The Death and Life of the 13-Month Calendar - <AUTHOR> https://www.citylab.com/life/2014/12/the-world-almost-had-a-13-month-calendar/383610/ <comment><USER2> In grade school I would hold out for about a month after the switch to Daylight Savings Time: anytime somebody asked me for the time, I would provide it with an hour offset to what they were expecting, and when they quoted a time in their system, I was vocal about correcting it to the original time zone.

Somehow I was the nuisance for doing this, even though I think it's quite clear that _they_ were the ones making time-keeping more difficult here - everything was working out just fine until they decided to change the meaning of 2pm for half of the year.

If we've somehow got an entire society that can play gymnastics with time in this way, and claim to wrap their head around it, I don't think changing the calendar is really a huge ask. But I think the only way to pull it off is for the government to mandate its use. There's just not enough interest in fighting the currents for this to reach critical mass otherwise.

That said, I'm not convinced of the value of this calendar. Months are constructs that don't have much meaning, but so are weeks - we could ax them both and just quote dates in terms of the numerical day within the year, for example. Or we could keep around weeks, but divide the year into quarters instead of months — that seems the most business friendly thing, and people already tend to think of the year in terms of four seasons outside of business; I wonder if Kodak considered it. Or, we could keep around the idea of weeks but rearrange them to be 10 days long to better fit with our decimal number system (7 days on, 3 days off? I might be amenable to that).

I guess months are valuable for businesses which provide long-term services and bill by the month, like ISPs or credit cards. But I'm hesitant to rebuild our time system to suit a business use-case that's particularly widespread _today_ without some plan on how to easily change it when it no longer is useful. DST was founded in a similar way, and now we're stuck with it for way longer than it ever made sense to keep it around.

<comment><USER3> _> If we've somehow got an entire society that can play gymnastics with time in this way, and claim to wrap their head around it, I don't think changing the calendar is really a huge ask. But I think the only way to pull it off is for the government to mandate its use. There's just not enough interest in fighting the currents for this to reach critical mass otherwise._

While we're at it let's convert to the Metric System too. Rip all the bandaids off at once.

<comment><USER4> How about the metric time system?

1 day = 10 hours

1 hour = 10 minutes

1 minute = 10 second minutes

1 second minute = 10 third minutes

Or should it scale at 1:100? Why or why not?

<comment><USER5> I built and android app just like this that marks ten hours, ten minutes, ten seconds and ten ticks being each tick 0.864 ancient seconds. Midnight starts at 000 and noon at 500.

<comment><USER4> Link?

<comment><USER6> Not the original poster, but I have decimal time as part of my (free) Android French Revolutionary Calendar app.

[https://play.google.com/store/apps/details?id=com.ttaxus.the...](https://play.google.com/store/apps/details?id=com.ttaxus.thermidor)

or the source [https://github.com/jhbadger/Thermidor- Android](https://github.com/jhbadger/Thermidor-Android)

</comment></comment></comment></comment></comment></comment><comment><USER5> I wonder why we haven't thought of a decimal calendar synced with the seasons like:

              W1 W2 W3 W4 W5 W6 W7 W8 W9
        SPR 1 10 10 10 10 10 10 10 10 10
        SUM 1 10 10 10 10 10 10 10 10 10
        AUT 1 10 10 10 10 10 10 10 10 10
        WIN 1 10 10 10 10 10 10 10 10 10 1 [1]

So we only have four months (seasons) and each has nine weeks of ten days each. Each season starts with a neutral day (equinox and solstice) then follow the weeks with ten days each. At the end of the year there is a universal holiday and an extra holiday for leap year.

We could also name all days of the week after the eight planets and the sun as initially intended (including moonday). We could have seven working days and three days off or three working days then two off then three more working days then two off per week.

Whatever, just wanted to leave a stinky brainfart in this room for posterity.

<comment><USER7> A season-based calendar, The World Season Calendar, was proposed by Isaac Asimov.

It consisted of four seasons, named A, B, C, and D, corresponding to Winter/Spring/Summer/Autumn in the Northern Hemisphere and Summer/Autumn/Winter/Spring in the Southern Hemisphere.

Each season looked like this:

      Sun Mon Tue Wed Thu Fri Sat
       01  02  03  04  05  06  07
       08  09  10  11  12  13  14
       ...
       85  86  87  88  89  90  91

That gives 91 x 4 = 364 days.

An extra day, called Year Day, occurs between D 91 and A 01 of the next year, and is not part of the 7 day week cycle. In leap years another extra day, also outside the week cycle, called Leap Day is added between B 91 and C 01.

</comment></comment><comment><USER8> I like this idea. The novelty of "what day is holiday X this year" has long worn off.

Also found weird the author goes to so much trouble to explain then insults it in the last sentence.

</comment><comment><USER9> The transition would be painful, but it would make so much stuff easier that we should just do it.

We would end up doing away with calendars. You would just know that the 16th is a monday.

<comment><USER10> Yeah, there's a bunch of stuff we should do to make things better in the long term. Unfortunately we seem to be stuck with short term thinking and can't even manage to transition away from daylight savings or imperial units or the penny...

</comment></comment><comment><USER11> This calendar would cause the seven-day week to get out of sync. I was curious about this some time back and couldn't find an exact history, but it certainly _seems_ like the seven-day cycle has been maintained continuously for millennia - probably dating from Babylonian and early Jewish practice, then spreading to Europe via Christianity, without skipping/adjustments. The shift to the Gregorian calendar, for instance, removed days but kept the cycle of weekdays - in continental Europe, 4 October 1582, a Thursday, was followed by 15 October 1582, a Friday.

Wouldn't this proposal cause nations that adopt it to shift their weekdays from nations (and religions) that don't, at the rate of one a year?

<comment><USER12> We already have leap years that add a day. The months have different lengths, so the days of the week fall on different dates all the time. More like it's always been out of sync, and this would bring it _into_ sync.

<comment><USER11> Yes - it would bring a lot of things into sync, but the tradeoff is that you wouldn't be guaranteed that seven days after a Monday is another Monday. That is true and has been true since before the Julian calendar even existed, as far as I can tell.

<comment><USER13> Strict 7-day weeks were a Jewish thing from sometime before 500 BC, unrelated to the Roman calendar. Even in other cultures that split time into weeks based on lunar phases, weeks were adjusted to match the moon (a lunar week is ~7.4 days).

From what I understand the Romans didn't adopt a 7-day week as a core part of the calendar until after the emperor had converted to Christianity. See [https://en.wikipedia.org/wiki/Nundinae](https://en.wikipedia.org/wiki/Nundinae)

</comment></comment></comment></comment><comment><USER14> I'm torn between preferring this (13x28+1) or a Coptic/Ethiopian calendar (12*30+5). Having each week start on the same day of the week is nice, but 12 months has advantages, too, and at least the first day of each month is consistent from year to year.

<comment><USER13> The Maya had 18 20-day months plus a 5-day intercalendary period.

</comment></comment><comment><USER15> A bit of a thought experiment: Do we really need years? In the past a calendar based on how long it took to make an orbit around the sun was useful for agricultural and other planning. Now we could have a 500 day cycle if we wanted to for some reason. Or maybe a hundred day cycle. Our ability to plant crops wouldn't be effected. There are many more variables involved now in determining when to plant or harvest than the Earth sitting at roughly the same spot as the last planting or harvest time. The Islamic calendar has long be out of sync with the solar calendar but still holds importance in Islamic culture. I'm sure there are others that likewise don't strictly abide by the solar year.

Instead of having a celebration on the day that the Earth is roughly in the same place in its orbit around the sun as it was when you were born, why not celebrate in increments of thousands of days you've been alive? Maybe broken down into once every hundred day celebrations before hitting the 5000 day celebration so children will experience them more often? I understand that some countries have a "Name Day" for the different common names in their culture, which is a celebration on par as one's birthday. We are very use to anchoring things to the orbital position on the Earth relative to the sun but we no longer live in a time where such things are of primary importance.

And don't even get me started on the possibilities of alternates to the primary school system being divided up into thirteen grades. Could each six week grading period (or a grading period of some other length) be its own grade? Do we really need to have so much of our culture and society tied so closely to the agricultural needs of the past?

<comment><USER16> Actually I think we do need years. It is kind of nice to know that the snowy season is typically dec-feb. That the warm summer months are July and August. And so on. Without having to do some mental arithmetic

<comment><USER17> Yes I think this is true.

I'm curious how future humans will relate.

You could imagine an intergalactic mission in which the calendar was kept as a keepsake from earth.

And if a new planet is colonized, would we work to stay in sync with earth in some way? Keep the same basic names but morph them?

What happens when two different civilizations meet with different calendars (we have some historical data on that).

<comment><USER18> if you're talking intergalactic, you have relativistic time shearing effects to deal with as well.

</comment></comment></comment></comment><comment><USER19> > A month is a wholly irrational division of time. It has no relation to > anything in astronomy, ...

Well, except for its name. And its basis in the phases of the Moon.

[https://www.etymonline.com/word/Month](https://www.etymonline.com/word/Month)

</comment><comment><USER20> A year or two ago I wrote a thing to generate up to date versions of these calendars based on the design of the 1928 Kodak one. [https://github.com/dzucconi/a-month- is/blob/master/app/javas...](https://github.com/dzucconi/a-month- is/blob/master/app/javascripts/index.js) & [http://work.damonzucconi.com/a-month- is/?year=2018](http://work.damonzucconi.com/a-month-is/?year=2018) (can change the year with the query parameter)

</comment><comment><USER21> I love the idea, but in all honesty it would be a real problem making the week start on Sunday.

In all countries I've been but the States the week starts on Monday, not Sunday.

</comment><comment><USER22> I love the logic behind it... although I guess quarterly planning would get a little annoying, since 13 isn't divisible by 4 or _any_ number.

You have Jan 1 - Apr 7, Apr 8 - Sol 14, Sol 15 - Sep 21, and Sep 22 - Dec 28 (+ year day). Not the end of the world... but not exactly elegant either.

<comment><USER23> Planned month for paying down technical debt.

</comment></comment><comment><USER24> In my office, we run out projects based on calendar weeks. I keep thinking why can't we take this idea to the general public. It would make life a little bit simpler without having to bother about months and its irregular amount of days.

</comment><comment><USER25> If this is what it will take to impose a 4-day work week then sign me up. :)

</comment><comment><USER26> Explanation in the style of cpggrey [https://www.youtube.com/watch?v=57G1Q8BW6Mw](https://www.youtube.com/watch?v=57G1Q8BW6Mw)

</comment><comment><USER27> Maybe I missed it in the article, do the four seasons start the same time every year? I assume they are adjusted, especially with Sol coming in the middle of Summer.

<comment><USER28> It's a 365-day calendar with the same leap-year rules as the Gregorian calendar, so yes, it should stay synchronized to the seasons.

</comment></comment><comment><USER29> I'm all for ditching the superficial Gregorian calendar, but do we really need inventing new one from scratch? There's plenty of calendars out there, just pick one.

<comment><USER30> Not actually in favor of ditching the Gregorian calendar, but if you're going to do it, this isn't the worst proposal I've ever seen and at least one (formerly) major US corporation was able to make it work for them internally for just over 60 years. It wouldn't make a difference if the calendar was from 1902 AD or 1902 BC as long as it could work for society. They're all pretty much made up. You draw some lines in the sand till you have a calendar, denominate a few standard units of time labeling some of them with the names of the gods or Kings or Emperors or whoever and count upwards from there.

My only problem with making the switch to any different calendar is no matter how uniform or predictable, you're breaking something that works pretty decently well to replace it with something that might be different, but probably isn't actually better.

A calendar is a calendar is a calendar. We've gotten pretty good as a society, as a civilization, marking time on the Gregorian calendar, ticking off holidays and making plans around our availability. A change like this would benefit a small number of people at a large up front cost to society, and the supposed benefits for the masses at large ring more as superficial justifications to get this imposed by the government than any kind of genuine benefit.

</comment></comment><comment><USER31> lousy Smarch weather

</comment><comment><USER32> Year-day would be the day when all computers stop. Truly an exceptional day!</comment>


Neural Algorithms and Computing Beyond Moore's Law - <AUTHOR> https://cacm.acm.org/magazines/2019/4/235577-neural-algorithms-and-computing-beyond-moores-law/fulltext <comment><USER2> It's an interesting point of view, for sure.

> There are cases of non-neural computer vision algorithms based on Bayesian > inference principles,22 though it has been challenging to develop such > models that can be trained as easily as deep learning networks.

Maybe. The paper he cites, "Human-level concept learning through probabilistic program induction," has like "On a challenging one-shot classification task, the model achieves human-level performance while outperforming recent deep learning approaches" right in its abstract. One shot sounds like exactly the meaning of easy to train.

Maybe he meant _accelerated_ training, but that kind of gets to the core of what's flawed about this analysis. There's no economic incentive to build specialized, accelerated hardware for one of Tenenbaum's research projects, until there _is_. There's enormous economic incentive to build video cards for games, which is what all those deep learning advances were predicated on, and it remains to be seen if there's any economic incentive for TPUs or whatever specialized hardware he's imagining, of whatever architecture.

Looking at computing architectures, like CPUs versus GPUs, the way he does is a post-hoc analysis, and nobody except those deep in the research community and paying attention to NVIDIA papers could have anticipated how GPUs would have affected research.

There isn't, and there is, an architectural difference between CPUs and GPUs that matter. He's sort of picking and choosing which architectural differences matter in a way that favor R&D that he conceded has problems with "falsifiability."

If anything, we need better, cheaper CPUs still! They're still very useful for R&D. I'd rather get a slow supercomputer built today than a nothing built tomorrow, if Tenenbaum is telling me he's chasing something now and needs it now.

Conversely, why should we listen to R&D people about problems that are fundamentally economically motivated? It would be a bad bet. We're getting low power CPUs now not because the world is "data oriented" or whatever he's saying, but because the iPhone is so fucking popular there's immense demand for it. Ask Paul Otellini, an expert on the CPU business, what he thinks about that! So maybe we should actually be doubling down on the needs of consumer electronics manufacturers?

</comment><comment><AUTHOR> So if I had to write a tl;dr I would say that there are two economic incentives for neuromorphic computing:

1\. Energy efficiency: More brain-like computers will eventually an energy efficiency comparable to the human brain. Consider that AlphaGo Zero used ~200 KiloWatts for learning Go vs. a human that uses about ~20 Watts for learning everything that humans can learn.

2\. AI & Neuroscience research: What better way to test neuroscience theory than to physically build a brain? As the saying goes, if you can't build you don't understand it.

<comment><USER3> >Consider that AlphaGo Zero used ~200 KiloWatts for learning Go vs. a human that uses about ~20 Watts

Maybe not the best example since to have any chance at all of taking even a single game off of AlphaGo Zero a human would need to study go for at least a decade.

Another big advantage the machine has here is that the result of the AlphaGo Zero training can be deployed to as many go-playing computers as you like with no additional training.

<comment><USER4> Point but that 20 Watt brain can learn a little more than one game.

<comment><USER5> HW that runs AlphaGo Zero code is a general purpose computer, so it can learn anything given the right software.</comment></comment></comment></comment>


Incrementable length values in text fields - <AUTHOR> http://leaverou.me/2011/02/incrementable-length-values-in-text-fields/

<comment><AUTHOR> This is rather odd. Not sure what I think about it. I've never seen anything like it. What do you guys think? Maybe useful in apps made for techies?</comment>


WhatsApp voice calls were used to inject spyware on phones - <AUTHOR> https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab <comment><USER2> Interesting!

Google's Project Zero team investigated WhatsApp's and Facetime's video conferencing last year:

"Overall, WhatsApp signalling seemed like a promising attack surface, but we did not find any vulnerabilities in it. There were two areas where we were able to extend the attack surface beyond what is used in the basic call flow. _First, it was possible to send signalling messages that should only be sent after a call is answered before the call is answered, and they were processed by the receiving device_. Second, it was possible for a peer to send voip_options JSON to another device. WhatsApp could reduce the attack surface of signalling by removing these capabilities."

"Using this setup, I was able to fuzz FaceTime calls and reproduce the crashes. I reported three CVEs in FaceTime based on this work."

WhatsApp: [https://googleprojectzero.blogspot.com/2018/12/adventures- in...](https://googleprojectzero.blogspot.com/2018/12/adventures-in-video- conferencing-part-4.html)

Facetime: [https://googleprojectzero.blogspot.com/2018/12/adventures- in...](https://googleprojectzero.blogspot.com/2018/12/adventures-in-video- conferencing-part-2.html)

In both cases, the close source nature of the applications stymied their efforts. Looks like NSO was willing to spend more time and resources!

<comment><USER3> _In both cases, the close source nature of the applications stymied their efforts._

Why do you say that? In the WhatsApp case, they were able to repeatedly modify the code and also yank it out and run it in their own controlled environment, etc.

<comment><USER4> From my experience, working with real source from the repo with comments etc is very different than working with reverse engineered binaries.

That's probably what they're referring to.

<comment><USER3> The post says "the close[d] source nature of the applications stymied their efforts" not "finding security bugs is harder than not-finding security bugs". I didn't read anything in the linked post that supports the former statement, the latter one (or variants) seems obvious.

</comment></comment></comment></comment><comment><USER5> It's not just the NSO group. Hacking Team is not exactly shy about the services they offer.

[https://en.wikipedia.org/wiki/Hacking_Team](https://en.wikipedia.org/wiki/Hacking_Team)

FinFisher: [https://en.wikipedia.org/wiki/FinFisher](https://en.wikipedia.org/wiki/FinFisher)

MiniPanzer: [https://en.wikipedia.org/wiki/MiniPanzer_and_MegaPanzer](https://en.wikipedia.org/wiki/MiniPanzer_and_MegaPanzer)

<comment><USER6> Wow! I had no idea there was a whole industry selling spyware to dictatorships. Surveillance equipment, yes, but not actual hacking tools. Really sickening. Must be why governments in Europe are so afraid of Huawei building 5G networks - they will only run Chinese spyware.

<comment><USER7> Huawei's equipment will almost assuredly run anyone's spyware. Huawei uses a medley of ancient, highly vulnerable OpenSSL libraries sprinkled through their basestation code, and apparently they've forgone any kind of version control to ensure an optimally confusing work environment for their development teams: [https://hmgstrategy.com/resource- center/articles/2019/04/04/...](https://hmgstrategy.com/resource- center/articles/2019/04/04/uk-flunks-huawei)

Frankly, these products are likely unmaintainable long term without a total refactoring of the codebase, nevermind the abject lack of security.

The trick with these vendors is the codebase will never see serious improvement, as these basestations aren't going to be sold for the next decade, so Huawei will do the bare minimum and shelve support in short order.

<comment><USER8> Huawei's software development practices seem quite horrifying. Critical systems like these ideally would be written in specially-designed programming languages that support mathematically proving correctness (Coq comes to mind). There's probably still room in the programming language design field to create new languages that are user-friendly but also integrate Coq-like systems plus other verifiability and correctness techniques into the language itself.

<comment><USER9> If you find that horrifying, don't look at Cisco CVEs ;)

<comment><USER7> Or Juniper's constant flow of new CVEs, they are a popular alternative to Cisco that many ISPs use heavily :P

Network security is piss poor, most of these vendors add vulnerabilties atop secure distros (OpenWRT, Debian, etc) and flog it as the best thing since sliced bread.

</comment></comment></comment></comment></comment></comment><comment><USER10> [http://archive.is/kDz13](http://archive.is/kDz13)

<comment><USER11> 184.108.40.206 mirror: [https://archivecaslytosk.onion.pet/kDz13](https://archivecaslytosk.onion.pet/kDz13)

</comment></comment><comment><USER12> Non-paywalled article on this: [https://9to5mac.com/2019/05/13/whatsapp- vulnerability-israel...](https://9to5mac.com/2019/05/13/whatsapp- vulnerability-israeli-spyware/)

<comment><USER13> Also BBC one: [https://www.bbc.co.uk/news/technology-48262681](https://www.bbc.co.uk/news/technology-48262681)

</comment></comment><comment><USER14> I guess these types of vulnerabilities could be placed intentionally. It would allow certain agencies to again access via "exploit" and all the while claim they support user privacy. These companies are under pressure from governments (like the recent Australian government law to requiring access to encrypted messages). Seems like a decent solution for company and governments.

<comment><USER15> It's not a decent solution, because it doesn't take much to find these vulnerabilities, just a matter of time.

<comment><USER16> But time is enough. New bugs can be introduced with the next update.

<comment><USER15> The update can be analyzed to see what was changed, even if we only have the binary executable. If we know that an app contains intentional bugs, just looking at where the update made changes could eliminate a lot of looking & find the bugs even faster! There are many automated tools that can do this too, eg. Fuzzing. The updates can also hint us where the previous bug was and what to look out for in the future.

So, nope. Introducing security bugs and backdoors just makes it insecure for everyone.

<comment><USER17> Oh, so you are reverse engineering and thoroughly analyzing every WhatsApp update? That's reassuring. Cause otherwise I'd have said nobody does this on a regular basis which would mean it still is a viable method.

<comment><USER18> Their is an entire industry that either is already or definitely would be doing this if there were deliberate bugs in Apps.

<comment><USER19> There is, and there are.

</comment></comment></comment></comment></comment></comment></comment><comment> ezequiel-garzon It seems to me that if this is possible an OS software upgrade of some sort is urgently required, in addition to possible updates of WhatsApp. How come there isn't coverage of this as Android and iOS vulnerabilities?

<comment><USER20> Gaining control of WhatsApp gains access to any API accessible to WhatsApp. Incompetent reporting may be at fault.

On Android, WhatsApp seeks a wide array of permission-controlled APIs. It does so on iOS as well. Once granted, the app has access to any data available through access-allowed APIs.

App code goes through an audit process to ensure that the app isn't using accessible APIs inappropriately, and doesn't permit unapproved code execution.

This vulnerability allows an attacker to execute unapproved code in the WhatsApp context. Any API that iOS or Android offer WhatsApp under normal circumstances is now attacker-controlled.

The two questions unanswered by the press to date are simple. On iOS and on Android, can the attacker's code be terminated by force-quitting and uninstalling WhatsApp?

Either the attack is persistent only because it sets up shop inside the app, which may have OS-granted background and/or screen-off execution rights, and thus can be terminated simply by quitting and removing the app — or, the attack gains persistence beyond the confines of the app.

Media reports are unclear on this point. If the OS offers apps endpoints that an app executing attacker-controlled code can use to infect the OS with persistent attack code that executes outside the app's boundaries and remains after app uninstallation, then that's absolutely a flaw in the design of the OS. As you say, "Android and iOS vulnerabilities".

Is this the case?

<comment><USER21> Very interested to know what this means in practice, particularly for iOS.

AFAIK, there's no permissions which allow you to read SMS messages, take screenshots (unless jailbroken), access photos in the background, access the camera in the background etc etc

Does this just spy on the users Whatsapp activity, or spy on the user in a broader way?

How could the API's whatsapp _does_ have access to be abused?

<comment><USER20> > How could the APIs .. be abused?

The app is infected, calls a 0-day using an illegal parameter that's normally rejected by app store filters, and gains a permanent beachhead in your Android system services list.

> access photos in the background

Unclear. Apps can show thumbnail galleries of your photos within their native UI, so it may well be possible for them to continue directly to reading photos.

> access the camera in the background

Unclear. Does FaceTime continue transmitting video when the phone screen is turned off? Is it possible to capture stills or video when the screen is off on a jailbroken phone?

> or spy on the user in a broader way

Android WhatsApp seeks permission to read your SMSes, so that would be almost certainly correct as well there.

<comment><USER21> Well I was thinking specifically about iOS :)

There's no possible way to read SMS messages programatically in iOS for example, the closest you get is reading one time passwords sent, and you can only do that when the user has the keyboard open when the SMS is received.

I know Android is slightly more lax in this (and some other) regards. I wonder if Android whatsapp users targeted by this exploit have had more data exposed than iOS users targeted by the same exploit?

<comment><USER20> All WhatsApp iOS users have an unpredictable set of permissions granted, whereas all WhatsApp Android users have all permissions granted.

If I were a nation state attacker, I would be thrilled to find that my target was Android.

</comment></comment></comment></comment></comment></comment><comment><USER22> CVE-2019-3568 suggests this was a buffer overflow. I'd like to understand why this was implemented in native code - Android seems to have an `android.net.rtp` package?

Is this simply for performance, or to enable code-sharing across Android and iOS? Is there anything about WhatsApp's use-case that would prevent an implementation using managed code?

<comment><USER23> Also, what exploitation mitigations are broken on Android/iOS such that a buffer overflow is reliably exploitable? Are their implementations of ASLR useless? Is it trivially bypassed? Is mandatory code-signing not enabled/enforced?

<comment><USER22> All very good questions, hopefully we can get some more information as time progresses (maybe a PoC, or at least a technical write-up on the specifics)

</comment></comment></comment><comment><USER24> I wonder! Should we call it a vulnerability or a leaked backdoor?

Besides, I think if it was from any other developer, probably it would be removed from the AppStore and force delete from user devices.

</comment><comment><USER6> All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with _their government 's blessing_ and open endorsement. That's some very shady stuff.

Before someone says something about government surveillance of fiber cables. Yes, that is also bad, but exploiting vulnerabilities to install spyware on peoples phones... It crosses yet another line that shouldn't ever be crossed.

<comment><USER25> They managed to destroy Iranian nuclear centrifuges using a very sophisticated attack. Read up on Stuxnet.

Also, as an Israeli, I can 100% confirm that Israelis have absolutely no issues with crossing any kind of boundary. The fact that others think that such a thing as "boundaries" exist only serves as an advantage.

<comment><USER26> Not clear whether you consider this a good thing or a disgrace?

<comment><USER27> As another israeli - certainly a good thing. For a nation in our position, in a deeply hostile region, where a major military defeat is certain to be genocide, doing everything possible for national defence is the only way possible to survive. Stuxnet in particular is something that I'm extremely proud of.

<comment><USER28> You say this as your country is invading and occupying land that doesn't belong to them and murdering innocents to drive them out. Yeah, nice way to be proud.

<comment><USER29> very hard to think of any country that has NOT done this. History shows that people and their countries do bad things.

<comment><USER30> True, but there is a difference between 'my ancestors have done this' and 'some of the taxes I'm paying are going into continuing the occupation; I've voted for the people who are ordering the air strikes'. There's fewer countries where that's true today.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> "update the app" is the sum of the advice?

how about telling us how to check if this exploit was used, how to remove the spyware, etc?

<comment><USER32> I'm not sure what can be done nowadays. In the past you would say, format disks and go back to a backup before the threatening event happened. But nowadays all our stuff is in the cloud and you can only go back to the state from 10 minutes ago, and all our disks are flash drives that you can't fully format as an end user. Maybe you can just accept that some virusses will always be there and act accordingly.

<comment><USER33> Some of us do snapshot backups.

Would be nice to have a tool that everyone on the planet could use to run against those backups and find a common source of the infections, along with an idea of when it was found in the wild.

</comment></comment></comment><comment><USER34> How were they able to install spyware on iOS devices?

<comment><USER35> Most likely by exploiting an iOS vulnerability . (Which might be unrelated to the WhatsApp bug, other than using it as a vector.)

</comment></comment><comment><USER32> What about Wechat? There are lots of seemingly pretty girls trying to voice or video call these days. Either I'm suddenly rich in their eyes or there's something fishy going on.

<comment><USER36> Name a chat app and I can provide a link or comment from someone saying the same thing about pretty scam girls. Facebook, Whatspp, Gmail, Kik, Snapchat, Instagram, and even BBSes, AOL, IRC etc...

<comment><USER32> What I saw on FB is automatic replies from bots. What I know from Skype are african boys who try to earn their next beer in an internet cafe by acting they would be a girl. I can confirm it's all not that.

</comment></comment></comment><comment><USER37> Just to be clear – does this affect iPhone, or just Android?

<comment><USER38> Affects both

<comment><USER39> Thanks. Is there a way to detect the infection?

</comment></comment></comment><comment><USER40> Wonder if this affects Signal, too.

<comment><USER41> My gut tells me no. Signal switched over to using the Signal Protocol for call signaling. It had used a few different signaling standards over the years (when it used to be called Redphone).

However, it's impossible to really know for sure as the server component for calls is a proprietary black box.

<comment><USER42> Agreed. It seems more plausible that the "injected code" would be limited to (1) the WhatsApp app, and (2) the infrastructure outside of the Signal Protocol implementation. If true, this still poses a problem to comms/calls secured end-to-end with the Signal Protocol impl - because once decrypted on the client, the rest of the WhatsApp may be compromised and able to exfil comms.

I will be surprised, if this vuln allows the attacker control outside of the WhatsApp app sandbox to other parts of iOS.

(I will be less surprised if the above is possible in Android)

</comment></comment></comment><comment><USER43> I like it how Facebook doesn't mention anything in the WhatsApp changelog about this.

<comment><USER44> Apple won't let you change a changelog after the binary is built and put on the store. So if you want to get a fix out, but not alert people that you're on to them, you have to put out a changelog that just says something like "Bugfixes". Then you have to build another build and submit another changelog, but Apple probably won't let you issue builds that are duplicates...

</comment></comment><comment><USER45> Spooky. I just travelled to Israel and this evening, at around 3 AM, iOS notified me that WhatsApp had been accessing my location in the background, which I had never seen before except when sharing my location with a friend.

</comment><comment><USER46> We need open source software to decentralize large companies' closed server farms and WhatsApp.

</comment><comment><USER47> Updated WhatsApp on my iphone just now. The version I got was 2.19.50. According to the CVE it's still vulnerable. Unable to get 2.19.51 which is the first fixed version. Is this just me? Or is everyone else updating to a still- vulnerable version?

<comment><USER48> Have you tried pulling down on the updates screen of the iOS app store? It refreshes the list of apps to be updated.

<comment><USER33> That did it. Thank you. And to think I _thought_ I installed all of my pending updates yesterday.

</comment></comment></comment><comment><USER49> Can the WhatsApp-injected spyware escape the iOS App Sandbox?

<comment><USER50> I was wondering the same. I would hope no, but even so, WhatsApp has plenty of permissions that make it a valuable target.

</comment></comment><comment><USER51> Yeah, don't install any Facebook app... use the web if you need to use their service... same advice has always been true.

</comment><comment><USER52> Isn't this also a screw up by Apple?

Isn't Sandboxing supposed to prevent this from getting any worse than hacking the app itself?

<comment><USER20> Isn't every article about this saying it persists, without saying how or whether it's a sandbox escape? If it just spins up bad code in WhatsApp space, that's sufficient to spy on you.

<comment><USER52> I'm sure I saw one say it infected the OS. I would like to know some more proper details too.

</comment></comment></comment><comment><USER53> Can anyone advise on minimum version numbers containing the patch (on IOS and Android)?

<comment><USER20> Listed here: [https://www.facebook.com/security/advisories/cve-2019-3568](https://www.facebook.com/security/advisories/cve-2019-3568)

</comment></comment><comment><USER26> [https://www.zerohedge.com/news/2019-05-13/secretive- israeli-...](https://www.zerohedge.com/news/2019-05-13/secretive-israeli- company-uses-whatsapp-voice-calls-install-spyware-phones)

</comment><comment><USER54> WhatsApp belongs to Facebook

Some of the largest data breaches in the last few years related to facebook

and yet

They continue do whatever they want

GDPR made no difference at all... Only hurt the small-medium business

FB, Google, Aamazon just keep doing whatever they want, protected by army of lawyers

</comment><comment><USER55> The article is behind a paywall. Here is a BBC link: [https://www.bbc.co.uk/news/technology-48262681](https://www.bbc.co.uk/news/technology-48262681)

</comment><comment><USER56> is this how saudi activists were tracked or uae tapped the phones of govt officials from various countries?

</comment><comment><USER57> Here's an article without paywall: [https://www.bbc.com/news/technology-48262681](https://www.bbc.com/news/technology-48262681)

</comment><comment><USER58> This was behind a paywall, here is a similar article:

[https://www.bbc.com/news/technology-48262681](https://www.bbc.com/news/technology-48262681)

</comment><comment><USER59> Why is that even possible? It's horrifying that simple voice calls via an app allow that kind of attack.

<comment><USER20> Cellular broadband modems are running a tiny OS that can be hacked by sending SMS messages with a carefully crafted NUL byte. Battlestar Galactica's "no networking, no wireless" computer restriction exists for a very good reason.

</comment></comment><comment><USER60> A

</comment><comment><USER61> Paywall, really?

</comment><comment><USER62> Why was the word "Israeli" removed from the title?

<comment><USER63> I took it out because the thread was veering into generic flamewar about Israel. Actually we often remove country names from titles because they trigger people into making more nationalistic comments, which are equal parts indignant and boring.

<comment><USER53> That's a bit of a pathetic policy if you ask me. In my opinion a country who permits this type of behaviour shouldn't be shielded from the ensuing negative press. If anything it might encourage otherwise unaware citizens to put pressure on the government to do something about it.

<comment><USER63> I hear you. I agree with your second sentence. But I'm trying to protect HN, not Israel or anyone else. This place is fragile, and when people bring the fires of the world here, it can only take so much.

I wouldn't call that kind of title edit (taking out a country name) a policy. We have an ad hoc bag of tricks and sometimes we use one and sometimes another, depending on what feels needed. Do I know how unsatisfying that sounds? You bet. Do I get how it opens us to accusations of bias? I do, better than anyone else does. But the threads are too complicated to be managed with precise formalizations.

<comment><USER53> Ack. I can see it's a tricky balance to maintain.

</comment></comment></comment></comment></comment><comment><USER64> WhatsApp voice calls used to inject Israeli spyware on phones

Messaging app discovers vulnerability that has been open for weeks

NSO's Pegasus software can allegedly penetrate any iPhone via one simple missed call on WhatsApp

Mehul Srivastava in Tel Aviv MAY 13, 2019 Print this page

A vulnerability in the messaging app WhatsApp has allowed attackersto inject commercial Israeli spyware on to phones, the company and a spyware technology dealer said.

WhatsApp, which is used by 1.5bn people worldwide, discovered in early May that attackers were able to install surveillance software on to both iPhones and Android phones by ringing up targets using the app's phone call function.

The malicious code, developed by the secretive Israeli company NSO Group, could be transmitted even if users did not answer their phones, and the calls often disappeared from call logs, said the spyware dealer, who was recently briefed on the WhatsApp hack.

WhatsApp is too early into its own investigations of the vulnerability to estimate how many phones were targeted using this method, a person familiar with the issue said.

As late as Sunday, as WhatsApp engineers raced to close the loophole, a UK- based human rights lawyer's phone was targeted using the same method.

Researchers at the University of Toronto's Citizen Lab said they believed that the spyware attack on Sunday was linked to technology developed by NSO, which was recently valued at $1bn in a leveraged buyout that involved the UK private equity fund Novalpina Capital.

NSO's flagship product is Pegasus, a program that can turn on a phone's microphone and camera, trawl through emails and messages and collect location data.

NSO advertises its products to Middle Eastern and Western intelligence agencies, and says Pegasus is intended for governments to fight terrorism and crime.

In the past, human rights campaigners in the Middle East have received text messages over WhatsApp that contained links that would download Pegasus to their phones.

WhatsApp said that teams of engineers had worked around the clock in San Francisco and London to close the vulnerability. It began rolling out a fix to its servers on Friday last week, WhatsApp said, and issued a patch for customers on Monday. The US Department of Justice has also begun looking into the situation.

"This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems," the company said. "We have briefed a number of human rights organisations to share the information we can, and to work with them to notify civil society."

NSO said it had carefully vetted customers and investigated any abuse. Asked about the WhatsApp attacks, NSO said it was investigating the issue.

"Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies," the company said. "NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the UK lawyer]."

NSO declined to comment on whether it had hacked WhatsApp's messaging service, and marketed the technology to clients, or on the US DoJ inquiry.

The UK lawyer, who declined to be identified, has helped a group of Mexican journalists and government critics and a Saudi dissident living in Canada, sue NSO in Israel, alleging that the company shares liability for any abuse of its software by clients.

John Scott-Railton, a seniorresearcher at the University of Toronto's Citizen lab, said the attack had failed.

"We had a strong suspicion that the person's phone was being targeted, so we observed the suspected attack, and confirmed that it did not result in infection," said Mr Scott-Railton. "We believe that the measures that WhatsApp put in place in the last several days prevented the attacks from being successful."

Other lawyers working on the cases have been approached by people pretending to be potential clients or donors, who then try and obtain information about the ongoing lawsuits, the Associated Press reported in February.

"It's upsetting but not surprising that my team has been targeted with the very technology that we are raising concerns about in our lawsuits," said Alaa Mahajne, a Jerusalem-based lawyer who is handling lawsuits from the Mexican and Saudi citizens. "This desperate reaction to hamper our work and silence us, itself shows how urgent the lawsuits are, as we can see that the abuses are continuing."

On Tuesday, NSO will also face a legal challenge to its ability to export its software, which is regulated by the Israeli ministry of defence.

Amnesty International, which identified an attempt to hack into the phone of one its researchers, is backing a group of Israeli citizens and civil rights group in a filing in Tel Aviv asking the ministry of defence to cancel NSO's export licence.

"NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics. The attack on Amnesty International was the final straw," said Danna Ingleton, deputy director of Amnesty Tech.

"The Israeli ministry of defence has ignored mounting evidence linking NSO Group to attacks on human rights defenders. As long as products like Pegasus are marketed without proper control and oversight, the rights and safety of Amnesty International's staff and that of other activists, journalists and dissidents around the world is at risk."

Copyright The Financial Times Limited 2019. All rights reserved.

<comment><USER65> Is this the full FT article?

<comment><USER66> Looks like it, from the archive.is link above.

</comment></comment></comment><comment><USER67> FT.com worst site in the world.. I thought you can't link things that require a subscription to read?

<comment><USER68> For these, there is a link below the headline titled "web" \- click this, it opens in a search that when clicked through allows reading.

<comment><USER69> Wow, TIL. Thanks!

</comment></comment></comment><comment><USER70> The title has been modified.

WhatsApp voice calls used to inject Israeli spyware on phones

<comment><USER63> Sure, we take out the baity parts of titles because they produce lousier discussion. This is standard HN moderation: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html). See [https://news.ycombinator.com/item?id=19906729](https://news.ycombinator.com/item?id=19906729) for more explanation.

<comment><USER6> Cursory Google searches seem to indicate that the same policy isn't applied for Chinese or Russian cyber threats. You also didn't remove the country name in other recent news, despite the production of even lousier discussion: [https://news.ycombinator.com/item?id=19638357](https://news.ycombinator.com/item?id=19638357) [https://news.ycombinator.com/item?id=19634570](https://news.ycombinator.com/item?id=19634570) The moderation is inconsistent.

<comment><USER63> I'm not claiming consistency. For one thing, we don't come close to seeing everything that gets posted here. If you see a particularly bad post get away without moderation, the likeliest explanation is that we didn't see it. We can't be consistent about what we don't see.

There are a ton of other considerations, though, and it gets complicated quickly. I'm always happy to discuss specific cases, but general arguments are another matter. Sometimes it feels like people want us to make general arguments so they can find exceptions and then say things like "aha" and "your obvious bias" and "figures". But we don't have general policies about such complicated things. We have basic principles and that's it: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html).

If you don't think we've been trying to reduce nationalistic flamewar about China and Russia, you could try looking at HN threads on those topics. I don't know anything I've been working at harder lately. On the other hand, there's 100x more of those, especially on China, so cf. the first paragraph above.

[https://hn.algolia.com/?query=by:dang%20nationalistic&sort=b...](https://hn.algolia.com/?query=by:dang%20nationalistic&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0)

<comment><USER6> > I'm always happy to discuss specific cases

If so, then maybe you can explain why you didn't change "Israel's Beresheet Spacecraft Moon Landing Attempt Appears to End in Crash" and "A private spacecraft from Israel will attempt a moon landing Thursday" to "Private Spacecraft Moon Landing Attempt Appears to End in Crash" and "A private spacecraft will attempt a moon landing Thursday" respectively?

I think your attempt at reducing nationalistic flame wars is very misguided, because I want to read what people think. If HN readers want to flame each other then I would like to have the chance to read the flames even if I'd likely scroll past them. But if you are going to do it, at least be consistent.

<comment><USER63> In one case I didn't see the article and in the other it didn't cross my mind. But also, that topic isn't so highly charged, and I didn't see nationalistic flamewar getting in there.

You're asking for a level of consistency in moderation that we can't deliver. I'd have to hold 100x more information in my head to come up with a consistent set of principles that would cover everything we do. Such a set would be inordinately complicated and impossible to explain or defend, so what would be the point.

> I want to read what people think.

Me too. But you can't read everything people think, because comments influence what gets posted in response. If a discussion becomes a flamewar, you're going to get the angry thoughts of the flamers, but lose the thoughts of those the flames drive away. It's a tradeoff—we can't have both. On HN the non-flamey, thoughtful comments take precedence, because that's the only way to optimize for HN remaining interesting. This is one area where I think we really are consistent, or at least I hope we are.

Look at it this way: each post changes the kind of site HN is. The container isn't static—it's altered by what people add to it. Our goal is optimize that container for curiosity. This is a global optimization problem, so it's important not to get distracted by local optima. Our experience with things like nationalistic flames is that while such comments are sometimes interesting (and certainly the topics are of great world significance), the _type_ of discussion they lead to is reliably worse. What we do is: extrapolate the vector of a given comment and ask what its shaping influence is on the site as a whole. Is it to make HN more, or less, interesting? Where more, we either do nothing or steer towards; where less, we steer away. In the case of flamewars, steering away means doing things to prevent the flames from spreading. There are various tools for that—digging trenches, pouring water, etc. Picking which to use where is more of an art and I wouldn't say we're particularly consistent on that level. But the fundamental principle is very consistent—there's only one, and it motivates literally everything we do here.

<comment><USER6> > In one case I didn't see the article and in the other it didn't cross my > mind. But also, that topic isn't so highly charged, and I didn't see > nationalistic flamewar getting in there.

They are right there, in light-gray color at the bottom of the respective articles. Now that you have been made aware for the problem, will you change those articles' titles? I don't understand how you can claim one title is "baitsy" while the other to examples are not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER71> This is the same country that has a secret nuclear stockpile (developed in partnership with Apartheid South Africa) with plans to use the threat of bombing their European "allies" as blackmail.

[https://en.wikipedia.org/wiki/Samson_Option](https://en.wikipedia.org/wiki/Samson_Option)

<comment><USER72> The "Samson Option" is a conspiracy theory that if Israel is ever at the brink of destruction it will nuke Europe and America. It is a conspiracy theory based on the ramblings of one Israeli historian and one American author.

Israel has nuclear weapons and its MAD policies are probably the same as other nuclear powers.

It's funny because Putin has actually said that Russia will end up destroying the entire world in retaliation if Russia is ever attacked with nuclear weapons. But for some reason you don't see this quote get the same attention as the "Samson Option".

 _'Why would we want a world without Russia? '_

 _Days later, he reiterated his stance, implying that nuclear war — a "disaster for the entire world" — would be a response to a major attack against Russia: "as a citizen of Russia and the head of the Russian state, I must ask myself: 'Why would we want a world without Russia? '"_

 _'Why would we want a world without Russia? '_

[https://www.japantimes.co.jp/opinion/2019/01/27/commentary/w...](https://www.japantimes.co.jp/opinion/2019/01/27/commentary/world- commentary/putin-and-the-apocalypse/)

<comment><USER73> > Israel has nuclear weapons and its MAD policies are probably the same as > other nuclear powers.

But with a much more controversial relationship with it neighbours, who's land it illegally occupies and state policies that are compared to apartheid policies.

<comment><USER74> Much more controversial, than Russian? At least those poor folks in Palestine have an incompatible religion, which I could not say about Ukraine.

<comment><USER73> There are also other examples like China and the Uyghurs. Perhaps "much more controversial" is going to far, as there is a lot of shitty behaviour.

</comment></comment></comment></comment></comment><comment><USER75> And nobody was surprised.

</comment><comment><USER76> My desktop WhatsApp on macOS is crashing pretty regularly, once every few days. Really makes me wonder if I'm being targeted using similar exploits.

<comment><USER77> It's probably the link preview preload. It can't handle certain sites and crashes almost instantly when trying to send a link.

</comment></comment><comment> a-dub Maybe that would explain the mysterious WhatsApp voice call I received about a week ago in the middle of the night from an unknown number? It's still in the history so maybe that means it didn't work?

<comment><USER78> Are you involved with anything that would make you think you'd be worth someone's time and money to be spying on? Most likely it was a wrong number.

</comment></comment><comment><USER79> I am not an expert on RCEs whatsoever but my limited knowledge / gut feeling tells me that one works by after a buffer overflow flipping some bits and

* invoking syscalls

* using (known) kernel vulnerabilities

* libc bugs

* exploiting buggy posix abstraction, etc.

However, here all platforms seem to be exploited, regardless kernels (darwin/linux/windows), process models, libc implementations etc.

I cannot unthink that this was simply doable because WhatsApp had already have code paths to place and run tasks/processes and this exploit works on this, higher level.</comment>


CopperheadOS: A hardened open-source operating system based on Android - <AUTHOR> https://copperhead.co/android/ <comment><USER2> I like to see it enable the user to logs and optionally block connections attempt base on IP/dns names with both whitelist and blacklist.

And track/logs all of them per Apk.

<comment><USER3> >And track/logs all of them per Apk.

Don't run programs you can't trust.

<comment><USER4> No point in a smartphone if you were to follow that mindset

<comment><USER5> good luck with THAT mindset.

edit: i never touched ios (except for my employer, but it's their data) and my Android phones all have my kernel and pf tables limiting all apps network access. specially to the local network!

</comment></comment></comment></comment><comment><USER6> Copperhead seems designed to protect against malicious attackers, but does it protect confidentiality against commercial tracking (another kind of attack)?

I'll add: I haven't come across another fork of Android that focuses on security so I'm rooting for these guys.

<comment><USER7> Privacy enhancements are definitely within the scope of the project. Most of the current features are exploit mitigations though. If you look through [https://copperhead.co/android/docs/technical_overview](https://copperhead.co/android/docs/technical_overview) you'll see that there are a few privacy features already, and there are many in-progress. They won't be listed there until they're actually completed though.

<comment><USER6> Are you connected to the project somehow?

<comment><USER7> Yes, I'm the (lead) developer of the OS.

<comment><USER6> Great! Thanks for your hard work, and thanks for participating in the discussion. I've been looking forward to Copperhead's first release for awhile.

</comment></comment></comment></comment></comment><comment><USER8> "Protection from zero-days" \-- how can you make a claim like this?

<comment><USER9> I'm not affiliated with Copperhead at all, but I am familiar with the sorts of techniques they are using. Exploit mitigations, such as Address Space Layout Randomization, Control-Flow Integrity, Fine-grained Randomization, etc. provide a layer of hardening to make exploitation of a source code vulnerability harder, or even not possible on the protected device. The bug (zero-day) still exists, it's just not as exploitable to do bad stuff.

<comment><USER10> ASLR is already a part of pretty much every current operating system ( save FreeBSD-RELEASE )

<comment><USER11> Not all ASLR implementations are equal, eg. PaX's ASLR vs standard Linux KASLR.

<comment><USER12> Or Android's almost useless 32-bit ASLR (even on 64-bit platforms) for that matter:

[https://googleprojectzero.blogspot.com/2015/09/stagefrighten...](https://googleprojectzero.blogspot.com/2015/09/stagefrightened.html)

[https://copperhead.co/blog/2015/05/11/aslr-android- zygote](https://copperhead.co/blog/2015/05/11/aslr-android-zygote)

</comment></comment></comment></comment></comment><comment><USER13> It looks like CopperheadOS has managed to upstream quite a number of mitigations! Bravo to them. This makes them the sort of OpenBSD research OS of the Android world, and everyone benefits from their work.

[https://copperhead.co/android/docs/technical_overview](https://copperhead.co/android/docs/technical_overview)

</comment><comment><USER14> "It will not support devices outside of the Nexus and Pixel lines."

This is really sad to me. :/ As far as we've come, everything mobile is still irritatingly device-specific.

<comment><USER15> "Devices will be supported until Google drops support from the Android Open Source Project. Google guarantees major version updates for at least two years after launch. Security updates are guaranteed for three years after launch along with 1.5 years after the last device is sold."

As someone that is still using a phone from 2012, this is problematic since I have no intention of getting a new phone that often. Is there no stable, secure, and open combination of OS and smartphone out there?

<comment><USER16> Cyanogenmod still supports security updates for the Galaxy S, a model released in 2010.[0] Is it still worth using a six-year-old phone? Maybe not, but if your device is lucky enough to have support it can last you a long time.

[0][https://download.cyanogenmod.org/?type=nightly&device=galaxy...](https://download.cyanogenmod.org/?type=nightly&device=galaxysmtd)

<comment><USER17> I recently lost my Note 3, subsequently bricked my HTC "Pico" explorer - bought as a dev phone and GPS device due to the notorious GPS issues on my first Android; a Galaxy S. So now I'm back (typing this in Firefox) on my ancient Galaxy S, running a recent cyanogen build [Ed: 11 nightly, based on Android 4.4.4 kitkat. I believe I tried 12 - but it failed to install].

It kinda works. Had to force a move from dalvik to art, and force HW rendering - there are quite a few stalls. I haven't tried encrypting the device; it's already slow enough.

Ironically(?) Firefox works better than Chrome. Signal seems to work OK (only for sms so far due to missing network effect; I don't message anyone with signal installed).

I'm considering just getting a new battery (replaceable battery, yay!) - as it is cheaper than getting an LG g3, nexus 5 (no memory card slot, bleh) or a Sony xperia z3 (waterproof). I wouldn't really say it's _usable_ \- but a g2 or 3 might be OK. [Ed:The low RAM on the early devices appear to me to be the worst issue. I wouldn't recommend buying a device with less than a gig of ram. the Galaxy S has ~384mb.]

</comment></comment></comment></comment><comment><USER18> See also: [https://lwn.net/Articles/675719/](https://lwn.net/Articles/675719/)

</comment><comment><USER19> Interesting development. Good to see another project trying to improve the mobile situation for Android. Getting us off iOS or Android without loosing all the good apps probably isn't happening due to lock-in effects and patent issues. At the least, projects that try to allow safer use of Android apps will benefit a lot of people.

</comment><comment><USER20> You had me interested until "..based on Android."

What we need is more original codebases in the mobile ecosystem, not endless modifications on top of the same old shaky foundation.

<comment><USER21> That shaky foundation also has a large ecosystem of useful software. I guess it doesn't need to be "based on Android" to run Android apps, though.

I'm not too familiar with security on Android (much more familiar with iOS) – what are the weakest links?

<comment><USER20> Android 0days at this point are so numerous, I find they are relatively worthless compared to time invested elsewhere. Other people seem to have the same experience (i've seen offers of double that amount for iOS remotes): [http://blogs- images.forbes.com/andygreenberg/files/2012/11/e...](http://blogs- images.forbes.com/andygreenberg/files/2012/11/exploitpricechart.jpg)

<comment><USER7> Android vulnerabilities aren't more numerous than iOS vulnerabilities. The key difference is that 97% of Android devices do not get security updates. There is no need for 0 day vulnerabilities for attackers, in general. Few users have Nexus devices.

</comment></comment></comment></comment><comment><USER22> Do they have a comparison table for how it fairs compared to cyanogen ? I'm interested if this is a good os if I want my personal data completely isolated away from any other app regardless of their initial permissions.

</comment><comment><USER23> How does this compare to CyanogenMod? Security is definitely important but how much should I trust this OS?

Both CyanogenMod and CopperheadOS should be able to run smoothly withoug google-specific apps I believe, which is nice for some.

<comment><USER24> The problem is the vast majority of applications actually require Google services to run on Android devices. Running an Android device without GApps is pretty much pointless unless you are really using it for a very very specific purpose.

<comment><USER25> It would be (relatively) easy to put together another suite of utilities offering the same API as the standard GApps, in order to allow 3rd party apps that depend on that API to function. Rumor has it Samsung has just such a project in the works, in case they need to punch the eject button on their relationship with Google: [http://www.digitaltrends.com/mobile/samsungs- secret-mission-...](http://www.digitaltrends.com/mobile/samsungs-secret- mission-cut-google-galaxy/)

<comment><USER16> It's in progress.

[https://microg.org/](https://microg.org/)

</comment></comment></comment></comment><comment><USER26> Besides USB Armory, are there any other open source harden hardware solutions?

<comment><USER27> The Yubikey neo can be programmed with JavaCard. There's a handful of applets on their github

<comment><USER26> The Yubikey neo hardware is not open source though, right?

</comment></comment></comment><comment><USER28> Couldn't find the Android version it's based on?

<comment><USER7> 6.0.1_r20 for the Nexus 5 and Nexus 9, and 6.0.1_r24 for the Nexus 5X. You can see the versions of the downloads page (it uses AOSP_TAG.COPPERHEADOS_TIMESTAMP) It's the same as stock. It will move to 7.0 shortly after it's released.

</comment></comment><comment><USER29> Google needs to step it up

</comment><comment><USER30> Built by drug dealers for drug dealers.

</comment><comment><USER31> This is a hoenypot for the NSA

<comment><USER9> That's called a baseband processor.

But no, in all seriousness, Copperhead (and AOSP itself) are open source. Go audit it for NSA backdoors yourself if you're worried about that.

</comment></comment><comment><USER32> This project seems interesting but largely impractical until a truly independent FOSS app store exists with a wide selection + security track record as good as Google Play or iTunes.

I don't see how it gets there with such a narrow hardware selection.

<comment><USER33> [https://guardianproject.info/2016/03/28/copperhead- guardian-...](https://guardianproject.info/2016/03/28/copperhead-guardian- project-and-f-droid-partner-to-build-open-verifiably-secure-mobile-ecosystem/)

There you go!

<comment><USER34> This makes the project alot more interesting to me.</comment></comment></comment>


Google shopping will give preferential ranking for paying customers - <AUTHOR> http://www.mercurynews.com/business/ci_20752755/google-shopping-give-paid-advertisers-an-advantage

<comment><USER2> So when will advertisers be able to buy their way out of your Gmail spam folder?</comment>


"Twiddla's API is crazy simple" - <AUTHOR> http://www.twiddla.com/API/Reference.aspx

<comment><AUTHOR> I've been wading through yet another needlessly complex 3rd party API, and I'm about to hit the breaking point.

I think that developers simply default to complexity when they can't think of anything better to do. When tasked with building an API for their thing, they'll look around for something to pattern it after, and do that. Unfortunately, the most visible APIs around are from Amazon, which all deal with cash money and therefore need to be super secure.

The end result is that we end up doing silly crypto tricks and parsing JSON just to embed somebody's widget onto a page. I figured I'd put forth a counterexample to show how simple a public API can actually be and still be useful.</comment>


Ask HN: Do you know how to create core dumps for windows processes (user-level)? - <AUTHOR>

Ask HN: Do you know how to create core dumps for windows processes (user-level)? Hi all, I have been trying to enable core dumps for windows, and it is suprising that there is virtually no documentation for this. All I could find was
http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx but seems to not work on windows 2008. Any Windows hackers around here that could help me?<p>Also, does anyone know a good forum for asking windows related questions? The Microsoft one really sucks. <comment><USER2> What you're looking for is referred to as a MiniDump.

Check out the following links for details:

[http://www.codeproject.com/KB/debug/postmortemdebug_standalo...](http://www.codeproject.com/KB/debug/postmortemdebug_standalone1.aspx)

<http://msdn.microsoft.com/en-us/library/ms680369(VS.85).aspx>

<http://msdn.microsoft.com/en-us/library/ms680360(VS.85).aspx>

</comment><comment><USER2> CodeProject.com and StackOverflow.com are two good sites to research and ask questions on.</comment>


How to Install Ubuntu Linux on your Dell PC - <AUTHOR> http://www.dell.com/support/article/us/en/04/SLN151664/en <comment><USER2> I'm writing this on the first Dell I've owned since... 1999: a new "Developer Edition" XPS-13 2015 (FHD i5 variant for max power savings, which are pretty incredible).

This is close the best linux laptop I've used, including various my various thinkpads and macbooks.

A couple years ago I met an enthusiastic Barton George showing off the first gen XPS 13 at the ubuntu dev conference. It was sexy but flawed. I wasn't interested in the machine, but I thought Barton was a guy to watch. His project Sputnik group is the _only_ reason I have kept Dell on my radar at all.

They could be doing a lot in a better way: the customer outreach, ordering process, out of box experience: all include some (at times _very_ ) rough edges.

Linux on the desktop is happening and, as I've said for a long time, it's happening where it needs to: with developers first. I'm not super excited with their Ubuntu centric strategy, but it's minimal effort to get Arch up and running on the Dell dev units. If anyone is going this route I'm maintaining a kernel for the XPS 13 (2015) here: [https://aur.archlinux.org/packages/linux- xps13-alt/](https://aur.archlinux.org/packages/linux-xps13-alt/)

<comment><USER3> I have an XPS 13 2015 version but it came with Windows 8. I want to try out ubuntu on it to see if it'll run better. Is yours touch screen? If so, how is it working?

Also is there a difference between the windows xps 13 and the developers edition? I heard the developers edition is cheaper, but with less powerful hardware?

<comment><USER2> I didn't get the touchscreen version intentionally. That's not to say that it's better with/without touchscreen. I just didn't want it, and wanted a lower resolution FHD screen for power savings. I know that gnome has basic support for touchscreens and just switched away from using a Surface Pro 3 with Gnome. It was _just_ ok. I'd say you'll be fine since you've got a keyboard and trackpad as solid backup for the touchscreen.

There is no hardware difference to the windows/linux machines... the hardware on the dev units isn't any less or more powerful. You will, however, want to make sure your BIOS is upgraded to the current rev (A04 as of this posting). [http://www.dell.com/support/home/us/en/19/Drivers/DriversDet...](http://www.dell.com/support/home/us/en/19/Drivers/DriversDetails?driverId=133FN)

<comment><USER4> XPS13 windows 8 with the QHD/ultra high res screen here -- it has issues scaling windows apps -- Adobe Photoshop CC included. The apps imho are the weak link as not all have been designed for the higher resolution display.

Sure, this will change in time for both OS but its quite annoying on a productivity machine.

Edit: With that said, the XPS13 with 256gb ssd, touch screen and 8gigs of ram is a very smooth running machine. Very happy with my purchase.

</comment></comment></comment></comment><comment><USER5> Most people don't know this, but Dell actually has an amazing line of computers that come with Ubuntu on them already. Best part - there's a team of people who make sure there's 100% driver support for everything on the computer.

Check it out: [https://sputnik.github.io/](https://sputnik.github.io/)

<comment><USER6> I'm very happy that I bought Dell XPS 13 (aka Sputnik 3) instead of MacBook Air.

There were some problems regarding driver support thought... but in the latest Ubuntu 15.04 most of them, maybe even all of them, are gone.

I've been using it for almost 1.5 years and can't recommend it higher.

<comment><USER7> How's the battery life? Durability? Does the computer sleep/wake up when opening/closing the lid (as expected)?

<comment><USER6> Note: I have a late 2013 edition, Sputnik 3, there's a newer - 2015 edition which has a much better battery life from what I've read.

On average lasts ~7 hours, less if you're watching a video.

Yes, sleep/wake up is working as expected.

I myself was very impressed when I got the laptop, I didn't expect such beautiful and fine tuned laptop from Dell.

<comment><USER8> I have a Dell E6320 (Core i3-2310M) from 2011 that I'm running Arch on with a 6 cell battery. The laptop can easily go for 6 hours with WiFi on if you're just editing code or managing some servers via SSH.

Upgraded to 16GB of RAM and an SSD. The only thing I wish was that the screen was higher resolution than 1366x768, but otherwise it's absolutely fantastic for Linux. The dock works so seamlessly it's amazing.

</comment></comment></comment></comment></comment><comment><USER9> I know this is a Dell thread but for those interested in running Linux on a sweet ultrabook, check out the Asus UX305. I've been running Ubuntu 15.04 on it and it works beautifully, no special instructions required. Also only $800 - probably one of the best deals going in linux laptops these days.

<comment><USER10> Since you started the "not-a-dell" thread, I'll chime in. I picked up a Toshiba Dynabook KIRA V63, which is _very_ similar to the Dell XPS 13 in specs. I'm quite happy with it. It doesn't seem to have the problems described for the XPS and I haven't needed a custom kernel. When it first came out the track pad was virtually unusable, but a kernel update a month or so ago seems to have fixed it.

Anyway, this is a Japanese model, so I'm not sure if/when it will be available in other places in the world. More generally, the Broadwell 5500 i5 is an amazing processor. It is very low power and is surprisingly fast. I thought I would be making tradeoffs for power/battery life, but not so. I have been using this as my main dev box since March (granted, I'm doing web development, so my compile chain is rather forgiving ;-) ).

I don't get anywhere near the rated battery life, but I can easily hit 6-7 hours of real work time (including wifi) without having to plug in. Since I am often working in strange places this is huge for me.

Anyway, the company I'm working for at the moment has a Dell contract and I've been encouraging them to look at the XPS 13 for remote people.

</comment></comment><comment><USER11> Not an endorsement of Dell or Ubuntu, but Dell appears to offer 8 (mostly lower-end) laptop models with Ubuntu pre-installed: [https://www.dell.com/us/p/laptops](https://www.dell.com/us/p/laptops)

</comment><comment><USER12> Still waiting for Dell to fully support Ubuntu in their 2015 XPS 13 model. I made the switch from a Thinkpad after Lenovo burned me too many times. While the keyboard isn't quite as excellent it's still top notch and it's one of the best laptops I've ever owned.

That being said getting everything working in Ubuntu has been a bit of a fiasco [1]. Luckily after some firmware upgrades and the new kernel in 15.04, a lot of issues have been fixed, but the laptop still does strange things waking up from sleep. The worst issue though is that audio still seems to not work in a dual boot configuration. The laptop can't produce sound from the speakers or headphone jack in both Windows and Ubuntu when booting between the two OS's. It seems the hardware gets put in a strange state by either OS and it takes two full reboots after switching from Windows<->Ubuntu to get the audio device to be recognized.

Also HDPI support in Ubuntu is still a little lacking so the beautiful higher- than-retina display sometimes makes things absurdly small. I've seen a lot of progress on this front though.

I really love this device but I'd be lying if I said I didn't miss the excellent out of the box hardware support for Thinkpads in Ubuntu.

[1] - [https://major.io/2015/02/03/linux-support-dell- xps-13-9343-2...](https://major.io/2015/02/03/linux-support-dell- xps-13-9343-2015-model/)

<comment><USER13> How did Lenovo burn you? Even minimal distros such as Arch with various DEs/WMs work great out of the box on my T450s, because all of the hardware is supported in the kernel. Reading the 2015 XPS 13 Ubuntu guide made it seem like a painful process that involved downloading drivers, etc.

<comment><USER14> 3 things I can think of straight away:

\- WiFi-card whitelist

\- Function-keys touch strip

\- Fn and Ctrl keys switch

<comment><USER15>
      - WiFi-card whitelist

gone in the [x,t][2,4,5]50 series

      - Function-keys touch strip

existed on one model for one revision, is now gone

      - Fn and Ctrl keys switch

this layout is correct and is mandated in the first chapter of the Bible

<comment><USER16> If you mean that from the left edge of the keyboard you have Fn and then Ctrl, then yes it's correct, however I checked my Bible and (un)fortunately God decided that the order of keyboard keys just wasn't worth divine inspiration.

</comment></comment></comment></comment></comment><comment><USER17> I just installed 14.04 on an 3-4 year old Inspiron. Haven't really pushed it, but it seems to have no issues, and I didn't have to do anything for everything to work; the vanilla install seemed fine.

<comment><USER18> I've been running Ubuntu on an Inspiron 17R SE since 2012. With the exception of the multi-touch touchpad pretty much everything worked fine out of the box.

</comment></comment><comment><USER19> How official are publications in Dell's "Knowledge Base"? This one looks like it was written by a non-native English speaker, and doesn't seem to provide much Dell-specific information.

<comment><AUTHOR> As far as I know they are directly coming from Dell. That's the "breaking" part of this manual, that a retailer as big as them are trying to explain how to get rid of Windows and just install a Linux distro.

<comment><USER20> They have been selling Ubuntu on laptops for years now, you used to be able to get it on low end laptops like the vostro now days it seems its reserved for developer editions of their xps line only.

<comment><USER21> They have some cheaper ones too, such as this: [http://www.dell.com/us/p/inspiron-15-3551-laptop- ubuntu/pd?r...](http://www.dell.com/us/p/inspiron-15-3551-laptop- ubuntu/pd?ref=PD_Family) (also a 14" for cheaper)

I have a Dell Mini 9 that I got for >$200 years (2009?) that came with Ubuntu that I still use regularly. Now it's running Puppy Linux (Slackware based) though.

</comment></comment></comment></comment><comment><USER22> Since they are providing installation instructions on their website, does this mean they will also do phone / email support for Linux related installation issues?

<comment> SG- Right at #1:

"Note: If you install an operating system other than the one that shipped with your system, then you do so at your own risk. Dell can't certify that the hardware will be compatible and we may not be able to support the system in that configuration."

<comment><USER23> I just bought refurbished XPS 13 with Windows because I wanted to save some money. Ubuntu wont work out of the box. There are whole bunch of issues that I'm still trying to resolve. So even if hardware is compatible, you may have hard time. I think it will take some time, because everything gets smooth. (afaik, hardware wise just wifi card is different)

<comment><USER24> try using a newer kernel, fixed a lot of issues for my xps13 (not the latest revision).

[http://askubuntu.com/questions/119080/how-to-update- kernel-t...](http://askubuntu.com/questions/119080/how-to-update-kernel-to- the-latest-mainline-version-without-any-distro-upgrade/142000#142000)

<comment><USER23> Thanks. There seems to be another issue of broadcom wifi being active when suspending hence draining all the battery. Have to figure workaround for that as well.

</comment></comment></comment></comment></comment><comment><USER25> I've set up a public issue tracker on Github for the XPS 13 (2015) developer edition: [https://github.com/advancingu/XPS13Linux/issues](https://github.com/advancingu/XPS13Linux/issues)

It should contain descriptions and some workaround for the most obvious issues that currently exist for running Linux on these machines.

</comment><comment><USER26> Kudo's to Dell for acknowledging that the world is more than just Windows. I'm the proud owner of a 1st Gen XPS 13 Developer Edition. It's a truly beautiful product and a joy to use (apart from some Wifi issues)

</comment><comment><USER27> There's lots of love for XPS 13 on this thread. I'm considering a switch from Thinkpad+Asus to something different. Is the "XPS 15" just as good? (Although it looks pricey).

</comment><comment><USER28> What's the best way to get an Ubuntu/Debian-compatible linux distro on my Mac laptop without destroying my data? The slowness of Yosemite seriously amps my cortisol.

<comment><USER29> if you have an older mac just install Ubuntu Mate [http://i.imgur.com/HB2meal.jpg](http://i.imgur.com/HB2meal.jpg)

[https://ubuntu-mate.org/](https://ubuntu-mate.org/)

<comment><USER30> Like good old Gnome 2, Mate DE is very nice if you do not want buttons that takes 10% of the screen.

</comment></comment></comment><comment><USER29> the year of th..

yeah.. i'll see myself out

<comment><USER31> The year of the Linux desktop was brought about by Android, at a growth rate and scale far beyond what Linux any enthusiast dreamed about 15+ years ago. And it came at Microsoft's expense, which means prophecy has been fulfilled and the world righted.

[http://en.wikipedia.org/wiki/Halloween_documents#Documents_I...](http://en.wikipedia.org/wiki/Halloween_documents#Documents_I_and_II)

<comment><USER32>
      The year of the Linux desktop was brought about by Android.

Oh, right. Ubuntu had nothing to do with it. Definitely not back in April of 2008, with LTS 8.04. No way. It was Android. The mobile operating system intended for smart phones was what brought the Linux desktop to everyone.

<comment><USER31> There are 1+ billion Android users. Are there even 1 million Ubuntu desktop users? I'm one of them.

<comment><USER33> Yes, from wikipedia: In 2015, Canonical's Ubuntu Insights page stated "Ubuntu now has over 40 million desktop users and counting"

Probably based on the number of hits to the repositories (so it would obviously be a minimum number).

<comment><USER34> Not to be picky, but that number includes servers too, where it is widely used.

<comment><USER33> Since they specifically say Desktop, I'm guessing they're measuring updates to stuff that's only on the Desktop (say, Unity or something).

<comment><USER31> Without disclosing how they came to that number it's just marketing puffery. I doubt it would hold up to scrutiny. But even 4 million active Ubuntu desktop users would be impressive.

<comment><USER33> The blog entry at:

[http://jspaleta.livejournal.com/42464.html](http://jspaleta.livejournal.com/42464.html)

estimated (in 2009) the number of Fedora users at around 16 million. I think Ubuntu has more users than Fedora had then.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: A complete guide on how to setup a SUCCESSFUL Adwords campaign - <AUTHOR>

I was wondering if there is a course or tutorial which walks through the setting up of a successful Adwords campaign. I am not talking about the basics, but rather showing an actual production adwords campaign, which was started from scratch. The challenges faced, and then the changes made to  turn it into a successful campaign. <comment><USER2> Although it would be awesome, I doubt you will find anything like that. After all, the second someone published their "actual production adwords campaign" info, their competitors would know exactly what keywords to bid on and by how much. I know a lot of the younger HNers are all about "transparency" but that's bordering on the absurd.

"But, Scott - surely they can blur out the text so we can't see it?" Sure, but then if they're doing that, how could you trust it? Example - author says "All I did was increment by $0.10 and our CTR jumped 100%!" But what if he really pushed it up by $10 just so he could quickly have an example screenshot to show?

<comment><AUTHOR> That is a valid point. However, there are many campaigns that are no longer active or have relevance. The learnings from that can be made public.

Alternatively if someone has the expertise in this field can start a new campaign and show how a campaign should be built for a new product. I am sure there will be a wide audience which will be willing to pay significant amount of money to learn from this.

<comment><USER2> _...there are many campaigns that are no longer active or have relevance. The learnings from that can be made public._

Sure, that could have value. It would require a long term pre-publication plan that says, "At some point, I'm going to trash this successful campaign so that I can write a book." I don't know that you do that though, do you? If you're making $10,000/yr with AdWords, would you really trash that so you could make $10,000/yr with a book that's going to be "stale" within a year or two?

FWIW Perry Marshall's basic guide to AdWords is a good start for most people.

<comment><USER3> With the recent switch over to enhanced campaigns this year I'm not even sure looking at a successful past campaign would be that great.

</comment></comment></comment></comment><comment><USER3> AdWords is not so simple that you can setup a successful campaign just by following a guide.

Your question is like asking "Is there a complete guide for how to set up a successful business?" There are too many what-ifs for any guide to be comprehensive.

Seeing actual production campaigns is a great way to learn, but beyond the basics this doesn't always teach you much about what to do in your own campaign unless it is in the same vertical.

If you give me some details about what you are trying to accomplish I can give you some guiding principles. Reply here and I'll reply in public or email is in my profile if you prefer.

</comment><comment><USER4> Check out:

Perry Marshall www.perrymarshall.com \- He's very famous and his training will get you on point.

Market Motive www.marketmotive.com \- This is an excellent way to learn how to do PPC correctly as if working for an agency.

Bonus: If you haven't already, check ppchero.com for a fun ppc blog and www.kaushik.net/avinash/ for everything you need to know about google analytics.

</comment><comment><USER5> I completed the Adwords videos on Lynda.com. Very comprehensive. Actually probably went through all the videos twice to make sure I understood it fully.</comment>


Ask HN Alums: How Many Ideas Is Too Many in the YC App? - <AUTHOR>

I work with an awesome team and we have an awesome product. However, I firmly believe in hedging our bets - making damn sure that funding or no, hit or no, we are going to be a success.
With that in mind, the question of "what other ideas we considered applying for" for YC, how many ideas is too many? Currently we have 5 in there, all of them well thought out and ready to jump on. I have another 4 I'd like to mention...but is that too much?
The last thing I want to seem like is unfocused. We have a laser focus on our core product; we simply want to show we aren't a one trick pony. Comments from Alumni would be great! <comment><USER2> do 1 thing at 1 time and make it best.</comment>


Practical Semantic Web and Linked Data Applications, Common Lisp Edition [pdf] - <AUTHOR> http://markwatson.com/opencontent/book_lisp.pdf

<comment><USER2> Context, plus some other works:

<http://markwatson.com/opencontent/></comment>


A simple browser-based hexapod robot simulator built from first principles - <AUTHOR> https://github.com/mithi/hexapod-robot-simulator <comment><USER2> neat! how do you (or would you) model active and passive forces at the joints and endpoints?

edit: having helped build a hexapedal robot (way) back in the day, my first thought is modelling rather than games or whatnot.

</comment><comment><USER3> It is both ridiculously awesome and terrifying at the same time.

</comment><comment><USER4> After a quick scan of the github project I note the presence of a lot of python - in what sense is this system "browser-based"?

<comment><USER5> Some applications that don't need a complex GUI use web browsers as a frontend because they are cross-platform and they come with a bunch of 'free' UI elements like buttons, text boxes, sliders, etc. You can also style things pretty easily with CSS and JS, to a point.

It's a flexible way of writing one-off applications; you can run them locally, remotely, or on someone else's machine in the cloud. One useful example is Tabula[1], a browser-based utility for extracting tabular data from PDFs. As it is often used by journalists and other organizations that don't want to leak the data they are analyzing all over the place, it is easy to run locally instead of uploading files to their website. You just point the browser to 'localhost:port' while the server is running.

[1]: [https://github.com/tabulapdf/tabula](https://github.com/tabulapdf/tabula)

</comment></comment><comment><USER6> hedapodia is the key insight

</comment><comment><USER7> Creative use of Dash!

</comment><comment><USER8> I'm triggered by all the spider emoji. Because spiders are not hexapods.

<comment><USER9> Sorry.. Here is a simple quadruped to ease your suffering: [http://vectorslave.com/exobot/](http://vectorslave.com/exobot/)

</comment></comment><comment><USER10> This seems like a promising step towards a game based on the red spiders from xkcd[1, 2].

[1] [https://xkcd.com/126/](https://xkcd.com/126/) [2] [https://xkcd.com/427/](https://xkcd.com/427/)</comment>


Front End coding exercises I wrote for practice - <AUTHOR> I'm interviewing for a Front End Engineer position currently and I've been coding various examples in order to practice. Here are some links to various coding examples I wrote in case anyone else finds them useful (they aren't supposed to be 100% correct):
Dialog modal: https://codepen.io/anon/pen/XOdyxL?editors=0010
Undo/Redo: https://codepen.io/anon/pen/omjMro?editors=0010
Async Task Queue: https://codepen.io/anon/pen/OdbNNo?editors=0010
setTimeout with requestAnimationFrame: https://codepen.io/anon/pen/wNzZoP?editors=0110
Blocking vs Parallel (promises): https://codepen.io/anon/pen/bzBpxX?editors=1010
Evented model attrs: https://codepen.io/anon/pen/pGNbvE?editors=0010
Lisp-like interpreter: https://codepen.io/anon/pen/ErNyPQ?editors=0010
Async Generator Functions: https://codepen.io/anon/pen/RvoRLX?editors=1010
Call function only once (closure): https://codepen.io/anon/pen/ZwBOor?editors=0010
Fade in/out with requestAnimationFrame: https://codepen.io/anon/pen/aPZqBO?editors=0010
DOM Events Playground: https://codepen.io/anon/pen/aXBpmY?editors=1000
Datepicker: https://codepen.io/anon/pen/yzNVzg?editors=0010
Click dropdown menu: https://codepen.io/anon/pen/ZVgrOb?editors=0010
Tooltip: https://codepen.io/anon/pen/VgmZGd?editors=0110
Deck of cards: https://codepen.io/anon/pen/YaOYyL?editors=0010
Autocomplete: https://codepen.io/anon/pen/rzbPQM?editors=0010
Flexbox chat thread layout: https://codepen.io/anon/pen/jdMJvG?editors=0010
Tabs: https://codepen.io/anon/pen/PVNdBx?editors=0010
Simple slider: https://codepen.io/anon/pen/qgqbKb?editors=0010
Hover menu: https://codepen.io/anon/pen/roMePa
Fade up CSS transition: https://codepen.io/anon/pen/zywpXZ?editors=0110
Arrow-up/arrow-down: https://codepen.io/anon/pen/pWmpRB?editors=0010
Form validation: https://codepen.io/anon/pen/dVKGRR?editors=0010
On focus place label above: https://codepen.io/anon/pen/eGgjJx?editors=1100 <comment><USER2> That's pretty cool. Thanks for sharing!</comment>


Skillshare - a lesson in marketing futility - <AUTHOR> http://joshgoldstein.me/post/32740259627/skillshareagrowthhacking

<comment><USER2> You should be selling the benefits of poker, not poker itself. Poker education is a pretty competitive field. Since it seems that you are involved in the start up world why not give your marketing an angle: "Poker for Start Ups"

Not only do you offer a unique skill that is highly relevant to start ups. You also create an interesting networking opportunity.</comment>


Boeing's Proposed Deep Space Explorer Will Be Our Stepping Stone to Mars - <AUTHOR> http://gizmodo.com/boeings-proposed-deep-space-explorer-will-be-our-steppi-1794004347 <comment><USER2> Boeingtoday unveiled _concepts_ for the deep space gateway and transport systems _that could help_ etc etc ( as per Boeing's press release on [http://boeing.mediaroom.com/2017-04-03-Boeing-Unveils- Deep-S...](http://boeing.mediaroom.com/2017-04-03-Boeing-Unveils-Deep-Space- Concepts-for-Moon-and-Mars-Exploration#assets_117:20176) ).

It doesn't seem very serious at this point, nor likely to happen in the timeframe given (2020).

<comment><AUTHOR> Access to space is getting cheaper and we have a reasonable experience in building modules for the ISS that could be composed into different spacecrafts.

Still, I'd prefer someone threw a small/simple probe with some sort of electric propulsion (the shortest cyclers need some delta-v before passing by Earth) on a Earth-Mars cycler orbit</comment></comment>


The Video Surveillance Program IBM Built for Philippine President Duterte - <AUTHOR> https://theintercept.com/2019/03/20/rodrigo-duterte-ibm-surveillance/ <comment><USER2> "From 2013 through late 2016, when one Davao security official estimated the IBM program stopped being in active use, Filipino human rights activists who worked closely with the Commission on Human Rights claimed to have documented at least 213 extrajudicial killings carried out by Davao death squads"

It's IBMs fault those killings occurred when the system wasn't being used?

</comment><comment><USER3> But did CEO get Merit Cross of the German Eagle with Star?</comment>