for OpenPGP, and the same OpenPGP subkey can be used for SSH. It's an all-in-one solution.

<comment><USER9> Yea, except YubiKey got compromised.

[https://www.yubico.com/support/security- advisories/ysa-2017-...](https://www.yubico.com/support/security- advisories/ysa-2017-01/)

And, if you lose your fob or your backup fob you're boned.

<comment><USER10> That vuln only affected RSA keys generated for specific niche functionality and not most uses of the YubiKey.

> The issue weakens the strength of on-chip RSA key generation and affects > some use cases for the Personal Identity Verification (PIV) smart card and > OpenPGP functionality of the YubiKey 4 platform. Other functions of the > YubiKey 4, including PIV Smart Cards with ECC keys, FIDO U2F, Yubico OTP, > and OATH functions, are not affected. YubiKey NEO and FIDO U2F Security Key > are not impacted.

<comment><USER9> Hm, I suppose, though that is the functionality the poster I was replying to was discussing. Though, one has to wonder, what other flaws are lurking below the surface on that chip. It isn't flawless. Once there is another major issue it is going to be an abandon ship type of situation. What are the alternatives if any, move to a new key that doesn't have the problem or look into an alternative means, etc.

<comment><USER11> I think this is a revocation and provisioning problem: when the device is compromised, how hard is it to revoke that device and provision a new one for yourself?

Structurally, actually making these tokens should be commoditized anyway. So on the software side, it needs to be not absolutely painful to rotate credentials. Something like a one-time-pad that you can use in "in case of fire break glass" situations.

<comment><USER12> If you've ever used GitHub's SSH keys provisioning, any halfway decent U2F or WebAuthn implementation (including GitHub's) works a lot like that.

You can register as many keys as you like within reason, you can give them names like "Yubico" or "Keyfob" or "USB Dildo" and any of them works to sign in.

Once signed in you can remove any you've lost or stopped using, and add any new ones.

The keys themselves have no idea where you used them (at least, affordably priced ones, you could definitely build a fancy device that obeys FIDO but actually knows what's going on rather than being as dumb as a rock) and there's no reason for your software like a browser to record it. Crypto magic means that even though neither browser nor key remembers where if anywhere you've registered, when you visit a site and say "I'm munchbunny, my password is XYZZY" it can say "You're supposed to have one of these Security Keys: Prove you still do" and it'll all just work.

<comment><USER11> Thanks for the explanation. It all makes sense, and the public/private key system is awesome for that.

The point I was getting at was "if your one Yubikey is stolen, what do you do?" If you fall back on password authentication, then your Yubikey based system was only as secure as the password mechanism protecting your account recovery mechanism.

The answer might be "provision two keys and stick one in a bank deposit box", etc. Regardless, there's an inherent problem that you want your recovery mechanism to be as hard to crack as your primary authentication mechanism, but you need it to not be an absolute pain.

<comment><USER8> Most sites require you to set up another form of 2FA along with U2F (for example, TOTP using Google Authenticator). There are also recovery codes that you print and store on paper.

I don't consider losing a Yubikey to be a serious problem, though it's important not to use it to generate RSA keys, as then you will not be able to make any backups. Generate your keys in GnuPG and load them onto the key, keeping backups in secure offline locations.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I'd like to mention that I've been testing the Krypton app (iOS only for now) for U2F. You install Krypton on your iOS device, it creates keys that are only on the device. You then install the extension for Chrome. When U2F is requested they send the challenge to the iOS device which calculates the response and sends it back to the extension. App can be configured to require approval or always send response.

App also support SSH keys.

Works very well for me and the service is free. [https://krypt.co/](https://krypt.co/)

<comment><USER14> Good to hear you're liking U2F on Krypton. Android support was released last week, and Firefox/Safari support is coming soon!

<comment><USER15> I wish you just had the workstation download on the homepage again. I had to find your homebrew bottle GitHub repo to figure out how to install Krypton on my new MacBook.

<comment><USER16> Agree. The new page seems phishy. I double checked the domain and certificate before trusting the page at all. Other than that.. great product

</comment></comment></comment></comment><comment><USER17> Am I only the one who is disappointed in the seemingly stalling of traction for U2F? Google, Github, and Facebook supported U2F 2 years ago - so all I can see is Twitter, Dropbox and niche security news like KrebsOnSecurity.com have added support since then? Sure it's something, but 2 years I would have expected more - Who am I missing? Without more websites, consumer mass market has little incentive to adopt - and without users, websites have little incentive to support U2F - thereby furthering the stalling.

<comment><USER18> I needed a new bank and thought surely there will be one that offers U2F.. days of searching later, and I still have yet to find one that does. It seems like the vast majority of online banks don't even support any kind of 2FA except email/text. Really really sad.

For regular guys like me, I can't think of any online service more important to protect than my bank account.

<comment><USER19> Vanguard supports U2F. [https://investor.vanguard.com/security/security- keys](https://investor.vanguard.com/security/security-keys)

<comment><USER20> Yet only Chrome is supported -- and this does not include chromium-browser on Linux.

</comment></comment></comment></comment><comment><USER21> I guess this is a dumb question, but is it still "multi factor authentication" if you only use a single physical device to complete the login process?

The way the article is written, it makes it sound like the physical key is a replacement for 2FA instead of just a hardware device that handles the second factor (while leaving the password component in place).

<comment><USER22> > I guess this is a dumb question, but is it still "multi factor > authentication" if you only use a single physical device to complete the > login process?

This is a common misconception. The threat model of 2FA is not "I lost my device, and it is now in the hands of someone who knows the password".

The threat model of 2FA is one of:

1) "An attacker has gained remote access to my computer, but not physical access"

2) "I have been targeted by a sophisticated phishing attack, and I trust the machine that I am currently using"

TOTP (and even SMS) protects against (1) in most cases, though U2F is still preferable. U2F is the only method that protects against (2).

<comment><USER23> > U2F is the only method that protects against (2)

Would you be able to elaborate on this? I'm not understanding the difference between TOTP and the physical key from the article for this scenario.

<comment><USER24> With TOTP, a sufficiently clever phish may convince you to enter the one time code.

With U2F, there is communication between the browser and the device, requesting authentication for a specific origin hostname -- that can't (shouldn't) be fooled by a phish hosted at Google.com-super-secure- phishing.net

<comment><USER25> Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.

<comment><USER26> This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites.

[https://www.youtube.com/watch?v=Z20XNp- luNA](https://www.youtube.com/watch?v=Z20XNp-luNA)

</comment></comment></comment></comment></comment></comment><comment><USER27> Microsoft's position is interesting. The article states Edge will be implementing support this year. They run Github, which supports U2F.

But Microsoft are in the process of launching a new MFA and password management product in Office 365/Azure, and I'm informed U2F isn't on the roadmap.

<comment><USER28> Welcome to The Strategy Tax

</comment></comment><comment><USER29> Google's instructions for setting up these keys are unfortunately very bad, so I wrote this guide: [https://techsolidarity.org/resources/security_key_gmail.htm](https://techsolidarity.org/resources/security_key_gmail.htm)

</comment><comment><USER30> I wonder what happens when you forget your key at home. If I forget my keyfob for work, I usually have to do the walk of shame, around the hallway from the reception desk, whenever I use the bathroom. But I can still get in. And if I really wanted to, I could get a temp key for the day.

Do compiles like Google, et. al. have security departments that give people temporary keys that expire after a day, or do they have to run back home?

<comment><USER31> Yeah, you usually have one time use keys that can work in cases like that. Or you can get a new key from IT and go through a registration support.

</comment></comment><comment><USER32> For my personal email (gmail) I only recently went to Google Authenticator because I finally figured out how to put it on multiple devices. I was worried about the SMS code method's security, but I had no other way to ensure that losing my phone wouldn't leave me with no way to get into my accounts. (If I lose my phone I can still resurrect my phone # on another device by SIM replacement).

The U2F works fine for corporate, etc. where you have a support team who can help you in case you lose it or forget anything. They can make you come in person and prove that you are you.

The problem with implementing this for personal is that if you ever lose the key or code generator, you are absolutely fucked because there is no way to prove who you are to Google and have them reset your password / security.

<comment><USER33> You don't need multiple authenticators. The right thing to do is print multiple copies of your one-time emergency backup codes ([https://support.google.com/accounts/answer/1187538](https://support.google.com/accounts/answer/1187538)) and put them in many places. Wallet, car, house, parents' house, etc. You only have to do this once. The codes are useless without your password and you can revoke them at any time if you really need to, so spread them widely and then you won't ever have to worry about losing your authenticator.

</comment></comment><comment><USER34> Notice something important: they didn't use SMS.

Also, look at how GitHub uses U2F. Anytime you need to make an account change, you can simply tap your u2f key. It's a great user experience and really locks down your account.

</comment><comment><USER35> How does one use a U2F / YubiKey on a mobile device like an iPhone (lightning port), or are they only compatible with laptops and Android phones (USB-2, USB-C, USB-3) connections?

<comment><USER36> On Android, you have plenty of options and they all work. Specifically, my Neo key works with NFC and my YK4 works with USB OTG (both original flavor and USB-C).

Apple limits the capabilities of Yubikeys so much that it's best to summarize it as "Doesn't work". It's more of Apple's anti-competitive restrictions that seem to go unnoticed by most people because they have a shiny UI.

<comment><USER35> Thanks for that info.

So, then, if Apple wanted to adopt a similar solution to Google - i.e. for their own enterprise security, as opposed to for their customers - could they use one of the Yubikey NFC options, or, would they have to 'create' a Bluetooth-specific device?

Maybe the long-rumoured Steve Jobs ring could take the form factor?!

And from an Apple customer perspective, is there a valid argument to be made that iOS devices can be, or are currently, less secure than Android counterparts because of the current lack of Yubikey / U2F options?

<comment><USER37> The Yubikey NEO recently supports iPhone 7 and up: [https://www.yubico.com/2018/05/yubikey-comes-to-iphone- with-...](https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile- sdk-for-ios-and-lastpass-support/)

<comment><USER35> With some limitations, at least in iOS 11:

"Besides the fact that the NFC Reader interface can only be fired up from an app, Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F. ...

However, because NFC tag reading is supported, it allows developers to build apps, including consumer facing or purpose-built enterprise applications, with one-time passcode (OTP) support."

Which is what 'smiley1437' and others have effectively stated in other parts of this thread.

edit: added last sentence

</comment></comment></comment></comment></comment><comment><USER38> Is there any inexpensive USB-based security keys? I'd love to get one for my Mac and PC but Yubico Nano is $50; I would like two of these, but they are $100 already.

EDIT: I also see Yubico Fido Keys which are $20 each (and $36 for 2). Are there any differences between these and the regular Yubico keys?

<comment><USER39> If you have to ask, get the super cheap ones; you probably aren't going to use any of the features on the expensive ones (like the nanos and the Y4s).

You will read lots of people talking about the cool things they do with their Y4s, but really they're just doing it because they can, not because there's a well-thought-out security benefit they're getting (I'm as guilty of this as anyone). 95% of the benefit of a security key is simply U2F.

<comment><USER40> I use Yubikeys to store my GPG and SSH private keys. This way even if my laptop gets 0wned, the attackers won't be able to get my private keys. It basically is a more convenient form factor then using a Smartcard (which was how I had previously stored by GPG / SSH keys).

<comment><USER41> Is there any simple way to keep SSH keys synced across multiple keys?

I have 2 laptops and an Android device, so if I was to start using these things it would be convenient to keep my private keys available across them all.

</comment></comment></comment></comment><comment><USER42> When I buy a key, how will I know I can trust that key?

Is there any way to validate it?

Edit: It seems Yubico is a trusted brand so I guess you are safe when you buy keys from them.

Here is a list of FIDO certified products: [https://fidoalliance.org/certification/fido-certified- produc...](https://fidoalliance.org/certification/fido-certified-products/)

<comment><USER12> (Cheap) Security Keys are very dumb objects. They don't know anything secret except their own secret key. So I think the two naughty things bad guys might do are:

1\. Sell you a key whose secret key they already know. This is hard to defend against. But if you just buy a generic key from a reputable manufacturer and aren't a major target this seems pretty safe in practice.

2\. Hide something malevolent inside the security key's case, e.g. it's secretly a GPS tracker or it's a tiny USB disk plus keyboard that hacks your PC after detecting inactivity.

<comment><USER43> Is there any way to generate a new key on the device? What steps can a paranoid user take to mitigate problem (1) above?

<comment><USER12> In principle devices could be designed with the ability to generate a new key. But if you don't trust the hardware how does that help?

You may be able to make more of the hardware yourself, depending on how capable you are with electronics.

(Much) more expensive devices can implement FIDO while actually using arbitrary new keys for each registration and you could arrange to hand-pick the keys and then verify it behaves as intended and uses your chosen keys.

<comment><USER44> In the more expensive devices, are the arbitrary new private keys imported from the computer it's plugged into? If the new keys are generated on the hardware you don't trust, it'd still be the same problem, since the private keys could be generated deterministically from a known seed and a counter.

You can at least verify when a cheaply-designed device has changed its secret key, because the public key it offers for github.com is different from before, but yeah, that 'new' secret key could still just be derived from a manufacturer-known seed/secret serial number, too, same as the first one was, but with an incremented counter.

</comment></comment></comment></comment></comment><comment><USER45> Too bad the MacBook Pro _(without TouchID)_ only has two USB-C ports.

I use one for charging and the other one for the external display.

Guess I'll have to buy the one with TouchID for extra security.

<comment><USER46> A USB-C hub would be cheaper.

<comment><USER47> Only if your looking for a USB-C to USB-A hub. There is a surprising lack of good USB-C multi-port hubs, let alone any that support USB PD on anything but the upstream port. You're just now starting to see any that even have generic pass-through of PD.

<comment><USER48> It is surprising; I understand the difficulty in making a USB-C multi-port hub, but it seems like a huge missed market opportunity. The MacBook is far from the only device with only a single USB-C port and a headphone jack.

</comment></comment></comment></comment><comment><USER49> Does anyone know how to enable U2F support for LastPass as the article claims? I was under the impression that LastPass only supported OTP codes with YubiKeys and not U2F.

<comment><USER50> I agree. I think it's a mistake in the article. The author most likely saw that LastPass supports Yubikeys and thought that was the same as U2F?

</comment></comment><comment><USER51> Do the security keys prevent phishing because they will only login to the same site by checking the domain? So you can't mitm someone.

<comment><USER52> U2F incorporates the origin, which prevents phishing (unlike TOTP 2FA)

<comment><USER51> Thanks!

</comment></comment></comment><comment><USER53> Does a password management / U2F solution exist that would let you view all password titles with a master password but only dispense the actual passwords, one at a time, via a button press? Would prevent having your entire password DB stolen if you were keylogged/mitmd/whatever.

Picture of what I kind of mean here : [https://pbs.twimg.com/media/Diylx-0X4AIjrqO.jpg](https://pbs.twimg.com/media/Diylx-0X4AIjrqO.jpg)

*edit- slide #2 and #3 are backwards. The passwords are stored on the USB device, if that wasnt clear. Master password allows you to view password titles and essentially 'unlock' the usb device. However, every action needs to be confirmed one by one. So for instance, you could in theory export 'all' passwords in one shot, but it would present you with that prompt on the device itself.

<comment><USER53> Looks like the trezor has native support for ALMOST this exact functionality: [https://www.youtube.com/watch?v=5Jva- vcFQjE](https://www.youtube.com/watch?v=5Jva-vcFQjE) (it for whatever reason, stores the passwords on dropbox, instead of in the device...)

<comment><USER9> Dropbox isn't secure. They have a master key override and have many times already unlocked boxes without the user's permission. Also, they cache your credentials, anyone who gets a hold of the cache file can put it on another machine and get into the box without authenticating.

</comment></comment></comment><comment><USER54> I got a Yubikey for free through Ars Technica, but I haven't set it up yet. Regrettably it was a base model instead of the NFC model, which means I'll have to grab several adapters to be able to use it with my various Android devices, all of which tie to the Gmail account.

<comment><USER22> > I got a Yubikey for free through Ars Technica, but I haven't set it up yet. > Regrettably it was a base model instead of the NFC model, which means I'll > have to grab several adapters to be able to use it with my various Android > devices, all of which tie to the Gmail account.

For what it's worth, you can have multiple U2F devices. Twitter is the only website I'm aware of that only lets you register one U2F key.

</comment></comment><comment><USER55> I guess one limitation of this approach is that one can't login to anything from a VM that is running on a server that one has no physical access to - i.e. no way to plug the USB key in.

<comment><USER56> There are one-time codes and and there is support of remote keys over SSH (in most simple from this key just pretends to be USB keyboard and does typing of the code for you).

</comment></comment><comment><USER57> > _...thieves can intercept that one-time code by tricking your mobile > provider into either swapping your mobile device's SIM card or "porting" > your mobile number to a different device._

I know I'm paranoid, but this makes me wonder how safe it is at cell phone kiosks and stores when you grant them access to your account so they can see if you're eligible for a promotion or upgrade.

Last time I was at one of these kiosks (in a busy store) I had to ask the guy to log out of my account before I walked away.

<comment><USER58> That isn't really just being paranoid. Logging into your account on any public device is not secure at all.

Those kiosks are just computers, even if that employee logged out, who is to say that he didn't also install a keylogger before you typed in your credentials?

That is a really bad idea.

<comment><USER57> Yeah. I agree.

Maybe this makes it slightly less bad: to log into my account, the guy typed in a single-use random code which their special administrative interface texted to my phone. Assuming that code is truly only good for one use, there's a little safety in that.

But, I still wonder what exactly these cell-phone representatives do with the info they can access on my account, and whether they truly log off, or capture that web page's info somehow, etc.

I once saw a cell phone rep in-training take a picture of such a private account screen with their personal phone and then text it to another person in the company so that they could ask that person how to carry out the next step in the sequence of screens they needed to fill out. It was pretty disturbing.

Customers have to place a lot of faith in the retailer, unfortunately.

</comment></comment></comment><comment><USER59> While password based phishing might have been stopped by U2F it still leaves Gmail accounts vulnerable to OAuth phishing attacks which can be just as devastating.

</comment><comment><USER60> What are the mobile prospects here? Sound like the main motivation is that phone numbers are not secure second factors. But the result is a solution that only works on desktops (is that correct?) and requires a physical key that can be easily lost.

Modern phones now have secure coprocessors and biometric authentication. Why not use that method for the second factor? It doesn't rely on a phone number and it would handle both mobile and desktop.

</comment><comment><USER61> If security keys are so great, why do I still have to process two to five reCAPTCHAs every single time I log into almost any website?

reCAPTCHAs are ubiquitous and becoming increasingly time consuming. I probably have to spend 4 minutes every day filling them out. Google is getting 20-25 hours of free labour from me this year.

The class action suit that was questionably dismissed by the judge in 2016 should be revisited.

<comment><USER62> reCAPTCHAs usually have a trustiness factor built into the code. If some combination of identity (IP address, browser fingerprint, last login on the site, etc) is questionable, it will give you more captchas. Do you use a lot of public VPNs? Are things from your network stuff Google might consider shady?

<comment><USER61> Lovely argument you have there. It boils down to this:

"Perhaps you are not subjecting yourself to monitoring by Google so that they may further monetize your Internet history."

My initial argument stands:

"If security keys are so great, why is Google subjecting me to so many CAPTCHAs? Perhaps it is because they want free work. A password and security key challenge should be all the proof that Google needs."

I've had similar discussions before. I've even had someone call me a criminal for running an ad blocker. I'm not fond of the word shady either.

</comment></comment></comment><comment><USER63> Does anyone know if these things are possible to get working when your daily interaction is with a thin client?

My workstation sits in a rack in a server room, and where I work's current policy of 1.7 people to a desk means we all hot desk. Whatever thin client I sign into uses RDP to connect to my workstation. Is there enough UDP redirection support in RDP to make using these keys possible?

<comment><USER12> I am not sure. I'm assuming your thin clients have USB sockets and you can plug in generic USB keyboards, mice, etcetera. If you have to use a built-in keyboard + pointing device then you're almost certainly screwed.

The USB FIDO tokens are HID devices, but they deliberately don't specify what _sort_ of HID device they are. The idea is that this makes the client (browser) side easier as every major OS has some means for ordinary programs to talk to generic HID devices - to support graphics tablets and other odd things. So it's possible that a system generic enough to let you plug in any HID device (mouse, keyboard, trackball, stylus, whatever) to your thin client could work with FIDO.

Security Keys do seem like an attractive idea for a thin client environment if they work.

RDP does have "input redirection" but the problem is whether it's low level enough to redirect a HID protocol it doesn't understand. If RDP insists on thinking about keys pressed or movement of a pointer that's obviously no help for FIDO, but if it can just proxy the HID layer itself that's enough.

</comment></comment><comment><USER64> I don't get it: how it's better than my password manager not autofilling passwords? Which is basically free, and doesn't require inconvenient usb dongles. (I'm not claiming that it isn't better, honestly asking how it's better because I don't understand benefits of this technology over simpler solutions like password manager)

</comment><comment><USER65> Question here - how do I use a technology like this with my iPhone and iPad?

This looks great for my laptop, but that's only about 20% of my online time...

<comment><USER66> For Google Apps, you could use a Bluetooth LE U2F Security key, like a Feitan [1] plus the Google Smart Lock app on the App store[2].

1\. [https://www.amazon.com/Feitian-MultiPass-FIDO-Security- Key/d...](https://www.amazon.com/Feitian-MultiPass-FIDO-Security- Key/dp/B01LYV6TQM) 2\. Google Smart Lock by Google, Inc.

</comment></comment><comment><USER67> Adversaries just steal the cookie issued after MFA completes these days.

"We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said.

Makes me wonder if they have the right detections in place. It's extremely unlikely and naive to think that Google would not have at least one compromised account at any given time.

<comment><USER65> > Adversaries just steal the cookie issued after MFA completes these days.

Stealing a cookie is a _much_ different attack vector than phishing, which is what TFA is discussing. It also requires a completely different level of access and sophistication, which puts it in a category so different as to make comparisons irrelevant.

> It's extremely unlikely and naive to think that Google would not have at > least one compromised account at any given time.

Stealing a session cookie does not equal a compromised account, while phising does.

<comment><USER67> In the online world a session cookie or Bearer token is pretty much equivalent to an account compromise, in fact often it is exactly the same. Hard to argue if one gets email access to claim that their account wasn't compromised.

<comment><USER68> Not so fast. For years, Google has supported channel binding between GFEs and Chrome. The cookie alone is not enough: you need to steal the private key as well. I can't remember if that's the case, but it would make sense for @google.com accounts to have more aggressive settings.

[http://www.browserauth.net/channel-bound- cookies](http://www.browserauth.net/channel-bound-cookies)

Even before that, Google has had a system to detect cloned or tampered cookies on the server side for more than a decade, as described in its patented glory (don't open if you think your company's lawyercats are going to be unhappy):

[https://patents.google.com/patent/US8302169B1](https://patents.google.com/patent/US8302169B1)

</comment></comment></comment></comment><comment><USER69> So something to note on using them:

[https://www.yubico.com/support/security- advisories/ysa-2018-...](https://www.yubico.com/support/security- advisories/ysa-2018-02/)

If Chrome has WebUSB enabled and can see it, it would be possible to get around the security U2F affords.

<comment><USER70> Surprised not more people mentioned or recalled this, its perfect for phishing. one click, thats it.

</comment></comment><comment><USER71> The US Federal Government started migrating to using "security keys" almost 15 years ago for this reason.

Thanks George W. Bush !

[https://www.dhs.gov/homeland-security-presidential- directive...](https://www.dhs.gov/homeland-security-presidential-directive-12)

</comment><comment><USER72> John C. Dvorak has been complaining for years about how Google handles press requests. I don't have a good link to point to that captures what he's stated- but i'd summarize his position as this:

Google is completely shut down to journalists. They ignore press requests with legitimate information requests and if they don't like the tone, you'll get no official response. Dvorak observes that Google is starting to get worse and worse coverage in mainstream tech media as a result.

When articles like this do come out, they're usually privileged access and tightly controlled. Lots of beautiful photos of young, attractive google employees "changing the world."

In this case, we have yet another article published talking about how google is doing everything right.

Krebs is typically a reliable journalist, but this article stinks of privileged access to me. The key point is right at the beginning of the article:

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017 [...] the company told KrebsOnSecurity.

How much trust should we be investing in The Great Google again?

<comment><USER73> Taken literally, the article only highlights a correlation - introduction of the physical keys + absence of phishing. But Google may have introduced other security changes as well. The article doesn't go so far as to say that the switch to physical keys from SMS 2FA actually solved the problem on its own.

</comment></comment><comment><USER74> All I can think of is this fun story from a few years back: [https://www.theregister.co.uk/2013/01/16/developer_oursource...](https://www.theregister.co.uk/2013/01/16/developer_oursources_job_china/)

</comment><comment><USER75> Series of blog posts on how to use a YubiKey for SSH, 2FA, and 1Password:

[http://www.engineerbetter.com/blog/yubikey-all-the- things/](http://www.engineerbetter.com/blog/yubikey-all-the-things/)

</comment><comment><USER76> We use keys like the one pictured at our company. Handy for key stores of any kind and for U2F.

That said, the dongles are an abomination of engineering. I know that USB- jacks have a defined top. That is to no interest to vendors as it seems...

</comment><comment><USER77> You really have to trust something that you stick in a USB port and press a button on.

<comment><USER77> Seeing as I'm getting downvoted for this, we've already seen breaches due to infected USB sticks being sold next to NATO in Kabul [1], these seem like a pretty good black hat attack vector to me, especially as most employees are going to carry these things around on a keyring so they don't lose them. It only takes a second to switch it out for a compromised key when that employee is at the bar.

[1] [http://uk.businessinsider.com/russia-planted-bugged-thumb- dr...](http://uk.businessinsider.com/russia-planted-bugged-thumb-drives-to- break-into-us-govt-computers-2017-3?r=US&IR=T)

<comment><USER78> Each key is locked to an account. If you tap your key and it doesn't work, that's a potential security issue to be reported.

<comment><USER77> Yes, yes it is.

<comment><USER78> My point is

1\. This is immidiately obvious 2\. You've now maybe pwnd a single device, but in doing so you also removed any credentials from the device, so it's not valuable 3\. USB mice and keyboards already exist, and are plugged in to most computers.

<comment><USER9> I think drcongo's point is that if an operative meets someone at the pub and swaps out a similar looking fob on his keychain for one that contains a virus. It doesn't matter if you only "pwned" a single device, you're in the network and it is time to start exploring.

<comment><USER78> But you're not in the network. You have to authenticate to access the network, and that requires the u2f key that you just removed.

<comment><USER9> Your virus is on a machine in the network, therefore you're in the network. At that point, it is a matter of exploring the network, fingerprinting systems, scraping for exploits, and attempting intrusions. Or, waiting until an administrator does something silly like attempt to use their privileges on the machine to accomplish some task. I believe this was exactly how the Sony hack was conducted.

Edit: Also, at some point the employee will be reissued a new key fob for the "broken" one and at that point they will enter their credentials into the network again on that machine giving you access.

Edit 2: I guess a procedure that could prevent this is to require I.T. check the serial number of a fob that has been reported as "broken" thereby verifying there hasn't been a potential intrusion.

<comment><USER78> As far as I know, at Google my work laptop has as much access to the 'network' as my personal one does, at least until I'm authenticated. (Beyondcorp)

And the last time I plugged my keyring key into a computer was a year ago. Most use the nano keys which you never remove from the history device.

<comment><USER9> Deleted

Edit: In answer to your response. Yup.

<comment><USER78> I can't make heads or tails of this comment, likely due to hn formatting.

But as far as I can tell, this exploit requires 3-4 zero day exploits to be discovered in a system the attacker has no access to, and to all go undiscovered for an unknown amount of time for while said attacker is exploring.

That's much better than "I can steal user credentials and then download an exploit trivially."

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER79> How does everyone keep track of where they have used their Yubikeys?

</comment><comment><USER80> I wish smartcards had gotten more support. I like that it can combine two factors in one authentication mechanism.

<comment><USER81> This is surprising to me as well. In Germany, where I live, the government is using smartcards as authentication mechanisms at many places for at least 5 years now, if not 10 or more. The workers don't need passwords or user names, they're simply plugging in their card into their keyboard and when they're leaving for a break or are going home, they're taking their card with them and everything locks automatically.

This is only working internally, externally they have to log into a VPN via username/password and then have to use the smartcard as well.

I don't see why this is suddenly innovative.

</comment></comment><comment><USER73> > ...thieves can intercept that one-time code by tricking your mobile provider > into either swapping your mobile device's SIM card or "porting" your mobile > number to a different device.

Are these theoretical attacks? Has this ever actually happened?

The article only correlates the end of phishing with introduction of the physical keys. I'm wondering if it's really necessary - if typical 2FA via one-time pw to SMS is easily sufficient.

<comment><USER82> Yes I can't find the articles now but there are reports of phishers using this technique to get around 2FA over SMS.

<comment><USER26> They got around 2FA over SMS because a number of services like GMail offered _password reset_ via SMS as well as 2FA over SMS.

It was the password reset process that was the most vulnerable, and strangely the part that kept getting glossed over when people reported on the takeover incidents.

</comment></comment></comment><comment><USER83> Nice article. However a bit weird that they link to one of their advertisers :/

</comment><comment><USER84> Imagine if a promoter of a technology implemented in their browser was flawed/didn't work.

If you ask a wine producer how tasty his/her wine is, she would reply that's awesome.

</comment><comment><USER85> Same can be achieved without hardware part.

</comment><comment><USER86> even Google employees fall for these phishing attacks?

</comment><comment><USER67> If Google has an internal offensive pen test team, I assume they would likely disagree with that statement, esp. since Chrome allowed (maybe still allows?) to read Yubikey info via WebUSB for instance - only one click in UI that was the mitigation.

If Google would authorize external hackers (eg via bug bounty), it probably would take about 2-4 hours to phish an account successfully. :)

<comment><USER87> I believe this is the key quote:

"We have had no reported or confirmed account takeovers since implementing security keys at Google,"

Security keys basically remove the account takeover path, but there are still many other types of phishing attacks out that are still effective.</comment></comment>


Boards running Linux  - <AUTHOR> http://dev.emcelettronica.com/boards-running-linux <comment><AUTHOR> Linux is a Unix-type operating system which uses the Linux kernel. The name - Linux- comes from the Linux kernel, written in 1991 by Linus Torvalds. The system's utilities and libraries usually come from the GNU operating system, announced in 1983 by Richard Stallman. The following article presents some boards that are running on Linux.</comment>


Show HN: Free Social media Press Pages (demo) (reactjs/django goodness) - <AUTHOR> http://newslinn.com/i/businessdemo <comment><AUTHOR> Hi HN, This is a demo version of our free social media press pages. Just put live 3 days ago. Plenty more work to be done. Newslinn is building a network that connects citizens, organisations and journalists - we lauched citizen-to- journalist smartphone app last year - and these press pages are part of the organisation-to-journalist side of the network. Still plenty of work to do on the citizen app, a new version coming out next month. 2,000 journalists have joined newslinn so far. Can't think of anything else to say. best Shane</comment>


Fairfax, California B-17 Crash in 1946 - <AUTHOR> https://en.wikipedia.org/wiki/Fairfax,_California_B-17_Crash <comment><USER2> There have been many military crashes with nuclear weapon material on board, some resulting in its dispersal.

[https://en.wikipedia.org/wiki/List_of_military_nuclear_accid...](https://en.wikipedia.org/wiki/List_of_military_nuclear_accidents)

I'm not sure why this alleged one is particularly noteworthy.

</comment><comment><USER3> Did something happen that made this currently relevant, or was it referenced in another source recently? It's interesting enough, but I can't tell if there's some subtext that I'm missing.

<comment><USER4> Perhaps this: [https://news.ycombinator.com/item?id=14085454](https://news.ycombinator.com/item?id=14085454)

</comment></comment><comment><USER5> Command and Control (the book, I haven't seen the documentary) has a number of stories way way way scarier than this one.

Imagine an ICBM, with warhead, in a missile silo in Arkansas, massively and rapidly leaking oxidizer, the pressure for which in part provides foundation for the weight of the rest of the rocket above that tank; if it gets to a certain low pressure point, it crushes under the weight above, and then fuel and oxidizer combine, ignite, and now you've got a warhead involved in the ensuing conflagration.

I really think we've been incredibly lucky with nuclear weapons, and comparatively unlucky with nuclear power plants. Not that I have a problem with that.

</comment><comment><USER6> I remember when I was kid a convoy with a Pershing missile had an accident close to where I lived and there was a big fire. Nothing happened but it was pretty scary.

Even found an article: [http://www.spiegel.de/spiegel/print/d-14354045.html](http://www.spiegel.de/spiegel/print/d-14354045.html)

</comment><comment><USER7> There's a mountain bike trail in Camp Tamarancho named "B-17" after the crash. Though there is supposedly extant remains of a _different_ crash on the slopes of Mt. Tam, I haven't personally seen them.

<comment><USER8> The other crash is on the Mill Valley side, off the Vic Haun trail:

[http://www.atlasobscura.com/places/mount-tamalpais- aircraft-...](http://www.atlasobscura.com/places/mount-tamalpais-aircraft- crash-site)

From downtown Mill Valley, drive up Summit until it ends. That's the start of the Temelpa trail. You can take that trail all the way up to east peak summit (some amazing views along the way, highly recommended) but if you divert at Sitting Bull rock onto the Vic Haun trail, the trail to the crash site is a bit before the creek.

</comment></comment><comment><USER9> Related: [https://en.wikipedia.org/wiki/1961_Goldsboro_B-52_crash](https://en.wikipedia.org/wiki/1961_Goldsboro_B-52_crash)

(edit: or at least similar)

</comment><comment><USER10> Pretty sure a B-17 could not carry nuclear weapons of that era. It was, however, used to do atmospheric testing for operation cross-roads.

</comment><comment><USER11> I live right at whites hill and have never heard this story, thanks for sharing!

</comment><comment><USER12> A little too close to home!

</comment><comment><USER13> Mods, can we append (1946) to this?

<comment><USER7> Haha yeah -- I live in Fairfax, and I did a brief double take (though B-17 implies it was a while ago).

<comment><USER14> It does, but there's also still some preserved/restored flying for airshows or whatnot. I thought initially this was a crash of one of those.</comment></comment></comment>


Plagiarism: Reprints PG's 'The Equity Equation' with new name and no link back to source! - <AUTHOR> http://thegies.typepad.com/runtosurvive/2007/08/the-executive-e.html This guy reprints Paul Graham's 'The Equity Equation' but changes the name to 'The Executive Equation' and doesn't cite the source except by leaving a few links point back to paulgraham.com.<p>Is it just me, or is this not blatant plagiarism... <comment><USER2> It's funny that his tag line is "leading through innovation."

</comment><comment><USER3> His phone number is up there. Maybe someone should kindly tell him that plagiarism isn't very innovative.

</comment><comment><USER4> Who would hire a tech consultant with an AOL email address?

<comment><USER5> What's wrong with AOL? It's the internet isn't it?

<comment><USER4> Nothing is inherently wrong with AOL. But there is something wrong about a tech consultant with an AOL email address.

<comment><USER5> Heh. I had hoped the saracasm in my comment was evident. Apparently not!

</comment></comment></comment></comment><comment><USER6> Complete with original footnotes. :-)

<comment><USER7> The footnote links in the article leads back to <http://www.paulgraham.com/equity.html> . They don't even know how to steal content correctly.

</comment></comment><comment><USER8> lulz. Let's see him try and apply to YC now too. =)</comment>


How to Develop Apple Watch Apps - <AUTHOR> http://thinkapps.com/blog/development/how-to-develop-apple-watch-apps/?utm_content=bufferabaa6&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer <comment><USER2> Check with MOWARES which provides apps with tutorials for FREE.</comment>


Bananas as We Know Them Are Doomed - <AUTHOR> https://www.youtube.com/watch?v=2Bm5NWCMlPo <comment><USER2> The last time there was a banana disease that wiped out the Gros Michael, we ended up finding an (admittedly subpar) replacement quickly enough. With the amount of commercial demand behind bananas, once the disease makes its way through south and central American banana fields, we'll find another replacement.</comment>


Raspberry Pi Foundation launches the Raspberry Pi Store - <AUTHOR> http://store.raspberrypi.com/

<comment><USER2> It is interesting to see the resistance to selling stuff "on Linux" here. When the Apple II came out "kids" made games and software for it, and sold it in plastic baggies with a floppy disk and a photocopied "manual". Those of us in the community thought this was a great idea, not because we bought everything that came out, but the notion that you could spend your time working on this awesomely cool stuff and if other folks liked it enough what you were producing they would buy copies from you. Heck you could even make a living on writing software for people.

That made a lot of things you take for granted today possible. And it made total sense, here was someone spending their time writing code to do something that you wouldn't have to spend your time doing. You could write it yourself or you could leverage their effort by buying a copy of their stuff. That infused money into the field which gave people the freedom to invest their time into building amazing things.

</comment><comment><USER3> The donations system is great, but I would have preferred to see a push for a community built up around free and open source software.

The idea of a young person beginning to code and polishing their application and uploading and getting some money in donations. I'm more likely to donate to a great attempt at a project by a young person than I am to buy software on Linux. Raspberry Pi Store could have been the communities push to loads of great community driven open source projects.

<comment><USER4> Yeah, it seems like a lost opportunity in regards to that, as I too thought Raspberry Pi will generally help accelerate the growth of open source software.

</comment></comment><comment><USER5> Too bad the store is running on a Raspberry Pi.

<comment><USER6> I'm sorry, but I've gotta ask: Was that supposed to be a joke about R-pi sites often being unable to handle heavy traffic -- or is the store actually running on R-pi's?

<comment><USER7> You'd think by now that they'd come to understand that the demand for this product is completely off the charts and would have built a site that'd scale accordingly.

</comment></comment></comment><comment><USER8> I believe its just a app store rather than a hardware store.. They already have a merch store (<http://www.raspberrypi.com/>) and links to their suppliers.

As far as I know they don't want to sell direct through their only store..

</comment><comment><USER9> Cache: [http://webcache.googleusercontent.com/search?q=cache%3Astore...](http://webcache.googleusercontent.com/search?q=cache%3Astore.raspberrypi.com)

</comment><comment><USER10> They are selling everything else, but Raspberry Pi. At least that is what I saw. Has anyone seen the little machine at their store?

<comment><USER11> Sad, I came to the store hoping that there'd finally be a dependable US distributor of the devices themselves.

</comment></comment><comment><USER12> Will be buying a MPEG-2 license key this week - I'm currently only getting a "It works!" message on their store, but when I visited it yetserday, I couldn't find what payment methods they accepted before filling out the whole checkout process. Anyone know (I didn't finish the checkout process)?

\-- EDIT --

Looks like I was confused with their other store. This indeed just looks like an App Store :)

</comment><comment><USER13> Alternate Link - <http://www.raspberrypi.org/archives/2768>

</comment><comment><USER14> But does it actually sell the Raspberry Pi??

<comment><USER15> No. It's sold only at Element14, RS Components and Allied Electronics.

</comment></comment><comment><USER16> Looks down: <http://isup.me/store.raspberrypi.com>

</comment><comment><USER17> Remember, kids, sharing is bad.

<comment><USER18> How passive aggressive. I thought that open source wasn't necessarily free as in beer? Also, here we are on a site that basically promotes and fosters _exactly_ this kind entrepreneurial endeavour and we have the entitled masses complaining that they might have to pay for something.

</comment></comment><comment><USER19> I'd much rather do without the IndieCity client to be honest.

</comment><comment><USER20> On a tangential note, are they ever going to update this thing with a faster SoC? Its been a year since the design was finalized. I just saw an android dev board that blows this thing away for not much more. Not sure what the allure here is at this point. What's the Pi's roadmap, if any?

<comment><USER21> Blows it away?

16 way vector integer processor - giving ~4 Gigaops of integer compute performance (see [https://github.com/hermanhermitage/videocoreiv/wiki/VideoCor...](https://github.com/hermanhermitage/videocoreiv/wiki/VideoCore- IV-Kernels-under-Linux) for how to access it from user land).

24 Gigaflops via the QPU (from the 3d shader pipe) - which we have people beavering away on to open up soon.

Yes the ARM is weak on this one, but don't underestimate the power of the functional blocks and the open source and reverse engineering community.

Edit: see [https://github.com/hermanhermitage/videocoreiv/wiki/VideoCor...](https://github.com/hermanhermitage/videocoreiv/wiki/VideoCore- IV-Programmers-Manual) for more info, or check the root wiki page. Volunteers wanted - all shapes - all sizes - all capabilities (join the mailing list, or come visit us on IRC).

<comment><USER22> In your efforts to RE the GPU, have you uncovered any hope of getting faster I/O? I'd love to use all that GPU power, but the applications I have in mind require I/O to match (at the very least, solid 150 mbits/s USB2.0 and 25mbits/s Ethernet).

<comment><USER21> The only options I can think of for fast IO would be exploiting the MIPI CSI and DSI interfaces. I think you can get 2 Gbps input on CSI and same on DSI for output. You'd need some fairly specialist interface chips.

What would be nice in a future SoC would be say 1 Gbps Ethernet or USB3 right into the core of the beast. The current USB situation is rather disappointing - I would imagine the team would be avoiding the current IP in a hurry on future devices.

</comment></comment></comment></comment><comment><USER23> Its good to know that it works.</comment>


China's claim to the Spratly Islands emerged in first half of the 20th century - <AUTHOR> http://cimsec.org/chinas-claim-spratly-islands-just-mistake/36474 <comment><USER2> All: recent threads on Chinese topics have descended into nationalistic flamewar. That's about the worst thing you can do on Hacker News, and we ban accounts that do it, so please don't do it or anything like it, regardless of which view you favor.

Hacker News is a large community with people on all sides of all issues in all regions. Assume good faith, and check your matches, lighters, and brass knuckles at the door.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER3> He takes a wonderfully naive approach for someone who's historically knowledgeable. I'm sure he knows why and how territorial claims are made and how countries use and abuse historical data, archives, archeology, myths, narratives and make inflated claims from otherwise trivial facts (e.g. this document which has a stamp of a representative of the King on this trade document exchanging camels for figs shows the kingdom had economic representation in the region which under the cultural norms at the time was viewed as de facto political rule, traced all the way to now means the republic that succeeded the kingdom still has sovereignty here.)

None of these are mistakes, they're political claims.

The Aegean dispute is quite an interesting case study for anyone who wants to dive into how this all works. Due to the many islands in combination with international law (UNCLOS) it ends up screwing over Turkey massively, which unsurprisingly hasn't signed. In the south china sea this isn't as big a deal, but still important due to shipping, rare minerals, fishing rights etc.

<comment><USER4> Turkey owns 4 islands in the Aegean. Greece has over 6,000 in total. I don't see where you get the "screwing over" part. Is it because you think Turkey should have more territories than it does today?

Turkey should have signed UNCLOS a long time ago. 168 countries have. The only reason they postpone it is to maintain claims over Greece. Signing UNCLOS would also mean that their warships can no longer venture near Athens while claiming to be on international waters. And of course they'd finally have to stop pretending that the Greek-Cypriot EEZ connection doesn't exist.

I can see why Turkey and China are abusing historical data, archives, archeology, myths etc, just like you said, but I can't help but notice that they don't have any valid claims, and the moral thing to do (if there is one) would most likely be to drop those claims.

<comment><USER3> When I say screwing over, I don't mean that as a value judgement on Greece's position. Greece's position makes sense, international law is on their side as is history. I mean that it objectively is a bad deal for Turkey, I'm sure you agree with that.

i.e. if anything north of Antalya has no more connection to the Mediterranean or Atlantic Ocean (i.e. access to the sea) without going through Greek waters, that's an issue for Turkey. Greece already 'owns' about 50% of the Aegean, 12nm would extend that past 70%.

International law is the area of law least concerned with morality. Everyone disagrees but that's how it works because there's no such thing as a world court, world government, world police force. Just some semblance of it in our institutions that make a good effort but where political power is still key. Greece doesn't come close to Turkey's geopolitical power and has no explicit support from any major powers on this issue. That's why it hasn't changed from 6nm despite the law.

I would disagree by the way that they don't have valid claims. Perhaps under strict application of international law (which doesn't really exist) they'd lose. But they also make non-legal claims to equity and make claims about genuine concerns of the so called greek lake, which make quite a lot of sense.

<comment><USER5> _I mean that it objectively is a bad deal for Turkey, I 'm sure you agree with that._

Let's just assume that it is.

But you'd have to agree also that's hard to have much sympathy for Turkey as the victimized party in the region. Or to repurpose a quote from _Apocalypse Now_ :

"What do you call it when the bully accuses the bully?"

</comment></comment></comment></comment><comment><USER6> China's claims are weak, but the United States Government's complete inability to prioritize has hurt their ability to confront China. That being said, China is alienating it's neighbors and they will depend on the USG to guarantee freedom of navigation.

<comment><USER7> Most areas in the world would be improved by a reduction in USA interference, just as you describe having happened in the South China Sea. Our omnipresent bullying makes it too easy for potential rivals as well as potential allies. Without us as a foil they take more care in finding their own way. [EDIT: or, to say it less self-centered fashion, possibilities emerge when they can devote fewer resources to handling interference from afar].

<comment><USER8> The only example I cant think of immediately, Iran, is not so much better off, nor its people.

<comment><USER7> Everyone in Libya was better off before USA and some random Europeans interfered there.

<comment><USER8> There's been a lot of chaos, but it started before the U.S. intervened, as I remember. The U.S. and European footprint has been very light - maybe, as in Syria, way too light to create order.

</comment></comment></comment></comment></comment><comment> temp-dude-87844 The research is interesting, and shows that a surprising amount of complexity around the claims was present for more than a hundred years. Legally, the 2016 arbitration was final and non-appealable, so absent some large shift in international jurisprudence, the letter of the law says one thing, yet the situation of the ground is different.

There's little reason the two will drift into alignment in the future, because of the reasons the Spratlys are sought in the first place: a prime spot for force projection, proximity to global shipping lanes, and credible rumours of hydrocarbon reserves, in descending order.

</comment><comment><USER9> This is a fascinating and illuminating piece of history, but I have a hard time believing that these cartographic mistakes are the reason for China's posture in the South China Sea.

The first part of the article mentions the strategic and economic resources in the region. Do we think that China would be minding its own business if these mistakes had not been made? It seems more likely that we would simply be left with the "ancient and historical claim[s] to the reefs and rocks in the South China Sea" without the attendant maps from the early 20th century.

<comment><USER10> > _I have a hard time believing that these cartographic mistakes are the > reason for China 's posture in the South China Sea._

Sure, these aren't China's motivation, but they are China's argument for the legitimacy of their claims. To the extent this research can be said to argue for a political outcome, it is less about dissuading China from its claims and more about reducing those claims from "legitimate" to simply "effective". (Which is more than enough for the Chinese, even if they accepted the research at face value -- which they won't.)

<comment><USER11> Needless to say, they will find a reason for what they want to do. I'd guess they can find an historical reason because they are not the first Chinese regime to desire to control the territories around them.

No doubt, nearly every piece of real estate in the world has been controlled by multiple governmental parties at some point in history, and can thus be contested. Perhaps Mexico will want Texas back? But what about the Native Americans in the area? Maybe the French will contest that the Louisiana Purchase was illegitimate on a technicality? How about identifying all the potential claimants to the land in Israel - we can add religious claims to the standard legal and geopolitical claims. Claims are noise, omnipresent for everything, not signal of much significance.

On the other hand, we want the debate to stay in the legal realm. I was just reading that rule of law for international disputes dates back only to the early to mid-twentieth century (depending on how you date it). Before then, war was the 'legal' way to resolve it; it wasn't outlawed effectively until the UN was formed right after WWII.

</comment></comment></comment><comment><USER8> Crazy as it sounds, Western nations colonized the island of Taiwan, which had a native population, China didn't - it wasn't interested. But should China's lack of appetite for colonization back then be penalized?

Rather than rewriting history now, I think China would do far better to blatantly object to any rules defining sea territories based on what small islands the nations who were eager to colonize managed to seize, back when; and instead argue that taking the population densities in the area is reasonable when divying up the sea. That's their real point, and it's a pretty good one.

The trouble with inventing claims and shoving military forces into places you'd like to have now, is that there's no end to it. It's a promise of eternal war. Eternal irredentism and revanchism. Bound to make 'em unpopular. China could make a legitimate argument, in my view, but even now they aren't bothering to do that. Pity.

I'd rather China invited other nations to discuss creating a law of the sea that's more reasonable than "small island theory" that comes down to us from colonial times.

<comment><USER12> > That's their real point, and it's a pretty good one.

I don't think that is china's point at all. China also defines national waters with a much larger buffer than most other countries, including the USA.

<comment><USER8> It's not their stated point, but if there's another rationalization, I can't imagine it. They feel their large population entitles them to more - I don't think they're wrong about that.

<comment><USER12> Well, they think they should have more than their neighbors if the nine dashed line is any indication (we don't believe in 100 km, except for other countries so...). Note that those countries in the SCS are much more densely populated than China, and double especially where the conflicts occur (they have millions and millions of people living on the line, china has like a garrison on small artificially buffed islands).

If they do claim that as a rationalization, the cognitive dissonance to dismiss the hypocrisy must be amazing. However, I've never heard them make such a rationalization before, and I don't think they have.

<comment><USER8> Dense, not nec huge populations -but you're right re Indonesia, it has a huge population. But isn't much affected.

<comment><USER12> Phillipines, Vietnam, Malaysia are all very populated and rather dense.

<comment><USER8> None of these are even in the top ten for population. So they're all dwarfed by China. [http://www.worldometers.info/world-population/population- by-...](http://www.worldometers.info/world-population/population-by-country/)

<comment><USER12> Philippines has 100 million people. Vietnam has 90 million people. Malaysia has 30 millions. None of these are big countries area wise, they are all located very close to the SCS, much closer than Hainan's 8 million.

<comment><USER8> In other words, the Philippines has less than 10 per cent of China's population. Dwarfed. This doesn't contradict them not even being in the top ten.

re SCS, I haven't mentioned or endorsed any precise boundary.

<comment><USER12> The population of all these countries is pretty much in the vicinity of seas disputed. The population of China is pretty much not (Hainan is one of the least populated provinces).

<comment><USER8> Which is consistent both with my proposal, (considering population), and would allow create boundaries very different from the little islands rules - so you seem to be "agreeing with vehemence" here, not disagreeing.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Lets be honest here, all the countries fighting for these islands will use an origin myth but historicalities is not the real reason for the fight, these islands have likely never been populated by humans because they're too small, they're arguing for shipping and natural resources reasons and historicalities is just part of the bs added.

<comment><USER8> Exactly; it's an error (a deliberate error, now what's the word for that, again?) not a mistake.

Reminds me of a very old grammar joke, husband interrupts wife in bed with another. Wife: "You startled me." Husband: "No dear, I am startled. You were surprised."

</comment></comment><comment><USER14> I don't think anyone believes that these disputes are based on legitimate land claims.

</comment><comment><USER15> This is a quite interesting story. Yet the piece one forgot to mention is that the government of Republic of China was founded in 1912, after the intense and long warfare. Meaning at most, the author's evidence could prove that during the times somewhat around 1912-1927. It wasn't on the government's official records, while they're trying to define its territory.

It does not affect evidence dated back before.

On the other hand, similar arguments could effectively be found for other countries who also land the claims. As their claims were only made more recently, as well as their governments, all after a long time of western colonization.

Different claims made by different countries must all be examined. Put one in the spotlight without examining others could only raise suspicions.

<comment><USER11> > the government of Republic of China was founded in 1912

The Republic of China is the official name of Taiwan; mainland China is The People's Republic of China.

The last Imperial dynasty, the Qing, usually is dated to have ended in 1911. There was a period of intermittent civil war and various claims to government until the Communists defeated the Nationalists in 1949.

1949 is usually given as the date of the founding of the current Chinese state. (The Nationalists fled to Taiwan, which became the Republic of China.)

</comment></comment><comment><USER16> Does it really mean anything? I'm actually a bit surprised that the claim existed as far back as 100 years ago. The US had absolutely nothing to claim about Hawaii whatsoever, yet just marched in, drove out the original king and occupied the place.

Surely any "historical facts" have no importance whatsoever in geopolitical maneuvers.

</comment><comment><USER17> Relatedly, the whole [https://en.wikipedia.org/wiki/United_Nations_Convention_on_t...](https://en.wikipedia.org/wiki/United_Nations_Convention_on_the_Law_of_the_Sea) is complex and prone to corruption.

It's hell.

</comment><comment><USER18> The discussion is much more civilised compared with those in chinese language.

The current power in china actually is not very consistent in maintaining its territories. If history based on Qing empire, the territorial claims would be very different.

It is all political.

For this area strangely even I studied politics even aware of it. Unlike a little island japan and china claiming sovereignty and Taiwan, it is really not much mentioned until lately.

Hence, it is more about another empire raising up, not about claims.

As regards the style of this empire, good luck you have a place where only its IT firm can do business and others including Apple has to hand over their databases.

IT people should concern, even if it is political. Too much at stack. If the chinese norm becomes the internet standard (as its communist chief tried in internet conference), you will be all affected.

</comment><comment><USER19> Dang, Its going to be really tough to ignore China. Especially on Hacker news.

I've recently read a book The China Dream: Great Power Thinking and Strategic Posture in the Post-American Era by the Chinese general Liu Mingfu and the country is by admission not a proponent of Human rights (but rather "Peace" and "Socialism with Chinese Characteristics")

Last year China VC funding grew tremendously [1]. China will surpass the US GDP in 15-20 years [2] or so (if not less), and dealing with China is difficult in the technology industry. Google, Facebook, the YC backed Airbnb [3], Uber and many more US companies have tried to enter the market with difficulty.

I understand nationalism is a problem especially in the Trump era but this issue will be with us for the foreseeable future and the tech community has a special responsibility to ensure the universal values of Human Rights are defended.

[1] [https://www.eastwestbank.com/ReachFurther/News/Article/China...](https://www.eastwestbank.com/ReachFurther/News/Article/China- s-Red-Hot-Venture-Capital-Tech-Scene) [2] [https://www.bloomberg.com/news/articles/2017-12-26/china- to-...](https://www.bloomberg.com/news/articles/2017-12-26/china-to-overtake- u-s-economy-by-2032-as-asian-might-builds) [3] [http://www.businessinsider.com/three-challenges-facing- airbn...](http://www.businessinsider.com/three-challenges-facing-airbnb-in- china-2015-8)

<comment><USER2> You can avoid flamewars without ignoring China.

</comment></comment><comment><USER20> "China's Claim to the Spratly Islands Is Just a Mistake"

Actually, China's claim is political not historical.

</comment><comment><USER21> In the board game Warhammer there is the tale of the Dwarves strongholds. They forever remembered grudges. Even over the course of time, when the nature of the grudge was forgotten, they still held on to the ill will. This article is well reasoned, researched, and makes sense to a Chinese speaker. However, this will be dismissed like the UN Tribunal simply because the result contradicts the official narrative promoted by China.

There is simply too much nationalism and national pride locked up with the whole South China Sea and Taiwan that no amount of logic and truth can change how it is perceived in China.

The South China Sea dispute has nothing to facts like these, and all about geopolitics and power within China. Like with the Austria pre-ww2, if the Chinese were to invade and conquer Taiwan and control the entire SCS, they'll magically find other "distractions" and "conflicts" to distract people away from their own misrule and corruption.

With Putin's Russia and the CCP, there must always be enemies (both internal and external). If they don't exist, you create one (think FalunGong)

<comment><USER22> "War, it will be seen, is now a purely internal affair. In the past, the ruling groups of all countries, although they might recognize their common interest and therefore limit the destructiveness of war, did fight against one another, and the victor always plundered the vanquished. In our own day they are not fighting against one another at all. The war is waged by each ruling group against its own subjects, and the object of the war is not to make or prevent conquests of territory, but to keep the structure of society intact." -1984

<comment><USER23> in 1984, war is strictly a distraction and an economic sinkhole to keep the masses occupied.

in China, it's likely about not setting precedent for sub states seceding, making the country less powerful because smaller, as well as making the "communist" setup look weaker/optional. Are these the same as 1984? I don't know.

<comment><USER24> What is war in the contemporary USA?

<comment><USER25> A way to keep a large industry fed, providing jobs which otherwise would be outsourced to low-wage countries. The same industry provides the politicians who get to decide over how public funds are to be spent with lucrative positions, enticing them to keep said industry on their side. People often hop from the industry into politics and vice-versa, a practice known as the revolving door between politics and industry.

In many ways this can be compared to the purpose of war in the feudal middle ages where land always needed to be conquered to be given as fiefs to up-and- coming nobility so that nobility would support the current king in his strive to remain in power. Things change but the basic tenet stays the same: those in power want to remain there and will use the means at their disposition to do so.

</comment></comment></comment></comment></comment><comment><USER26> The claims will be, at worst, useful bargaining chips in future negotiations. There's no point in forcing them to drop them.

</comment><comment><USER27> Good ol dang to the rescue. Never says a single word about subtle slandering of conservatives, white males, christians or Republicans; but, since Chinese are non-white, he leaps to defense of alternate points of view on HN. Ask yourselves why each of you find disagreeable topics only acceptable in these cases.

<comment><USER2> When I say 'regardless' I do mean it: [https://hn.algolia.com/?query=by:dang%20regardless&sort=byDa...](https://hn.algolia.com/?query=by:dang%20regardless&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0).

It always feels like moderation is against you. This is the Hostile Media Effect:

[https://en.wikipedia.org/wiki/Hostile_media_effect](https://en.wikipedia.org/wiki/Hostile_media_effect)

[https://hn.algolia.com/?query=%22hostile%20media%20effect%22...](https://hn.algolia.com/?query=%22hostile%20media%20effect%22&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0).</comment></comment>


Amazon Snaps Up Online Math Instruction Company TenMarks - <AUTHOR> http://techcrunch.com/2013/10/10/amazon-snaps-up-online-math-instruction-company-tenmarks-to-help-it-make-education-apps/

<comment><USER2> Amazon is good at pouncing and snapping.</comment>


The Armoured Glass Box Is an Instrument of Torture - <AUTHOR> https://www.craigmurray.org.uk/archives/2020/03/the-armoured-glass-box-is-an-instrument-of-torture/ <comment><USER2> Yet again, the British courts acting illegally as it suites them. I am pretty sure that Assange's trial already has a written ending.

Why, for example, is he even being held in prison? He's innocent until proven guilty, even by the law of the land. Instead he is held in maximum security reserved for the worst of criminals.

<comment><USER3> Perhaps because he has a history of trying to escape the law?

<comment><USER2> > Perhaps because he has a history of trying to escape the

> law?

I don't think that warrants him being treated like a terrorist, even if you believe he has a high chance of fleeing.

</comment></comment></comment><comment><USER4> The existence of this box, the descriptions of his treatment... He's not the first person to undergo this and he won't be the last. Setting aside Assange, is there ever a time when this treatment is not crippling and dehumanizing? I'm trying to imagine a need for something like this, and maybe I'm not imaginative enough, but I can't figure out why such awful conditions were built in the first place.

<comment><USER2> > I'm trying to imagine a need for something like this, and

> maybe I'm not imaginative enough, but I can't figure out

> why such awful conditions were built in the first place.

For somebody who is a high escape, high assassination or generally high risk. Somebody with enough money for example could arrange for an escape attempt at the court itself.

Unfortunately it's also used for anybody who acts "against the state", i.e. whistleblowers. Such cases do not occur without consent from high levels of government.

<comment><USER5> > For somebody who is a high escape, high assassination or generally high risk

I don't know if it still in use, but Italy had at least a bunker court for mafia trials which could withstand even missile attacks. In case of high risk targets, I feel it would be better to ensure the safety of every person inside the court, instead of enclosing just one person inside a box which could still be opened, after spilling enough blood.

To me, it seems the glass box is used only for the psychological effect and justified with the security concerns.

</comment></comment></comment><comment><USER6> I tried to reply to this thread, but the thread was flagged for a while. Not sure what that was about.

I generally agree with the author's assessment. It seems as if the goal of his treatment is to mask a suicide or cause one. It just goes to show you that we the people should always be suspicious of those in positions of power, because it may be abused.

<comment><USER2> I had to "vouch" for the article, no idea why it got flagged off of the front page. I read back through the guidelines and I'm pretty sure this is a useful and insightful article for the community [1].

[1] [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER7> Probably because people are getting tired of this deluge of Assange stories. From this blog alone we have one every day.

And I haven't seen a "new comment" in months now. It has been talked to death. You won't convince me, I won't convince you. It's all well-rehearsed sound bites.

<comment><USER2> Surely it's for each person to decide whether they want to engage in the stories?

This blog is interesting (at least to me) because the guy is actually reporting first-hand from the court that will decide his fate.

<comment><USER7> Have I said otherwise? I simply explain why some people engage by flagging. And that's nothing you're to "forbid".

Sure, read his blog. I still maintain that there has not been a single interesting comment – on either side – in the discussion threads.

</comment></comment></comment></comment></comment><comment><USER8> People in governmental authority positions seem to want to make an example of Julian Assange in order to discourage others from following in his steps.

</comment><comment><USER9> What is the actual legal pretext for him being in the box?

<comment><USER10> Well, he does have a history of violating bail and fleeing. Judges tend to not like that.

</comment></comment><comment><USER11> It's good they left the EU :( I don'T want to live in a place where anyone can be treated like that.</comment>