The CCC: Men Who Hate Women - <AUTHOR> https://blog.patternsinthevoid.net/the-ccc-men-who-hate-women.html <comment><USER2> Another story about the CCC's handling of another abuser: [https://twitter.com/NGC_3572/status/945680642792189954](https://twitter.com/NGC_3572/status/945680642792189954) (which as far as I can tell wasn't public before today?)

</comment><comment><USER3> Whistleblowing, when making allegations against an _individual_ , is best done under non-pseudonyms and inviting possible libel/slander charges. If you're making allegations of this severity, it seems it would be better to straighten out the facts of what happened in a court of law rather than let the court of public opinion make its judgement. The "informality" of all of this makes me quite uncomfortable.

<comment><USER2> Getting a court involved won't solve the community problem. If multiple active members of the community come forward, that should have more weight then a random judge's ruling. Nothing will compel them to "believe" or act like they believe the judge either.

Two women, including the author of the article, put their own names on their allegations.

<comment><USER3> It is _not_ about a "random judge's ruling" \- a proper court of law has very specific safeguards in place to ensure that both parties have a equal chance to make their voice heard and put their case forward.

Now, it's possible to argue that those safeguards do not always work perfectly but it's something I have far more confidence in than blog posts, which have none of those requirements.

<comment><USER2> The conference should have safeguards as well. Instead if you're famous enough and friends with the right people, you can get away with anything. See also the link I replied to your sibling comment for a specific refutation of the way German courts handle justice.

<comment><USER3> Looking...

</comment></comment></comment></comment></comment><comment><USER4> It's pretty obvious why they don't want to have a discussion with her. She's an activist that isn't objective. The title is more hyperbole from her -- anyone who doesn't like her personally is a mysoginist. Likewise, the River incident, which in Rivers own account is her having sex with her boyfriend in front of his friends, while very drunk, becomes a "brutal gang rape." Not negotiating with someone like this is just common sense.

</comment><comment><USER5> Reading this thread made me very sad. People talking about the ccc that clearly don't have the slightest idea what the ccc is, talking about the "word of god" of the hacker community. sp332 somehow tried to argue against a ruling through a court of law mentioning this post [https://blog.patternsinthevoid.net/the-forest-for-the- trees....](https://blog.patternsinthevoid.net/the-forest-for-the-trees.html)

For the record: The first (and many times the only) place rape allegations should be made are with the police so that they can be judged by a court of law.

Accusing someone of a heinous crime like this (yes the prison sentences mentioned in the blog post should be mostly correct) can ruin someone s life even without a ruling. There was a fucking lynchmob for christ sake.

To the allegationa against Appelbaum: They were mostly proven to be false or probably false. There were many accounts against the accuser and the accounts that went against the accused were (afaik) mostly disproven (no claim was ever proven or brought before a court of law). Here is a Spiegel article about it for the once too lazy to google [http://www.zeit.de/kultur/2016-08/jacob- appelbaum-rape-alleg...](http://www.zeit.de/kultur/2016-08/jacob-appelbaum- rape-allegations-contradictions) here are accounts of ex girlfriends of his [https://twitter.com/cfarivar/status/741634572673110016](https://twitter.com/cfarivar/status/741634572673110016) This is the only case I know of where people actively defended someone accused of rape that I know of.

Here are some links for the backlash the tor project got for proscecuting someone like this without proof [https://shiromarieke.github.io/tor](https://shiromarieke.github.io/tor) [https://web.archive.org/web/20160817173704/https://www.oneey...](https://web.archive.org/web/20160817173704/https://www.oneeyedman.net/?p=2581) [https://trac.torproject.org/projects/tor/ticket/19690](https://trac.torproject.org/projects/tor/ticket/19690)

And the ccc (even if I don't count myself as one of it's members anymore) is one of the best, friendliest, most helpful, lawful good and open organisations in existence and "articles" like thos are toxic (not to say evil) and fud spreading. I will accept any ruling by a judge, but I will forever condemn people "blogging" about things like this in a fashion like this.

<comment><USER2> I think event organizers should be told so that they can take steps to protect other attendees. And if the victims would rather reconcile and restore their relationship with the abuser, why would they go to court? Somehow you want someone to spend decades in jail and be deported, but being merely avoided is somehow too much - that's an odd value judgement.

<comment><USER6> It's more likely they don't want to go to court because they know the accusations are bullshit.

<comment><USER2> [https://firstname.lastname@example.com/behind-every-serial- abuser...](https://firstname.lastname@example.com/behind-every-serial-abuser-there- are-many-enablers-491bf2303f82) "I firmly believe that individuals (and organizations) who have committed mistakes should be forgiven if they truly understand the harm done and genuinely work to make things right for the future." You have failed to make a link from anything these people want to anything they could get by going to the police. "The second person involved in my assault has apologized and gone through a community justice process." So it's not bullshit.

</comment></comment></comment></comment><comment><USER7> This is the first I'm hearing of allegations that Jake and Will are rapists, so I don't know anything about the case besides this article I just read. Forgive me if I'm missing some part of the story that makes this make sense, but shouldn't the first line of defense be to tell the police and let the government prosecute rapists? I don't really think I want the Chaos Computer Club to start deciding who is a rapist, again, unless there's some big part of this story that I'm missing.

<comment><USER2> I'm sure other people will add links, it's been a long-running story. But a lot of the people involved on both sides are anarchists of various stripes, who would rather handle things themselves than get the police involved.

Edit: well no one else has posted links, so here are a couple. [https://blog.patternsinthevoid.net/the-forest-for-the- trees....](https://blog.patternsinthevoid.net/the-forest-for-the-trees.html) [https://pervocracy.blogspot.com/2012/06/missing- stair.html](https://pervocracy.blogspot.com/2012/06/missing-stair.html)</comment></comment>


Ask HN: Is BDD/Cucumber an overkill? - <AUTHOR>

I was learning about Behavior driven development and Cucumber recently. It looks interesting, but i feel that it could be an overkill in the production.<p>What is your good/bad experience with BDD in real projects? Do companies like Google, Github use BDD  in largescale projects? <comment><USER2> If a project is having a difficult time specifying requirements BDD can help to derive better scope. I have quite a lot of experience of BDD in small and large companies. And have found that it does help where stakeholder's are pretty vague about what they want, BDD can help them think about the User Stories in more detail. Which ultimately helps to deliver the right product. You can also do the automated testing part too so you have automated acceptance tests which become regression tests after the feature has been released. However, I also found that it's difficult to get all the people onboard with it as it takes more time.

TLDR; Good if you have problems defining requirements, difficult if you have uncommitted stakeholders.</comment>


Giving Mars a Magnetosphere - <AUTHOR> https://medium.com/our-space/an-artificial-martian-magnetosphere-fd3803ea600c <comment><USER2> While the terraforming of mars is still a long way off, a satellite of similar design positioned on earth's L1 could be a viable defense against geomagnetic storms that threaten our power grid.</comment>


Spammers are abusing GitHub gists for link building - <AUTHOR> https://gist.github.com/anonymous/b9be8ff0bf4f7e0e0cc24d2a5c39c257 <comment><USER2> Yes, but inspecting source, those are nofollow links. So that should eventually deter anyone trying to actually keep using that as a method.

<comment><USER3> It's entirely possible these are being used by a static site generator or some such. It only takes a real repo to use GitHub pages.</comment></comment>


Llvm-Cbe: Resurrected LLVM "Bitcode to C Back End" with Improvements - <AUTHOR> https://github.com/JuliaComputing/llvm-cbe <comment><USER2> This has been passed around been a couple folks after it got ripped out of LLVM. Looks like we still have the most up-to-date version here. Happy to answer any questions if I can (if not I'll have to bug Jameson who did all of the work here ;)). See here for some context of what we used this for: [http://juliacomputing.com/blog/2016/03/10/j2c-announcement.h...](http://juliacomputing.com/blog/2016/03/10/j2c-announcement.html)

<comment><USER3> Could this work bring closer the possibility of LLVM compiling itself into the Plan9 C dialect?

[http://lists.llvm.org/pipermail/llvm- dev/2010-February/02965...](http://lists.llvm.org/pipermail/llvm- dev/2010-February/029659.html)

<comment><USER2> From that email it sounds like there was more concern about the front-end side C/C++->LLVM-IR than the backend side, so this wouldn't affect that. As for the backend side of things, I know nothing about Plan 9, so I can't comment if their dialect would require modifications to this could base. However, I can't imagine that making the changes to support Plan 9 natively in LLVM would be significantly more onerous than changes required to this backend. In fact, a lot of the ABI work may have been done already since I believe Go shares the Plan 9 ABI.

</comment></comment></comment><comment><USER4> I wonder if this works Rust-to-C?

</comment><comment><USER5> Where can i Find what the improvements actually are over the original?

<comment><USER2> The improvements are better coverage of possible LLVM IR, and significant bug fixes to make this actually work.

<comment><USER5> Anything in regard to using less locals and more nesting, like previously:

a(b(c)) became int val = b(c) a(val)

even though val never was used anymore after this

Either way pretty cool!

<comment><USER2> Don't think that particular optimization was ever implemented. It looks straightforward, but one does have to be careful about re-ordering, so the legality check is slightly more complicated. We briefly considered writing a clang-based source-to-source transformation as a post processing pass to clean up, but it wasn't worth it for our use case.</comment></comment></comment></comment>


One language to rule em all - C# - <AUTHOR> http://devzoneblog.wordpress.com/2013/11/20/one-language-to-rule-em-all-c/

<comment><USER2> If you really agree with this article (and you are uncomfortable with learning a new language) you should really learn other, different, languages (hit: Java won't do).</comment>


Tell HN: Apply to TSF before January 20th - <AUTHOR>

I had the opportunity to be a mentor to one of the companies that went through the latest TSF Class and I was impressed with the process and the team they have there. The company was PopUp and one of the co-founders Fitch wrote an awesome blog post about the process (I swear I wasn't that mean to them).
http://foverc.tumblr.com/post/37687567170/accelerators-are-like-roll-cages
TSF (Triangle Startup Factory) is an accelerator located in Durham, NC (part of the research triangle area). They invest up to 200k in each of the startups (a mix of equity and convertible note). There is a Call in Session tomorrow for more information (http://trianglestartupfactory.com/event/call-in-session/) and you can apply here (http://trianglestartupfactory.com/start-the-application/) <comment><USER2> This is one of the richer accelerators and located in the SouthEast where there isn't as many choices. Plus Durham is a great location. Worth checking out. Only downside is how new it is so there is a huge Alumni organization to tap into yet but only time solves that problem.</comment>


Ask HN: Please critique our logo. - <AUTHOR>

http://www.verelo.com/images/logo.png (if it shows up on black as its transparent, just check the main site verelo.com)<p>We think its good, but we've been staring at it for months.  Ideally we'd like to a/b test something if its worth the time. <comment><USER2> It looks cheap. Sorry that was my first impression. It might be some other logos that I've seen around the place for cheap products that was triggered. Your website looks good however. If I was you I would lose the upper part of the check mark and just have a green V.

<comment><USER3> I'd agree that the check mark could be a little less dramatic.

</comment></comment><comment><USER3> It's not bad.

When I saw it before going to the site, I said to myself "This should be the logo of a company that is offering assurance or 'verifying' something for the check mark to be so prominent", and I'm glad I was right.

I think it works for what you're doing, but I wouldn't say it sweeps me off my feet. I think you could leverage the V-check mark in a lot of ways, however, like you have on your globe.

In my un-qualified opinion: B+

</comment><comment><USER4> Not my style but my opinion doesn't matter here. Its what you guys like and what your customers (TARGET audience) think that matters. As for why its not my style, I don't like the font or the check design in place of the V.

</comment><comment><USER5> It reminded me of Verisign so I was expecting some kind of web verification tool. So logo and business do match well.

The only comments I'd make is the roundness/bubble style of the font make it look a bit on the comic sans side.

I'd say the tick is quite long, almost turning into a green shoot, which makes me think more of growing your business. I think it's because the point on the end of the tick doesn't match with the roundness of the font.

The good points are that it is recognisable and would work well in colour or on b&w documents too.

</comment><comment><USER6> Man, I was expecting something crap (that's usually what happens when someone asks for "please critique $x")

It's very well done. There's a bit of an issue with the aliasing on the top of the checkmark, and I would make the left stroke of the V slightly larger (it looks slightly smaller than the other side of the V, which is jarring), but other than that it's simple, recognizable, portable into different media, and will age well.

</comment><comment><USER7> Graphically, I think it's good enough overall that you should move on.

My concerns are:

Dark grey background doesn't really scale over the long term.

Very dark red would be better than the black.

See: <http://www.kadavy.net/blog/posts/d4h-color-theory/>

</comment><comment><USER8> The only thing I have to say is that you extended "loopish" off the V tends to make the rest unreadable/ rather small once it hits the favicon size. The green tends to not be enough contrast between FF's grey in the favicon area.

</comment><comment><USER9> to me its a bit hard to identify the check mark as V. additionally the kerning is very close which makes it hard to read. i hope that helps, martin

</comment><comment><USER10> I cannot guess from the logo that this is a web tool.

</comment><comment><USER11> The left side of the V should be tad higher. Unless I know the name of your website, it seems like "erolo" with a check mark in front. May be I am too dumb :)</comment>


Ask HN: USB3.0 to VGA display adapter with ubuntu drivers - <AUTHOR> I need to use dual monitors with my laptop which only have one video card. So i was trying to find a USB 3.0 to VGA/HDMI adapter. I got one with fresco logic card but there are no compatible drivers for ubuntu. It seems there are displaylink drivers for ubuntu however I dont know any compatible device. Does someone know a good option that is available on amazon/ebay? <comment><USER2> Most laptops can run an external (second )monitor and provide a video out and can be configured to display different content on each screen. Historically, and Apple products aside, going back to the late 1990's the connector was VGA. More recently the connector tends to be HDMI.

So I'm curious what brand of laptop it is and whether or not it has a video connector.

<comment><AUTHOR> Actually I am looking for 2 external monitors and already used one slot. Just of someone found a solution, could use same config.</comment></comment>


Hackation in NYC - Free Trip for Outstanding Hackers - <AUTHOR> https://www.joingrouper.com/hackation <comment><USER2> Tldr: Explain why you want to go, and why you think you should be picked, and grouper may potentially fund a trip to hack stuff ( preferably their stuff but also your own )

My own question: What is the definition of a skilled hacker? Are they looking for white hat hackers? What sort of achievments would count to demonstrate this? Writing some great software? Full pen test analysis and attack vectors on some software?

Considering this is "hacker news" this is a pretty vague offer.</comment>


POPFile – Automatic Email Classification - <AUTHOR> http://getpopfile.org/ <comment><AUTHOR> I posted this as a blast from the past. I wrote POPFile (and antecedents) in about 2000 and was invited to the first MIT Spam Conference organized by one... Paul Graham.

<comment><USER2> Thank you for such a great piece of software. I used POPFile during 6 years at office and it worked flawlessly.

<comment><AUTHOR> Cool. Glad it worked well for you.

</comment></comment></comment><comment><USER3> Used to use this and it works great, though it's a bit difficult to setup for the average person.

Wish someone would implement Bayesian classification directly into a webmail service. Gmail classifies to its own categories, but it's just not the same as being able to specify your own.

<comment><USER4> IIRC Google Inbox supports that feature.

<comment><USER3> Gmail and Inbox only classify email into certain categories. You cannot specify your own and have it learn over time.

</comment></comment></comment><comment><USER5> > POPFile is a proxy which sits between your mail client and your mail server.

Is there anything similar that works as a service / daemon that uses rules to move new messages into folders?

Working with multiple email hosts, each which has there own flakey rules engine, can result in inconsistent routing. I would love something I can run on my own server that would move messages on mail hosts before my various email clients are used to read them.</comment>


Netflix now worth 900x the price they offered to sell to Blockbuster for in 2000 - <AUTHOR> http://exstreamist.com/netflix-is-now-worth-over-900x-the-50-million-price-tag-blockbuster-rejected/ <comment><USER2> If Netflix had sold, I doubt that today the service would be nearly as good. There would probably be a better competing service.</comment>


Tell HN: Github has dozens of public s3 passwords - <AUTHOR>

I almost pushed my s3 credentials to a public github repo for the third time in one day.
So, I got curious. Are there people out there who forget cover their tracks?
A quick search shows quite a few 'open' buckets out there. What's the best way to warn these folks? What other credentials are lurking out there?
Here's the search: http://github.com/search?langOverride=&language=&q=S3+Base.establish_connection&repo=&start_value=1&type=Code&x=0&y=0
And the first open bucket I found: http://github.com/prakashraman/jammmin/blob/a668672c69fafdb8317fec4fb19b7abb0b318e1a/app/scripts/s3_connect.rb <comment><USER2> In case anyone else made this mistake, Github's help section has an article describing the steps needed to remove sensitive data from a git repo:

<http://help.github.com/removing-sensitive-data/>

<comment><USER3> In this case rotating your S3 creds is probably the optimal solution.

</comment></comment><comment><USER4> It's something that almost happened to me too. A git repository for a project that at first, in the prototype-stage, had credentials hard-coded, but inevitably moved on to be config-file-driven.

I concocted the following command to change all mentions of a specific word to another word, in a git repository:

      git filter-branch --tree-filter "find . -type f -exec sed -i -e 's/originalpassword/newpassword/g' {} \;"

Use this to check if there are any mentions of some word, e.g. your password, in the repository:

      git filter-branch --tree-filter "grep -r originalpassword * || true"

</comment><comment><USER5> " What's the best way to warn these folks? What other credentials are lurking out there?"

Sure, posting that on HN is a good way...

<comment><USER6> How about leaving them some README-NOW.txt file in their S3 bucket?

<comment><USER7> I rarely list the contents of my S3 buckets so I'd probably never notice this.

Send them a message on GitHub, perhaps?

</comment></comment></comment><comment><USER8> My God, I can't believe I left it there. While I was developing a while ago I had put it there and completely forgot to remove it. What a costly mistake this could've been or even is.

Thank you, kabuks, so much for noticing this. I have changed my S3 key pair and am getting to cleaning up my git commits.

My God ! But thanks so much.

</comment><comment><USER9> why don't you just email github? i'll bet they have a way to contact their users

<comment><USER10> <http://support.github.com/discussion/new>

Don't forget to make it a private discussion.

</comment></comment><comment><USER11> What I have done to prevent that is to use the OS's environment variables:

<http://github.com/roder/riakaws/blob/master/clouds.rb#L10>

</comment><comment><USER12> There is a "message" button on each github user page.

I just sent this to a few people (including someone who had forked one of my projects and added their S3 keys to a config file):

Noticed you have your Amazon S3 keys out in the open on github. You might want to remove those config files from your repository as described in the thread here:

<http://news.ycombinator.com/item?id=1574211>

-Pete

<comment><USER13> Remove _and_ change at Amazon, as the values could still be floating around in fetches, caches, archives, indexes, etc. for a while.

<comment><AUTHOR> And still cached in their search cache

</comment></comment></comment><comment><USER7> Might be worth setting up a git hook to scan your commits for sensitive data.

Of course you'll need to include that sensitive data in the script, though the first few characters of AWS credentials should be unique enough.

I thought about setting up something similar for networking. If a packet contains my password in cleartext then pop up a warning allowing/denying (denying would have to force the connect to close, I guess). Might be too much overhead though.

</comment><comment><USER14> Protip: keep settings in a separate file

Mark the file as excluded from svn/git.

Make a _settings.sample_ file for the project.

</comment><comment><USER15> Rather than store passwords or sensitive config data in a file I'll usually try to store them in an environment variable. Heroku has a little guide on this: <http://docs.heroku.com/config-vars>

<comment><USER16> I use a similar strategy: <http://trevorturk.com/2009/06/25/config-vars-and- heroku/>

...this kind of thing doesn't have to be Heroku-specific, though.

<comment><USER17> Yup, symlinking config files after deploy is the approach I use. Thanks for the Cap task to set things up; at the rate I setup new projects, manually copying those files was getting old :)

</comment></comment></comment><comment><USER18> There is a business opportunity here. Managing credentials and secrets is (passwords, private certs, etc) is hard. Making that process turnkey, secure and easy would be useful.

<comment><USER19> I'm not sure it's that hard.

You can use any number of very low-barrier strategies to solve this. One that was mentioned a few times in this thread is to use environment variables. Personally I just put a {whatever}.yml or similar in my project tree somewhere and throw it in .gitignore.

I can't imagine a process that starts with "go to westorecredentials.com and sign up..." being any easier. Willing to be surprised :)

<comment><USER20> People are advocating not saving settings to source control. F-that, I want to be able to clone my repo and run the project without scp-ing an additional file around. A file, that by all rights _should_ be part of the project.

Here's my solution - github 'extends' git somehow, so files can be marked private. Then, unless you have commit rights to that repo, you can't see the file's contents. So a public http checkouts lacks the secret password.

And because it's git, someone you give commit rights to is someone you trust. People you don't trust can just make their own repo.

<comment><USER19> That sounds like too much software to me. What's with the aversion to scp? You only have to do it once per box you set up... There's something to be said for having GitHub do everything 1000% for you, but there's also something to the unix philosophy that would suggest git is good at the version control thing, and scp is good for the configuration-file-moving thing.

<comment><USER20> so... which _version_ of the config file are you using?

<comment><USER19> The one listed first in a `git log config/whatever.yml`

Just because it isn't in a public repo on GitHub doesn't mean it isn't versioned properly. Quite the contrary, I use git locally and on a personal webserver for _tons_ of stuff.

The point isn't that it shouldn't go into git. It's that it doesn't belong as part of your project. Different config options are often needed on each machine, especially development boxes. I don't have the same database.yml as my co-workers... I have my box in production mode or with memcache off for testing purposes maybe... There's tons of stuff like that.

I still keep those files (along with my ~/.git/config, ~/.ssh/config, .gemrc, ~/.profile, ~/.vim* and a hundred other things) in git, just not on GitHub in a public repo.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> A more precise search [http://github.com/search?langOverride=&language=yaml&...](http://github.com/search?langOverride=&language=yaml&q=access_key_id+!ENV+!Panda&repo=&start_value=2&type=Code&x=16&y=20)

</comment><comment><USER21> How about something with github API? I'm pretty sure you can search/email?

</comment><comment><USER22> Yeah, this is a typical mistake, I've pushed Django's secret keys and even twitter credentials.

PS: I do it all the time on my private repos but I try to not do it on the public ones.

<comment><USER23> In case of django there is a nice workaround in using a non-git localsettings.py file.

Just put "from localsettings import *" in your settings-file, and keep all deployment-specific settings in the localsettings-file

</comment></comment><comment><USER24> good reminder to us all, thanks Kabuks</comment>


Show HN: Let people know you are featured on Product Hunt - <AUTHOR> https://hypeok.com/onph/ <comment><USER2> In step 4 the subscribe line says "Subscribe to get announced when we lunch." This should probably say "Subscribe to get notified when we launch." or something like that.</comment>


Introducing Sid Meier's Civilization V for SteamOS - <AUTHOR> http://steamcommunity.com/games/CivilizationV/announcements/detail/1787114954235229948

<comment><USER2> From the Civ V Steam Listing:

"Don't meet the above requirements? Running on Ubuntu? That doesn't mean your configuration wont run Civ V, it just means we have not tested and vetted your configuration. Visit the Civilization V community page to share your experience with other Linux players and learn about how to send bugs to Aspyr. Your feedback will help us improve Civ V Linux and future AAA Linux releases".</comment>


Clojure Concurrency Tutorial - <AUTHOR> https://purelyfunctional.tv/guide/clojure-concurrency/ <comment><USER2> I get to do Clojure about ~60% of the time at work now, and it never ceases to amaze me how much easier it is to deal with concurrency than in vanilla Java.

Futures and Promises and core.async don't allow you to totally avoid planning out your project (I've been bitten slightly by core.async's `go` blocks behaving differently than Go's goroutines), but they are a godsend compared to dealing with manual mutexes and semaphores.

I still need to play with manifold; I hear that it helps deal with the IO- heavy stuff that core.async chokes on.

<comment><USER3> I was reading somewhere that the core.async lib has not been updated in awhile...is this correct? (generally curious if the lib is actively updated)

<comment><USER4> It is maintained, but not actively. Like the last year there was two issues fixed in it.

There isn't someone actively trying to enhance it or add more features to it.

So my understanding is only major issues gets addressed.

<comment><USER5> Which is a quite peculiar and reccurrent pattern in closure.

After a while libraries and tools stabilize and the community just maintains it.

<comment><USER6> Most Clojure libraries I've worked with, even the "larger" ones, are fairly small and concise by modern standards. I wonder if this has something to do with the lack of activity (in addition to being a small community). It feels a bit like the Unix philosophy - lots of small/medium libraries handling discrete problems, rather than many competing mega-frameworks. To me, this feels like a silver lining that comes from the limitations of a smaller dev community.

<comment><USER2> This is why I love functional programming as a whole. I feel like my code is really terse, without little/no sacrifices in expressivity, and usually no substantial sacrifice in performance.

</comment></comment></comment></comment></comment></comment><comment><USER7> Data flow programming is a natural Concurrency programming. In addition, Clojure's STM mechanism comes from RMDB's MVCC. It is the easiest, most convenient, and most appropriate to support data flow programming. [https://github.com/linpengcheng/PurefunctionPipelineDataflow](https://github.com/linpengcheng/PurefunctionPipelineDataflow)</comment>


Tokyo Radiation Less Than Paris's Three Years After Meltdown - <AUTHOR> http://www.bloomberg.com/news/2014-03-09/tokyo-radiation-less-than-in-paris-three-years-after-meltdown.html <comment><USER2> ...of course, the radiation levels have been in the "normal" zone for Tokyo since a week or two after the accident. It looks like the levels have been below background for (say) New York City as well.

A bigger concern than air radiation in Tokyo is the contamination of food -- the worst-hit areas of Japan also happen to be the major farming regions of the country. People are probably more worried about consuming food grown in cesium-contaminated soil than air contamination in the middle of Tokyo.

<comment><USER3> The idea is to hide the truth, not uncover it.

<comment><USER4> The snark may provoke some downvotes, but that is exactly what's happening here: hiding the inconvenient truth by focusing on the convenient, but not particularly relevant truths.

Which is pretty much the standard operating procedure when it comes to defending nuclear power, which makes it near impossible to have a constructive debate on the matter.

<comment><USER5> As a person formally trained in Nuclear Engineering, I am curious as to what relevant truths you are seeking to know that the "standard operating procedure" tells me we should be hiding.

I'm all for constructive debates on nuclear power generation, but I do want to point out that the snark is making it difficult for me to want to even try to engage you in a dialogue.

<comment><USER6> Well, what was then the "standard operating procedure" in dealing with all that radioactive waste? No, I'm not asking for quoted texts by the book for how things should go when everything's OK, I'm interested more in how a large scale contamination should be (or should have been) dealt with? That, if there ever was such an assumed scenario after Chernobyl, of course...

</comment></comment></comment></comment></comment><comment><USER7> ""I wouldn't have come here then," said the 28-year-old German native after touring Tokyo's Imperial Palace on Friday. "But now I have friends here and they are fine, so I guess I'm fine too. I don't fear it at the moment."

Which shows how well the general public understands the effects of radiation exposure.

</comment><comment><USER8> > If sustained for a full year, that would be 154 times the maximum possible > dose of 1 millisievert per year recommended for public exposure by the > International Commission on Radiological Protection.

Note that this limit has no real meaning. There is no clear data indicating that x amount of millisieverts per year is harmful. We know radioactivity clearly kills at high doses, but the effects of low doses are largely undetermined. And people fly all the time and take CT scans in hospitals without realizing that they get more radioactivity exposure this way.

<comment><USER9> > There is no clear data indicating that x amount of millisieverts per year is > harmful.

Radiation damage is a game of statistics: A single charged particle, electron (whatever) striking the right molecule in your body may be enough for you to develop cancer and die in a particularly nasty way. The chances of this singular event happening and at the same time all safeguard of your body failing are minuscule, though. But the more events you have (the higher the radiation), the higher the chances that it will happen. This is what we basically know about radiation: it damages cells and for some events the natural cleanup doesn't work. Basically you could say that _every_ bit radiation is harmful, even the natural background radiation [1]. All guidelines and limits are based on the question whether the increased risk outweighs the possible gain. Early X-Rays had the problem of exposing the doctors to high doses, modern machines are designed with safety in mind. Still, patients and doctors wear protection when possible.

[1] to make matters worse, there's different kinds of radiation: alpha rad which doesn't even penetrate the skin, but is very harmful if dust is inhaled to high energy gamma rad that is basically impossible to shield without lead or other heavy metals around. So "1 millisievert" doesn't even tell you what it is, 1ms of alpha is probably better to handle than 1ms of gamma rad..

<comment><USER10> So how does that account for the supposed idea that people who live in Denver, who get 2x to 4x the average radiation than the normal population have far lower rates of cancer than average.

<comment><USER11> Maybe because the background radiation is just one of many, many contributing causes of cancer?

For instance, airline pilots are exposed to more radiation than the average worker. But they also have a low percentage of smokers, and in order to keep their medical license they need to be in fairly good health. So, apart from skin cancer, they have lower than average rates of cancer compared to the general population:

[https://www.alpa.org/portals/alpa/magazine/2001/March2001_He...](https://www.alpa.org/portals/alpa/magazine/2001/March2001_HealthAmongPilots.htm)

<comment><USER12> What do you propose is the lifestyle difference shared by the population of Denver that offsets their doubled exposure to low-level radiation?

Obviously cancer has many causes, but to the extent Denver shares those causes with Oregon, they should wash out and reveal Denver's radiation-linked cancer (which, after all, you're basically arguing exists).

<comment><USER11> I was just pointing out a flaw in his reasoning. I didn't argue that it exists (and from what I gather from other comments, it doesn't). But if it did, it could be offset by any number of things, some of which might not be shared to the same extent with other cities.

Or it might be that the baseline background radiation is so small that 2x that baseline is still statistically insignificant compared to other factors.

<comment><USER12> If you believe the latter statement, then you also aren't alarmed by radiation in Japan, right?

<comment><USER11> I don't believe anything in particular, that was just one of many potential explanations.

That said, I'm not alarmed by the radiation in Japan, I'm more alarmed about the situation of the Fukushima plant and the problems they face with potential leakage into the groundwater (among other things).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> And that says exactly nothing about the dangers of the accient, it could also just be that winds blow the radation away from Toyko and pollute other places.

</comment><comment><USER14> "Closer to the wrecked plant in Fukushima, levels remain high enough to prevent the return of many of the 160,000 residents evacuated after the nuclear accident"

</comment><comment><USER15> [http://www.youtube.com/watch?v=ByZ1AyDEGSk](http://www.youtube.com/watch?v=ByZ1AyDEGSk)

our friend the atom

</comment><comment><USER16> It's not about background radiation level. It's about the risk of ingesting or inhaling a speck of radioactive material. If this particle settles somewhere in your body, it means that the cells in the immediate vicinity of this particle are going to subjected to very intense radiation.

</comment><comment><USER17> Well, Shinjuku is on the West side of Tokyo. I wonder how the measurements compare on the East side, very near the bay. And in Chiba. And at Narita airport, closer to Fukushima.

<comment><USER18> I'm not sure the Fukushima power plant is where you think it is.

<comment><USER17> Well I know it's in Sendai region.

But I forgot how much Japan bends up at Tokyo. Sendai isn't North East like I imagined. It's more directly North.

Also, although Narita feels like an exhausting distance from Tokyo after you get off a plane, Sendai is of course much much farther away.

</comment></comment></comment><comment><USER19> That's what happens when you have the Pacific Ocean to dump the waste into.

</comment><comment><USER20> Well that's the all-clear signal, folks. Let's go skinny dipping in the effluent!

</comment><comment><USER21> What is this article meant to signify? Is it just to reassure people who travel to Tokyo?

Fukushima is 300 Km north of Tokyo, so while the radiations in the latter might be low, the former, (correct me if I'm wrong), is a lost city that won't be possible to inhabit for thousands of years. That, in my opinion, is a more relevant fact.

<comment><USER22> > Fukushima ...(correct me if I'm wrong), is a lost city that won't be > possible to inhabit for thousands of years.

Please edit your comment. You're completely wrong, and it's unsubstantiated speculation like this that drapes everything in FUD. People are already returning to the immediate vicinity of the power plant, having only been excluded this long because of ludicrously conservative recommendations.

[http://www.telegraph.co.uk/news/worldnews/asia/japan/1065957...](http://www.telegraph.co.uk/news/worldnews/asia/japan/10659577/First- Fukushima-evacuees-to-return-to-their-homes.html)

(The actual city of Fukushima and the rest of the Fukushima prefecture have been safe, even according to the highly conservative recommendations, for a long time now. I'm not sure they were ever even evactuated. As teraflop notes, the above article refers to the small town of Ōkuma in which the reactor was located.)

As expected, the actual harm caused by the meltdown is essentially undetectable above background levels, and is _trivial_ compared to the tsunami disaster that precipitated it. Most of the harm done comes from fear mongering when no actual risk exists.

[http://www.reuters.com/article/2014/03/10/us-japan- fukushima...](http://www.reuters.com/article/2014/03/10/us-japan-fukushima- children-idUSBREA280RJ20140310)

<comment><USER23> > when no actual risk exists

Now who's over-stating their case? 0% risk?

<comment><USER24> Please don't stoop to this level of discourse. If there are two possible readings of a comment, one reasonable and one unreasonable, it's best to choose the reasonable one.</comment></comment></comment></comment>


The Web Is Passing Most of You By… And You are Asleep - <AUTHOR> http://technosailor.aaronbrazell.com/2010/08/13/the-web-is-passing-most-of-you-by-and-you-are-asleep/

<comment><USER2> Strongly agree, not withstanding the gratuitous swearing. Mobile browsing has radically reduced my tolerance for designer cruft; if things don't improve soon there's going to be an opening for a mobile browser that specializes in filtering and caching web pages to speed up navigation.

Note to admins: if my browser string indicates I'm using a smartphone, then I'm going to be gone after about 20 seconds. 80%+ of my mobile browsing is for the purpose of reading news, but 80%+ of what I'm downloading is eye candy. I've started blocking the worst offenders.

<comment><USER3> * if things don't improve soon there's going to be an opening for a mobile browser that specializes in filtering and caching web pages to speed up navigation*

Opera Mini already does this I think.

<comment><USER2> To some extent, but I don't find it terribly usable in its current form. But at least they're trying.

</comment></comment></comment><comment><USER4> _Everyone has a smartphone_

Fuck. That. Shit.

You know who always says this? People with smart phones. It's amazing how having a smart phone convinces you that everyone has one. You also are convinced that they have your exact model of smart phone. Buy an iPhone? Guess what, suddenly everyone has one and you should be writing iPhone apps. Android? No way, nobody has one of those.

Mobile is definitely an interesting area to look at, but always trying to be on the cusp of the next big thing just means you'll spin your wheels a lot chasing stuff that doesn't pan out. Just ask everyone who touted Wave as "The thing you need to f-ing know right now!!!1!11!"

Don't be scared of getting passed over by the next hotness. Just look at all the plenty of companies making money on stuff that's old and tired. Wanna make money? Look at email! Groupon, Mailchimp, and a whole host of other companies are making money hand over fist. Try tell them about how email is dead.

</comment><comment><USER5> What is with the non-stop vulgarity? Trying to be "hip" somehow?

Your message is lost when one can't respect how you are saying it.

<comment><USER6>
      Your message is lost when one can't respect how you are saying it.

Although, in this case, the main role for the vulgarity seems to be covering for the fact that the author _has_ no message.

      "The RIGHT data to the RIGHT person at the RIGHT time on
      the RIGHT device. Data first, Device LAST."

This sounds good, but what does it actually mean, practically speaking? That we should be targeting SMS on old phones that Haitians use in national catastrophes? That doesn't sound like a very good business strategy...

</comment></comment><comment><USER7> I've been trying to convince people to design and code for mobile devices _first_ for a while now. I'm always amazed at the corporate resistance against this. I'm so forwarding this, swearing included. Good thing is that in my startup I do whatever i want.

</comment><comment><USER8> Can we please not have these inflammatory and uncivilized things on HN? I'm sure if there was a point to it, someone else would have written it down with less drama and more substance.

Thanks.

</comment><comment><USER9> Right-time > Real-time.</comment>


Tungle.me Sunsets Following RIM Acquisition - <AUTHOR> http://us2.campaign-archive2.com/?u=b7623d5c5ef0e681e8d7eda4b&id=c94f03d9f1&e=b81dced7b7

<comment><USER2> I just _knew_ that RIM acquisition would be a bad thing for us Tungle fans.</comment>


Jetty Web server flies to Eclipse - <AUTHOR> http://www.infoworld.com/article/09/01/28/Jetty-Web-server-flies-to-Eclipse_1.html

<comment><USER2> I've always liked Jetty better than Tomcat. In my experience Jetty can scale better than Tomcat. The only real minus is the lack of docs compared to Tomcat.

The problem I find with Tomcat is that it's difficult / foolish to try to be both the reference implementation and yet also try for stuff like performance at the same time. Probably doesn't help with Tomcat teams change up every half version, along with throwing out huge portions of the code base (though someone can correct me on that)</comment>


Prism Break - <AUTHOR> https://prism-break.org/ <comment><USER3> While I understand and sympathise with the compulsion to resist surveillance in this practical, technological way, I think it might be the wrong reaction to the information. It's typical of techie people to seek technical solutions to social problems, and this is one such case.

It may well be possible to mitigate their ability to watch you by wearing enough tin-foil hats. Even if you succeed, all you've achieved is to protect one solitary person at the cost of considerable personal inconvenience. Worse, once you consider yourself "safe enough" from prying eyes, your incentive to actually _act_ on what they're doing will be diminished.

I think that we should try not to be meek about this issue, passively hiding ourselves and then getting on with our lives saying "Fuck you, got mine". Why should the tech community flee the very Internet that it has played such a crucial role in building? Is the idea that our democracies could eventually fix this situation really beyond all hope?

If you live in the UK, write to your MP ([http://www.writetothem.com/](http://www.writetothem.com/)). Support PPUK ([http://www.pirateparty.org.uk/](http://www.pirateparty.org.uk/)) if you feel strongly enough, as they're seemingly the only political group treating this matter with the seriousness it deserves.

<comment><USER4> I'm starting to think people should begin to create "crypto-selves". I've seen a lot of talk saying essentially "get off facebook! get off gmail!" But that's a lot of persistent effort even for fairly technical people. Plus even in secure, anonymous environment interacting with your real life friends, purchasing your favorite books on amazon etc will reveal who you are anyway.

In non-web life we have private and public spaces and there's plenty of study on how these two play together and how important they are. Most people have erroneously thought that because your computer is in your private physical space that it's also 'private', but that's clearly not the case.

What people need is the education to create the technological equivalent of locking yourself in your bedroom for the afternoon to clear your head.

Gmail is like sending a postcard, facebook like chatting with friends at the mall or park. Tor/truecrypte/pgp etc for parts of your life you want private. Separate usernames, interests, tones of voice, etc in this private space.

Trying to hide your real (ie public) self is silly as should you become a target of the nsa & co. they'll find a way to dig up something even if you've been completely hidden from july 2013 on. What people need is a reasonably benign public self and a hidden crypto-self.

Also I'm all for fighting the surveillance state, but I'm extremely cynical of it's success. I see no feasible way to reduce the power and authority of the militarized aspects of our government(s). I can't think of a single example of where public knowledge and outcry has changed anything other than getting a few puppets punished anywhere except the non-militarized parts of government.

<comment><USER5> >I see no feasible way to reduce the power and authority of the militarized aspects of our government(s).

I partly think it's because people are asking for the wrong things. People say things like "stop NSA surveillance" which is vague and impractical. What needs to happen is to hit them where it hurts: Reduce total defense spending to 50% of what it is now. That should be the demand from everyone. Money is power. If you want them to have less power, stop giving them so damn much money. And besides, who can't get behind massively lower taxes?

<comment><USER6> If you want them to have less power, you need other powerful entities to tell them to stop abusing their powers. Boycott the tech giants and you'll see it happen. it's way more effective than any protest or online petition.

<comment><USER7> Isn't that another way of saying, "rule of the strong" instead of "rule of law"?

</comment></comment></comment></comment></comment><comment><USER8> Several of these suggestions seem somewhat disingenuous - e.g. many of them to be about free software more than actual concerns about tracking, as reflected in the labels "Proprietary" and "Free alternatives". In particular:

\- None of the proprietary browsers will track you - well, beyond what's specified in the privacy policy. Two of the alternatives are Tor applications, but the other two are Firefox (which provides no additional protection) and GNUzilla IceCat (which has little reason to exist other than free software politics).

\- Most of the browser add-ons are mostly about third-party tracking; these could be subject to PRISM, but the notes suggest that the concern is more about the third-party tracking itself and non-free software (in the case of Ghostery).

\- Ditto with the notes in cloud storage, which discount three storage systems with client-side encryption (i.e. equal protection) because they are proprietary.

\- The media publishing section promotes third-party blog publishing services for "privacy and security", even though most blogs are public and thus have no need for either.

\- Ditto above with Icedove vs. Thunderbird in the email desktop clients section.

\- iOS is advised against with a misleading claim that "iOS devices contain hardware tracking" due to an long-patched bug. The claim about it being impossible to verify whether an iOS app was compiled from the original source is disingenuous, as this is rarely done on any platform, but would certainly be possible to do on iOS if the developer cared.

\- OS X and Windows won't track you. (Chrome OS won't either, but it strongly encourages using cloud services which will, so I'll concede that.)

In the claims that proprietary software won't track you, I am assuming that the NSA will not compel (or has not compelled) these companies to modify their software to include secret tracking. This claim is made explicitly under the operating system section: "Apple, Google, and Microsoft are a part of PRISM. Their proprietary operating systems cannot be trusted to safeguard your personal information from the NSA." But even considering all that we have heard about the NSA, this seems absurd, far beyond what they are willing to do, and even if it were true, using free software would not necessarily prevent the US-based host of the download from being similarly compelled. Moreover, someone would probably notice (unless it were an intentionally introduced but otherwise unremarkable security bug, but it's sure easy enough to find real zero-days in software, free or not, without having to resort to that! - not that that should necessarily make you feel better.)

<comment><USER9> _> None of the proprietary browsers will track you._

Can you elaborate a bit on this, how do you know they won't? My default assumption is that anything I can't see the source code of and compile myself is compromised.

<comment><USER10> Sociologically: there is a surprisingly large contingent of people who believe that if a company makes a claim, it's the God's honest Truth. The OP may not necessarily fall into this camp.

Technically: if the browsers were somehow phoning home, even if the data were highly fuzzed, I'm sure there would be guys like tpatcek who would manage to detail, if not the content of the tracking, at least the amount of data sent and the targets. I don't recall there being such a scandal in recent memory.

<comment><USER9> It is possible to send data along with other data so that it's reaaally hard to find. Also, they don't need to send data all the time, but rather activate this mode on request, say when a person using this browser is a suspect for some reason and govt needs to track his every move on the internet. This would make detecting of such a functionality virtually impossible, because it'd be turned off most of the time for most people.

<comment><USER8> It is possible. However, considering that it would only take one person being exceptionally curious with IDA, one employee to blow the whistle (the source is still "open" to a fairly large number of people, and a backdoor is far harder to hide than passive collection of existing data), or one slipup to cause a massive amount of PR damage, and this has never occurred, nor does the Snowden leak suggest this is happening, I personally consider this claim extremely improbable. YMMV.

</comment></comment></comment></comment></comment><comment><USER11> If you're going to continue using Google Mail, it's a dumb idea to deliberately switch away from Chrome. The connection between Gmail and Chrome is among the more carefully guarded TLS connections on the Internet.

<comment><USER12> How does Google create one of the most carefully guarded TLS connections? Should other sites model their implementation?

<comment><USER13> When Google.com's certificate was faked, it was discovered because Chrome restricts what CAs are allowed to sign Google's certificates, if I recall correctly.

<comment><USER11> Google does that for a number of other non-Google sites, too.

<comment><USER14> Pretty sure its just google sites, because otherwise you might get false positives as other sites change servers/ips/certificates/etc

<comment><USER15> [https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...](https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json?view=markup)

<comment><USER16> Interesting. Kind of an eclectic small list: Google, Twitter, Tor, CryptoCat.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Let's pretend I'm the NSA. I don't care right now about what your saying, I just care about who you associate with and where you are hanging out. If those raise my suspicions then I will also track the where/who connections and create a map of activity. Those dots might start to line up and create further interest.

If suspicions are founded as actual threats I will do anyone of the following and probably more.

FISA request

Look into your credit card records and bank transactions

Serve your host/ISP with a request and also get your SSL private keys

Listen in on your cell phone/home phone/sat phone

Use traditional listening devices (these are great btw..)

Find an exploit in something you use (I'm pretty sure I have some zero days lying around).

Listen in on your girlfriend/wife/husband/boyfriend/friends and family.

Create lots of tor exit nodes and track your patterns

Ask some actual spy's/moles for some intel

Use satellites and tracking devices, maybe even some drones

Torture

Wait for you to mess up..people are lazy.

I made this to point out some real tactics that are actually used and why the vast majority of PRISM related posts like these are a bit silly...aka..you're probably not a terrorist. The NSA tracked bin Laden's courier Abu Ahmed al- Kuwaiti's cell phone which eventually led them to Bin Laden. Does that sound like anything you're doing?

The NSA is not above the law and I generally support Snowden, William Binney, etc .. I just think people need to get grip on reality here. The only people tracking you are ad trackers.

ps. Don't fret too much about the NSA, Google Glass will have citizens spying on each other in no time flat.

<comment><USER18> You completely missed the point. The NSA is tracking everyone. They're building a database of everyone's activities. Nobody knows who the "terrorists" are going to be 20 years from now. The moment you become a suspect, they can bring up everything they've recorded you saying or doing and use it against you.

The NSA is above the law and the rules they follow are set by a secret court appointed by a single man who has his position for life.

<comment><USER19> Also extremely likely - the NSA/GCHQ/Whoever siphon off all "metadata".

At the next Boston bombing, or whatever, they analyse that metadata for the perpetrator. And the next one. And the next one. And build a profile of what a "terrorist's" communication patterns look like.

And then they single out everyone matching that profile and stick watches on them, or bring them in.

It's Minority Report without the psychics. Google Now for Homeland Security.

<comment><USER20> > It's Minority Report without the psychics.

Wow, that never occurred to me. Analyzing Metadata really _is_ a lot like "pre-crime".

Sure, in a sense all police or intelligence work can be looked at in a way that makes it seem "like pre-crime" \- after all, crime prevention does have its merits. But putting every single citizen on the list is something different entirely and really does smack of "psychics".

<comment><USER21> >Wow, that never occurred to me. Analyzing Metadata really is a lot like "pre- crime".

I thought that's why everybody's freaking out. I mean... that's why I'm freaking out. I haven't even seen the movie.

</comment></comment></comment></comment></comment><comment><USER22> Surprised Arch Linux [1] isn't listed. It's probably one of the most secure distros by limiting the installed packages to a bare minimum. Combine that with App Armour (or SELinux designed by the NSA) with a firewall and basic network monitoring to protect against rootkits. Plus always-on VPN, dm-crypted harddrive, noscript etc.

NSA also released SEAndroid [2] which hardens Android significantly. It's included preinstalled w/ Samsung S4. Although still not very popular and I'm sure not heavily code-reviewed.

[1] [https://wiki.archlinux.org/index.php/The_Arch_Way](https://wiki.archlinux.org/index.php/The_Arch_Way)

[2] [http://selinuxproject.org/page/SEAndroid](http://selinuxproject.org/page/SEAndroid)

<comment><USER23> I'm more surprised that Mint is being suggested at all in this. Considering how ridiculous this list is in the first place, the 'curator' should have noted that Mint, by default, installs search engines that are partnered with Mint[1].

Even more surprising is that BSD just got a cursory mention. You may as well switch to OpenBSD if you're going to switch to a majority of these alternatives.

[1] [http://www.linuxmint.com/searchengines.php](http://www.linuxmint.com/searchengines.php)

<comment><USER24> I've added a note about Mint's search engine policy, thanks.

Also, BSDs will get greater emphasis in future updates. I'm working on a way to promote more operating systems without the page getting even more overwhelming than it already is.

</comment></comment></comment><comment><USER25> Tor should NOT be on here. It has little to do with "breaking" PRISM. PRISM is a voluntary program wherein a handful of endpoints have chosen to submit copies of their database to the NSA. Regardless of the mechanism or browser used to access Facebook, the reality is that all of that data gets uploaded to the NSA anyway, so who cares? People aren't interested in the real solution to PRISM, which is "Don't use services provided by PRISM participants".

Furthermore, Tor's outproxy network (i.e., accessing normal internet sites through Tor) is heavily compromised, rife with honeypots run by both non- governmental and governmental operatives, and nothing stops anyone from injecting more honeypots. New exit nodes are automatically registered and used by the network as soon as the client flips his/her bit. While ostensibly exit nodes are not supposed to be sniffing these packets, since it likely violates wiretapping laws in their jurisdiction (unless it's an NSA-owned exit node, of course), one would be very naive to presume such sniffing is not occurring. This means that any data that eventually hits the exit node should be considered, for all intents and purposes, public (correctly-implemented SSL may mitigate this risk where employed). This is fine if you're just trying to circumvent a firewall (remember, Tor was originally designed as a firewall- circumventer so that dissidents in China et al could convey their traffic to blocked sites; the goal was simply "get this public blog post out of China and to the rest of the world", not "hide all data from the NSA", hence the design of the exit node network) so you can use IRC, where your conversations are public anyway, but it's not fine for all kinds of browsing applications, so "try using Tor for everything" is actually horrendous advice.

The upshot of that is that like most other privacy software, you really need to understand the software well to a) actually obtain any meaningful privacy from its usage and b) not accidentally seriously harm yourself.

On top of all that, Tor traffic is easily distinguished and most likely automatically flags your NSA profile for additional attention.

<comment><USER26> > On top of all that, Tor traffic is easily distinguished and most likely > automatically flags your NSA profile for additional attention.

As a fairly boring non-dissident who's just trying to be a good citizen on the internet, I think I actually consider that to be a feature.

</comment></comment><comment><USER14> Cyanogenmod should have a big asterisk beside it noting that it's system is signed with PUBLICLY AVAILABLE KEYS. Also they have just the same proprietary blobs (most of them) that other android devices have (radio firmware, camera drivers, etc) that have just been pulled out of shipping factory android images. The description (without these) is playing people false IMO

<comment><USER27> Ugh, really? So is there no smartphone OS that you can be at-least-sort-of certain doesn't have a backdoor (leaving aside unintentional exploits)? My understanding was that even FFOS was built on top of an Android kernel...

<comment><USER28> No, not really. I guess your best bets are [http://replicant.us/](http://replicant.us/) and the openmoko freerunner.

</comment></comment></comment><comment><USER15> I really do not understand the thought process behind this page:

Why is chromium not listed as a free alternative to Chrome/IE/Safari?

What components of DDG are partly proprietary and which are not? (not a criticism of DDG just this page) What is a "free search engine" anyway?

Why are Firefox and Thunderbird listed alongside Iceweasel and Icedove?

How do you list OpenNIC if they have not adopted an official privacy/anonymization policy?

Speaking of official privacy policies; I see that you tried to load /analytics/piwik.js. Where is the privacy policy for prism-break?

<comment><USER24> > What components of DDG are partly proprietary and which are not? (not a > criticism of DDG just this page) What is a "free search engine" anyway?

These parts are open source: [https://github.com/duckduckgo](https://github.com/duckduckgo). I've added this note to PRISM Break. A free search engine would be a search engine where users have the freedom to run, copy, distribute, study, change and improve the software. YaCy fits this description, but there are currently not a lot of people using YaCy at the moment.

> Why is chromium not listed as a free alternative to Chrome/IE/Safari?

Chromium will be added once I get a list of good Chromium extensions that rival the Firefox addons.

> Why are Firefox and Thunderbird listed alongside Iceweasel and Icedove?

Iceweasel and Icedove are difficult to install on Windows and OS X. If users are unable to switch to Linux, Firefox and Thunderbird are still really good options.

> How do you list OpenNIC if they have not adopted an official > privacy/anonymization policy?

Good point. OpenNIC will be removed for the time being.

>Speaking of official privacy policies; I see that you tried to load /analytics/piwik.js. Where is the privacy policy for prism-break?

PRISM Break does not track the last 2 bytes of your IP - e.g. 192.168.xxx.xxx. A Privacy Policy is on the todo list.

EDIT: [https://prism-break.org/privacy.html](https://prism- break.org/privacy.html)

<comment><USER29> Would you please add rsync.net to the "cloud storage" section ?

If you're not familiar:

[http://www.rsync.net/resources/notices/canary.txt](http://www.rsync.net/resources/notices/canary.txt)

We explicitly support duplicity and git-annex which makes us very versatile for secure cloud storage.

</comment></comment></comment><comment><USER30> New poster here, but someone needs to say this. Tor is amazing and great, but if you don't think the US/NSA don't know how to run their own Tor hops and cache the very same traffic that you think is on "anonymous" servers. . . then you have a more serious problem of understanding how this works. It's easy to run Tor servers. Even easier when you have an NSA budget. Also, ask yourself why wouldn't they be running thousands to tens of thousands of them knowing that most of that traffic is "suspicious".

Be safe. Not ignorant.

<comment><USER31> Welcome! Don't worry, most of us know this, and those that don't are constantly being shouted at by everyone else.

</comment></comment><comment><USER32> This is great for us. We understand these tools and can use them. But most people don't. So if all geeks switch to the things on this list, we've left most of society just as susceptible as before.

Other, possibly better, solutions:

1) If you work for one of the companies listed as "proprietary", you can do the most. Stand up and say you care in company meetings. Tell managers and executives that it's worth finding better ways to secure, anonymize, or not collect information in the first place. Even if it comes at the cost of profitably or usability.

2) Authors of lists like these: Instead of saying all commercial software is lousy, compare them to each other! Make having secure, private software an actual selling point that people can understand.

3) Developers, designers: make beautiful, usable software that is secure and anonymous by default. Don't have privacy as your ONLY selling point. We can only win if we're private and amazing.

</comment><comment><USER33> It is important to mention that "self-hosted" by itself, does not make one Prism-Free.

In most cases, if the hosting platform provider will be asked to provide access to the infrastructure, it is most likely that SSL private keys that stored on the virtual machine will be taken along with other data.

<comment><USER34> Sorry, this is a fallacy of false equivocation. Not all hosting platforms are the same, especially in terms of jurisdiction.

Switzerland and China do not respond to Secret Service or FBI orders.

<comment><USER33> China?

What makes you think this is not the case there by default?

I am talking about local authorities ofcurse.

</comment></comment></comment><comment><USER35> I praise this effort. Whatever the criticism may be, it's a useful site and it educates people. Folks like them do a lot more than us ranting here in the comments :)

<comment><USER36> I am not sure what kind of education does it provide. If NSA has access to GMail, it does not matter what email client you use, open-source or proprietary. If your ISP logs all your activity, it does not really matter what browser do you use. And in general it is simpler and more revarding to target services providers instead of client apps for those services.

</comment></comment><comment><USER16> Interesting, I learned about the Autistici/Inventati collective only from this link, even though they seem to already be a large (>1k users) organization and in existence for a decade now. Useful info.

<comment><USER37> I've signed up for their email service and will now use it as my primary email id.

</comment></comment><comment><USER38> Is there any indication that this isn't disinformation geared toward a false sense of security? Call your government representatives instead, it'll have a greater effect.

</comment><comment><USER39> What about obscuring rather than hiding? For instance, a script that emails hundreds of random addresses, tweets on hundreds of different accounts, visits thousands of different urls, texts and voice calls hundreds of numbers (for those with "unlimited" mobile plans), etc. every hour or every minute or what- have-you.

It seems that would be the digital equivalent of a paper shredder - <USER2> but not necessarily easy to pick up and read. Just as well, all these collection operations that seem to be in place would fill up with mountains of useless data.

</comment><comment><USER40> With systems like Tempora [https://en.wikipedia.org/wiki/Tempora](https://en.wikipedia.org/wiki/Tempora) in place and the main goal of intelligence organizations (probably around the whole world) being to "know all information", the only way to be safe from losing your secrets is not to disclose them in any electronic form on the net. Simple as that.

And with your "secrets", I mean any piece of information you don't want them to know: email, websites you visit, mobile phone calls (and locations)...

Since Echelon/PRISM/Tempora/etc is practically public knowledge at this point, I would imagine that most "real terrorists" have also deduced the above facts and are living by them, making the whole exercise a fishing expedition paid with regular Joe's privacy and tax money...

</comment><comment><USER41> The listed software is usually a good idea, but there should be a bit more explanation. Using TOR to access non-SSL website for example, might be bad idea.

Also, noticing TextSecure, it's great, but I have personal gripe with it -- you can't use it without using Google play, and that means irrevocably pairing your phone with Google account and therefore some identity. Would it be that much of a hassle to put APK on f-droid? Software that's supposed to be secure but requires you to have Google account is a sad view.

EDIT: of course, after the (de)cryptocat debacle, using TextSecure without reading the source code might not be a good idea. Homepage of "security" software like that should always include page about security: what algorithms it uses, stuff like that.

</comment><comment><USER42> Politics aside, this is a really interesting list of tools I haven't heard of before. Thanks!

</comment><comment><USER43> Very nice. Didn't think we'd be seriously discussing alternatives to the Internet in 2013 =) ([https://projectmeshnet.org/](https://projectmeshnet.org/)) ... maybe this will spur innovation! Cheers.

</comment><comment><USER44> Although it relies on Mega and Chrome, neither of which is recommended in the article, [http://www.nimbusvid.com](http://www.nimbusvid.com) streams encrypted videos from your private cloud storage in your browser.

No other service does this and it allows you to have the convenience of the cloud and video streaming while maintaining the privacy that you would get by viewing videos on your local computer.

As far as I know it is one of the few examples of a (client-side) web app based on encrypted cloud storage. (I would like to know other examples, I don't know any).

(I am the author)

</comment><comment><USER45> Just a bit of site feed back:

Maybe its me, not completely unlikely, but when I open the left hand nav menu, with the button at the top left, the whole site shifts to the right to show the menu, but that cuts off the text in the last column. As well as that, no bottom scroll bar appears. Maximizing or resizing the browser window makes no difference. This is in Chrome, Iron(which you don't list and I reckon should), and firefox. Tried in IE, but the menu button at the top left doesn't work at all.

On the up side, the site name gave me a welcome chuckle!!!

</comment><comment><USER46> I want to like this page but there are many problems...

* Who is the target demographic for this page? If it's lay-users, many of the suggestions are inappropriate: no-script, arch linux, "host-your-own cloud provider"... these are useless if you're not a programmer.

* Many of the suggestions don't do anything to improve your privacy. As tptacek noted, host-your-own may protect you from gmail handing your emails over en masse, but it doesn't protect you from yourself (you eliminate one attack surface but add many many new ones). Switching your email client... again, if the gov't can just ask your provider for all your mails, your client is irrelevant (excepting gpg which is a different question). It seems like many of these will create a _false_ sense of security, which is even worse than no sense: "Yay I switched from outlook to icedove, take that NSA."

* There are _way too many alternatives listed_. What is the point of listing six different linux distributions? Pros are aware of the fact that there are many distros, newbs need a _recommendation_ , not a dizzying list of alternatives with no guide to how to pick one. (I see mint is listed as newb choice; why are qubes, trisquel, etc. listed at all?). Ditto mail clients, browsers, and especially social networks. It seems little care was taken to ensure that the software on this list has any merit beyond being "free." Hey I made a free [barely functional, never updated] chat client, why isn't it on your list??

* The list reeks of politics over practicality. Seriously, IceDove? Trisquel? I'm a linux user at home, have used tbird, pidgin (& finch), adium, OTR, debian, ubuntu, mint, etc. etc. and I've never even heard of these tools. I suspect they are being listed because they are "FSF Endorsed" _not because they are actually more useful._ This is an AWESOME way to alienate new users: steer them toward ideologically pure but hard-to-use or nonfunctional software.

My suggestions: * pare down the list (only list 1 or 2 of the best alternatives, maybe with a "more options" link for IceDonkey or whatever);

* Indicate how much technical expertise is needed for different tools. NoScript is USELESS for lay-users, disconnect.me (if it's like ghostery) & adblock are set&forget, very low friction options for new users. Ditto arch linux &c.

* _Don 't include things just because it meets the requirements of being "free"!!_ You don't need every half-functional email client in the world because it's "free"\- this makes the list _worse_ , not better.

* Make clear what tools do and don't do!! Merely switching to pidgin to connect to your does nothing for you, your list suggests it does. Blocking google analytics does not stop the NSA or whomever from requesting information from your ISP about your browsing habits!!! This _needs_ to be more clear on your list.

* Don't make outlandish, inaccurate, unrealistic claims! "Stop the American government from spying on you by encrypting your communications and ending your reliance on proprietary services." 90% of these tools have nothing to do with encryption and/or aren't any more secure by default. You can't "opt out of prism." You're not "stop[ping] the American government from spying on you" by hosting your own wordpress. This claim is horsefeathers and it needs to be removed.

Oh well... at this point I'm feeling that in its current state your list does more harm than good, overwhelming users with too many (shitty) choices, creating a false sense of security, and muddying the waters about online privacy like crazy. These tools require attendant tech education: you can't just dump Adium in someone's lap and say "now you're protected from spying."

</comment><comment><USER47> It's interesting that none of the BitTorent software was mentioned, at least BitTorrent Sync as an alternative to proprietary cloud storage.

<comment><USER48> Closed source afaik.

</comment></comment><comment><USER49> Spideroak.com - online backup and sync with zero-knowledge client side encryption should be represented in cloud services in my opinion, though since we are not yet 100% open source I understand the arguments against it.

We are however very close to opening nimbus.io and crypton.io open-source secure and private storage APIs based on our storage infrastructure.

</comment><comment><USER50> Quite aside from protecting your data from the NSA, this site has a lot of software it's good to be aware of -- Jitsi, git-annex, Etherpad [1], and Piwik seem particularly interesting.

[1] I've seen Etherpad mentioned multiple times on HN, but I somehow never realized that it's self-hosted FOSS.

</comment><comment><USER51> Aren't these all false suggestions? (Except for Tor like software maybe)

For example: DuckDuckGo might hide your search but when you click on a link in the result list the request to that link is still monitored by your Internet provider.

<comment><USER52> For the sufficiently paranoid, DuckDuckGo is available as a Tor hidden service: 3g2upl4pq6kufc4m.onion

They also run a Tor exit enclave for DDG searches, so using https over tor for DuckDuckGo searches should provide about as much anonymity as you can get doing search engine queries.

</comment></comment><comment><USER53> Switched to DuckDuckGo a couple weeks ago. It's surprisingly pleasant to use.

<comment><USER54> I was wondering the other way. If you just open Chrome in incognito mode and search Google without logging in, is it very much different from DDG? Except for the results quality, of course.

Is the big difference being your IP tracked with the searches by Google?

<comment><USER55> Google will track your IP and probably store the searches you made alongside it. These can easily be linked back to your google accounts.

Duckduckgo claim not to log your searches.

<comment><USER56> Yes but how much is a claim worth? Anything centralized is at risk to be tracked by the government. It's not as if Google put in the TOS that the NSA is monitoring their data.

<comment><USER53> I wonder if there is a decentralized P2P crawler system that shares IP addresses of at least major domains/hosts.

With that you could run a node and search locally against your machine without anybody knowing.

<comment><USER57> Yacy is mentioned in the article.

[http://yacy.net/de/index.html](http://yacy.net/de/index.html)

</comment></comment></comment></comment></comment></comment><comment><USER58> Its kinda nice of a list thanks :) I'd add here.com as proprietary maps. Its actually pretty good. yes its proprietary - but even having proprietary alternatives is good.

oh also gallery3 should probably be in there.

</comment><comment><USER59> Nobody seems to be talking about whonix added layer of anonymity [http://sourceforge.net/projects/whonix/](http://sourceforge.net/projects/whonix/)

</comment><comment><USER60> Nice resource, thanks for posting. It would be really cool to have some kind of ratings and reviews for each service/app listed. Maybe an official review/rating and then user contributed.

</comment><comment><USER61> The only way you can truly guarantee you haven't been rooted is to at _least_ trust your compiler. Even if you have the compiler's source code, how are you compiling it...?

</comment><comment><USER62> Needs more emphasis that the left column is the one to avoid.

<comment><USER63> Seems like the lack of links in that column makes it pretty obvious

</comment></comment><comment><USER64> Surviving in the current situation, will require a radical change in attitude and education - you know, effort - not just switching out bits of software.

</comment><comment><USER26> I'd be interested to hear about the state of encryption (particularly end-to- end encryption) in the listed Social Networking projects.

</comment><comment><USER65> sharefest.me is another alternative to secured file sharing. The main advantage is browser only - sandbox security. And p2p - files don't touch the server. Although not _yet_ as secured as the other, we're working to improve it. Would love any security feedback on github.com/peer5/sharefest/issues

</comment><comment><USER66> Would like to see a mention of alternatives to commercial mobile networks.

<comment><USER67> OpenBTS :)

</comment></comment><comment><USER68> I still prefer IRC over all of those Instant Messaging options.

</comment><comment><USER69> I think its fair to say that this is a highly opinionated list.

</comment><comment><USER70> On Social networks, we have Diaspora*

What's with the '*'?

</comment><comment><USER71> how about app.net

<comment><USER72> american;

edit subject to the rulings of the fisa court etc.

</comment></comment><comment><USER73> prism

</comment><comment><USER73> nice!

</comment><comment><USER74> There is no easy secure way of having audio and/or video chats? Like we had with skype before microsoft stepped in.

XMPP is here, and we have no real good clients either for desktop and for Android we got basically none that supports Jingle.

<comment><USER75> Jitsi supports ZRTP and Jingle (experimental).

<comment><USER74> Ive tried it, it sucks and crashed too many times, bugs reported, but gave up.

Jitsi also doesnt run on our phones last time I checked.

Basically we have these smart-phones, awesome hardware, good devices, but we cant use them to talk confidentially with our friends.

<comment><USER76> Lot's of clients are stuck because they use Telepathy:

[https://bugs.freedesktop.org/show_bug.cgi?id=16891](https://bugs.freedesktop.org/show_bug.cgi?id=16891)

[https://bugs.freedesktop.org/show_bug.cgi?id=29904](https://bugs.freedesktop.org/show_bug.cgi?id=29904)

Libpurple doesn't seem to move either: [https://developer.pidgin.im/ticket/11221](https://developer.pidgin.im/ticket/11221)

Those are major libraries which are used on the desktop and mobile, and that's probably the reason why you don't see actual clients with ZRTP support.

</comment></comment></comment></comment><comment><USER77> For cloud storage I also recommend [https://mega.co.nz/#fm](https://mega.co.nz/#fm)</comment>


When A.I. Matures, It May Call Jürgen Schmidhuber 'Dad' - <AUTHOR> http://www.nytimes.com/2016/11/27/technology/artificial-intelligence-pioneer-jurgen-schmidhuber-overlooked.html <comment><USER2> This is terribly depressing. I feel bad for Jurgen cause I have always thought he was on the right track philosophically, which is arguably what put him at odds with the rest of the community.

</comment><comment><USER3> article confuses AI with ML.</comment>


Carlos Ghosn Escaped Japan According to the Ex-Green Beret Who Snuck Him Out - <AUTHOR> https://www.vanityfair.com/news/2020/07/how-carlos-ghosn-escaped-japan <comment><USER2> > On the train, Taylor's phone began an unexpected automatic software update. > "The first thing I thought was, I wonder if the NSA knows," he recalls. "I > wouldn't put anything past them." The update meant that Taylor wouldn't be > able to access any of the apps he needed to be in contact with other members > of the team while the mission was under way.</comment>


Censor Google - <AUTHOR> http://pando.com/2014/05/19/censor-google/

<comment><USER2> Why is it the responsibility of Google to remove these items from their index, and not the responsibility of the original publisher to block it from being indexed?</comment>


The Truth - <AUTHOR> http://meyerweb.com/eric/thoughts/2014/04/03/the-truth/

<comment><AUTHOR> I need to stop crying now</comment>


What If All the World Ran Linux? - <AUTHOR> http://www.pcworld.com/businesscenter/article/214596/what_if_all_the_world_ran_linux.html

<comment><USER2> 5\. Better Software

This is a highly dubious claim. First off the commercial software industry would just migrate to Linux, just like it does any high volume platform it can make money off of.

Secondly, and this opinion might not be popular but... I for one have yet to be convinced that open source software is "better" quality wise by definition. Yes much of it is as good as commercial products, much of it isn't. I still feel that a controlled, well selected development team working in a proper environment that encourages good communication will be more productive than a loosely tied group effort. The latter often suffers from a lack of clear goals and direction, sadly. Not that it CAN'T be done, but I'm not yet convinced it's a given that open source = better quality by default. Either side of the coin can produce quality, and crap. :)

Just my 2c.

<comment><USER3> Offhand, I'd have to say the amount of bad/good software is similar to what exists commercially. The difference is that a lot of commercial software is either enterprise and hidden, or so obscure nobody cares.

"Better" often refers to _better designed,_ however, and a lot of OSS projects are actively hostile to any one creative vision that would shape the interface.

</comment></comment><comment><USER4> An interesting article, but I have to disagree with his conclusions about the effect on malware.

I'd say that mainstream Linux adoption would likely be dominated by 1 or 2 major distros, like Ubuntu. Any potential attack vector could be targeted at that distro's package management system, for instance, and be assured of _some_ impact.

In addition, many distros share a common underlying base system (like Debian) - any child distros of a vulnerable system would also presumably share the same vulnerabilities.

<comment><USER5> I also disagree on points 1 and 2 but for different reasons. We're still going to need antivirus as long as less computer literate people download and run random executables. Gaining root or administrator privileges isn't necessary for the common tasks that malware does such as spending spam or getting the user's usernames/passwords/credit card details.

Also, despite its stronger security model, all it takes is one script that runs as root to have the wrong permissions set, or to read/execute other executables which have wrong permissions and you've got root. I'm not sure if the common packages on standard Linux desktop machines are configured correctly out of the box (I'd hope that they are), but this is worryingly common in corporate/enterprise environments. There are also bugs in other packages (including the kernel) which can be used for privilege escalation through buffer overflows, etc (although these tend to be patched fairly quickly)

</comment></comment><comment><USER6> This article makes the specious assumption that if all the world ran Linux, free software would reign. Currently, the dominant Linux culture is a self- selected group of FLOSS fanatics. If all the world ran Linux, those people would be just as much a minority of Linux users as Linux users are of the total PC-using populace.

It isn't as though people lack options for free software on today's popular operating systems — they just generally choose to use commercial software.

</comment><comment><USER7> The argument that bothers me is "Better Software". Sure, the leading software platform in the world will definitely have better software, since there'd be more developers working on it. Feels like begging the question to me.

You might as well replace "Linux" with "Web Apps" and get a similar picture. I'd argue we're closer to this world than an all-Linux one.

</comment><comment><USER8> I am a big Linux and Open-source fan, but the author is lying to himself. His claims have absolutely no proof.

Espacially point 1 is a joke. How many Linux users habe anti-virus software?

</comment><comment><USER9> Didn't read the article yet, but I think the world would be full of people who actually understood computers (or enough about Linux to function with it) and a much much geekier life. That would be awesome. _reads article_.</comment>


Show HW: PlaceSheen - <AUTHOR> http://placesheen.com/

<comment><USER2> You'll probably want to disallow stuff like this: [http://placesheen.com/phpthumb/phpthumb.php?src=http://cvcl....](http://placesheen.com/phpthumb/phpthumb.php?src=http://cvcl.mit.edu/hybrid/cat2.jpg&w=200&h=300&zc=1)

<comment><USER3> Look in phpthumb.config.php for $PHPTHUMB_CONFIG['nohotlink_enabled'] and make sure its set to true.

If you need to enable it for some domains you can do that too: <http://phpthumb.sourceforge.net/demo/docs/phpthumb.faq.txt>

Edit: you should turn off debug too: [http://placesheen.com/phpthumb/phpthumb.php?src=xxx.jpg&...](http://placesheen.com/phpthumb/phpthumb.php?src=xxx.jpg&phpThumbDebug=9)

</comment></comment><comment><USER4> While these are fun, if you want something more serious: <http://placehold.it/>

</comment><comment><USER5> Are you ready to roll to kittens at a moment's notice, in case Sheen kills someone (possibly himself)?</comment>


Embedded Content and Iframe Security - <AUTHOR> https://www.tinfoilsecurity.com/blog/protect-your-website-from-embedded-content-iframe-security

<comment><USER2> I hate it when the article is written with the assumption that it is going to make the front page of HN /and/ spark a discussion.

EDIT: Interesting article though.

<comment><AUTHOR> The "Hacker News discussion" text at the bottom was meant to be a link to the article on HN - whoops! We didn't assume we'd make the front page (super happy we did for a bit!) but I like to use HN as our centralized discussion forum since we don't have a commenting system of our own.</comment></comment>


Ask HN: Version control for large amount of small projects? - <AUTHOR>

How do you handle version control for a large amount (100+) of small projects (<100 LOC) with only a single contributor?
Especially when some of the projects share libraries which are maintained in a separate SVN project.<p>At the moment I am torn between creating a single "blanket" repository and just check in the individual files and creating a single repository for each of the projects. <comment><USER2> It sounds like Git submodules would work for you, basically it means each small project is its own repository but they are all bundled as part of one big project. Submodules work well for when there is only one contributor to keep things version-controlled but all in one place. Check them out!

<comment><AUTHOR> I will definitely give that a try, the reason that I've left them out however is my previous bad experience with keeping them in sync across systems. That issue might be lessened considerably here though due to both the size of the projects and the fact that It's just a single person working on them, from a single location.

</comment></comment><comment><USER3> When you sit down to do something, how many of these projects do you touch?

If the answer is "one", then do a git repo for one. The answer you should ask yourself is "when I look at the git log, which history(ies) would it make sense to see together".</comment>