On the S-Box of GOST Streebog and Kuznyechik - <AUTHOR> https://who.paris.inria.fr/Leo.Perrin/pi.html <comment><USER2> Someone should hold a backdoored blockcipher or hash function competition.

The structure would be that submitters are intended to submit proposals which are structurally like those of normal cipher competitions, e.g. make the same security arguments, etc. To focus efforts most usefully, they could be required to not just lie about the properties they claim (not a restriction on real attackers, but we already know that if people make claims that people accept and no one checks that this can allow backdoors-- and due to the risk of being caught real attackers would probably avoid outright lies).

But every entry is required to contain an exploitable algorithmic backdoor, not just a certificational weakness.

The process continues like a normal cipher competition, and the winner is selected based on no one being able to break their scheme.

Then the backdoors are disclosed. (Perhaps some escrow process could be used to make sure that they're really back doored, or a ZKP to that proves they could break a nothing-up-my-sleeve instance could be required along with the submission)

I think from such a process we could learn a lot about what submission norms are actually useful for protecting against cleverly constructed back doors, and something about the submission norms that we're missing.

Alternatively, it might be useful for normal competitions to allow secretly backdoored contributions. E.g. every submitter submits a commitment at the beginning, and then at the end everyone reveals their commitment (to avoid the case of a bad submission being revealed as "white hat" selectively only if its caught). ... but I fear that the result of such efforts would do more to erode our trust in the process (because it would fail to find the backdoors) than it would educate us about making things more secure. It would, however, make cryptanalysis of proposals more attractive, because it would increase confidence that there are discoverable weaknesses in at least some of the proposals.

<comment><USER3> > some escrow process could be used to make sure that they're really back > doored

Or the judges ask the teams to provide a working implementation, encrypt some text with each implementation (a random sentence, perhaps), and return the ciphertexts. Each team can then prove it is backdoored by providing (a significant part of) the plaintext.

<comment><USER4> > Each team can then prove it is backdoored by providing (a significant part > of) the plaintext.

Some backdoors are asymmetric backdoor, so the original designers can decrypt anything at will.

But some others only hide a trick that reduces the computation complexity to, say, 2^80. Unless you are a nation-state, you cannot use the backdoor. And the other type of backdoor only increases the susceptibility to implementation vulnerabilities (cache-timing attacks, invalid curve attacks), mathematically speaking they're still secure, but too difficult for most people to implement it perfectly.

A escrow process would be better.

<comment><USER5> _> But some others only hide a trick that reduces the computation complexity to, say, 2^80. Unless you are a nation-state, you cannot use the backdoor._

That's not an issue - you just publish the backdoor. You don't need to demonstrate the complexity reduction, you just need to prove it exists.

</comment></comment></comment></comment><comment><USER6> The maths is way beyond my level, but I think it's rather amazing that they were, given a presumably random permutation, able to figure out the algorithm that generated it. I'd like to read more about how that was done --- did they just try different algorithms until they found a match?

This reminds me of the story around the DES s-boxes:

[https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's...](https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's_involvement_in_the_design)

To me, the possibility of a backdoor in these GOST algorithms seems just as likely as the possibility that the structure was chosen carefully to strengthen them against a type of attack that is still classified.

<comment><USER7> If you pick a random S-Box you can see that there is an expected value for its nonlinearity. On the other hand, you can also look at the maximum amount of nonlinearity you can have in an S-Box of a given size (and also some other properties). Then you can maximize those. This was done with DES.

The S-Boxes used here on the other hand have a whole lot of structure, i.e. linearity, that has been put there intentionally. This is generally the opposite of what you would want to see in a S-Box. It is of course hypothetically possible that these linearity combine with other parts of the algorithm in a way to result in greater non-linearity or specific hardening against specific unknown attacks, but this does sound a bit far-fetched in my ears (I can't think of precedent for this; e.g. in DES the issue that was worked around was related to differential linearity, and it wasn't solved by adding more linearity into the algorithm).

</comment></comment><comment><USER8> Here the opinion of one of the Veracrypt authors on this topic:

> > [https://github.com/veracrypt/VeraCrypt/issues/419](https://github.com/veracrypt/VeraCrypt/issues/419)

Highlight:

"This leads me to think that maybe there is another interesting possibility: the designer of Streebog and Kuznyechic are aware of new type of algebraic attacks affecting modern ciphers and hash functions and they wanted to ensure that these algorithms are immune against this attack without revealing anything about the attacks they are protecting against!

This may seem to be far fetched as it would mean that someone has made a breakthrough cryptanalysis but history tells us that this is in the realm of possibilities.

For example, people were suspicious of the SBoxes forced by the NSA in the 70s for the DES encryption standard and everybody was saying that they were backdoored. But more that 10 years later, we discovered that actually the NSA was aware of Differential cryptanalysis before it was discovered by academics and they designed the DES SBoxes to resist it.

So, if history is repeating it self which is often the case, what we are witnessing here is like the discovery of a cure before the illness is even publicly announced. In which case, we should really worry about existing ciphers like AES and Serpent."

\---

TLDR: existing ciphers might contain a weakness that was fixed in the design of Streebog and Kuznyechic.

EDIT: Why the downvote?

<comment><USER9> This is a really bad look for VeraCrypt and the writer is clearly not informed enough on this topic to make that kind of statement. It really pains me to be the lone -1 on that GitHub comment.

</comment></comment><comment><USER10> > That is why I recommend that, until their designers provide a detailed > explanation of their complete design process, you do not use these > algorithms and, should you be in a position to make such a decision, that > you do not standardize them.

Nobody would use those ciphers unless required. And they are required if you're interacting with government state information systems or licensing your software for certain usage. I have zero doubts that those ciphers are intentionally backdoored. It does not really change anything. Those are "certified cryptography" and conventional ciphers like AES-256 are not, even if it sounds absurd.

<comment><USER8> > I have zero doubts that those ciphers are intentionally backdoored.

> And they are required if you're interacting with government state > information systems

What interest would the government have to have interaction with government state information systems done using broken/backdoored ciphers?

</comment></comment><comment><USER11> backwindow</comment>


Lifestyle, Inc. (2004) - <AUTHOR> http://www.plope.com/Members/chrism/lifestyle_inc

<comment><USER2> I have literally no idea what this means. At first I took "lifestyle company" to mean "company that produces things for people's lifestyles", but his description seemed to be more about one's work for the company being a part of their lifestyle.

Regardless, I recoil and avoid like the plague any product or service targeted at my "lifestyle" (typically with the word "luxury" thrown in for good measure). It's a sure tell of a company looking to separate fools from their money.

And therein lies the problem with the author's attempt to extract huge meaning from a two-word term. Or perhaps he truly understood what the CEO meant, but just utterly failed at articulating what he meant.

<comment><USER3> Erm, that's... no, not what they mean. A "lifestyle business" is a colloquial term for a business that is built to stick around, not on an aggressive growth trajectory, and which can provide a reasonable lifestyle for its proprietors, but not a meteoric rise, "fuck-you-money-providing" exit event. It's a business that's a going concern: a company that is profitable, healthy, and well-rounded, but not spectacular, and not a startup that is burning investor capital on the way to their hopeful exit.

I think you might have gotten caught up on the phrase and extrapolated quite a bit of meaning from that which isn't there. It's a pretty common phrase, and it has nothing to do with luxury goods or providing "lifestyle" products to people.

</comment></comment><comment><USER4> Cool that this was written in 2004. Also reminds me of what David Ogilvy said about running his company- he'd only seek out clients that he personally wanted to help, only wrote copy for clients whose products he actually used and believed in, and he experienced joy and a thrill doing what he did.

I'd love to hear/read about other such companies and founders. I imagine Buffer might be a real-world modern example.

<comment><USER5> I run such a company ([https://coderpad.io/](https://coderpad.io/)). One of the things you start to realize very quickly is that the term "lifestyle business" is often just a matter of convenience.

Put another way, a lifestyle business can be looked at as simply a good business patiently looking for its opportunity to go big. Or, a lifestyle business can be avowedly lifestyle. Businesses can change a lot over time.

It's also odd that you'd mention Buffer as being a candidate for a lifestyle company. They've taken about $4m in funding, which implies that they convinced all of their investors that they'd see a significant return on their money. That's not to say that they can't operate like a lifestyle business, but they are almost certainly looking to generate a very large return.</comment></comment>


Parallelism is not concurrency - <AUTHOR> https://existentialtype.wordpress.com/2011/03/17/parallelism-is-not-concurrency/ <comment><USER2> _Concurrency_ \- property of systems in which several computational processes are executing at the same time, and potentially interacting with each other.

 _Parallelism_ \- computation in which many calculations are carried out simultaneously, operating on the principle that large problems can often be divided into smaller ones, which are then solved concurrently ("in parallel").

Go to slide #13 in my presentation:

<http://www.slideshare.net/nivertech/migrationtomulticore>

</comment><comment><USER3> If I'm reading the article correctly, the author is saying that with parallelism, you can perform independent operations in parallel (like sorting both halves of a quicksort), whereas concurrency as people think about it deals more with parallel operations on a shared state?

<comment><USER4> _Parallelism_ often implies that the tasks are working towards the same goal together, like dividing-up the workload among sibling processors. This is purely for performance.

 _Concurrency_ is simply the introduction of non-determinsm, like having a thread run a task in the background. Concurrency can be used to make a networked GUI application more responsive to the end user, even if there is no performance benefit.

</comment></comment><comment><USER5> I don't agree with the author's conflation of concurrency with non- determinism. To me, concurrency means there may be more than one operation logically "in flight" at any given time; parallelism means there may be more than one operation physically happening at any given time. Determinism vs non- determinism is an orthogonal issue.

You could have a single-threaded cycle-counting CPU simulator which is entirely deterministic, yet if it is simulating a multi-threaded program, that program would exhibit concurrency (for example, if it were a web server, it could be serving multiple requests over separate TCP connections concurrently, working a little on each request round-robin).

<comment><USER6> To appreciate his point, you must be aware that Harper is thinking about a formalization of concurrency. In such a formalization, you could have a deterministic execution of the concurrent processes as you hint, but you will also have a trace of incoming events in the formalization, not under the control of the CPU.

For the system as a whole to be deterministic, you would have it be deterministic for arbitrary event traces. This is rarely the case in practice though. Harper does not tend to just sling out a postulate unless he has good reason to think it is so, backed up by a formal system in which he identified the association.

It could be that he has identified concurrency goes hand in hand with non- determinism. To me, it does sound rather plausible.

<comment><USER5> It sounds poorly defined to me. Concurrency for me means a specific thing, and that specific thing does not have a necessary implication of non-determinism. My position is similar to dmbarbour's ([https://existentialtype.wordpress.com/2011/03/17/parallelism...](https://existentialtype.wordpress.com/2011/03/17/parallelism- is-not-concurrency/#comment-20)).

</comment></comment></comment><comment><USER7> The post says that the depth of quicksort is O(log^2 n). Blelloch's list of NESL algorithms gives a depth of O(log n) instead:

[http://www.cs.cmu.edu/~scandal/nesl/alg- sequence.html#quicks...](http://www.cs.cmu.edu/~scandal/nesl/alg- sequence.html#quicksort)

Or do I misunderstand something?

<comment><USER8> There may be some difference in accounting. The recursion depth of Blelloch's recursive function you linked to is O(log n), but it uses an operation that cannot be implemented in constant time: partitioning the elements into those greater and less than the pivot. I'd guess that operation is itself O(log n), which would account for the O(log^2 n).

<comment><USER9> "Depth" and "recursion depth" are not the same thing.

Quicksort partitioning normally takes O(N) time, but it can be in some sense perfectly parallelized once you have the pivot.

<comment><USER7> By "in some sense", do you mean it can be parallelized to O(1) time as long as you don't have to actually build up the data structures that result from partitioning (e.g. arrays)? Then it's not clear to me why this assumption is applicable to quicksorting an array. Doesn't it call for some non-obvious representation of intermediate results?

<comment><USER9> I'm out of my depth (heh) commenting here, but I think it depends on what kind of communications infrastructure you're assuming.

</comment></comment></comment></comment></comment><comment><USER4> > Isn't concurrency required to implement parallelism? Well, yes, it is...

Not exactly. Non-determinism is not required for parallelism; just look at VLIW:

<http://en.wikipedia.org/wiki/Very_long_instruction_word>

<comment><USER5> Non-determinism is not concurrency either (I think the author is wrong to conflate the two).

Parallelism is a physical, hardware, implementation of concurrency. VLIW, vector operations, GPUs etc. execute very fine-grained operations in parallel, but whether this is regarded as concurrency in any given context depends on how "lumpily" you define a concurrent task for that particular context. For example, fancy parallel instructions might be used to resize images in a thumbnail generator in a web server, but if the task being considered is the processing of a web request, then there is no concurrency. If the task being considered is processing a line, stripe or block of pixels, then there is concurrency.

</comment></comment><comment><USER10> _long_ (and some worthwhile) threads

[http://www.reddit.com/r/programming/comments/g6k0p/paralleli...](http://www.reddit.com/r/programming/comments/g6k0p/parallelism_is_not_concurrency/)

</comment><comment><USER11> _Concurrency is concerned with nondeterministic composition of programs (or their components). Parallelism is concerned with asymptotic efficiency of programs with deterministic behavior._

Interesting distinction. My understanding is that these terms are typically used interchangeably in a more general sense. Perhaps it would be better to come up with some different terms for these concepts.

<comment><USER4> > these terms are typically used interchangeably in a more general sense

No, these terms are used interchangeably by users who don't know what they mean.

> Perhaps it would be better to come up with some different terms for these > concepts.

These concepts already have different terms. We don't need to come-up with new ones; we just need to start using the existing terms correctly.

</comment></comment><comment><USER12> related: scalability is not efficiency. discuss.

<comment><USER6> Yes, and efficiency is not latency.

</comment></comment><comment><USER13> In other words, more confusion. Don't read if you don't understand words like "asymptotic efficiency" and "nondeterministic composition". Ugh.

Can someone put this in lay terms?

<comment><USER14> Parallelism is recognizing the 5 guys should be able to dig a ditch close to 5 times as fast as 1. Concurrency is making sure everyone has a shovel and is digging in the right place.

<comment><USER5> Determinism is making sure the digging is in the right place. Non- deterministic digging may be possible, but it's harder to get right.

Concurrency could also be having one guy with one shovel, but digging iteratively in 5 separate places and digging a shovelful or two at a time.

Or to put it another way, parallelism is digging two ditches with 4 people 4 times as fast as 1 person digging two ditches; concurrency is 1 person digging two ditches at the same time, alternating; determinism is making sure that the two ditches are being dug correctly, at an even pace, etc.</comment></comment></comment>


Linux and BSD Web Servers at Risk of Sophisticated Mumblehard Infection - <AUTHOR> http://www.eset.com/int/about/press/articles/malware/article/linux-and-bsd-web-servers-at-risk-of-sophisticated-mumblehard-infection-says-eset/

<comment><USER2> That pirated copy of DirectMailer that you loaded onto your server also sends _spam_?! Whoda thunk it?

<comment><USER3> I know what you're saying... but this is odd:

"... we found that IP addresses hard-coded in the malware are closely tied to those of Yellsoft"

</comment></comment><comment><USER4> Learned a couple of things from linked research paper like always mount /tmp and /var/tmp as noexec, and some `dig` fu.

<comment><USER5> noexec can break a lot of things so please be mindful

<comment><USER4> Ya, was wondering about package install scripts.

<comment><USER6> You can remount those dirs without noexec when you need to do a legitimate install.

</comment></comment></comment></comment><comment><USER7> 8,500 unique IP addresses during 7 months. How is this not trivial?</comment>


Ask HN: Review my weekend project, a free RSS to email service (feedserf.com) - <AUTHOR>

This weekend I was hacking on a new project, a RSS to email service (inspired by a recent post here on HN). The first version is now online, and I'd like to ask everyone interested to give it a try and to kindly share feedback.
http://www.feedserf.com
I chose Python as programming language and Google's AppEngine as hosting platform (my first encounter with AppEngine, and I really like it). The service is free and the code is open source (hosted on https://github.com/metachris/feedmailer, released under the AGPL). I know the user interface could definitely need some love. If you have ideas let me know! <comment><AUTHOR> Clickable:

\- <http://www.feedserf.com>

\- <https://github.com/metachris/feedmailer></comment>


Scientists find key to ageing process in hypothalamus - <AUTHOR> http://www.guardian.co.uk/science/2013/may/01/scientists-ageing-process

<comment><USER2> I'm no biologist - but could it be that this hormone is some evolutionary artefact - a holdover from some ancient common ancestor - that we can now do away with completely? If the evidence in mice shows that blocking the ageing process showed no real 'negative' consequences, then does this suggest that we might simply block the effects in humans completely? Or, as I suspect, is it more likely that there is some evolutionary advantage to ageing in the 'normal' way?</comment>


Seeing Through Walls - <AUTHOR> https://cacm.acm.org/magazines/2020/6/245152-seeing-through-walls/fulltext <comment><USER2> I'm really hoping this tech gets more accessible (i.e. uses OTS components and shows up on 2-minute-papers [i] along with a github repository) for a variety of use-cases e.g. not just detecting humans, but also for detecting wiring and other hidden features in walls and floors.

[i] [https://www.youtube.com/user/keeroyz/videos](https://www.youtube.com/user/keeroyz/videos)</comment>


That Old College Lie - <AUTHOR> http://www.democracyjournal.org/that_old_college_lie.html

<comment><AUTHOR> From this thought-provoking article:

"The near-total lack of useful information about teaching and learning has three main effects, all bad for students. First, it creates distortions in the higher-education market that drive up prices. Second, it gives colleges free rein to ignore their teaching obligations in favor of a mad contest for status and self-gratification. Third, it leaves colleges that serve the most disadvantaged students with the fewest resources."</comment>


I have a tab problem ..what to do - <AUTHOR> I have over 300 + tabs, some from almost a year ago. I am afraid to throw them away because I find that at some point I need them, but browser performance is becoming degraded. The problem with bookmarking is there is no guarantee the page will still exist when you reopen it and tabs are easier to to sort than bookmarks. <comment> ng-user That's like saving every webpage you've ever visited to your favourites because you MAY need it in the future. The internet is vast, learn to traverse the noise in search of what you're actually looking for. You don't need to know where everything is, just that it does indeed exist and then your detective skills can determine how to find it.

If you haven't needed them by now, you probably don't actually need them. Data hoarding is cool and all but at some point you're creating more clutter than is necessary.

</comment><comment><USER2> Download each tab to preserve contents and enable offline access. Your local directory's `file:///` URI can be used as an index view to avoid the need for a file manager

</comment><comment><USER3> There's no guarantee that the page will still exist when you revisit the tab. I'm not sure I understand how keeping them open solves the problems bookmarking suffers from.

What browser are you using that doesn't unload pages from memory when RAM becomes scarce? Have you not rebooted or upgraded your browser in a year? Has it never crashed with 300+ tabs open?

</comment><comment><USER4> Use pocket. I know there was a big shitstorm when Mozilla integrated it into firefox but it works great. I close tabs and bookmark them in pocket for later. Couldn't be easier and the tagging feature + firefox integration makes it very nice to use.

</comment><comment><USER5> You are about to close 2283 tabs. Are you sure you want to continue?

</comment><comment><USER6> Pinboard[0] with the Archival feature.

[0] - [https://pinboard.in/](https://pinboard.in/)

</comment><comment><USER7> save as pdf</comment>


Outside Plato's Cave episode 1 (02/06/2020) - <AUTHOR> https://outsideplatoscave.substack.com/p/outside-platos-cave-episode-1-02062020?r=5xuid&utm_campaign=post&utm_medium=web&utm_source=hackernews <comment><AUTHOR> please tell me what you think ? purely non profit newsletter</comment>


In the Age of AI [video] - <AUTHOR> https://www.pbs.org/wgbh/frontline/film/in-the-age-of-ai/ <comment><USER2> So is this only available in the US?

<comment><USER3> I was able to download it being in EU using youtube-dl.</comment></comment>


Where could I get an architectural review for an idea? - <AUTHOR>

I've been building out some stuff on the side, and I really want to sit down with some folks to just get an architectural review of the application that I'm building. I'd love to hear people's thoughts from an engineering perspective about how to do it differently/better than what I'm doing right now.<p>Is there such a group? <comment><USER2> I am by no means an expert but I do take care of some high availability systems. I could take a quick look at your arch. if you want me to.

</comment><comment><USER3> Whack it on stackoverflow. People there love to think about stuff like that.</comment>


Facebook Will Label Content From State-Controlled Media - <AUTHOR> https://about.fb.com/news/2020/06/labeling-state-controlled-media/ <comment><USER2> What is the point of this? This is useless at best and dangerous at worst. I guess nobody from Facebook has ever read Manufacturing Consent...

In many countries, the state media is more accurate and less partisan than the corporate media. Australia and the US are both good examples of this.

<comment><USER3> What state media does the US have?

<comment><USER4> NPR for internal consumption, voice of X for external

<comment><USER5> NPR is not state funded or controlled. They receive a tiny amount from grants from organizations that are federally funded amounting to around 2% of their budget.

Probably a lot less than some of these large private media corps get in subsidies and tax breaks on both state and federal levels.

<comment><USER2> This is an interesting point and one could make the argument (based on these subsidies and tax breaks) that _all_ corporate media in the US is a form of state media.

The key difference between US corporate media and state media in other countries being:

* In other countries: the government controls the state media outlets.

* In the United States: the corporate media outlets control the government.

</comment></comment></comment></comment></comment><comment><USER6> Nowadays it feels like private media is even more partisan than state controlled media.

YouTube did the same. This seems like some feelgood thing more than something practical and useful.

</comment><comment><USER7> Acceleration continues down the slippery slope many say doesn't exist for private businesses.

</comment><comment><USER8> Sounds like an elegant solution since they do not need to counter points of views like Twitter did recently with Trump. But still provides valuable information.</comment>


Disable Wikipedia Blackout (Bookmarklet) - <AUTHOR>

For those who already know about SOPA, and would like to use Wikipedia today:

    javascript:%24(%22%23mw-page-base%2C%20%23mw-head-base%2C%20%23content%2C%20%23mw-head%2C%20%23mw-panel%2C%20%23footer%22).css(%22display%22%2C%22inherit%22)%3B%24(%22%23mw-sopaOverlay%22).css(%22display%22%2C%22none%22)
 <comment><USER2> Adblock method: <https://gist.github.com/1631355></comment>


The School of Wants and Needs – And Wood-Fired Showers - <AUTHOR> http://www.nytimes.com/2016/10/29/your-money/california-prep-school-teaches-self-reliance.html <comment><USER2> This is one of those articles where I have to tell my name and email before I get to read a letter?</comment>


Best startup alternative to MS project? - <AUTHOR>

i've seen some great posts w/ tools other HN people have used for their startups.
at my startup, we're currently trying to scope out and schedule resources for a really big project coming up.  i've used MS project in the past, but would like to move on from it since i'm on a mac now.
any recommendations?
thanks in advance! <comment><USER2> I absolutely loathe MS Project, but for large projects it does one thing well that I haven't found in other desktop packages: it does a passable job of supporting effort-based planning. There are lots of good enterprise-class planning projects like HP PPM and whatever Oracle renamed Primavera to. But they're very expensive.

Since I went Mac, I began running MS Project under Crossover Office. It's un- Macish and still just as awful, but it works.

</comment><comment><USER3> Serena has OpenProj it is a Project knock off but has much of the same feature set. I use it to look at project schedules and make modification to MS Project files that project managers send to me. It is not pretty but it does the trick. I am on a Mac as well. I have heard a lot of raving about basecamp but I have never used it so I cannot speak for it.

<http://openproj.org/openproj>

</comment><comment><USER4> I've had some success with Tracks - <http://www.getontracks.org/> You can even get a turnkeylinux version with it and run it ASAP in VM <http://www.turnkeylinux.org/tracks> (that's how I run it). Sure, it's not MS Project, but I like it.

</comment><comment><USER5> I use a large whiteboard and lots of post-it pad. Write the tasks on the post- it and stick it on the whiteboard. Rearrange it accordingly. Anytime I want to work on things, I just take a post-it with me and work on it on my laptop.

</comment><comment><USER6> Try:

<http://www.digite.com></comment>


Show HN: Dualgram is a iOS 13 app that records multiple cameras at the same time - <AUTHOR> https://dualgram.com <comment><USER2> Reminds me _(coughs)_ of a similar app made by a certain _(coughs)_ startup that refused an acquisition from _(coughs)_ Twitter called _(cough)_ _(cough)_ Frontback [0] _(cough)_. Sorry _(coughs)_ I'm allergic to Deja Vu.

[0] [https://www.businessinsider.com/frontback-app-shuts- down-201...](https://www.businessinsider.com/frontback-app-shuts- down-2015-7?r=US&IR=T)

<comment><AUTHOR> Yea those were the days. This time the technology is different. iOS 13 really does support using multiple cameras, including recording of videos.

And, I am just a solo developer working on the apps I like to use.

</comment></comment><comment><USER3> Nice app! I downloaded the app on iPhone 11 Pro Max. While recording the back video looks a bit choppy. However, the actual recorded video is smooth. Any idea why that is happening?

Also, will the branding annotation stay on the video?</comment>


The FCC has fined robocallers $208M and collected $7k - <AUTHOR> https://www.foxnews.com/tech/the-fcc-has-fined-robocallers-208-million-its-collected-6790 <comment><USER2> Can someone explain to me how spoofing is even possible and why it is allowed? That's what I've never understood about this whole thing. Does it has any legitimate use?

Robocalls would be much easier to address if you could block/report the actual number they come from.

<comment><USER3> It's because:

1) Caller id was conceptually flawed from the beginning so was implemented as an honor system instead of something required to communicate (like an IP address)

2) Caller id is unregulated, so there is no penalty for spoofing

My previous comment on it:

[https://news.ycombinator.com/item?id=19303931](https://news.ycombinator.com/item?id=19303931)

From the linked article:

 _Unlike phone numbers and domain name service (DNS), wherein there are internationally recognized databases that are authoritative sources, there is no central authority or regulation for caller ID. No FCC guidelines regulate carrier accuracy, and although federal regulations exist regarding telemarketers and spoofing, carriers can maintain their caller ID databases as they see fit._

[https://www.onsip.com/blog/how-caller-id-works-why-it- might-...](https://www.onsip.com/blog/how-caller-id-works-why-it-might-take- months-to-update)

<comment><USER4> Exactly this. The last time I had a chance to talk to an FCC commissioner (they were in the Bay Area at an IEEE meeting) I strongly suggested that they could do a world of good by creating such a database, requiring anyone who wants to call into the US have their numbers registered in such a database, and to put 'DO NOT TRUST' on any number that wasn't in the data base as its default Caller ID.

Pair that with creating an access restriction to the US PSTN for any entity that originates a call with a spoofed number that is enforceable with technology rather than by voluntary or compelled action, and much of the problem will be mitigated.

<comment><USER5> That doesn't solve the problem where legitimate numbers are spoofed, does it? It seems my number is among the many that are being used by robocallers, because I sometimes get texts from strangers saying "who are you?", or "sorry, can't talk now".

<comment><USER4> That is part two, adding real teeth to spoofing a legitimate number. Basically on confirmation that a provider allowed such a call to be made on the US PSTN would result in all their numbers being blocked from the US PSTN until they could prove they had fixed the problem.

</comment></comment></comment></comment></comment><comment><USER6> Here are some tips for anyone plagued by robocalls.

My cordless phones have a simple "call block" button. It's quite helpful. The set is similar to this set:

[https://smile.amazon.com/Panasonic-KXTGF344B-4-Handset- Landl...](https://smile.amazon.com/Panasonic-KXTGF344B-4-Handset-Landline- Telephone/dp/B00V5ZKBZI)

My "landline" is actually VoIP through Callcentric. They have good rates, the service is extremely customizable, and they are very reliable. Sometimes I use Callcentric to block numbers before they reach my phone.

I'm not affiliated with Callcentric or Panasonic. I'm just a happy customer.

<comment><USER7> What do those "call block" buttons do?

<comment><USER8> I believe they just add the currently listed (via caller ID) to a blacklist that it will block in the future. It doesn't help for spam calls that rotate their spoofed numbers.

<comment><USER6> That's right, the button instantly adds the caller ID to a blacklist. In my experience, spammers don't rotate their numbers very often, so the button works well enough. YMMV of course.

<comment><USER9> Interesting. I've never received a spam call from the same number twice. They just pick something with the same first 3 digits and area code.

<comment><USER8> That's my experience. Either a northern VA (703, 571) or DC (202) area code with random last 7 digits.

And these days, about half the spam calls are in Chinese. Because Alistair is such a common name in the Chinese-American community. :|

<comment><USER7> > _Alistair is such a common name in the Chinese-American community_

I'd bet you a dollar they're just dialing numbers sequentially; while they're specifically targeting Chinese folks, I very much doubt it's more cost effective to pre-filter phone lists.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> From a similar article from _Gothamist_ :

 _> The problem here is partly bureaucratic: While the FCC has the power to dole out fines, it lacks the power to actually enforce those orders. That task, according to the Journal, falls to the Justice Department, and is not made easier by the fact that many entities responsible for this relentless aural spam are individual people or small outfits that can't afford the fees they rack up and can skirt collectors without too much fuss._

... and...

 _> The Federal Trade Commission, it should be said, has done slightly better. Since 2004, it has won a total of $1.5 billion from robocallers and No-Call Registry violators in court, of which it has collected $121 million, or 8 percent of the total._

The Federal Trade Commission, it should be said, has done slightly better. Since 2004, it has won a total of $1.5 billion from robocallers and No-Call Registry violators in court, of which it has collected $121 million, or 8 percent of the total.

[http://gothamist.com/2019/03/28/fcc_robocall_collection.php](http://gothamist.com/2019/03/28/fcc_robocall_collection.php)

</comment><comment><USER11> Change might be coming. The SHAKEN/STIR framework to authenticate calls is making decent progress:

[https://transnexus.com/blog/2018/providers-responses- shaken-...](https://transnexus.com/blog/2018/providers-responses-shaken- without-delay/)

Once implemented incoming calls can be handled differently (e.g. UI differences on dialer, dropped to voicemail) based upon the attestation.

</comment><comment><USER12> Can filtering out robocallers be solved through technology? Similarly to how Spam folder in your email app works. I have zero knowledge about how telecom works, but it seems not too complex.

Also, it seems that iOS have support for third party apps helping to block spam calls: [https://support.apple.com/en- us/HT207099](https://support.apple.com/en-us/HT207099) Android have this feature built-in: [https://support.google.com/phoneapp/answer/3459196?hl=en](https://support.google.com/phoneapp/answer/3459196?hl=en)

<comment><USER13> I've noticed that almost all of the robocalls i receive come from a number beginning with the same three numbers as my number. I would love for the ability to block all calls beginning with these three numbers, UNLESS they are already on my contacts list. This would solve 95% of robocalls for me and wouldn't have too much of a negative impact.

Although I could imagine the impact for people who receive many unknown calls from their own area code would be non-negligible.

<comment><USER14> > _I 've noticed that almost all of the robocalls i receive come from a number > beginning with the same three numbers as my number. I would love for the > ability to block all calls beginning with these three numbers, UNLESS they > are already on my contacts list._

Hiya (and presumably other solutions, but I've used Hiya extensively) does this.

<comment><USER13> you're a lifesaver; glad I asked!

</comment></comment></comment></comment><comment><USER15> One of the biggest issues here is that the people who would pass laws to crackdown on robocalls depend on the technology to raise re-election funds.

</comment><comment><USER16> The only reason I didn't cancel my phone is 2FA and a few essential apps relying on you having a phone. Otherwise it's been weeks, if not months I haven't initiated a voice call, and I might only get one valid voice call per 2 weeks.

<comment><USER17> My solution to the robocalls problem is that I essentially don't answer my phone anymore. Some known numbers will get through, like my parents. 95% of my communication is either text-based, web-based video calls, or something else that's not traditional phone calls, _especially_ not from unknown numbers.

</comment></comment><comment><USER18> Fines are a worthless form of punishment since almost all companies just see them as a tax that may or may not be levied, and even if it is levied it will never exceed the profits made by the illegal behavior. Every single fine over $1000 should come with prison time for somebody. I don't care if it's a single weekend in jail, when company executives choose to abuse consumers it's people who should be punished, not bank accounts.

</comment><comment><USER19> This is kinda funny. This is one area where private industry is demonstrably doing better than a government agency.

Lawfirms have collected billions from private industry via class action TCPA cases.

This just means that the FCC has been ineffective. The law is actually mostly working as intended. It stops/punishes legitimate large enterprises from robocalling. It's no surprise that a law isn't doing anything about scammers who are already breaking the law.

</comment><comment><USER20> I still don't understand how hard it would be for major phone carriers to validate the source and let the calls thru. Wouldn't it be possible just to allow Verizon to TMobile, or ATT to Verizon, since they both have their user info and can validate each other's calls? I mean, I can see their names on my phone, why not just add a little bit more info to make it more legit.

<comment><USER21> What about the non-major providers? They are no longer allowed to operate?

</comment></comment><comment><USER22> We out to fix robocalling / spoofing.

We also ought to fix the collection of fines and include jail time for execs when fines aren't paid.

</comment><comment><USER23> For my own understanding, is the issue with robocalling the same with the issues of spam emails or arbitrary DDOS attacks? In the guise that they look "legitimate", but are "malicious" and any attempt to identify the original source is difficult due to multiple proxies masking the origin?

</comment><comment><USER24> Stop fining and start jailing. Those fines aren't going to compensate the people getting robocalled anyway. Jail a few dozen people, and in 10 years when parents tell their kids that recordings used to call to trick you into financial scams, they'll think their parents are joking.

</comment><comment><USER25> Mandate that telephone customers who receive bad calls can acquire the billing information of every call received (whatever is behind the spoofed Caller ID), as well as implementing the ability for users to block incoming calls based on the unspoofed number and/or account holder.

</comment><comment><USER26> Any time I get a call from a human robocaller, I treat it as a game to get them to hang up by telling them I plan to waste their time, then dong so without remorse. Knowing many companies won't let them hang up so long as I'm on the line, it can be quite the game.

<comment><USER27> The problem with that is that it also wastes your time...

<comment><USER28> In theory this could actually be done by a robot on your behalf that pretends to be a human being. In theory this could even be a service that you transfer the caller to silently. Want to write this so I can subscribe?

<comment><USER29> Glad you asked!

[https://jollyrogertelephone.com/](https://jollyrogertelephone.com/)

Unfortunately, I find these spammers have gotten wise to this, and I haven't been able to snag them in a year or so.

</comment></comment></comment></comment><comment><USER30> Why even have laws and regulations that aren't or can't be enforced? Might as well stop pretending like the government cares about this issue or that there is even a law/regulation. It's exactly the same thing as not having a law/regulation.

</comment><comment><USER15> Does anyone have experience with the google call screening available on pixel phones?

<comment><USER31> I do; it's fantastic. Robocallers hang up every time.

</comment></comment><comment><USER32> Has anyone had any success with one of the handful of call blocking apps or services? T-Mobile's Name ID service seems to be doing a fairly good job, but a handful of calls still slip through the cracks.

</comment><comment><USER33> Why do they stop with the robocallers, instead of going after a-holes who are paying for the robocaller services?

</comment><comment><USER34> You can stop robocallers by simply not using the archaic phone system. Set your phone to only accept calls from people in your contacts, or simply reject all calls. Educate everyone you know about doing so. Legacy telecom needs to die.

<comment><USER35> I am interviewing for jobs and I have my phone number on my resume so recruiters can contact me. This is not a good solution for many people or small businesses.

<comment><USER36> I just took a Google Voice Number and put it in the resume. I get so many calls from recruiters and I will not even be notified as I don't have anything that connects them to my phone. I use the web interface of GV everyday end of day and go through the voicemail, or calls them back if I think they are legit. Again call back is also from GV number. So Google voice handles it for me where it even converts voice to text in voicemail.

<comment><USER35> Besides the fact many people may not want Google to listen to their phone calls and voice mails, I still receive robo calls on my GVoice number, albeit less.

</comment></comment></comment></comment><comment><USER37> Last week tonight released an episode on exact this issue a few days ago -- [https://www.youtube.com/watch?v=FO0iG_P0P6M](https://www.youtube.com/watch?v=FO0iG_P0P6M)

John Oliver should increase the frequency of robocalls to FCC chairs.

</comment><comment><USER38> Can someone explain me what is the business model for WSJ of acquiring new readers. If new readers can't even read the article to know if it's worth subscribing or not. It looks like they only rely on older people who used to read WSJ when it wasn't behind a paywall

<comment><USER39> The WSJ has a well-deserved reputation for its financial analysis. People in business and especially in finance will gladly pay for the subscription.

They don't really care if anyone else reads the paper; the expected return on a non-core subscriber isn't worth much more than the cost of acquisition, so there's not much point to changing their business model to chase gadflies.

At the same time, non-core readers are a large source of potential revenue, so they make their stories available through some means (like Apple News) in a manner that allows them access to a large non-core market while protecting their core subscription model.

</comment></comment><comment><USER40> Robocallers are a problem! You can help fight this and make a difference with just a few simple steps! First, you...

Please subscribe for only $N per month to keep reading!

<comment><USER41> > Hates paying for content

> Hates advertising

mfw

<comment><USER42> Or use outline.com! Ignore that it's just straight up rehosting pirated content from paid sources.

Edit: This is a heavily downvoted comment. Instead of downvoting, how about you explain why you think you're entitled to paid content for free?

<comment><USER43> Shh...the knowledge workers that arrange bits in one format don't think the knowledge workers that arrange bits in another format deserve to be paid. They should innovate their way out of their victimization in a way that pleases their attackers.

</comment></comment></comment></comment><comment><USER44> Outline isn't working for me. Anyone know if the WSJ did something to thwart them?

<comment><USER45> They've definitely been working on fewer domains for me lately

</comment></comment><comment><USER46> This appears to be the same article - or at least a substantial portion of it - without a paywall (but with an annoying autoplaying video)

[https://www.foxnews.com/tech/the-fcc-has-fined- robocallers-2...](https://www.foxnews.com/tech/the-fcc-has-fined- robocallers-208-million-its-collected-6790)

<comment><USER47> Thanks! We've updated the link from [https://www.wsj.com/articles/the-fcc-has- fined-robocallers-2...](https://www.wsj.com/articles/the-fcc-has-fined- robocallers-208-million-its-collected-6-790-11553770803).

</comment></comment><comment><USER48> Tear down that wall!

....WSJ!

</comment><comment><USER49> Non paywall version [0] Or just copy and paste the original link in your Facebook search and click it from there. [0] [https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.wsj.com%2Fa...](https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.wsj.com%2Farticles%2Fthe- fcc-has-fined-robocallers-208-million-its- collected-6-790-11553770803&h=AT2p7k0fAEoiHsQyIX1vF0awPvoLkfNbwnpoENJ4TZzT6zAJyj6TDSaUXzncCU2T5efBKuWK_2u3LRoEjkRbKTm- qHcakP42-Td4sS3obUwsY69qsMZGackjfwfS_HaxzYJa-g&s=1)

<comment><USER50> That link is still paywalled

<comment><USER51> I used it but then realized I was logged in to the WSJ and had a subscription

I'm just so used to circumventing paywalls that I forgot I actually pay for that

</comment></comment></comment><comment><USER52> Maybe they can hire some robocallers to robocall the robocallers for collection?

<comment><USER53> [https://jollyrogertelephone.com/](https://jollyrogertelephone.com/)

<comment><USER54> Love this!

A cool added feature would be detecting long catches, and then calling you, so you could listen in real time.

</comment></comment></comment><comment><USER55> Some time ago Google demonstrated a robocaller, and iirc most people on HN thought it was cool ...

<comment><USER56> Robocalling refers to the automated dialing of numbers, not automated speaking over the telephone.

<comment><USER57> They literally suggested the use case of robo-calling restaurants to get holiday hours. I think it's a great idea BTW.

<comment><USER56> But you choose the restaurant, it doesn't automatically call every restaurant nearby. The product is the automated voice, not the automated calling of numbers.</comment></comment></comment></comment>


Ask HN: Any of you summarize lectures with a laptop? - <AUTHOR>

Hello.
I'm a student which try to summarize the course material in my laptop live during class.
I've already found many solutions to entering math formulas quickly. However, I have not found any good solution to enter simple and common graphics (at least in Computer Science). (Such as graphs, timelines, etc.)
Do you have any recommendations? As for now, I simply do not copy any graphical representation.
If nobody will find anything, it could be a fantastic mini application or office plugin to develop. <comment><USER2> I say you should choose which classes best support laptop notes (if you really want to use your laptop) and for those classes with a large amount of math/graphics just write in a normal notebook, it is faster and easier.

</comment><comment><USER3> I used TeX to type up all my class notes. I found that if you practice enough, you can hammer out pretty much any diagram in realtime. In the meantime, you'll have to condense your class notes by a bit to make up for lost time.

Unfortunately, I don't remember any of the packages I used, but I definitely did trees, timelines, and, of course, equations. Plus, as long as you get the content right, you can fix your typos and other silly mistakes after class ... that's the point of separating content from display!</comment>


Minecraft's creator excluded from event over his 'comments and opinions' - <AUTHOR> https://www.theverge.com/2019/4/29/18522546/microsoft-minecraft-anniversary-event-notch-creator-comments-opinions <comment><USER2> It's sad how wealth affected Notch or perhaps magnified his character. A long time ago, I started following him on Twitter and I think I lasted about 2 weeks before I unfollowed him. The sheer negativity and woe is me is bananas. If there's a prime example that money doesn't buy happiness, he is one.

<comment><USER3> To be fair- The Notch you are disliking is the same person he was __before__ the influx of Micro$oft cash. At very least, he's consistent.

<comment><USER4> I don't know if that's entirely true—I followed him on twitter for a period of time before and after the sale, and post-sale his tweets got more and more unpalatable. Perhaps you're right, and he didn't change at all, but at the very least the public persona that he expressed changed.

<comment><USER5> It gets dangerous when tons of the people around you are somehow seeking to feed off your wealth and thus you get very little negative feedback anywhere. Everyone says they hate yes men. In practice most people love yes men.

<comment><USER4> > Everyone says they hate yes men. In practice most people love yes men.

Sadly true.

</comment></comment></comment></comment></comment><comment><USER6> Notice Verge is quoting a politically-charged journal, called Roots, as proof of "problematic" language.[1]

I don't know. Microsoft can do what it wants, but as a society we need to consider doing two things:

A _\- Socially spurning all political language in non-political contexts._

      or

B _\- Being tolerant of all political language that isn 't DIRECTLY hateful. Using the word "white" and just saying a contextless tweet "It's ok to be white" should not offend people, or if it does, it should be tolerated. OR, we can have a long discussion about it, and go back and forth and try to figure it out._

_A_ seems wise. But society chooses [edit] neither A nor B and we get into fights over it.

And if C, allowing some opinions but not others is the course of action, then we have a real problem. We're not going to "eliminate hate" by going option C: selection of opinions that are Correct and Not Correct. Because those in the "Not Correct" category will regroup in far worse ways - don't we learn from history?

[1] - Read this and judge for yourself. Please read their OTHER articles and tell me if you don't find evidence of hate. [https://www.theroot.com/minecraft-creator-goes-full-white- pr...](https://www.theroot.com/minecraft-creator-goes-full-white-privilege- denying-whi-1820904201)

</comment><comment><USER7> I tried clicking the links about Notch's non-pc comments. Those took me to newsweek articles which also talked about twitter but didn't link to the offending tweets themselves. Only one article linked (someplace called "the root") actually referenced any of his words per se. Among the problematic quotes were:

"Privilege is a made up metric used to silence and repress. We are all different, and that is ok. We listen to individuals and help each other based on individual strengths and needs.

We do not generalize based on skin color, bigot."

That's a far cry from the sensationalized title of "Notch hates diversity".

So in answer to your question, my guess is Notch basically a DeMoore type character and is being crucified by the media.

<comment><USER8> It took about 5 seconds of googling to find this:

[https://twitter.com/notch/status/901192994971410433?lang=en](https://twitter.com/notch/status/901192994971410433?lang=en)

Another 2 seconds for:

[https://twitter.com/notch/status/1101794469060337664?lang=en](https://twitter.com/notch/status/1101794469060337664?lang=en)

<comment><USER9> For those of us at work, do you mind summarizing these tweets in a reasonably SFW fashion?

<comment><USER10> The first "(pizzagate is real)" second "Q is legit. Don't trust the media." the second is followed with him defending the Q conspiracy in the comments, the first all the replies have pretty much been deleted.

</comment></comment></comment></comment><comment><USER11> Seriously what the fuck happened to Notch. I don't blame Microsoft from excluding him at all.

<comment><USER12> He's self-made and not afraid to express his opinions even if they aren't politically correct. People like him should be applauded as they are increasingly rare in today's society.

<comment><USER13> Do you think the reasons most people don't express opinions like the ones notch has expressed recently is due to a fear of backlash over being considered 'un-PC' as opposed to not actually holding those opinions? This rhetoric plays into a common theme among extremists which is quite dangerous: "Everyone actually thinks the same way I do, they are just afraid to say it".

<comment><USER14> > Do you think the reasons most people don't express opinions like the ones > notch has expressed recently is due to a fear of backlash over being > considered 'un-PC' as opposed to not actually holding those opinions?

Repeated surveys show that the identitarian left accounts for about 8% of the population, and that their views are over represented in media, while people are genuinely afraid of being publicly lynched for saying the wrong thing.

The entire #walkaway movement started because of that.

</comment></comment></comment></comment><comment><USER15> > "His comments and opinions do not reflect those of Microsoft or Mojang and > are not representative of Minecraft."

Do all the comments and opinions of every other participant in the event reflect those of Microsoft and Mojang?

<comment><USER16> Which other participant created Minecraft?

</comment></comment><comment><USER17> Notch seems to have gone a bit off the deep end, and I'm not referring to his conservative views. His tweets often sound incoherent. Maybe English isn't his strongest skill? I can't tell.

Someone in the Minecraft YouTuber community speculated that perhaps he got involved with party drugs (MDMA) and it affected him permanently, as they had seen something similar happen with a friend of theirs. Pure speculation.

</comment><comment><USER18> Why did this get flagged?

</comment><comment><USER19> If I felt that Microsoft was delivering high quality software and was a meritocracy I would cut them a lot of slack, no matter what opinions they espoused and who they favored or excluded.

Unfortunately I have to use Skype for Business literally every working day and it's symptomatic of a company that is fat dumb and happy, secure in its cash flow.

</comment><comment><USER20> Microsoft is simply applying a strategy that's known to work (see: the study confirming that banning problematic subreddits has had a positive effect on Reddit as a whole). This is what happens when you hold views decent people don't hold: you get silenced, ostracized, and your name blotted from your own work. Want decent people to engage with you? Change your mind.

<comment><USER21> How do you reconcile that with censorship in general?

<comment><USER22> Censorship is being put in actual jail under threat of a gun for saying something.

Private individuals and organizations should not be forced to subsidize your speech.

<comment><USER21> > Censorship is being put in actual jail under threat of a gun for saying > something.

I think that's kind of a limited definition. You can be censored without being put in jail or forced into it by violence.</comment></comment></comment></comment>


Quel Solaar: How I program C - <AUTHOR> https://www.youtube.com/watch?v=443UNeGrFoM <comment><USER2> Eskil's presentation on how he made an MMO by himself through smart technical choices has been a great inspiration for me for many years.

[https://www.youtube.com/watch?v=f90R2taD1WQ](https://www.youtube.com/watch?v=f90R2taD1WQ)</comment>


Two simple tricks for better shell script error handling - <AUTHOR> http://www.turnkeylinux.org/blog/shell-error-handling <comment><USER2> (posted to blog comments as well)

If you decide to trap INT or TERM, it would be wise to properly kill your process with INT or TERM:

        # if you're using bash, you can use $BASHPID in place of $$
        for sig in INT TERM EXIT; do
            trap "rm -f \"\$TMPFILE\"; [[ $sig == EXIT ]] || kill -$sig $$" $sig
        done

Not propagating signals in this manner is being a bad Unix citizen. Bash would have re-raised the SIGNAL, so you should too.

For more information: <http://www.cons.org/cracauer/sigint.html>

<comment><AUTHOR> I haven't run into any problems (yet) obstructing signal propagation in my scripts but as you point out it's not The Correct Thing To Do. For the sake of correctness I'll be updating my error handling code. I find doing the correct thing often saves me from debugging strange edge cases.

(replied to on blog comments as well)

</comment></comment><comment><USER3> Personally, I think shell scripts should start with "#! /bin/sh", not going for some specific shell. If I need more than the standard Bourne shell, I should probably be using something else.

More or less sane systems have something like this (Ubuntu 9.10):

        $ ls -l /bin/*sh
        -rwxr-xr-x 1 root root 917960 2009-09-14 06:08 /bin/bash
        -rwxr-xr-x 1 root root 101608 2009-09-21 00:49 /bin/dash
        lrwxrwxrwx 1 root root      4 2009-10-29 19:25 /bin/rbash -> bash
        lrwxrwxrwx 1 root root      4 2009-05-17 19:57 /bin/sh -> dash

<comment><AUTHOR> I find using specific shebangs is a good habit if you don't know exactly which generic POSIX shell features/syntax you can rely on. In years past I would all too often use #!/bin/sh for the shebang only to find out later I had accidentally used a BASH specific shell feature, which is fine if /bin/sh happens to point to /bin/bash but can break if it points to something else.

OTOH, I believe the error handling tricks discussed should work with any POSIX shell so I've updated the shebang line in the code snippets to use the more generic #!/bin/sh.

<comment><USER4> When invoked as sh, Bash enters POSIX mode after reading the startup files.

<comment><USER5> When invoked that way it still supports more than /bin/dash on my system:

      % ln -s /bin/bash sh
      % ./sh
      sh-3.2$ echo {1..10}
      1 2 3 4 5 6 7 8 9 10
      sh-3.2$ exit
      % dash
      $ echo {1..10}
      {1..10}

where dash is supposed to be POSIX compliant.

</comment></comment></comment></comment><comment><USER6> If your script is a daemon, a runlevel or service script, an at or cron job, or just needs to spawn or control processes then trap will make you hate unix and your life.

</comment><comment><USER7> Another invaluable mention would be "set -u" which triggers an error on undeclared variables.</comment>


The Art of Racing Pigeons - <AUTHOR> https://www.texasmonthly.com/being-texan/texas-homing-pigeons-fly-home/ <comment><USER2> Basically they are exploiting the bird's instinct to return home. It's like pigeon Hansel and Gretel roulette.

They get exhausted if they can't make it back home and many die. [..] Pigeons can mate for life, and both the cock and the hen take turns sitting on the nest and feeding the hatchlings. Young homers are weaned and housed together at about six weeks old. After a few days of acclimation, a door in their pen is opened, and the birds begin to fly outside the loft but stick close to it. They'll flock together, flying big circles, until the day comes that they stay aloft for an hour. That's the signal, says Morse, that it's time for road training. The birds are taken five miles away from the loft and released. "That first time, they make about thirty huge circles, figuring out where home is. But they do figure it out."

Morse will do five days at five miles, then two days of loft flying, a kind of weekend of rest at home. The next week, it's ten miles. When the birds start arriving home before him, it's time to stretch out their mileage—twenty miles, then forty, sixty, and so on, until they successfully do one hundred miles three times before their first race. The longer flights build endurance, but it's the early flights that reinforce the notion of home and the bird's ability to get there. In a race, you want a pigeon to break fast and sure instead of wasting time circling or succumbing to the flock instinct and following other birds. "People get in a hurry for training distance, which is a mistake," says Morse. "The five- and ten-mile trips are imperative. That gets them confident." [..]

<comment><USER3> This is correct. I have a pet pigeon who is very happy, and often quite insistent, to be put back into his cage once he's had enough outside time. He also makes it VERY clear when he doesn't want out of the cage.

The pigeons are trained when they have eggs or babies in their nest, since they will be in such a panic to get back, they learn to be very quick about the travel. It's certainly not very humane.

<comment><USER2> Pigeons are awesome. They have an instinct to nest and love and be loved. It is cruel to do this for sport and profit.

<comment><USER3> It is true. My pet pigeon stomps his feet on the ground then joyfully runs to me pretty much demanding to be picked up when I enter the room if I've been elsewhere for any extended amount of time. And he likes to perch on my leg and sleep when I have my feet up on the foot rest.

</comment></comment></comment></comment><comment><USER2> How is this not animal abuse?</comment>


How  to Keep Your Google Browsing Private - <AUTHOR> http://www.readwriteweb.com/archives/5_ways_to_keep_your_google_browsing_private.php <comment><USER2> It is enough to just follow two steps.

(1) carefully review your google/facebook/... privacy settings

(2) make a habit of logging out after you are done, or use NoScript or an equivalent.

If you belong to the 0.00000001% who is really paranoid, then stop using these sites, or better browse the web like Richard Stallman does.</comment>


Ask HN: Do you feel more focused at night? - <AUTHOR>

I've been having trouble focusing in the day. I think part of this is having to deal with so much non-work stuff-to-do, plus organizing work, plus managing e-mails. At night places are quiet. People don't e-mail. I can focus.<p>Thoughts? <comment><USER2> I do focus better at night, but realized it was a bad trade off because you have to get early later afterwards. I switched my schedule instead and work really early in the morning now. I love it because you don't have the "oh f __* it 's 4am already" if you wake up at 4.

<comment><USER3> I work nights, and I do feel like I get more done. I also feel sort of guilty for staying up so late (maybe because I have roommates who work regular hours in offices).

Regardless, I'm interested in trying out your method...

<comment><USER4> I used to be a serious night owl: in university I commonly stayed up till 6-7am working thinking I was at my best. However, since getting into the real world and having a 9-5 I obviously couldn't keep this up, so recently I tried to switch to becoming a morning person.

It wasn't easy (especially those first few days), but slowly I managed to push my weekday alarm back to 6am (from 8am: I live just round the corner from where I work) and on weekends to 8-9am. The biggest things that worked for me were:

1\. Make the alarm annoying and put it somewhere that forces you to get out of bed

2\. Have a good routine that you can follow in your zombified state (e.g. get up, head straight for the shower, get dressed, have breakfast while _not_ browsing HN/reddit, sit down to work)

3\. Give yourself a good reason for getting out of bed. For me, this was only allowing myself to work on an exciting new project in the morning before work

I still lapse occasionally, but it has made me realise that being a night owl or a morning person is entirely my choice.

<comment><USER5> I fell victim to the snooze button for years. I'd set my alarm early, and then hit snooze for literally two hours every morning.

I finally started getting up early by ditching my alarm clock altogether. Once I did that, I just started getting up the first time I woke up each morning.

I think this approach works because you always wake up at the end of a sleep cycle. I haven't used an alarm clock in over 10 years, and I am way more productive because of that.

<comment><USER2> A simple way to get rid of the snooze problem is simply to put your phone in a location not accessible from your bed. My alarm clock is in my bathroom. I have to get up to stop it.

Once it´s done, I am 30 cms away from a hot shower :)

I used not to have an alarm clock in the past. The problem I had is that it definitely means that you cannot stay up late the day before, not to wake up too late.

</comment></comment></comment></comment></comment><comment><USER6> Well for one thing, your body is trying to prepare yourself for sleep. So naturally, you feel more relaxed and don't get as energized by the distractions that are available to you.

If you're having trouble focusing during the day, you might want to work on being more present while you work and training your mind to not give into those distractions. Yes, it can be trained just like anything else.

I have a course that addresses this issue and other issues that programmers face if you're interested. It's available at [https://www.programmingspiritually.com/](https://www.programmingspiritually.com/)

</comment><comment><USER7> Totally. I love when you work and you hear only the rain, no cars, no cabs, no buses, no salesman, no childrens going to school.

</comment><comment><USER8> Definitely. I was doing all my assignments and exam preparations at university only at nights. It looks like my productivity triples then - no noise, no phone calls/IM's and you can always take a break and just gaze at the stars for a moments to relax. Sadly I have a day job now and can't stay with that life style anymore.

</comment><comment><USER9> On the other hand, at the morning(and that means MORNING :)) I am super effective for first 2 hours. So if I can go vampire until 1am and sleep until 8am or I can go sleep at 11pm and wake up at 6am, I choose the second one.

6am-8am >>>>>> 11pm-1am (in terms of effectiveness)

</comment><comment><USER10> Nod in agreement. I guess its about getting that loooooooong stretch of uninterrupted time. The day is good for getting the usual things done and brainstorming. But yes, when I am working on something new and exciting, i start at about 11:00 pm and my thought process peaks between 3 and 4 am

</comment><comment><USER11> I work far better at night when I'm alone for obvious reasons like you mentioned - phone isn't ringing, people aren't texting, emails for the most part are far, far less, etc. etc. Definitely a night owl...

</comment><comment><USER12> I don't let it get that far. I focus regardless or try my hardest so long as I got some good rest I am fine</comment>


Service Workers - <AUTHOR> https://hackernoon.com/service-workers-62a7b14aa63a <comment><USER2> I think service workers are the biggest foot gun to web development. There are so many issues you bring to the table just to have offline capability.

First you have to design a service worker that can intelligently download new updates to your app, relay to the user there is a new version, and you have to make sure you support changing apis as clients can be using the old versions of an app for a long time.

You have to design self destruct logic because your service worker itself can have bugs and break your app. In addition your self destruct logic can break.

You also have to make sure you service worker does not infinitely cache an old version of you app, because it will never expire without correct logic. You cant just assume to download higher version numbers, some times you want to revert to an older version of your app.

<comment><USER3> Can't you just add a dead mans switch?

<comment><USER4> Sure, that's a kind of "self destruct logic," as aclatuts put it. Just make sure you coded and tested _that_ correctly...

</comment></comment></comment><comment><USER5> Unfortunately, until Apple gets onboard we aren't willing to take advantage of them at my job.

<comment><USER6> Apple came aboard with iOS 11.3.[1][2]

[1] [https://webkit.org/blog/8090/workers-at-your- service/](https://webkit.org/blog/8090/workers-at-your-service/) [2] [https://caniuse.com/#feat=serviceworkers](https://caniuse.com/#feat=serviceworkers)

<comment><USER7> Ok but for real their implementation is _severely_ lacking.

<comment><USER8> They are doing everything they can to put off Safari Push on iOS. That will seriously destabilize the App Store, by giving webapps the most important feature of native apps, Push.

</comment></comment></comment></comment><comment><USER9> I hate to say it, but the writing is strange; Hacker Noon should have someone proofread it.

<comment><USER10> There's also a syntax error in the first code sample:

[https://gist.github.com/ankita1910/1ff6c67a63c0f2d62a5c82c7d...](https://gist.github.com/ankita1910/1ff6c67a63c0f2d62a5c82c7d8dcb3e3#file- fetch-js-L12)

</comment></comment><comment><USER11> Do service workers work with iOS yet? Last time I tried doing the "progressive web app" thing, apple was on an older, shittier iteration of the idea.

<comment><USER12> Apple has started to implement service workers in the latest Safari, but it still lacks behind the other browsers - I suspect they are worried it will provide a disincentive for applications to be hosted on the app store.

My biggest draw to PWAs was the ease of which I could deploy an intranet app on portable devices with spotty connectivity. This works fine with the appcache, which is what I currently use, but service workers require SSL and self-signed certificates are a no-go. This adds to the complexity of using service workers in a simple intranet hosted PWA. Also, back to Safari's poor implementation of service workers, the amount of time a PWA will reside in the browser is unspecified. I can only imagine the the headaches it will cause if the PWA drops randomly. So I'm avoiding service workers in my PWAs for now.

When appcache deprecates (it's slated to), maybe it will be time for me to go native if I am going to have to add complexity regardless.

</comment></comment><comment><USER13> > immediately switched back to my browser to navigate to the website, to read > the blog that I was peacefully reading on the native app

I had to read this twice because I couldn't believe there's actually someone out there who prefers those "install the app" banner spam apps that the mobile web is littered with.

</comment><comment><USER14> Unclosable pop-up. Again.

<comment><USER15> Slightly related - not much a fan of hackernoon. The electric lime green banner at the top is essentially blinding. I had to zap the element with Ublock Origin just to read the article comfortably.

</comment></comment><comment><USER16> I tried service workers and even just unlaunching the feature was a major challenge. Our users ended up having cached versions of the site with a service worker for every and we had to put a ton of cache busters in to deal with it.

Not ready for primetime.

<comment><USER17> Sorry but it is completely your own fault. We've been using Service Workers on production for two years now, and never had any issues of any sorts. Also kudos for "trying" a new API on production.

<comment><USER18> Person 1: "It didn't work for my single use case / environment / circumstances = non-working garbage"

Person 2: "It worked for my single use case / environment / circumstances = the best thing ever, it's your fault"

:)

</comment></comment></comment><comment><USER19> The design of service workers is ridiculous!

A normal application will check if a file it needs is downloaded, and if not, download it.

An insane application would unconditionally attempt to download the file, except first it forks off a new child process, turns it into a network MITM proxy, and have it intercept the request. Because how else can you access local files on disk except through HTTP?</comment>


GitHub's 2015 Transparency Report - <AUTHOR> https://github.com/blog/2202-github-s-2015-transparency-report <comment><USER3> 0–249 National Security Orders received?

> _" we are not even allowed to say if we've received zero of these reports—we > can only report information about these types of requests in broad ranges"_

Interesting. What are they really telling us with that range? Could they not get away with saying "1–249"?

Edit: Nevermind. The document they cite[0] clears it up.

[0] [https://www.justice.gov/iso/opa/resources/422201412716042240...](https://www.justice.gov/iso/opa/resources/422201412716042240387.pdf)

<comment><USER4> I believe this is what the security canary used to be that companies would use to skirt the rules until the rules were changed. It used to be that you couldn't say how many you received but you could say you hadn't received any. Now you aren't even allowed to say that.

<comment><USER5> No, nothing has changed on that front. If you have not received any National Security Letters, it is legal for you to say "I have never received an NSL" (as other commenters have suggested). Warrant canaries rely on the idea that it is much more legally difficult to compel speech than to restrict it. There is no (non-secret) case law indicating that a NSL recipient could be compelled to lie and include the warrant canary paragraph in a future transparency report, while there is case law indicating that NSL recipients can be prevented from actively disclosing the letter (gag orders are fairly well- established in particular aspects of our legal system).

The reason why warrant canaries are binary is that once an NSL has been issued, the case law that the parent commenter linked comes into play: companies may only indicate in buckets how many they have received (0-249, 250-499, etc). So you couldn't have your warrant canary say "I have never received more than 3 NSLs" then "I have never received more than 5 NSLs" etc.

<comment><USER6> So what happens if you make a range of canaries? e.g.

\- We have not received any requests in Q1 of 2016.

\- We have not received more than 50 requests in Q1 of 2016.

\- We have not received more than 100 requests in Q1 of 2016.

<comment><USER5> If I understand your scenario, the problem is that you would have to remove all the canaries as soon as you receive your first NSL. As soon as you receive a NSL, you may only disclose the number of NSLs you have received in the buckets I mentioned above, so you would not be able to say "we have not received more than 50/100 requests;" you would only be able to say "we have received 0-249 requests." So the canary still only works to tell people that you have never received an NSL.

<comment><USER7> But I think the "novelty" in his scheme is that he has separate canaries for different time periods -- so it may not be helpful in letting users know the number of requests received, but it would allow them to know when they had been received.

Assume he had a scheme that just said the following:

We have received no NSL letters in Jan 2016 We have received no NSL letters in Feb 2016 We have received between 0 and 249 NSL letters in March 2016 We have received no NSL letters in Apr 2016

<comment><USER5> Oh, well that scheme wouldn't be legal for a few reasons: once you receive an NSL you aren't allowed to say you've received 0 NSLs in a given time period (you can only report in 0-249 buckets so you couldn't say "We have received no NSLs in Jan 2016") and the granularity with which you can report (on my read of the document: [1]) is per year or per six months depending on which option you choose (so you couldn't say "We have received 0-249 NSLs in March 2016", just "We have received 0-249 NSLs in 2016").

The only reason the canary "works" is as a binary option - if you say "We have never received an NSL" up until you receive one, the government cannot compel you to continue including that line in your report, because that would be compelled speech which is legally difficult and (as far as anyone knows) hasn't been attempted. But anything you say beyond that related to the quantity or existence of NSLs is subject to the linked guidelines. In other words, they cannot force you to continue including a paragraph (the canary) in your report, but they CAN regulate anything you do choose to include in your report.

[1]: [https://www.justice.gov/iso/opa/resources/422201412716042240...](https://www.justice.gov/iso/opa/resources/422201412716042240387.pdf)

Edit: NSL letter, ATM machine, blah

<comment><USER7> Hmm that's really interesting. I guess I just wondered if somehow there was a case for trying to really stretch that idea of not being able to "compel" speech to its fullest limits by simply issuing separate canaries for different time periods, then simply removing it for the time period in question. By the logic you present, you still have a binary option -- you just restrict its scope. But I guess what would happen in this case is those separate "scopes" that I tried to create would simply all collapse into one, following the per- year/six-month option you cited above.

So even if before I received any letter I'd tried to be clever and just said: "No NSL letters in March, No NSL letters in April.... etc.", if I ended up receiving one during that time period at all, all of those WOULD HAVE to collapse to "We have received 0-249 letters in the first semester of 2016 (or 2016 altogether)"

<comment> squeaky-clean > So even if before I received any letter I'd tried to be clever and just > said: "No NSL letters in March, No NSL letters in April.... etc.", if I > ended up receiving one during that time period at all, all of those WOULD > HAVE to collapse to "We have received 0-249 letters in the first semester of > 2016 (or 2016 altogether)"

Sort of. There's also a required 6 month delay. So if you received an NSL today, but had "No NSLs in Jan" , "No NSLs in Feb", "No NSLs in Mar", etc, you would need to remove all those and could not report the 0-249 number until 2017.

<comment><USER8> Twelve canaries with different colors representing each of the months. Remove the canaries where the color corresponds with the month. Make absolutely no claims beforehand as to what the colored canaries represent - people should be able to figure it out (3 green, 3 red, 3 brown, 3 blue: take a guess?)

You are saying _nothing_ at all. Just adding/removing images on a page called /canary/

IANAL, but I'd be interested how the above would be illegal.

<comment><USER5> They would contend that this is just a wink-and-a-nod way of providing the information you aren't allowed to provide. It doesn't matter if you disclose the information in English, French, or binary, it's still illegal. If you have it in a page called /canary/ and it obviously corresponds with NSLs you'd be in some hot water.

People tend to assume the court system is like a machine when it's very human at its core. A judge isn't going to say "well you technically didn't reveal any info so you're kosher," a judge is going to be pissed that you decided to low-key defy his/her order.

<comment><USER8> AFAIK, even a binary "canary" has been untested in court and might not even stand on its own (yet many companies have one).

There are _countless_ loopholes in various legal systems across the world that "get a pass". It's often a matter of finding the right loopholes.

One example is gambling in Japan. Illegal. But if you play at a pachinko slot for a chance to win some tokens you can go next door and there is a business that will buy the tokens from you! It really is convenient someone is willing to buy these otherwise useless tokens. :)

I'm sure if I put some thought into it I could find a few more loopholes that are a "wink and a nod" away of being illegal. Of course, my suggestion might be _too_ blatant and the company would be dragged to the courts. But even a single canary could still warrant being dragged to court over.

<comment><USER5> This is true, but there's a core fundamental issue. There has never been any legal support for the idea that the government can compel speech (such as forcing the continued false inclusion of a "binary" canary). There is a clear basis of support for the idea that the government can regulate speech, whether it's English or cryptic colored circles. So trying to speak (publish canary info) in any sort of cryptic way will still always be more risky than choosing not to speak (omit your canary). The government could always drag you to court over anything, but you still want to keep them at the downhill end of the battle.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Since nobody else has mentioned it, let me just point out that it's really great that Github is taking the time to compile and publish this kind of information.

</comment><comment><USER10> The FBI is trying to make it easier to give out NSLs as well:

[http://www.wyden.senate.gov/news/press-releases/wyden- places...](http://www.wyden.senate.gov/news/press-releases/wyden-places-hold- on-intelligence-authorization-bill-that-needlessly-expands-fbi-surveillance- undermines-independent-oversight)

Contact your Senator/Representative if you don't want that to happen. Even though a similar amendment failed in the Senate last week, it was a close call.

Also, next there they are supposed to vote on the renewal of the FISA Amendments Act, and I'm sure they'll try to further expand their spying powers some more then, too.

</comment><comment><USER11> I noticed a bunch of DMCA takedowns coming from UCSD's CSE131 class in the DMCA repo: [https://github.com/github/dmca](https://github.com/github/dmca)

If you search for cse131 you'll find a bunch of repos still up.

This kind of whack-a-mole is typical of DMCA and requires a lot of resources to manage.

<comment><USER12> Can you DMCA a student's repo for hosting their own solution to a coding exercise? In programming books, when the exercise is often closely related to the sample code submitted (e.g. "Exercise 3.2. Rewrite the above sample to use a for loop instead of a while loop"), I imagine a large number of independently-derived solutions might look very similar.

<comment><USER13> Yes, kinda. At least UIUC did that to students who had libraries from the coding exercises.

For example, the cs225 course provides an image processing library, and you need it for the assignment, so if you put the library in the repo they DMCA'd.

Similarly, many courses give you a framework of code. If you filled in the framework they would DMCA.

They did this a bit, but there was a pretty massive back lash. I don't think they are doing it atm

</comment></comment></comment><comment><USER14> I don't get why employees don't leak the real stats anonymously. Perhaps companies should not try so hard to compartmentalize this information - <USER2> 40 or 50 key people, enough to spread suspicion and enable plausible deniability.

When a law is clearly unethical, don't work so hard to abide by it.

<comment><USER15> The government could easily prevent that by punishing the company whenever there is a leak, instead of trying to punish the specific person. This may be what they do already

<comment><USER16> Unfortunately (or fortunately?) not everyone cares whether their actions harm their employer.

</comment></comment></comment><comment><USER17> While we're here, [http://www.nytimes.com/2015/03/31/technology/china- appears-t...](http://www.nytimes.com/2015/03/31/technology/china-appears-to- attack-github-by-diverting-web-traffic.html) also happened in 2015. Not a legal request to remove content, per-say, but something...slightly different.

</comment><comment><USER18> If any GitHub folks are watching this thread: please sue the government for the right to disclose the number of NSLs you've received, or better yet to have NSLs declared unconstitutional in general.

<comment><USER19> Twitter's already suing the federal government for the right to disclose NSLs. In March, their lawsuit was dismissed. However, the EFF is still working on it...

[https://www.eff.org/deeplinks/2016/04/disappointing- ruling-n...](https://www.eff.org/deeplinks/2016/04/disappointing-ruling- national-security-letters-not-last-word)

[http://thehill.com/policy/technology/278448-judge- dismisses-...](http://thehill.com/policy/technology/278448-judge-dismisses- twitters-lawsuit-against-government)

</comment></comment><comment><USER20> Oh my god the "fast die" take down request from Russia. Is that a real business?

[https://github.com/github/gov- takedowns/tree/master/Russia/2...](https://github.com/github/gov- takedowns/tree/master/Russia/2015)

[http://fast-die.github.io/](http://fast-die.github.io/)

<comment><USER21> You mean request or Fast-Die? The former is a real business. The latter is an example of trolling of Russian internet censorship agency.

</comment></comment><comment><USER22> At least they still publish it. That's worth _something_ , right?

</comment><comment><USER23> Does anyone have any idea what happened with all of the DMCA takedown requests in September?

<comment><USER24> Among other things, someone sent 20 requests for removal of their fonts (each request contained numerous files), and jetbrains requested the removal of ~500 product keys from across GH.

<comment><USER25> It looks like JetBrains got a whole lot of keygens removed, plus one poor person's Hadoop demo code (which happened to have a filename of keygen.java).

</comment></comment></comment><comment><USER26> 0-249 for national security orders. I think it's safe to assume 249.

<comment><USER27> If you read elsewhere in the comments here, you'll see that it's not a safe assumption at all--"0-249" is the specificity allowed by the law.

Your assumption was also my own until reading here.</comment></comment>