Long stacktraces for V8 (Chrome and Node.js) implemented in user-land JavaScript - <AUTHOR> https://github.com/tlrobinson/long-stack-traces

<comment><USER2> Reminds me of the Causeway debugger for E, which lets you view causality traces instead of just stack traces: <http://www.erights.org/elang/tools/causeway/></comment>


Share anything. Anytime. Anywhere. - <AUTHOR> http://googlereader.blogspot.com/2008/05/share-anything-anytime-anywhere.html <comment><USER2> It will be interesting to see if this works. del.icio.us is a good demonstration of sharing and storing links with attached context but very few users use this aspect of it. I sense that many users do not have enough time or inclination for such advanced features.

</comment><comment><USER3> Lightweight linksharing. Friendfeed, twitter, tumblogging, and now google enters the space.

I think this is probably too tied to gReader to make a real go of it... but this particular problem is ripe enough that I'm working on an idea in the space, too.

</comment><comment><USER4> It's a nice feature but I doubt it'll get used much. For sharing to happen you need to first create a space where people enjoy hanging out with their friends, and that's not really what Google Reader is.

<comment><USER5> The share button is so trivial to click and the sharing is forceful (i.e. it appears in my feed without me ever adding the friends or letting them share stuff with me implicitly) that I think it will actually be used a lot.

</comment></comment><comment><USER6> Though I don't use FriendFeed it sounds a bit like it...

<comment><USER7> Not really, this makes google reader and friendfeed play even nicer.</comment></comment>


Big Data, Hype, the Media and Other Provocative Words to Put in a Title - <AUTHOR> https://amplab.cs.berkeley.edu/2014/10/22/big-data-hype-the-media-and-other-provocative-words-to-put-in-a-title/

<comment><USER2> The author's name (Michael Jordan) might increase the amount of clicks he gets in social media too.</comment>


Disqus Hijacking Links in Comments. Redirecting to Ad Networks - <AUTHOR> https://disqus.com/home/discussion/channel-discussdisqus/bug_reports_feedback_url_replacement_in_comments/ <comment><AUTHOR> If you're either using Disqus to provide commenting on a website you run, or leaving comments on other sites, with commenting provided by Disqus, you might want to check this out.

I found that links in Disqus comments on one of my sites were being hijacked and redirected to _redirect.viglink.com_. Other Disqus users have reported links being hijacked and redirected to _avantlink.ca_ [both ad networks].

Needless to say, this has been introduced by Disqus at some time in the fairly recent past [links in Disqus comments on my sites worked fine, previously] without telling their users they were doing this. Unbelievably underhand behaviour!</comment>


Ask HN: Forming an IT service organization, how much do I charge per month? - <AUTHOR>

I was formally the IT Director for a chain of Retail stores (150+) - the company was sold and they eliminated my position.
What I have discovered is they have left their franchisees out to dry by not continuing their IT support. I was sure they were going to hire someone else, but they didn't. They are on their own. They have to find IT support locally, which from what I am hearing has proven difficult for them. The software vendor doesn't offer quality after hours support. There is definitely a need I can fill here.
About 50% of the stores are using Quickbooks POS and the other half is using a industy specific point of sale solution which I am an expert in.
What I would like to do is call every one of the store owners and offer my services, introducing my new IT organization. They know me, they all like me, and would be willing to pay a monthly fee I am sure of it. It easily a $100,000 a year business if I only charge $60 a month.
Where I am lost is:
How am I going to handle issues that require physical intervention? (Sourcing local contractors) Should I charge a call out rate for this and pay my contractor a 1/3 or a 1/2 and keep the rest? Better yet, how am I going to find these contractors and present such a job to them. If I go through another company, they are sure to charge me a high market rate for their technician.
Is $60/month enough for such a service? The phone lines would have to be available from 9am to 9pm Monday through Saturday and Sunday 11am to 7pm.
I need to keep my employees local, I cannot outsource. So if I hire a $35,000 a year help desk employee - I've got approximately $6K a month left in revenue to work with.
Common issues would be: My receipts won't print, I can't find report X, my database is corrupt, I have these stupid pop ups, etc. Easy stuff.
Thoughts? <comment><USER2> _Is $60 /month enough for such a service?_

No. Not even close. $60 a month is cheap for best effort support via email 24 business hours later, rather than on-demand phone support 7 days a week.

Consider from the store's perspective. "My database is corrupt." means "We can't process transactions and are losing $15+ _per minute_ ", right? That sounds like it's worth closer to "What you pay for insurance every month" rather than "What you pay for toilet paper every month."

I'd be inclined to price this in the hundreds per month for virtual intervention. After you get a few clients under your belt, I suspect that while it might be priced monthly it will be sold yearly. (i.e. It's $500 a month, you want to buy it, OK, I'll invoice you for $6,000 for your first year of service and if you want to continue it 11 months from now I'll invoice you for another $6,000.")

Local hands-on assistance available "at preferential rates."

 _So if I hire a $35,000 a year help desk employee - I 've got approximately $6K a month left in revenue to work with._

I'm not aware of your location, which makes it difficult to calculate this with specificity, but you should know that a $35k a year employee will likely cost you closer to $50k all in. You will be responsible for payroll taxes, contributions on unemployment insurance and worker's compensation, etc etc. I also think you're underestimating your staffing needs by at least 0.5 FTEs. (Consider: your employee gets a standard offering for holidays/sick days/vacation, right? Do databases just agree to not corrupt themselves when she's on vacation or do you need to plan for availability then?)

</comment><comment><USER3> To what extent could you eliminate on-site failure points and/or build-up on- site redundancy? The reason I ask is that maybe the question shouldn't be about hiring more people for on-site failures but instead planning for up- front costs to build-up redundancy at each location (ie RAID, virtualizing, better networking equipment, IP-KVM's, etc.).

I know local hardware failure will never be completely eliminated but your pitch could be "look, I'll provide your much better IT than you'll find locally at a much lower cost but to make this work we have to invest in your hardware to build-up redundancy and backup systems."

</comment><comment><USER4> As much as you can do remote support. Charge incident packages. You should structure the fee/cost structure like insurance. Pay more monthly, get more service, lower out of pocket costs.

</comment><comment><USER5> definitely higher monthly fee cap the number of support hours/incidents assuming only a small percentage of incidents require physical intervention, contract out to part time local tech even if their per incident rate is high</comment>


Fungus Makes Snakes Look Like Mummies. It Just Turned Up in California - <AUTHOR> https://www.livescience.com/snake-fungal-disease-in-california.html <comment><USER2> Some fungi are so insidious when you start looking into how they function. They need to land, spore and infect but keep the host plant or animal alive in order to keep feeding itself, so they very slowly kill the host before they spore and move on.

</comment><comment><USER3> A lot of people don't appreciate that snakes pose about as much good to the environment as bee's do.</comment>


The Invisible Pandemic - <AUTHOR> https://www.thelancet.com/journals/lancet/article/PIIS0140-6736(20)31035-7/fulltext <comment><USER2> Key point is that the author suspects to see similar effects of the pandemic on countries that had lockdowns and those that didn't</comment>


Ask HN: How many friends of yours don't use HN because of UI? - <AUTHOR> I have 2 friends who both do not use HN because they do not like the UI (which I find awesome).
Both guys are great devs, btw.
Do you know such people? <comment><USER2> I have no friends who prefer slower UI's, sorry.

But I don't have PM's as friends. They would.

</comment><comment><USER3> I have no friends who don't use HN.

</comment><comment><USER4> 0

</comment><comment><USER5> none.</comment>


Perfect Forward Secrecy can block the NSA, but almost no one uses it - <AUTHOR> http://blogs.computerworld.com/encryption/22366/can-nsa-see-through-encrypted-web-pages-maybe-so <comment><USER2> Chrome should change the lock icon to something weaker for sessions that don't use ephemeral keys.

This may be the most important article on HN related to the NSA leaks. Fact is, most of us haven't paid enough attention to the details of https.

EDIT: "something weaker" \- didn't mention color. People dont need to understand "forward secrecy", the browser just needs to raise the bar for what's considered secure. The goal is to change server-side behavior, not consumer behavior.

<comment><USER3> People barely pay attention to the lock icon. Why would color-coding the lock make a difference?

<comment><USER4> I don't think the goal would be getting everyone to pay attention, because if it is, you're absolutely correct.

But if you look at it as a way to spread awareness to web admins, to be confronted with the question "how come we don't have the bestest type of icon", it's not so bad.

A related example: I have recently been wondering how widespread DNSSEC is.

I installed the DNSSEC validator chrome plugin, and now (almost) every website on the planet shows me a sad "no DNSSEC" icon. I can't help but feel that part of the low deployment of DNSSEC is because almost nobody, including web admins, gets any feedback about DNSSEC. (I am aware that there are other costs and risks to deployment.)

<comment><USER3> DNSSEC provides minimal value and adds significant overhead. We're better off the less it's deployed.

<comment><USER4> If you're like me, and wishing tptacek would elaborate, it turns out he has in the past. For example, this entertaining thread from three years ago:

[https://news.ycombinator.com/item?id=1234567](https://news.ycombinator.com/item?id=1234567)

Also, despite my earlier google queries about DNSSEC, everything I was reading was pretty dry. The magic phrase to google for is "DNSSEC sucks"\--that gets you the interesting stuff.

I haven't digested it yet, but in those results, this looks pretty interesting from D. J. Bernstein: [http://cr.yp.to/talks/2010.12.28/slides.pdf](http://cr.yp.to/talks/2010.12.28/slides.pdf)

<comment><USER3> More:

[https://news.ycombinator.com/item?id=5571937](https://news.ycombinator.com/item?id=5571937)

[https://news.ycombinator.com/item?id=4071178](https://news.ycombinator.com/item?id=4071178)

[https://news.ycombinator.com/item?id=2932378](https://news.ycombinator.com/item?id=2932378)

I _really_ don't like DNSSEC. I think it's a bad design that will harm the Internet.

</comment></comment></comment></comment></comment></comment><comment><USER5> I really hate the name "Perfect Forward Secrecy". There's no guarantee in ECDHE that the connections cannot be decrypted at some future time. All that's being implied is that the key changes per connection.

Sure, it's 'better' than RSA with a long lived private key, but there could be advances that would breach ECDH and make none of this 'perfect'. Such as: [http://www.wired.com/politics/security/commentary/securityma...](http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115) If the NIST supplied curves used by the TLS standard had a backdoor none of this would be perfect.

<comment><USER3> What you hate is the word "perfect". "Forward secrecy", though, has a technical meaning: a compromise in the long-lived key material for the cryptosystem doesn't enable an adversary to go back and decrypt earlier saved sessions.

The link you've provided doesn't implicate Diffie Hellman; it's in an obscure, virtually unused NIST standard that uses elliptic curves to generate random numbers.

There are other things not to like about the NIST curves, but the methodology used to generate them is documented (I suppose you could generate your own using the same method) and is based on the literature on ECC from the late '90s.

<comment><USER5> Yes, it's the word 'perfect' that really bothers me. I think it gives the general public the wrong impression.

<comment><USER6> Perhaps they should call it "pretty good"?

<comment><USER3> I just call it "forward secrecy". I think "complete" would be a better word than "perfect", but I think that neither are necessary.

</comment></comment></comment></comment></comment><comment><USER7> I agree with the article. Perfect forward secrecy (given master private key, still can't figure out derived session keys) is a wonderful property.

However, it's a bit over-reaching to say it can "block the NSA". It won't stop them from backdoor-ing your hardware/software (keyloggers, compromised random numbers, etc). It won't stop them from storing the encrypted communication until (for example) quantum computers make it possible to decrypt it (assuming RSA).

<comment><USER8> Sure, it won't "block the NSA" from discovering anything about you. But it raises the stakes.

It is much easier for the NSA to backdoor/crack/make deals with a few telecoms, collect all of the encrypted data, and then decrypt it at their leisure (via stealing RSA keys, getting them via legal channels, cracking RSA, taking advantage of compromised random numbers, or the like), than it is for them to backdoor your hardware (much larger surface of possible discovery), install keyloggers (need physical access, much more expensive to do so only makes sense to do in a targeted fashion) etc.

The whole point of this brouhaha is that the NSA appears to be hoovering up massive amounts of data, which it keeps and which even fairly junior employees at government contractors have access to and could abuse. I don't think that anyone (or most people, anyhow), object to specific, targeted wiretaps of targets that you have appropriate warrants for. It's the incredibly broad based collection of all records, without targeting, for later data mining, coupled with the first-amendment destroying demands of secrecy about discussion these practices, that have people up in arms.

The NSA has admitted that they retain encrypted data for longer than unencrypted, as they cannot as easily discard it as irrelevant. If you use a protocol with perfect forward secrecy, it substantially undermines the value of that collection.

 _Edit to add:_

> It won't stop them from storing the encrypted communication until (for > example) quantum computers make it possible to decrypt it (assuming RSA).

Actually, it will stop them from using quantum computers to crack RSA and thus be able to read past communications. That's the who point of perfect forward secrecy; even if you can crack the RSA layer (or obtain the private RSA keys), which is used for bootstrapping the authenticated encrypted channel, perfect forward secrecy generates the symmetric key in a way in which it is never actually communicated over that channel.

Perfect forward secrecy protocols, such as Diffie-Hellman key exchange, work by both sides coming up with two values, one of which is secret and one of which is passed over the channel, such that both of them can compute the same secret value by combining the private and public values. Even if the "public" values are intercepted, for instance by cracking RSA, you cannot determine the secret values, because you do not have the secret portions of the keys that each side generated.

The reason to use RSA in addition to key exchange is that Diffie-Hellman key exchange is not authenticated; someone could MITM you, doing both sides of the Diffie-Hellman protocol, and intercept your communication that way. RSA allows for signing of certificates which can be used to bootstrap the authentication process.

So, if RSA gets cracked in the future, then the NSA could at that point MITM all of your future connections. But they could not decrypt your prior conversations, which had been encrypted using a private key generated via a key-exchange protocol that provides perfect forward secrecy.

 _edit 2_ :

Hmm. After further investigation, it looks like quantum computers would be able able to break the common "perfect forward secrecy" algorithms as well. So yes, in the case of RSA being broken due to quantum computing taking off, it's likely that DH and other discrete log based perfect forward secrecy algorithms will be broken as well.

Sigh. Why can't we have any NP-complete problems that work cryptographically? While even that isn't a guarantee of security against quantum algorithms (after all, it may still be the case that P == NP), there's a fairly strong belief that P!=NP and that NP-complete is a disjoint category than quantum polynomial algorithms, and so would give us a better security margin against quantum attacks.

<comment><USER9> Cryptography needs problems that are hard _on average_ , not in the worst case. This doesn't fit well with P/NP/NP-complete, which are all about the worst-case difficulty of a problem.

For example, see the Merkle-Hellman knapsack cryptosystem [1], which is based on the subset sum problem --- a NP-complete problem! Nevertheless, it is broken. As you can see, using a NP-complete problem as a computational basis for a cryptosystem is not a silver bullet.

[1] [https://en.wikipedia.org/wiki/Merkle- Hellman](https://en.wikipedia.org/wiki/Merkle-Hellman)

<comment><USER10> Apparently it is very hard to prove results in average case complexity theory. We don't even know if computational problems that are hard on average assuming P!=NP exist, let alone actually designing a cryptosystem out of one.

<comment><USER11> There actually are a few "average-case complete" problems. The field was started with this 1986 paper: [http://epubs.siam.org/doi/abs/10.1137/0215020](http://epubs.siam.org/doi/abs/10.1137/0215020)

It's true that we don't seem to know how to build a cryptosystem out of them. Part of it is that a cryptosystem needs something stronger than average-case complete, a property more like _every_ instance being hard (possibly excluding trivially easy instances that can be detected and filtered out).

<comment><USER10> Average-case complexity is a not a topic I know a lot about, and I can't easily get the paper itself, but what the abstract seems to say is that for some particular NP complete problem, if an efficient average case algorithm exists for that problem then efficient average case algorithms exist for all NP complete problems. There is no mention of showing that such an algorithm does not exist.

My reference is Impagliazzo's 1995 survey paper "A Personal View of Average- Case Complexity" where he lays out five possible worlds based on open problems in complexity theory. He calls the world where P!=NP but all NP problems are easy on average "Heuristica." This is still an open problem as far as I know.

On your second point I can say a bit more. Cryptosystems in general do not need all instances to be hard. With RSA for example, there are all kinds of weird attacks, like the modulus n can easily be factored if phi(n) or phi(phi(n)) are products of small primes. There is no need to filter out these cases because the probability of them occurring is so small. There are cryptosystems where an arbitrary instance of the problem is as hard as the average case. This was a notable selling point for lattice cryptosystems when they were first invented.

In the RSA case the probability of these corner case attacks decreases with the size of the instance. So for current parameters the probability is near zero. However, even if you only had a scheme where the probability didn't diminish with the instance size and there are attacks that you _can 't_ check for, you can still securely send messages. Say the probability that your key generation algorithm gives you an instance that is hard is 50% (or any constant). You can securely send messages with arbitrarily small probability of having your message decrypted by using multiple keys and breaking up your message with a secret sharing scheme (Shamir's for example) and encrypting each message share with each of the keys. The attacker, able to only get a constant number of decrypted message shares will not be able to get decrypt your message.

</comment></comment></comment></comment></comment></comment><comment><USER12> Two notes:

(1) While Google uses forward-security on their HTTPS connections, I've not yet seen evidence either way as to whether the SMTP-TLS connections (relaying email to other domains) use forward-security. (The report at checktls.com mentions only the cipher "RC4-SHA", not the key-exchange mechanism.)

(2) If one side of the connection chooses to retain its session keys, or chooses session keys in a poor/predictable manner, or leaks information about session keys via a side-channel (either by mistake or intent), then the forward-security could be destroyed, and in a very subtle/undetectable way.

(This could be a cheap and sly way to grant visibility to a third-party: adopt forward-security outwardly, but ensure your session keys only look random to people who don't know the bug/secret-seed-shared-with-the-third-party.)

<comment><USER13> Thanks for asking this -- apparently there is no really easy tool for this (I was thinking openssl s_client could do this automagically -- apparently not) -- however, see:

[http://superuser.com/questions/109213/is-there-a-tool- that-c...](http://superuser.com/questions/109213/is-there-a-tool-that-can- test-what-ssl-tls-cipher-suites-a-particular-website-of)

And now I realized I hadn't tuned the SSL ciphers on one of my servers to not accept (among other thing NULL ciphers... at least if that bash-script works -- I'll have to double check).

<comment><USER14> You should check out [https://ssllabs.com](https://ssllabs.com). They accept a URL and do SSL checks to determine if your server is not configured in the most secure manner possible.

It is already interesting to run the check against online banking sites to see first hand how seriously they take security in practice. I was surprised to see that some banks score pretty poorly in this regard.

<comment><USER12> I don't find an option at ssllabs.com to check SMTP (the topic of this thread). Am I overlooking it?

<comment><USER13> No, you're not. It would be nice if they had one, though.

</comment></comment></comment></comment></comment><comment><USER15> FWIW, news.ycombinator.com provides perfect forward secrecy with ECDHE_RSA. Thanks, Nick!

<comment><USER13> Of course, there is no way for us to know whether or not yc archives a copy of the session keys... (Not that I think yc does that, but we're still talking a shared secret -- you need to trust both parties, if you want to trust forward secrecy...).

</comment></comment><comment><USER16> I don't see how this really helps, though. The NSA can still force a CA to generate certs for any domain they wish to intercept and MITM everyone they care about. They are likely to have the resources for that.

<comment><USER13> In the case where providers/servers are under NSA jurisdiction (or control, in the case of them hacking servers) -- they could also keep a copy of session keys.

But that would force them to intercept at _many_ more points than simply various edge routers (which is what they may or may not be doing now, having (or not having) equipment at ISPs/TelCos).

Essentially, if you use gmail or outlook.com -- you'll just have to trust that no one has forced (or covertly) installed backdoored crypto libraries. I do think it is very likely security agencies (both foreign and domestic) have agents/assets working at large companies like Google and Microsoft -- I don't think it is very likely that they have been able to covertly subvert their infrastructure. But it certainly is _possible_.

<comment><USER16> They don't need to do that much. If they control a CA and a few ISPs (especially networks to the outside of the US, since apparently us in the rest of the world are fair game), they can MITM anyone reliably. The only defence is checking fingerprints, but few will bother.

</comment></comment></comment><comment><AUTHOR> Note that despite this headline, the article does correctly state that Google now uses Perfect Forward Secrecy.

<comment><USER17> Who cares? The NSA gets it's data directly from google. You need to protect yourself from all hops between you and the one you communicate with, not only from the hops between you and google.

<comment><USER18> I'm assuming you read the article, in which it offers an explanation of how the NSA gets Google data. Are you disputing that very likely explanation for the theory that a Powerpoint slide somehow communicates more technically accurate and viable information?

Obviously, Google could be lying in their most recent denial that disputes such a claim. They are, after all, required to lie _if_ they are directly and materially involved in the program.

On the other hand, were I the business owner of a corporation that held millions of people's information and the NSA approached me for access, I don't think it is at all inconceivable and unlikely that I would attempt to negotiate not having the NSA on my network, in my machines, so I could retain the ability to truthfully tell my users that the company did not allow direct access to company servers.

In the article, Mr. Horowitz suggests that, given other leaks and information we've had in the prior years regarding NSA tapping the internet, the slurping of company data is happening at the on/off ramps to the networks, where data is coming in/out. This _is_ far more likely than Google shipping off deltas in cron batches. Thus, Google et al. can appear on the PRISM Powerpoint, which just says their data was added to the system. That can mean anything, you know. The Powerpoint presentation is hardly a source of empirical data presenting the technical architecture of the program.

This article is attempting to help educate and achieve protection at _all hops_ , not just the hops between you and Google. Perfect Forward Secrecy is just for that purpose--it removes the ability to find your encrypted data crackable via single master key decryption by using temporary keys.

So, while Google can only do so much in resisting NSLs, perhaps there is a little bit worth appreciating here. Google can't stop the NSA from slurping up traffic. But they can prevent that data from being massively decrypted via a single key.

<comment><USER17> > Google can't stop the NSA from slurping up traffic. But they can prevent > that data from being massively decrypted via a single key.

I don't want to sound snarky, but, so what? If you want privacy you still have to encrypt data end-to-end, not end-to-[google|microsoft|yahoo|facebook]-to- end.

And, anyway, [google|microsoft|yahoo|facebook] should not know about your stuff just like the nsa or anyone else who is not the intended recipient.

<comment><USER19> It's not up to Google to encrypt your e-mail end-to-end, though. That you have to do yourself. This technology exists and is called PGP.

Obviously Gmail's HTML interface can't work with these e-mails, until you get some way to sandbox part of the DOM on the client. Search won't work either.

</comment></comment></comment></comment></comment><comment><USER20> It would have been a fantastic effect and win for computerworld.com if their site supported what this article talked about.

</comment><comment><USER21> It's odd that there seems to be no definitive instructions for nginx or apache for enabling PFS. Given that it's clearly not obvious how to set this up, how many here are inadvertently running non-PFS without knowing it?

<comment><USER22> Funny, I think in part it's because few people care. Maybe I didn't have the right keywords, but I _just_ wrote an article about this for nginx/stud, and it got 2 upvotes on HN.

Here's the HN link: [https://news.ycombinator.com/item?id=5935988](https://news.ycombinator.com/item?id=5935988)

</comment></comment><comment><USER4> I've had a question about PFS for a while now: How 'expensive' is it to implement?

First up, let me state for the record that I don't have personal experience with running SSL on a server. But back in the day, generating a public/private key pair for PGP was a semi-expensive operation. Definitely not the kind of thing I could imagine running on a per session basis.

Since PFS requires per-session public/private key pairs, how "costly" is it?

(I understand that the goog uses ECDHE, so I guess I'm asking for a general feel for how quickly and efficient this compares to RSA key generation.)

<comment><USER23> The article mentions 23% reduction in speed for ECDHE-RSA vs RSA. Another example states between 15% and 27% reduction.

<comment><USER4> Thanks! I knew I should have read the article more carefully.

(The same section of the article also references [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward- se...](http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html) which answers some of my follow on questions.)

</comment></comment></comment><comment><USER24> Gmail uses Perfect Forward Secrecy, so what? If the NSA really does have direct access to Google's servers, then PFS will not provide you any extra protection from them. Sure, PFS will make it harder for others to snoop. But the current context for the general population is PRISM and the NSA.

I'm not saying that PFS (ugh, what a name, perfect, really?) isn't valuable, I'm just pointing out that no one should think this is going to make it any harder for the NSA to read/access your gmail account.

<comment><USER25> The NSA is getting all of the attention, but this applies to all of the world's intelligence services.

Even if you absolutely believe and support what the NSA is doing, you probably have good reason to want any number of governments, foreign competitors, and individuals from knowing what you are doing or (at the least) your financial status.

<comment><USER26> Sure, but if Googles stores all session keys, as is likely (key phrase: meta- data), then the session data store is a rich and likely target for all the world's intelligence services, and one that is not invulnerable. After all, Google is a big organisation with a large turnover of staff.

<comment><USER27> I would say that storing session keys is vanishingly unlikely and eliminates the benefit of PFS. Google probably spends millions of dollars a year in PFS additional handshake costs. Google then storing the session keys would be a little like the Dutch building an expensive dike and then knocking a big hole in it.

If you want to store data like "user X searched for Porsche 911 GTS 0-60 statistics, so let's show him some 991 Cabriolet ads the next time we can," you don't need to store the session keys.

</comment></comment></comment></comment><comment><USER28> The line has always been, "You can't stop a determined hacker with any single solution."

The NSA may be a group of determined hackers.

One technology isn't going to suddenly cure the whole problem. It takes a solid security policy set at and followed by the top levels of a company, and _constant_ vigilance to respond to threats. You're not going to stop anyone from getting in, but you can stop them from getting anything of value, and you can kick them out quickly and quietly.

</comment><comment><USER29> This article seems to start out with wrong assumptions and therefore ends up presenting dangerously wrong conclusions:

 _" Suppose, for example, the NSA was recording all HTTPS encrypted traffic to/from joeswebsite.com in January. Then, in February, they learned the private key for joeswebsite.com. Almost always, that lets them decrypt everything from January, February, March and beyond."_

We should instead suppose that the NSA has had the private keys all the time (since it started recording encrypted communication), so every piece of communication that has been recorded can be decrypted even with Perfect Forward Secrecy. I.e. let's assume they got Google's private key immediately when it was last changed, then all communication with Google's servers is decryptable (correct me if I'm wrong).

The NSA doesn't have to brute-force private keys, they just use legal/strong- arm techniques to obtain them, so it doesn't take a lot of computing power and time.

<comment><USER30> Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works.

ECDHE has been in Openssl since version 1.0.0 so its out there just not used.

Btw. Is there any addon for Firefox that shows the "encrypted communication" details like google does?

<comment><USER31> They don't have to take an active role though if they just sniff all the traffic, right?

<comment><USER3> Yes, they do.

<comment><USER31> Whoops. This wouldn't be the first time I got public/private key schemes muddled in my head.

</comment></comment></comment></comment></comment><comment><USER32> PGP complete lacks perfect forward secrecy. Suppose an eavesdropper is recording your email, even though they can't understand it. If your private key is ever compromised (say by torture or subpoena), then all your previous messages can be immediately decrypted.

> You could say that Bob losing control of his private key was the problem. > But with today's easily-compromised personal computers, this is an all-too- > likely occurence. We would really prefer to be able to handle such failures > gracefully, and not simply give away the farm.

[http://www.cypherpunks.ca/otr/otr- wpes.pdf](http://www.cypherpunks.ca/otr/otr-wpes.pdf)

</comment><comment><USER33> It appears this very site is using Perfect Forward Security. [http://cloud.lucasjans.com/image/081m1V3c3O1z](http://cloud.lucasjans.com/image/081m1V3c3O1z)

</comment><comment><USER34> Does it need to be DHE or will DH do just as well? What exactly is the difference here?

It still uses a key per connection at the least, and it's still not on the NIST/FIPS 140-2 standards because you can't decode it after the fact so it breaks auditing (all AFAICT, and I have looked at this stuff a lot).

That said, we're best using AES_GCM, 2048-bit RSA and ECDHE as a matter of course, because at the very least it requires a valid, active MITM to break and can't just be logged and scanned later.

</comment><comment><USER35> If Google is offering perfect forward secrecy for e-mails, why don't they have the same for Hangouts (OTR with perfect forward secrecy)?

</comment><comment><USER36> How important is the difference between ECDHE_RSA and DHE_RSA security-wise?

edit: I asked because Opera showed a site's free StartCom certificate as "TLS v1.0 256 bit AES (1024 bit DHE_RSA/SHA)". I checked with Chromium and there it is shown as ECDHE_RSA though. This is confusing...

<comment><USER37> They both provide PFS, but ECDHE_RSA is _much_ faster.

Do you have TLS 1.1/1.2 enabled in Opera?

</comment></comment><comment><USER38> What about more use of one-time or ephemeral email addresses? The info we have so far seems to suggest NSA likes to track email addresses. Compare tracking an email address that was only used to send or receive one or a few messages with one that has a long history of use.

</comment><comment><USER39> Suppose the data captured is not a dump of a database but rather a https log. Doesn't it imply that NSA has to essentially rebuild the server functionality to make sense of the data?</comment>


Parenthood, the Great Moral Gamble - <AUTHOR> http://nautil.us/issue/2/uncertainty/parenthood-the-great-moral-gamble

<comment><USER2> Many people talk about kids who grow up to be serial killers, or bringing another child into an overcrowded world, but ignore the aggregate value of the tremendous joy people experience simply being alive. I think often, we in the first world cannot fathom how poor people can be happy. But the fact is that something as simple as sharing a meal with family is a source of joy for people the world over, and the magnitude of that joy is not proportional to whether you live in the West Village or in an actual village.

This is a bit metaphysical, but in my opinion there is a cosmic opportunity cost to _not_ having kids--a lost opportunity for a human person to experience the joy of being alive.

<comment><USER3> > This is a bit metaphysical, but in my opinion there is a cosmic opportunity > cost to not having kids--a lost opportunity for a human person to experience > the joy of being alive.

By this logic you should have as many children as possible.

<comment><USER2> By that logic, all else being equal, society in the aggregate (not necessarily any individual) should have as many kids as possible.

I don't think it's such a far fetched idea. I think at least one of the subconscious appeals of Star Trek is that it's a story where humanity is freed from being tied to a single world, and _populates_ worlds all over the galaxy.

</comment></comment></comment><comment><USER4> _Everything_ we do has a chance of causing harm. People regularly agonize over the potential of harm, often despite minuscule odds thereof. To become a sane productive adult, one must come to accept that harm _may_ happen as consequence to an action, but not doing that action causes harm as well. Go forth with good intent in good faith; stark horrors _may_ occur, but not doing so accumulates greater horror.

[http://4.bp.blogspot.com/-KKLOmJySIgk/TghkJ21To5I/AAAAAAAAA0...](http://4.bp.blogspot.com/-KKLOmJySIgk/TghkJ21To5I/AAAAAAAAA0c/qh1g73xU22s/s1600/bloom+county+much+too+eco- friendly.jpg)

</comment><comment><USER5> On the one hand, those are very interesting questions to discuss.

On the other hand, getting/having children is a deeply rooted desire/need in humans, and passing judgement on it feels like passing judgement on the decision to eat food, sleep, breath, or having sex.

Can you blame somebody for eating when hungry? Even when it has far-reaching consequence some fifteen years later?

</comment><comment><USER6> This article reads like a confused run in circles [0]. Parents are responsible for kids they cannot control? How can you be responsible for something you have no control over??

Sure, there is a tendency to blame parents of evildoers, but that is fallacy of the accuser, not the parents.

[0] @native speaker: Is there a good phrase for this?

<comment><USER7> > _How can you be responsible for something you have no control over?_

In the general case, this is very easy and logical: by unleashing it to the world.

Isn't that the idea behind the "Sorcerer's Apprentice" (famous from Mickey Mouse's version in Fantasia)?

[http://en.wikipedia.org/wiki/The_Sorcerer%27s_Apprentice](http://en.wikipedia.org/wiki/The_Sorcerer%27s_Apprentice)</comment></comment>


Hidden "Drop Box" feature in Mac OS X Lion lets you sync files across Macs - <AUTHOR> http://www.appleinsider.com/articles/11/11/02/hidden_drop_box_feature_in_mac_os_x_lion_lets_you_sync_files_across_macs.html

<comment><USER2> I hope they find a way around having to ask the user what to do during a version conflict.

<comment><USER3> git never did...

<comment><USER4> As a closer comparison, DropBox doesn't either; it just dumps a file named "yourfilename (Other Person's conflicted copy 2011-11-03)" in the directory.

</comment></comment></comment><comment><USER5> I thought this was a, like standard feature of iCloud. I mean, the slogan is: "Your content. On all your devices.".

<comment><USER6> It is. And "Documents and Data" is just a wrapper term to mean "App Store apps have APIs to sync data with iCloud", whether it's a Mac or iOS app. It doesn't mean "Just iWork documents".

I think the reason for confusion is just... so few apps support it yet. Not even iWork on the Mac supports it yet, I don't think.

<comment><USER7> When I imagine telling my Mom, "Good news; the Finder is an iCloud app!" I very clearly understand why Apple has not published this as a feature.

Nice that it works, though.

</comment></comment></comment><comment><USER8> Why is this Mac specific? This is exactly the sort of feature that must be cross platform.

Does Apple really think it will have a monopoly in the years ahead?

<comment><USER9> I don't agree that cross-platform is a requirement. For example, I haven't touched a Windows-only PC in years. Also, Dropbox can't sort out access control precisely because it is cross-platform. That's just one example of many downsides of supporting all major platforms.

<comment><USER10> This is one of those classic forks in the road.

If you make it cross platform, you make it easier to be a lingua franca of sharing between loosely connected people. Dropbox is handy for sharing project files between consultants and clients, for example.

OTOH, if you make it platform-specific, you can make it a better experience for people who use it to synchronize their own files or between closely connected people such as colleagues on a team that have a single standard OS.

The whole thing seems analogous to Apple's strategy for integrating hardware and software. It sacrifices "interoperability" for just being better. I suspect a lot of the same arguments apply here.

<comment><USER11> It's also an hedge against someone deciding they want a 4G Android phone, a BlackBerry, a Kindle Fire, a Windows 8 tablet or whatever comes along next week in addition to their other Apple devices. This provides another incentive not to mix and match.

Or an incentive to stick with Dropbox if you think you might want a heterodox solution.</comment></comment></comment></comment>


Infinite USB - <AUTHOR> http://jianggonglue.com/DesignUSB.html

<comment><USER2> Does anyone know if this is different than using powered USB hubs? I imagine attaching an "unpowered" USB hub (no power cord), and then attaching a powered USB hub to that, and then another powered USB hub to that one (...to infinite and beyond). Same thing, no?</comment>


How Microsoft Community Blames on Browser for Hotmail's Slowness - Anil-Shrestha http://answers.microsoft.com/en-us/outlook_com/forum/oemail-osend/why-is-the-new-outlook-for-hotmail-so-slow/6fb4b7de-9829-40fc-bfcf-dfe29357127a?auth=1 <comment><AUTHOR> Since this user is on XP, really should not be using IE8 anymore, and should use a third party browser.

I'm frankly surprised it works halfway well at all, and in general IE8 requires ES5 shims/shivs beyond even ES6 babel support.</comment>


Ask HN: Is it safe to use Facebook's open source projects? - <AUTHOR> There is a PATENTS file in almost all Facebook's open source projects with statements on "Additional Grant of Patent Rights".
E.g., React (https://github.com/facebook/react/blob/master/PATENTS)
Why Facebook adds this declaration on top of the BSD license of the software? Is it safe to use those projects in my commercial project? <comment><USER2> There is no way to be safe from patents. Anyone could have them, they don't have to declare them, and they're written in deliberately obtuse ways so that you have no way of finding relevant patents before you're sued for infringing them (you don't have to have copied, or even be aware of, any patented thing to violate a patent). It's just a hazard of the software industry.

The BSD license says nothing about patents, so this project is in some sense _safer_ than a "normal" BSD-licensed project (but not an Apache, EPL or GPLv3-licensed project). The grant Facebook is giving you is fairly minimal but that's understandable from their perspective: they don't want to give you any extra patent rights, just enough to use the stuff they're actually trying to release.

It's not _safe_ to use software in a commercial project. Facebook might hold patents on any random library you're using. Companies that aren't Facebook might hold patents on any random library or on React. You could develop a library in-house in a clean room and it could still infringe someone else's patent. Patents really suck that way. But React is in no more danger than any other code you might use.

EDIT: no more danger than any other BSD-licensed code. It would be safer to use code that has a less revocable patent grant, such as that in the Apache License, EPL, or GPLv3.

<comment><USER3> "You could develop a library in-house in a clean room and it could still infringe someone else's patent."

IANAL, but, it is my understanding that if that's the case the patent wouldn't hold up to the novel requirement.

<comment><USER4> It all depends on how the court sees it.

See "Carmack's Reverse" \- where John Carmack independently developed an acceleration for robust stencil shadows, documented his discovery and then had to capitulate to Creative Labs who owned a patent on the algorithm from a few months earlier.

</comment></comment></comment><comment><USER5> No. The license has a chilling clause that says if you ever suggest that _any_ Facebook patent might be invalid, your license to use their code is automatically revoked.

And in corporate world, that means any comment of any of your employees in an official capacity.

Edit downvotes, well maybe the text of the clause will help

> The license granted hereunder will terminate, automatically and without > notice, for anyone that makes any claim ... by ... assertion or other action > ... alleging .. that any right in any patent claim of Facebook is invalid or > unenforceable.

> > [https://github.com/facebook/fbcunn/blob/master/PATENTS](https://github.com/facebook/fbcunn/blob/master/PATENTS)

<comment><USER6> _…if you ever suggest that any Facebook patent might be invalid, your license to use their code is automatically revoked._

This is not correct — your _license to use any patent of Facebook 's that covers the software_ is revoked. You are still not infringing copyright on the software by using it, but you will no longer be protected by Facebook's patent grant, which is _in addition_ to your license to use the software.

This is a boilerplate patent grant, and it doesn't mean that Facebook holds any patents on e.g. React.

To be clear, this parent grant is _in addition to your license to use the software_ and as a result _does not restrict your freedom in any way_ , versus the license not being granted at all.

<comment><USER7> Are you saying that they _could not_ come after you for simply using React (even if you were to dispute the relevant patents in court), or just that there is no _evidence_ that they could?

<comment><USER6> Facebook cannot 'come after you' for using React if you have not accused them of patent infringement.

They can 'come after you' iff you _have_ accused them of that, _and_ you are using their software in such a way that a parent of theirs is violated.

It's pretty straightforward:

\- Facebook has released some open source software. In the case of React, it's under the BSD license.

\- You can use this software however you want, in accordance with the license.

\- In _addition_ to granting you a license to use the software, Facebook has granted you a license to any patents they own that cover the software.

\- There is no enumeration or claim that any patents _do_ cover the software.

\- Your license to use any hypothetical patent that _does_ cover the software will be revoked if you make a claim—legal or otherwise—that Facebook has infringed any patent.

\- At that point, you will no longer have a license to use any patent that covers the software.

\- If you are subsequently using the software in a way that infringes one of their patents, Facebook would legitimately be able to claim patent infringement.

</comment></comment></comment></comment><comment><USER8> Facebook is granting you additional rights on top of the BSD license. In the worst case, where you do something that causes the patent rights to be revoked, you're still left with the same rights you have under the BSD license.

This is unambiguously safer to use than if they had released it under a vanilla BSD license. As for why Facebook did this, they're most likely trying to give away additional rights while still maintaining the ability to use these patents defensively, in the event someone sues them for infringing a different patent.

It's ironic that people are freaking out about this. If anything, we should be encouraging more companies to give away patent rights. Sure, it's not as broad as the Apache license, but it's a lot better than the default (nothing), and given some of the ridiculous patent lawsuits that have been brought against Facebook, Google, and others, I can understand why they'd want to avoid restricting their ability to use their patents defensively.

<comment><USER9> "Facebook is granting you additional rights on top of the BSD license. In the worst case, where you do something that causes the patent rights to be revoked, you're still left with the same rights you have under the BSD license. This is unambiguously safer to use than if they had released it under a vanilla BSD license. As for why Facebook did this, they're most likely trying to give away additional rights while still maintaining the ability to use these patents defensively, in the event someone sues them for infringing a different patent. "

This is 100% totally and completely wrong :)

The BSD license normally includes an implied patent license.

It says " Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met .. "

This grants an implied patent license to the patents necessary to actually do this, as long as you meet the restrictions.

This is actually well settled law. You don't get to give people stuff unrestricted, and say "you can use this for free", and then say "just kidding, what i meant was, you can use this for free as long as you pay me for the patents"

However, when you do what facebook has done, and give _an explicit license_ , you have overwritten the terms of that implied license, and you get no implied license.

So it is not only "not unambiguously safer", you are not "left with the same rights you had under the bsd license if it is revoked".

This is because if you revoke the explicit grant, you get nothing in terms of patents. But the implicit grant is not revokable unless you violate _the copyright license_.

So sorry, but this is not "better than the default" and does not in fact, help you.

<comment><USER6> _This is actually well settled law._

I'm not sure it is, and I'd argue the situation is unclear. I'd be keen to see any examples though – it would be awesome if there was something to fall back on.

All I can find is evidence that it would be at best very risky to rely on an implied patent grant.

For example, it's considered unclear enough that the ClearBSD license was explicitly created to clarify that it doesn't offer patent grants - [http://directory.fsf.org/wiki/License:ClearBSD](http://directory.fsf.org/wiki/License:ClearBSD)

Even more damning:

 _In the absence of an explicit patent grant, but considering the word use in the license, can we assume that the BSD license impliedly grants enough of whatever patent rights the Univer- sity of California then owned that a licensee may use the soft- ware as it was originally distributed by the University? Most licensees under the BSD assume it does on the theory that oth- erwise the copyright license would be of no value. What good, they say, is software that can be copied but not used?

Such a conclusion is not based on the law of licenses. Indeed, a bare license of copyright need not include a bare license of patent at all. It is only if the BSD is viewed as a contract that we can introduce contract law principles such as reliance or reasonable expectations of the parties. If software is licensed under the BSD without forming a contract between licensor and licensee, the extent of any patent grant is at best ambiguous.

As to whether an implied grant of patent rights extends to versions of the software with modifications, that's an even more complicated question. The BSD license is silent about a patent license for derivative works. So if a licensee improves the origi- nal Berkeley Software Distribution in a way that infringes a patent owned by the University of California, there is no easy way of knowing whether an implied BSD patent license includes a patent license for that improvement.

Since courts are likely to construe implied grants of license narrowly, a licensee should consider obtaining separately from the licensor an explicit grant of patent rights that might be needed for modified versions of BSD- licensed software._

      http://rosenlaw.com/wp-content/uploads/Academic-Licenses.pdf

<comment><USER9> ""I'm not sure it is, and I'd argue the situation is unclear."

I wouldn't. What you've quoted is Larry Rosen's view. Larry is a wonderful guy, but his views are pretty far outside the norm for open source lawyers.

To start "If software is licensed under the BSD without forming a contract between licensor and licensee, the extent of any patent grant is at best ambiguous."

This is now settled since he wrote this. It is in fact a contract, that, if breached, leaves the licensor without a copyright license (causing both infringement of copyright and breach of contract).

So you don't have to worry about this.

The latter is a real issue, but one that most explicit grants don't solve either.

In particular, apache/et al have explicit grants do _not_ cover modifications by others that suddenly encompass patents.

So you aren't any better off there either :)

</comment></comment></comment></comment><comment><USER10> Pardon my ignorance, but isn't this just equivalent to Apache's patent retaliation clause?[0][1]

[0] [http://en.swpat.org/wiki/Patent_clauses_in_software_licences...](http://en.swpat.org/wiki/Patent_clauses_in_software_licences#Apache_License_2.0)

[1] [http://en.wikipedia.org/wiki/Software_patents_and_free_softw...](http://en.wikipedia.org/wiki/Software_patents_and_free_software#Patent_retaliation)

<comment><USER11> The events that trigger Apache License 2.0 patent termination are much narrower: "If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed."

<comment><USER12> Yeah, Apache is a little more giving in actual terms, but it's a similar deal.

</comment></comment></comment><comment><USER13> Discussion: [https://news.ycombinator.com/item?id=8985541](https://news.ycombinator.com/item?id=8985541)

<comment><USER14> Also here, which IMHO is more informative:

[https://news.ycombinator.com/item?id=8901357](https://news.ycombinator.com/item?id=8901357)

<comment><USER15> Yeah, this discussion points out an important point that it's easy to miss if you scan Facebook's patent grant: The license Facebook grants you is invalidated by _any action_ that even alleges that _any_ of Facebook's patents is invalid.

E.g. if you so much as Tweet that one of Facebook's patents, even one entirely unrelated to React, is invalid, you've lost your license.

Compare this with the patent grant in the Apache license, as used in a library like Angular: [https://github.com/angular/angular/blob/master/LICENSE](https://github.com/angular/angular/blob/master/LICENSE)

Here the license is only terminated in the event that you institute litigation alleging patent infringement by the software itself. You're still free to challenge shitty patents and call out companies about them. Not so with Facebook's license.

<comment><USER16> No. In context it refers to "filing any ... action." Lawsuits and similar procedures in other legal forums are often called actions. Think the movie called A Civil Action staring John Travolta about a civil lawsuit. The concern here is not how it is triggered (it must be by a lawsuit or something similar) but rather the balance of power it provides if you get into a war with Facebook, since you cannot undo having used their software.

<comment><USER14> In DannyBee's original post, he says that the key words there are "for anyone that makes any claim (including by filing any lawsuit, assertion or other action)", and that by including the words for "assertion or other action", it encompasses claims outside of a court of law. A post on Hacker News or a tweet on Twitter is an assertion, and so would fall under this. Otherwise why include that language?

IANAL, but he is, and this is his area of expertise (IIRC he runs the open- source program for Google).

</comment></comment></comment></comment></comment><comment><USER17> IANAL, but shouldn't you be more concerned about open source projects which _don 't_ grant you patent rights required to use the software?

<comment><USER18> Do [m|]any open source projects hold patents?

</comment></comment><comment><USER6> Of course it is – you've got this back to front. The grant of additional rights to use any patent Facebook may hold is an additional benefit and in no way places any restriction on you.

If you're going to worry about anything, worry about the squillions of open- source projects that _don 't_ include any patent grants. But you probably shouldn't worry about that either.

<comment> vertex-four Most open-source projects' owners and contributors don't have any patents to enforce, thus can't grant anything. The rest tend to be less chilling than the clause that Facebook uses - there's no "we'll only grant you this if you promise never to mention that any of our patents might be invalid".

Are you certain that Facebook doesn't have any patents that cover any of its open-source software?

</comment></comment><comment><USER19> The best way to stay safe from software patents is to not enter the US market, if you can afford that :)

</comment><comment><USER20> Hmm, interesting. The grant of rights looks as though it's designed to build a defense against patent claims against Facebook. Get everyone using their stuff, and anyone who does will find it quite difficult to challenge Facebook patents.

</comment><comment><USER21> It is safer than using SW without those "Additional Grant of Patent Rights". They explictly state that you can use it, other didn't make the effort to check for patents, or simply can screw you later.

</comment><comment><USER22> IANAL, but does this just mean that you can use and amend _their work_ , but you can't create the same basic thing from scratch and claim that you created it?

</comment><comment><USER23> other than a) (ii) of that PATENTS file, it's way better than I thought it would be. Unless I'm reading it wrong, I'm losing my right to use the package if I publicly state that someone is misusing Facebook's software.

</comment><comment><USER24> It all boils down to the license - open source means jack all.</comment>


Where 3000MPG+ Cars Come to Compete: The Ecomarathon - <AUTHOR> http://hackaday.com/2015/04/15/where-3000mpg-cars-come-to-compete-the-ecomarathon/

<comment><USER2> I think it's pretty awesome the group of mech engineers still came in 11th despite the requirement to design your own controller. Cross-discipline challenges like this are great way to build skills.</comment>


AngularStrap gets rewritten - AngularJS 1.2+ native directives for Bootstrap 3 - <AUTHOR> http://mgcrea.github.io/angular-strap/?v2

<comment><USER2> Interesting, how is it different from another (probably more popular) project angular-ui.github.io/bootstrap/. From a quick glance of the code, looks like you have view hardcoded to the js [0]. Is it consider a good practice? Since it'll be loaded regardless if user is going to overwrite it, and increase the size of the js.

Good work, can't wait to see more high quality angular projects.

[0]: [https://github.com/mgcrea/angular- strap/blob/master/src/drop...](https://github.com/mgcrea/angular- strap/blob/master/src/dropdown/dropdown.js#L7)

<comment><AUTHOR> Author here, it would end up hardcoded anyway as it must be pre-loaded for performance reason.

But indeed, it could be compiled in a separate file to reduce the payload in case you don't use base templates, but at the cost of an extra http request, not sur the trade-of would be worth it.

I may add other build configurations at a later date, but for the sake of simplicity, I think it's best as it is for now.

</comment></comment><comment><USER3> I can't see support for collapse anywhere. It is in bootstrap.js and ui- bootstrap. Handy for responsive navbars amongst other things.

<comment><AUTHOR> Not really fond of Bootstrap's collapsing system, but there is a pending issue regarding this, so I might tackle it very soon.

</comment></comment><comment><USER4> This is awesome! Saves me from the trouble of writing the directives myself.

</comment><comment><USER5> awesome this is great news. The jQuery and Twitter js libs kept me from using it in the past, cant wait to update some of my projects with it.</comment>


Ask HN: Why is there a black bar added on top? - <AUTHOR> Why has the black bar been added on top of the title bar ?
http://i.imgur.com/O8FU6km.png <comment><USER2> To all people saying "We should add some link to the news because I don't know who Andy Grove was". C'mon, this is the community of people who don't need to have everything delivered on the silver plate - either you know, or you spend a while and find out by yourself. That's something we do every day.

<comment><USER3> Except it COULD have been a black bar for Brussels.

In fact I've just arbitrarily decided that it is, because there is no official word either way. If I go off and do research into what happened today Brussels makes just as much or as little sense as Andy Grove. Both are on the front page.

Anyone who disagrees needs to show me why it is an Andy Grove bar instead of a Brussels bar? And, yes, I am intentionally being obstinate to make a point.

<comment><USER4> I noticed it on here last night (ET) between news of Grove's death and the Brussels bombing. Not trying to be pedantic, but it definitely seems to be in honor of Andy Grove.

<comment><USER5> I didn't. I got to work this morning and saw it. It easily could have been either.

</comment></comment></comment></comment><comment><USER6> @hn, since it's not the first time this question pops up, for increased "discoverability", what about making the black bar a <a> that links to the associated news? This, or pushing it even forwards, adding text?

<comment><USER7> I think that would take away a lot more than it adds. There's something poignant about a simple, unadorned 5px #000000 line. The lack of text or a link sends the message, "This person was significant enough that HN readers already know who it was, and why their life was so important."

It's like flying a flag at half-mast; you don't attach a sign with the person's name.

<comment><USER8> I visit HN every day and I am either dumb or missed something but I had no idea why the black bar was at the top. I assumed it was an error.

Unless you know what it is, it's really not obvious at all. A flag at half- mast is a commonly known thing, someone important died. A 5 pixel black bar at the top of a site is not used anywhere but here.

<comment><USER7> C'mon, "no idea"? There are three mentions of Andy Grove on the front page right now, and there's been at least one the entire time that the bar's been up.

<comment><USER8> I can assume lots of things raldi. I could also assume it's because of Brussels, but I would be wrong. I could assume it's because of a mudslid, still wrong.

Regardless of what you say it's not obvious... If it was there wouldn't be this thread.

<comment><USER9> I initially assumed the bar was for Brussels as well until reading further and then felt a bit silly.

I am aware of what the black bar represents however it is not always consistently used. for example, Ian Murdock who I consider to have a great impact on GNU/Linux in general was not given one after his passing.

<comment><USER10> I definitely believe Ian Murdock was deserving of a black bar as well. Debian is one of the most widely used Linux distributions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> It's displayed as a sign of respect following the passing of important tech luminaries.

In this case Andy Grove - one of the fathers of Silicon Valley.

May he rest in peace.

</comment><comment><USER12> Is it possible that in the future, the element alt text could contain some short explanation or information? For example, "Andy Grove, Semiconductor Industry pioneer passes away at 79."

</comment><comment><USER13> I wasn't sure if it was for Brussels or Andy Grove.

</comment><comment><USER14> I had the same question yesterday (saw it previously and thought it was a styling issue or maintenance mode etc). It would be nice to have a tooltip on hover to tell people what it's about. Good way to pay tribute.

</comment><comment><USER15> It's a bit surprising that so many people just don't search when they see something they don't understand.

EDIT: just putting [black bar] into the search box tells you why the black bar is there. Sorting by date tells you who died.

<comment><USER16> I think most of us just assumed it was a bad design change. I don't normally search every time a website makes a bad design decision, just in case it has secret and very obscure meaning.

<comment><USER15> I perhaps should have said "it surprises me when people make a post before searching".

<comment><USER17> You must be new? (To the Internet, humanity, etc)

</comment></comment></comment></comment><comment><USER18> [https://news.ycombinator.com/item?id=11333402](https://news.ycombinator.com/item?id=11333402)

<comment><AUTHOR> Oh ....

</comment></comment><comment><USER19> When someone dies that they believe worthy, they do the black bar thing.

</comment><comment><USER20> I thought this was about the brussels attack...

</comment><comment><USER16> It's especially meaningless for those of us who use Hacker Vision.

[http://i.imgur.com/c81G9a6.png](http://i.imgur.com/c81G9a6.png)

</comment><comment><USER21> I didn't even notice the black bar until I read this post. Maybe something a little more distinctive would be useful, maybe.

</comment><comment><USER22> Probably related to the same change that brought the black bar, but the Chrome extension I use to add collapsible comment threads is now broken.

Can we __please __get native collapsible threads here?

edit: Also I just attempted to use an emoji for the first time here, and it was stripped. ????

edit2: I thought it was a simple design update, had no idea it was a tribute. RIP Andy Grove.

</comment><comment><USER23> I was equally as confused recently, until someone (quite bluntly...) pointed it out to me on Twitter.

</comment><comment><USER24> Well, it would be simple to read the page looking at entries containing 'passed away', 'died', 'killed', etc

(It's usually one of the first as well)

<comment><USER25> Even so, the connection isn't in any way made clear. Your assumption that if people saw that Andy Grove died they would immediately identify the black bar as a sign of mourning is kind of, I dunno, culturally normative?

<comment><USER24> The site is in English, is based in the US and contains mostly news from certain regions of the world, of course it's going to be culturally biased

I agree an association would be helpful (is it for Andy Grove or for Belgium, for example)

But it is not hard to find the association

<comment><USER26> Whatever happened to "We exist without skin color, without nationality" and "Cyberspace does not lie within your borders"?

<comment><USER24> The site is accessible everywhere, but to expect it not to cater to a specific audience is disingenuous

</comment></comment></comment></comment></comment><comment><USER27> This gets asked every time the black bar happens.

</comment><comment><USER28> .mourning { border-top: 5px solid rgb(0, 0, 0); }

</comment><comment><USER29> Princeton's colors are black and orange.

</comment><comment><USER30> The black bar is nice and geeky but totally inappropriate to mark the passing of a human being.

<comment><USER31> I'm curious why you think it is inappropriate. I find it very tasteful.

<comment><USER30> To me it just feels rather curt. I suppose it saves the effort of trying to write something meaningful.</comment></comment></comment>


FedEx bandwidth (XKCD What-If?) - <AUTHOR> http://what-if.xkcd.com/31/

<comment><USER2> What this calculation fails to take into account is that when you transfer data over the wire it usually lands in the place where it's needed to be. This wouldn't be the case if you still have to read data from fedex'd drives and copy it to their appropriate locations, which should take additional time.

</comment><comment><USER3> Impact on the environment?</comment>


Asking for feedback on an idea: scatter storage across home computers - <AUTHOR>

Could this idea work?  Maybe someone has built it already?
The idea is that you run a storage server application on your home computer.
You get paid for storing blocks of data which are encrypted.
The more reliable and fast your server is, the higher you get paid.
Customer of the system submit a file to be stored which gets broken into blocks and stored across many home storage servers.  Customers can choose the amount of redundancy required -i.e. a block gets stored on 20 different servers across the world.  More redundancy costs more.
Any thoughts on whether this sort of thing might be practical? <comment><USER2> Yes, this was a popular topic of discussion around 2001. The net result is that your home computer is so unreliable and has such little bandwidth that its spare resources are worth zero. Specifically, repairing data lost due to churn can easily consume all available bandwidth.

[http://www.slideshare.net/emery/tfs-a-transparent-file- syste...](http://www.slideshare.net/emery/tfs-a-transparent-file-system-for- contributory-storage-124607) (especially slides 21-23)

<http://www.cs.umass.edu/~emery/pubs/TFS.pdf>

<http://tahoe-lafs.org/trac/tahoe-lafs>

<comment><AUTHOR> 10 years down the track are things the same?

<comment><USER3> Worse. Systems are more likely to have an always-on connection than they were ten years ago, but the amount of upstream bandwidth has not increased proportional to the amount of data that users wish to store. Integrity checking and replication will eat you alive. The best place for you to start is the following paper from 2003 (check CiteSeer):

High Availability, Scalable Storage, Dynamic Peer Networks: Pick Two

If you can't figure out a way to get around the problems outlined in this paper then do not waste your time. A built-in incentive/payment system is _not_ going to solve the problems you think it will and is really the start of another "and now you have two problems" koan. Trust me on this one...

<comment><USER3> BTW, the answer to your "Maybe someone has built it already?" question is that it was called Mojo Nation and as enticing as the concept may appear, it won't work. MN does live on as the progenitor of BitTorrent and Tahoe-LAFS, but the core idea of persistent, secure peer-to-peer storage across a dynamic peer group is a fools errand.

</comment></comment></comment></comment><comment><USER4> There are free systems that do this such as -

<http://freenetproject.org/>

<http://oceanstore.cs.berkeley.edu/info/overview.html>

</comment><comment><USER5> Check out CrashPlan: <http://www.crashplan.com>

<comment><USER3> CrashPlan has a friend-net mode, but this is an entirely different kettle of fish than a truly dynamic peer network.</comment></comment>


Open Hardware Pushes GPU Computing Envelope - <AUTHOR> https://www.nextplatform.com/2017/03/17/open-hardware-pushes-gpu-computing-envelope/?adbsc=social_20170320_70931886&adbid=843906722003533825&adbpl=tw&adbpr=92598387 <comment><USER2> I'm wondering if an application like Deep Learning would require a fast interconnect network between GPUs. Without this requirement, upscaling would be much simpler, I suppose.

<comment><USER3> I think this is an area where Intel is sort of mucking things up for everyone.

Because of licensing issues, we'll never see a modern version of the nForce/XBox design where the CPU and GPU share relatively fast RAM via a common MMU from Intel/NVidia.

The best we can hope for future shared RAM designs are Zen/Radeon (or a new HyperTransport), Intel/Knights Landing, or an ARM/NVidia solution.

But I'm surprised NVidia doesn't make something like a Tegra on steroids for this application. Basically an ARM running its own Linux, a 10GigE ethernet port, and a Titan/1080Ti, all in a single blade/PCI-E card. I guess the market demand isn't there yet.

edit: Looks like the Drive PX2 is more or less what I'm talking about but meant for cars, so the market demand is there: [http://wccftech.com/nvidia- pascal-gpu-drive-px-2/](http://wccftech.com/nvidia-pascal-gpu-drive-px-2/)

<comment><USER4> [https://www.nextplatform.com/2017/02/28/amd-researchers- eye-...](https://www.nextplatform.com/2017/02/28/amd-researchers-eye-apus- exascale/)

AMD Research, the research division of the chip maker, recently took a look at using accelerated processing units (APUs, AMD's name for processors with integrated CPUs and GPUs) combined with multiple memory technologies, advanced power-management techniques, and an architecture leveraging what they call "chiplets" to create a compute building block called the Exascale Node Architecture (ENA) that would form the foundation for a high performing and highly efficient exascale-capable system.</comment></comment></comment>