Ask HN: What Personal Finance Management Tool/Software do you use and why? - <AUTHOR> Example: Quicken, MS Money, Budget Pulse, etc. <comment><USER2> Long time Mint user for the cash flow/budgeting bits. It works on all of my devices and is always up to date with my accounts for assets, debts, etc... I'm considering a change for my investments which are with a money manager; Betterment, FutureAdvisor and Wealthfront all offer similar portfolio management at a much lower cost.

</comment><comment><USER3> I'm in the UK and still using MS Money even though it hasn't been in development for years now.

Microsoft still let's you download it though: [http://www.microsoft.com/en- gb/download/details.aspx?id=2073...](http://www.microsoft.com/en- gb/download/details.aspx?id=20738)

</comment><comment><USER4> YouNeedABudget (YNAB) works for me as an effective budgeting tool where other solutions failed. It's approach acknowledges that you will over/underspend in particular spending categories. Highly recommended.

</comment><comment><USER5> Mint is pretty good for tracking spending, and I use [https://www.futureadvisor.com/](https://www.futureadvisor.com/) (only the free tier) for tracking my investments.

</comment><comment><USER6> Personally I just use Account Tracker on my iPhone to keep track of expenses and seeing how much money I'll have left at the end of the month (it's by Graham Haley on the App Store)

</comment><comment><USER7> Personal Capital, SigFig and Nvestly are all solid, but Excel ftw

</comment><comment><USER8> Mint.

</comment><comment><USER9> I use GnuCash and OpenOffice.

GnuCash is quite powerful however it is rather heard to learn. I expect that's because its instructions were written by software engineers.

Before I figured out GnuCash, I kept my checkbook in OpenOffice. Now I use OpenOffice just for budgeting. I have a really good method for it that my ex- wife figured out, and that I expanded on.

I've been intending for eons to write up my method.

I don't use QuickBooks for business finance because it charges money to download the US IRS and state tax tables. Those are provided free of charge, at considerable taxpayer expense, by the tax authorities, yet Intuit has the gall to charge, and of course the QuickBooks tax tables are in an undocumented format.</comment>


Graphene: Fast, Strong, Cheap, and Impossible to Use - <AUTHOR> http://www.newyorker.com/magazine/2014/12/22/material-question <comment><USER2> I have no doubt that graphene will change the world, but as the article mentions, it may take a long time to get there.

The thing that bothered me the most was the mention of the patent race. Everything was "patent patent patent" \- which means instead of a discovery in lab A spurring a totally new way of thinking in lab B, it restricts lab B from ever thinking that way.

Without the race to patent every single minuscule discovery about graphene and its properties, advancing early discoveries could move at an exponentially faster pace. Don't grab the ball and run with it - grab it and keep it to yourself.

I know all the arguments for patents, but I can't shake the feeling that they do nothing but stifle innovation and discovery by locking up research just when it gets interesting.

(When the measure of success is how many patents are filed, not how many discoveries are made... or how you just beat the Chinese to _filing a patent_ , I'm just a tad less hopeful.)

<comment><USER3> If you think provisional patents are stifling innovation, you should see what happens when you tell these researchers that they no longer have the possibility of getting incredibly filthy rich someday from their discoveries - because all patents have been eliminated and a new era of _" share and share alike for the common good"_ is upon us.

<comment><USER4> Nobody I know in research is in it for the money. There are much, much more direct ways for technically gifted people to get rich--look up "quantitative finance".

</comment></comment></comment><comment><USER5> Forgive me for derailing a technical thread, but I want to comment on the author's description of the building I work in:

 _A vast arc of glass with an upswept front awning, it is a kind of monument to the difficulty of predicting the future. Saarinen imagined that transformative ideas would emerge from groups of scientists working in meeting areas, where recliners and coffee tables still sit beside soaring windows. Instead, the scientists spend much of the day hunched over computer screens in their offices: small, windowless dens, which seem to have been created as an afterthought._

I don't think he gives it enough credit. Saarinen actually had an egalitarian notion: _no one_ gets a window office, because the shared hallway is one giant window. You can see what I mean in this shot: [http://www.research.ibm.com/people/a/alpert/watson_night.jpg](http://www.research.ibm.com/people/a/alpert/watson_night.jpg)

The building is long, not high. The two main hallways that go the length of the building (the inner and outer parts of a semicircle; aerial shot here: [http://upload.wikimedia.org/wikipedia/commons/thumb/d/de/IBM...](http://upload.wikimedia.org/wikipedia/commons/thumb/d/de/IBM_Yorktown.jpg/200px- IBM_Yorktown.jpg)) are floor-to-ceiling window. The spokes that actually have offices are short hallways between these two long, main hallways.

I like this building. I get to see the outside world as I walk around the building - not in glimpses, but in full. During the day, there is a lot of natural light coming from the large hallway windows. More than other office buildings I've been in, I have a constant sense of where I am, physically, with respect to the outside world. I like the notion that everyone - even the executives - get the same kind of office. (Some are a little larger, but not more than twice the size of a normal office.) And unlike cube-farms, we have private offices with doors we can close.

<comment><USER6> Got to disagree with you on this one Scott :) It's a simple matter of light- hours. Folks spend a lot more time in their office than walking between them. The light streaming in through those big beautiful windows is wasted on a mostly empty hallway!

<comment><USER5> I'm comparing it to Hawthorne, where most people had interior offices _and_ the building had completely interior hallways. I was one of those who had a completely interior office, and it sucked.

If you give some offices windows, then you must take those window spaces away from other public and private spaces.

<comment><USER7> Or you can use light wells.

</comment></comment></comment></comment><comment><USER8> I enjoyed this little jab: "It was twice rejected by Nature, where one reader stated that isolating a stable, two-dimensional material was "impossible," and another said that it was not "a sufficient scientific advance.""

It's completely impossible, but if you did manage to do it, meh.

<comment><USER9> That's peer review in a nutshell for you :)

</comment></comment><comment><USER10> I have a question for someone on here. When I began research in grad school in 2012, graphene had already been discovered eight years previously. I understand that before this happened, a "2D" atomic layer of a material had never been isolated.

What I want to know is: why was this considered impossible before then? I do molecular dynamics simulations (and am in fact performing simulations on graphene currently), and an individual layer of graphene easily stays intact in both a vacuum and other environments. The capability to simulate one layer of graphene was also available way before 2004.

So what was it that made single-layer isolation so astonishing at the time? It seems like it would have been a perfectly reasonable assumption to me (but like I said, I suppose I'm biased by the benefit of hindsight).

<comment><USER11> > I do molecular dynamics simulations (and am in fact performing simulations > on graphene currently), and an individual layer of graphene easily stays > intact in both a vacuum and other environments.

You can make a lot of 'stable' things in molecular dynamics simulations that don't exist in reality ;) You could construct any number of 2D materials that exist quite happily because they're close to some local minima or other, or because of some quirk of the potential forcefields you use. So I don't think "I can make it exist in a computer" is necessarily a good reason for expecting it to exist in reality, even if in the case of graphene it's relatively straight forward. Though useful, classical molecular dynamics is also quite dumb: it's really good for simulating known materials, but not so much for discovering new ones.

As for "2D" materials generally...well, we can make monolayers of a lot of things, sandwiched between other materials. And we can make other things that act like they're 2D even if they're not. There's nothing spectacular about it per se. The difficulty, as with all these materials, is that predicting that something has useful properties and actually being able to manufacture it at scale and relatively defect free is _huge_. You're fighting entropy, basically. So I think the surprise was not that graphene could exist in principle, but that it could be made reliably.

<comment><USER10> > You could construct any number of 2D materials that exist quite happily > because they're close to some local minima or other, or because of some > quirk of the potential forcefields you use ... though useful, classical > molecular dynamics is also quite dumb

I believe you're thinking of the state of simulation in the 1980s. There's been quite a bit of progress since then ;)

For my work, I'm using a new reactive forcefield that's based off of DFT calculations and has a very close energetic match with experiment. Another forcefield I have used is optimized for structure and almost exactly reproduced neutron spectra for a variety of hierarchical materials, including long-range order (and that was from model systems alone).

Also, QM-MM methods have recently become more popular with additional computational power, so the parts that have significant non-classical effects can be computed correctly without wasting computational power on the parts that aren't going to make a difference.

As with any tool, molecular dynamics works very well if you know the theory behind it and know what you can and can't use it for. Structural carbon simulations is one of the areas where a lot of good forcefields exist (AIREBO for instance).

</comment></comment></comment><comment><USER12> Great article. IMO, CVD is the most promising scalable, manufacturing method, but the following advances have to happen:

\- Able to grow Graphene of arbitrary thickness on a wide variety of surfaces \- Achieving CVD at low temperature \- Control of grain size, ripples, doping level, and number of layers \- Coming up with a cost-effective way to handle to the Transfer step, or eliminating it entirely

As the current market for graphene applications is driven by the production of this material, there is a clear hierarchy in how soon the applications will reach the user or consumer. Those that use the lowest- grade, cheapest and most available material will be the first to appear, probably in a few years, and those which require the highest, electronic- quality grades or biocompatibility may well take decades to develop.Also, because developments in the last few years were extremely rapid,graphene's prospects continue to improve.

<comment><USER13> I'm surprised that they seem to be concentrating so little on CVD.

Yes, CVD is expensive, but it's not rocket science anymore. We can do all manner of things to pizza-sized wafers of silicon in CVD. Shining lasers just above the surface to heat the gas but not the substrate is one of the easiest ones.

It feels like the labs are all chasing patents rather than actually doing research.

</comment></comment><comment><USER14> Shoutout to the journal that rejected the research team's findings, once for being impossible, then once for being mundane.

</comment><comment><USER15> I like the sentiment of "Friday Experiments". That's exactly in line with how we have hackathons and hackdays. They have also led to very interesting innovations.

</comment><comment><USER8> The title doesn't seem remotely accurate given the content of the article. Graphene is _already_ being used in several applications, with many thousands more being researched, a number of which were highlighted in the article. As it also discusses, it takes quite a long time for any new material to really become fully utilized; that certainly doesn't equate to "Impossible to Use".

</comment><comment><USER16> Tells a lot about current human civilization:

"The technology for the Fukushima-reactor cleanup stalled when scientists in Japan couldn't get the powder to work, and the postdoc who developed the method was unable to get a visa to go assist them. "

</comment><comment><USER17> The original Graphene paper:

"The reported graphene films were made by mechanical exfoliation (repeated peeling) of small mesas of highly-oriented pyrolytic graphite as described in the supporting online material. This approach was found to be highly reliable and allowed us to prepare FLG films up to 10 μm in size. Thicker films (d ≥ 3nm) were up to a hundred microns across and visible by the naked eye."

Electric Field Effect in Atomically Thin Carbon Films (Science, 2004)

[http://arxiv.org/pdf/cond-mat/0410550.pdf](http://arxiv.org/pdf/cond- mat/0410550.pdf)

</comment><comment><USER18> What I took most from this is that the continual battle of whether graphene will indeed be important as a semiconductor rages on. I remember back in the day when I first heard about it I wanted to hop in and invest like Texas instrument with silicon. I guess at this point it's a guessing game.

</comment><comment><USER19> Are there any other materials in the past that have taken this long to get from the lab to mass production?

<comment><USER20> Have you read the article?

"Aluminum, discovered in minute quantities in a lab in the eighteen-twenties, was hailed as a wonder substance, with qualities never before seen in a metal: it was lightweight, shiny, resistant to rust, and highly conductive. It could be derived from clay (at first, it was called "silver from clay"), and the idea that a valuable substance was produced from a common one lent it a quality of alchemy. In the eighteen-fifties, a French chemist devised a method for making a few grams at a time, and aluminum was quickly adopted for use in expensive jewelry. Three decades later, a new process, using electricity, allowed industrial production, and the price plummeted."

</comment></comment><comment><USER21> Once again fooled by a headline which is equally applicable to the realtime graphing framework...

<comment><USER10> I believe you're thinking of "graphite". Although they should make a lightweight version of their framework called "graphene" haha.

<comment><USER22> There's a project called "grapehene" which is a nicer ui for a graphite backend. [https://github.com/jondot/graphene](https://github.com/jondot/graphene)</comment></comment></comment>


Does anyone know about Twitter's funding? - <AUTHOR>

Does anyone know if Twitter went for any rounds of funding after Odeo (in their initial stages of development back in 2006)? <comment><USER2> I don't think they took any funding in 2006. Have a look at their CrunchBase profile (Funding section on the left sidebar): <http://www.crunchbase.com/company/twitter></comment>


Ask HN: Interesting Lisp/Clojure articles for experienced programmers? - <AUTHOR>

HNers, are there any interesting articles (or short books, or chapters in a book) that would show me the power of Lisp/Clojure, and make me really want to learn it?<p>(Better if a free resource, but not really necessary.) <comment><USER2> The Joy of Clojure is fine, and maybe even exciting in parts. It's worth the money, or you can have mine (hope that's not discouraging).</comment>


The AI Threat to Open Societies - <AUTHOR> https://www.georgesoros.com/2019/01/24/remarks-delivered-at-the-world-economic-forum-2/ <comment><USER3> This reminds me of the "Do artifacts have politics" paper by Langdon Winner [1]. He argues that technologies have inherent political traits.

Nuclear power is considered to be supportive of autocratic political systems since nuclear power plants need centralized planning and networks to be effective. Solar power is considered democratic since anyone can harness it. It's an interesting paper and definitely worth a read.

On similar lines, I feel internet is a democratizing force, since it allowed anyone to publish data and anyone to consume it, and is (somewhat) difficult to control centrally. AI, on the other hand, is a centralizing force, since the most powerful AI can be managed and powered by the most powerful institutions.

[1] [https://www.cc.gatech.edu/~beki/cs4001/Winner.pdf](https://www.cc.gatech.edu/~beki/cs4001/Winner.pdf)

<comment><USER4> Internet is out of control by citizens. The web was such a democratic space but browsers narrow that space down because they are centralized products. DRM-enabled only (if ever comes) will kill the web.

<comment><USER5> I don't understand - why are browsers centralised?

<comment><USER6> How many major browsers do you know? How hard it is to implement your own? How hard it is to just read and roughly audit the source code? How much control do you have over the features of the browser?

<comment><USER5> Well, several are open source. I know that they have vast and complex code bases and are extremely hard to understand or modify but it is possible and diverse communities are working on them.

For me the centralisation is at the search engine and the content generation; both have narrowed and narrowed and narrowed.

</comment></comment></comment></comment></comment><comment><USER7> AI is only in a supporting role here. It's massive data collection and storage at low cost that's the problem. Machine learning just helps to digest the data.

Tech has solved the problem of previous attempts at Big Brother - you just couldn't afford enough watchers to watch everybody all the time. Now, you can. It's even profitable.

<comment><USER8> And tech will also solve the power problem of autocratic regimes. Right now, a dictator can't control every single individual in the country on their own. They need police that can search your apt at 5am because you made a blog post critical of the government. They need lawyers to convict you, prison guards, etc. In such regimes, the dictator still has to put people into places of power so that the will of the dictator is executed. But people can refuse orders, and they can declare someone else to be president.

Coups are one of the biggest dangers for dictators, and many rebellions are semi-coups where people in power just _step aside_ , letting the rebels do their thing.

Now, enter AI. Now the dictator could give all that power to an AI instead of intermediaries. An entire government run by two entities: the Dictator, with direct control over the AI that runs the remainder. All the bomb-equipped drones, all the self-driving tanks, all the bipedal robots with their machine guns. All the robot prison-guards and the robot judges to put critical people into prison. If this AI would answer only to the head of government, then any kind of upheaval would become unrealistic and impossible.

<comment><USER9> The exertion of control doesn't even have to be blatant or physical. If social credit is a determining factor in an individual's ability to function effectively in society, e.g. by way of credit ratings and access to opportune employment, there's a clear risk of increased self-censorship and conformance, thereby debilitating serious political opposition even in its infancy.

<comment><USER10> If this social credit or indirect influence is perfectly fair, it's not really a problem. However, it's very likely it will be unfair to some, and create tension and unrest that will lead to the same problems we have without AI.

<comment><USER11> I would argue it's unrealistic to make such a system that would be fair in the eyes of all coming generations. Imagine they implemented a social credit system in the Middle Ages and added or deducted points based on whether or not you followed the laws and norms of that era.

<comment><USER10> > I would argue it's unrealistic to make such a system that would be fair in > the eyes of all coming generations. Imagine they implemented a social credit > system in the Middle Ages and added or deducted points based on whether or > not you followed the laws and norms of that era.

The middle ages basically had exactly that system, but the enlightenment still occurred.

</comment></comment></comment></comment></comment></comment><comment><USER12> History has already answered this numerous times. AI is a tool much like a semi-automatic rifle or the printing press. The people who understand it well have an accelerated advantage over those who do not. It is both a good and bad thing depending upon who wields the tool. Like any force multiplier it will be misunderstood (magic) and improperly regulated by both open and closed societies alike.

Like with any tool the real victors will be those who adapt it to solve basic immediate problems: a utility.

<comment><USER13> The question people need to address, is whether AI is a tool like the evolution from the Gun to the automatic rifle.

OR whether AI is the kind of tool like flight, which made fortresses redundant.

We have many areas of thought and society, which have been protected by walls of 'difficulty' making them intractable to large scale, automated and effective manipulation.

This may no longer be the case, and AI may well represent the more fundamental change of the second kind.

<comment><USER12> Why must people know those things? As with any new technology the second and third order consequences are unclear and will likely be entirely surprising beyond any intended (or not) consequences.

Here is what my own experience in programming and my understanding of history have taught me. A sufficiently advanced understanding of a useful technology (doesn't even have to be new) allows a small group dominance over spaces traditionally controlled by large organizations or heavy investments in large technology. This causes fear and panic when it becomes clear. The common current solution is to attempt to purchase the competition, but what if the competition is not available for purchase?

Perhaps the most common fallacy regarding new technology is that you can destroy the competition with a sufficiently large force. History has proven this false numerous times and it remains false with modern technology. Consider the battle of Argincout, battle of Crecy, or the establishment of the Yuan dynasty. Consider how much current corporations are investing in AI research with thousands of dedicated developers.

A superior technology can easily compete with Amazon's AI unit, for example, even though you may have a team of 5 developers competing against their 5000. The reason why is because it takes time to learn and develop a superior understanding of technology necessary to create the superior technology while the army of competing developers will find friction abandoning their perceptions of reality even when confronted with critical evidence. An army of 5000 developers is an establishment of culture, practices, identify, and perceptions resulting in a large stagnant wall.

</comment></comment></comment><comment><USER14> Full video of his speech. His delivery adds to the message:

[https://m.youtube.com/watch?v=7ZGoXP- BWoc](https://m.youtube.com/watch?v=7ZGoXP-BWoc)

<comment><USER15> The transcript of the speech.

[https://www.georgesoros.com/2019/01/24/remarks-delivered- at-...](https://www.georgesoros.com/2019/01/24/remarks-delivered-at-the-world- economic-forum-2/)

</comment></comment><comment><USER16> Some thoughts I just had, and haven't really developed yet beyond the initial moment of having them:

It used to be you would see theories about the internet threat to Closed societies, and I suppose those threats are real too. But perhaps the threats to closed societies are the obvious threats, and the threats to the open societies were not immediately obvious, and thinking on this is somewhat murky but if there are a bunch of obvious threats and a bunch of hidden threats then I guess people guard against the obvious threats.

Finally maybe anything that threatens one type of human society must also threaten all types, only the threats are changed around for each type.

<comment><USER17> Open societies are threats to closed societies, and vice versa. An open world is stable; a world of closed societies is also fairly stable internally, although much more likely to go to war with each other.

The idea of "the end of history" was that Open had won, and it was just a question of mopping up the remaining closed societies. It turns out that maybe the open societies weren't as open as they thought.

<comment><USER18> > It turns out that maybe the open societies weren't as open as they thought.

Or that an "open world" isn't as stable as predicted.

Would we even have the same "open" societies without China's repressive society and their willingness to finance western consumption?

</comment></comment></comment><comment><USER19> It is self evident that labeling any knowledge, technology, or artifacts to be against open society is completely nonsense and contradicts the very concept of open society itself.

<comment><USER20> It's not nonsense, as you cannot carry on mass-killing events like the Holocaust or the Goulag without a modern-ish technology like the railway system. Or, to go directly to the source, let's use Goebbels [1], as he was explaining that without modern technologies like the radio or the airplane the nazis' ascent to power wouldn't have been possible:

> It would not have been possible for us to take power or to use it in the > ways we have without the radio and the airplane. It is no exaggeration to > say that the German revolution, at least in the form it took, would have > been impossible without the airplane and the radio.

[1] [https://research.calvin.edu/german-propaganda- archive/goeb56...](https://research.calvin.edu/german-propaganda- archive/goeb56.htm)

<comment><USER21> So? let's make any modern-ish technology illegal?

<comment><USER22> Let's make leveraging technology to harm or control those who cannot effectively wield it illegal, or at least compensate for such power imbalances.

</comment></comment></comment></comment><comment><USER23> Jacques Ellul makes very similar points in his work _La Technique_ (The Technological Society). He traces how technology and power interplay from the invention of the pocket watch and steam engine, all the way to computers. It's one of the best works I've come across in this space and a must read for Technology critics and advocates alike. I wish it would be (even) more widely read here[1] than it is but finding it in languages others than English or French might prove a challenge. His follow up work "Propaganda The Formation of Mens Attitudes" is also phenomenal. These 2 books are among the best books I discovered in 2018 (if not in the last decade).

[1] [https://hn.algolia.com/?query=Jacques%20Ellul&sort=byPopular...](https://hn.algolia.com/?query=Jacques%20Ellul&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

</comment><comment><USER24> Even though the reason why the author has these positions is perfectly understandable, I don't subscribe to his views, and there is an issue in complete liberalization of movements across borders.

Fundamentally, AI is not a threat or a blessing, it is a technology.

</comment><comment><USER25> I think the biggest threat to open societies is that nobody will be able to read the warnings against dangers if they don't have money to subscribe to a thousand publications :/

</comment><comment><USER26> Perhaps this is my pessimistic view but wouldn't _any_ government that monitors it's civilians for a potential of being "against" the government (thus, threatening that government's power) be authoritarian?

Let's take the second amendment in the states for an example. The right to bear arms is meant to stop oppressive government but you cannot purchase anti- aircraft or anti-tank or anti-anything-really weapons. So, the might of the government's force is disproportionately in favour of the very government that the amendment is proposed to prevent oppression from, yeah? (Not that I'm in favour of overthrowing the government of the states, whatsoever; this is just an observation.)

When the Snowden revelations came about, this was the equivalent of China's list of people to send for "re-education". Granted, in the states, there's been no re-education (that we're aware of), it's only a small step from taking that information gleamed from those "lists" and doing just that.

At what point do we draw the line between authoritarian and not? Shouldn't the very notion of putting people on a list count? After all, it was a list of people that suffered the consequences of the Night of the Long Knives, was it not?

I fail to see how an open society would be considered "open", if it includes secretive programs like that. Isn't the principle of secret programs against a government's citizenry the antithesis of an open society?

Maybe I'm missing something here but to say that there are any open societies left (while probably dystopian in nature and bereft of any hope of the future) is beguiling the very fact that there doesn't seem to be very many (if any at all) open societies left.

(I'm probably talking bullshit circular logic, so feel free to ignore this tirade of discontent.)

<comment><USER27> I think maybe you're comparing "open society" to utopia. There will always be bad actors that have to be accounted for and handled in some way. What is bad and how bad is always up for debate, but their existence will always be with us. In my opinion that requires lists. I do agree that most countries including the US have gone too far from what I've read.

<comment><USER26> Aye, your argument has merit. I was just looking at it from a perspective of whether or not an open society is what we're in, to begin with, to argue that other societies should be more "open". It would be hypocritical to say something of such sort, if not; which is something that Soros seems to hint to with his posit (e.g.: corporations and governments combining to create a far more in-depth surveillance state).

To give a principled example, the <insert the appropriate three-lettered agency here> keeps a list of anyone who even looks-up things like TOR or TAILS. Users have their own reasons for looking the information up, and those are notwithstanding the fact they're automatically on a list, simply for doing so.

I get bad actors are a part of reality (let's be honest: they always have been) but, as I proffered originally, at what point do we decide a society is no longer open?

For example, if those who participated in Occupy[0] were on a list maintained by their respective government[s] - just for exercising their democratic right to protest - then should we consider any society open, anymore? For example, it's no secrety that those lists, themselves, are shared amongst communities, like the five-eyes.

Of course, the best example would be the no-fly lists but given that those are black box, in and of themselves, should that be demonstrative of no longer being an open society?

The O.G. comment was merely conjecture, out loud, as it were; just as this comment is... Though, I'm still left bereft of what constitutes an open society, anymore, since that definition seems to have drifted in modern times.

(Of course, maybe I _am_ obfuscating the definition of an open society with the precept of a utopia but maybe that's my stubborn hopefulness for a better future than the one that I know that's coming...)

[0] - [https://en.wikipedia.org/wiki/Occupy_movement](https://en.wikipedia.org/wiki/Occupy_movement)

</comment></comment></comment><comment> VvR-Ox You post an article about open societies and then I can't access it without subscribing - <USER2>

Just my opinion then without reading it: \- in China we already see what a government can do with technologies including AI to control the behaviour of people \- the West always seems to think it's not going to be that evil around here because people are moral superior (I don't believe that - with Hitler in Germany we saw how quickly things can change and with refugees and poor citizens in all those countries we see how badly people can treat others and still think this is correct - even without an AI they'd believe blindly) \- too many techies have no moral & ethics. While studying and also in business I saw most of the people just being interested in personal welfare and earning the most money they can

TLDR; This (whatever 'this' will be) is definitely going to happen if not enough people find back to humanity - with or without support of IT/AI/... (just tools)

<comment><AUTHOR> Btw you can read the article for free by registering, though it's a hassle. Might be easier to read from some of the alternative links with the same speech posted by others here:

[https://www.wired.com/story/mortal-danger-chinas-push- into-a...](https://www.wired.com/story/mortal-danger-chinas-push-into-ai/)

[https://www.georgesoros.com/2019/01/24/remarks-delivered- at-...](https://www.georgesoros.com/2019/01/24/remarks-delivered-at-the-world- economic-forum-2/)

<comment> VvR-Ox Thank you very much :)

But that's exactly what I dislike: for everything you wanna do on the net you're forced to register. I just can't see it anymore and instantly close stuff that behaves that way.

</comment></comment></comment><comment><USER28> It is not AI. It is the chinese communist party.

Otherwise might as well have a paper called "The Internet Threat ..." or "The pen and paper threat ..."

The America fought Soviet Union. But ok with a communist party in china, with their all in and everywhere in the society (and copy things on top of contributions) ... it might be too interwoven and too big to ...

Good luck.

<comment><USER24> Also the US antagonized the Soviet Union but ultimately it fell by itself.

Remains to be seen what will happen in the Chinese case.

<comment><USER29> The Soviets dumped all their resources into war economy output. The Chinese, consumer goods for the world pay for their war machine, which is basically the strategy the US used to have.

</comment></comment></comment><comment><USER30> I've been interested in science and engineering since my youngest days and I've always considered myself a hacker from way back. At school, my fellow schoolmates nicknamed me 'The Boffin' as back then the terms 'hacker' and 'nerd' hadn't yet been coined. My profession is electronics engineering and IT and for my entire career I've followed and worked with the latest developments in the field. Right: I'm an insatiable technophile!

My other studies were in philosophy (ethics, etc.) and government and over the years I've found my formal training in them truly invaluable, they've broadened my perception and worldview about the ways science and engineering dovetail into society and make the world a better place by improving the lives of its citizens.

I have to agree with the tenet of George Soros' message for many reasons but from my perspective perhaps the most significant one is that we are moving at a frenetic pace headlong from an industrial age into a post industrial one that's driven by advanced technologies (and primarily through the use of information). We're entering a new era whose paradigms will have morphed into ones so very different from anything humankind has ever before witnessed and the changes are coming so very fast that they'll almost certainly cause fear and social disruption on an unprecedented scale unless we act now to adapt technology to our human needs and not those of governments and large multinational corporations—after all, they ought to be our servants, not vice versa as it is at present.

At present, society is both ill prepared and ill equipped to handle monumental changes of such a magnitude without considerable preparation, and we've hardly even begun to discuss the matter let alone draw up viable plans for society to adapt to them.

Leaving ML and AI aside for a moment, let's just look at the metaphysical† aspects of the Google/Facebook revolution. Both behemoths, but especially Facebook, are floundering in the mire over very important issues such as those concerning privacy, fake news, damaging effects on democracy and politics in general, and there's precious little light on the horizon to shine upon any potential solution let alone any commonly-agreed methodologies or viable options.

Let's look at what has effectively happened here: internet technologies evolved to a stage where worldwide networks such as Facebook became feasible and thus they were built without any real thought of the wider social consequences other than the paramount need to make money. Zuckerberg et al would like us all to believe that they had actually executed both their financial and social objectives as they'd planned but as we now know this is far from being the full truth.

Not only did Big Tech companies have secret plans all of their own with the deliberate intention of exploiting users but they kept these intentions hidden from both governments and users alike thus no independent scrutiny was possible until the inevitable leaks occurred. The lesson from this is that with no oversight, undesirable metaphysical effects arose from their complex systems the consequences of which have come back to bite them. Inevitably, this will happen again and again with ML and AI unless careful and sophisticated (and mandatory) regulation is introduced. To think otherwise would be foolhardy in the extreme.

It's clear to many that these 'geniuses' of Big Tech would have been fully cognizant of and understood how new physical properties often emerge from complex systems that are not foreseen from just examining their less complex building blocks. Moreover, similar but metaphysical processes evolve in human minds when they encounter complex systems. For instance, examining fine architecture brings an aesthetic experience to humans that no examination of a brick to the nth degree reveals. Therefore, there can be little if any excuse for Zuckerberg and his cronies for not anticipating in advance emergent human problems (such as those that have arisen from the Cambridge Analytica fiasco).

When in 1847 Italian chemist Ascanio Sobrero* invented nitroglycerine and immediately perceived its extreme dangers he became so scared and concerned about what he'd actually done that he kept the fact secret for over a year. However, unlike Sobrero who clearly had ethics on his side, the likes of Zuckerberg et al never gave any serious consideration of the consequences of their 'inventions'. As day follows night, they were expecting human problems but they simply ignored them until it was too late. Their lack of concern for humans—the hands that actually feed them—is palpable in the extreme; ethically and morally they're bankrupt.

As history illustrates yet again, we're now well past the point where it's safe to leave extremely powerful technologies in the hands of political novices who possess so precious few ethics—or whose few ethics are easily trumped on by their zealotry for certain technological fixes and or financial objectives. The fact that they may be the inventors or owners of newer technologies such as Facebook is irrelevant; what matters first and paramount is what is best for the citizenry and society at large.

The Google, Facebook et al cases ought to have been a non sequitur from the very beginning as the general will of the populus should have nailed them dead from the outset but it never happened for many reasons, including the highly addictive properties that Big Tech deliberately designed into their pernicious technologies. Tragically, over the past 40-50 years or so, many traditional ethical values which would have put the kibosh on these Tech Giants long before they'd gotten started have largely evaporated as our societies have become more homogeneous and international—nowadays, the lowest common ethical denominator is just that—pretty low.

Given that societies are still struggling with very basic ethical issues such as withering of our hard-fought democratic processes, rise of totalitarian power from both governments and Tech Giants then we're not even at ground level when it comes to solving the ethics of ML and AI. For starters, there are serious cultural differences (hence little or no agreement) over how to resolve the infamous trolley car/moral dilemma problem‡. At present, it is abundantly clear the various societies of an international world are not able reach a common worldview or consensus on this conceptual problem let alone a specific ML/AI incarnation thereof, consequentially we have precious little hope for solving even greater moral and ethical dilemmas that undoubtedly will be created by these fast-advancing technologies.

It seems to me very first steps must be taken to forge a common moral and ethical consensus for humankind. We need to first begin with the easiest problems to agree upon such as the inviolability of human life and then work upwards. Expect this to take a long time and it will. Of course, the huge dilemma is how to hold technologists and technocrats sans ethics (and common sense) at bay whilst various consensuses are being reached.

I am strongly of the opinion that (as I was fortunate enough to experience), we should begin by ensuring that core training for all engineers, scientists, technologists and technocrats—and for that matter, politicians—also include compulsory training in key philosophical subjects, especially ethics, moral philosophy and formal logic as well as basic/essential political science (the study of government).

I'm realistic enough to realise that despite such ethical studies being both core and compulsory, there is every that they will only have a minor impact in changing human nature if anything at all (at least in the beginning). Nevertheless their compulsory nature will achieve one major objective which is that every engineer, scientist and technologist and technocrat will be forced to learn the essentials of morals and ethics as they should be practiced in our increasingly technological societies.

Thus when their technologies go belly-up and damage both societies and people lives, with compulsory training in ethics under their belts, the Zuckerbergs of this world will no longer be able to claim ignorance as an excuse for their negligence, they will not be able to say that they 'did not know' or that 'we never considered that outcome'. The only likely excuse that they'll have left to argue is that of 'force majeure'—and it'd had better be a pretty good instance thereof or they'll be toast. …And good riddance.

Good effort George, keep the pressure up.

_____________

† As many will be aware, the uncomplicated definition of 'metaphysics' is 'above and beyond physics', that's to say ontological a priori deductive concepts of existence, of being, of becoming, reality etc. As far as Physics is concerned, metaphysics deals with ethereal, intangible concepts that are inconsequential to its Laws but nevertheless they're key to human existence as we know it, what it is to be human, our values, beliefs and ethics are metaphysical.

‡ The Moral Machine experiment , Nature, vol. 563, pp59-64, 2018-10-24 [https://www.nature.com/articles/s41586-018-0637-6](https://www.nature.com/articles/s41586-018-0637-6) Especially note graphs in Fig. 3: 'Country-level clusters'.

* Incidentally, Alfred Nobel was a student of chemist Ascanio Sobrero.

___

</comment><comment><USER31> This is kind of funny how this article focuses on China and totally leaves our surveillance capitalism (Google, Facebook) out of the picture. If this article was unbiased than we would see example how the AI threat impacted the last election in the USA as well.

<comment><USER32> It's probably presented in such a way to b convincing to the maximum amount of people. Being addressed to an English-speaking audience that tends to already be suspicious of a Chinese grab for economic power, that serves as common ground to establish rapport with the audience.

This being Soros, any connection to the US election would already doom his message to be disgeraded, or even taken as evidence for its opposite.

</comment></comment><comment><USER33> Any non-paywalled version?

<comment><USER8> [https://www.wired.com/story/mortal-danger-chinas-push- into-a...](https://www.wired.com/story/mortal-danger-chinas-push-into-ai/)

<comment><USER9> Mods, please consider changing the link to this.

[edit] From the speaker himself: [https://www.georgesoros.com/2019/01/24/remarks-delivered- at-...](https://www.georgesoros.com/2019/01/24/remarks-delivered-at-the-world- economic-forum-2/)

</comment></comment></comment><comment><USER34> I disagree with the premise. The threat from AI, while serious, isn't immediate compared to the threat of using thing like AI to justify inequality. You want to tell me that suddenly the global elite became concerned about relatively esoteric technology to the point where common politicians talk about it like it is the tax rate? And that just happens go with with the effects of globalization, crony capitalism and extreme rent seeking? If the excuse wasn't AI it would be something else.

</comment><comment><USER35> When Trump and Soros sound the same, they're probably right.

</comment><comment><USER36> here is an idea: instead of sacrificing AI maybe we should sacrifice organized governments.

<comment><USER37> It has been tried in the world history many times and is currently being tried in some parts of Somalia. Most of people do not prefer that, so if you do, maybe you should move there?

My guess is that we are about to see "No True Scotsman" very soon after I post this.

</comment></comment><comment><USER38> That's funny coming from from George Soros especially that it was delivered at Davos.</comment>


Funding Lessons from a Successful Kickstarter Campaign - <AUTHOR> http://www.readwriteweb.com/start/2011/01/funding-lessons-from-a-success.php <comment><USER2> You may want to use Invested.in (from what I understand it is more "open" while KickStarter projects are edited / filtered).

Disclaimer: Invested.in is my brother's company.

</comment><comment><AUTHOR> Anyone on HN using Kickstarter? I have this crazy simple hardware accessory idea that I keep thinking of every time I see a Kickstarter story.

<comment><USER3> why not just do it, then? (edit: "it" = use kickstarter)</comment></comment>


Black Fungus Found in Chernobyl Eats Harmful Radiation - <AUTHOR> http://www.foxnews.com/story/0,2933,276196,00.html <comment><USER2> I read this awhile back and it made me wonder why if that fungus could exist here why it doesn't already exist on other planets. The fact that all sorts of crazy life forms are here and nowhere else is interesting.</comment>


InfoWars' conspiracy theories have advertisers ditching YouTube channels - <AUTHOR> https://arstechnica.com/gadgets/2018/03/infowars-conspiracy-theories-have-advertisers-ditching-youtube-channels/ <comment><USER3> Good. InfoWars and the rest of these turgid shit outlets are a cancer on society, and advertisers absolutely have the right to not want to fund or be associated with them.

</comment><comment><USER4> Sure, nobody wants to be associated with the next armed person who tries to take down a "secret pedo ring" in the non-existent basement of a pizza joint. After all, it may not end without bloodshed next time. Advertisers are going to start placing similar demands on YouTube that they do on TV, and for the same reasons. They don't want or need bad press.

Of course this might finally open the door to taking a slice of the video hosting pie. It might also end up like a Reddit vs. Voat, because at the end of the day a lot of the crap being objected to here is really quite objectionable. I know that people like to invoke freedom of expression arguments, censorship and so on, but again, look at Voat if you haven't eaten lately; it's a combination of appalling and dead.

Usefully though, these alt sites can act as a useful way to monitor the degree of real censorship, if it exists. When and if you start to see significant amounts of something other than paranoia and hate there, you'll know something is being suppressed elsewhere. So far though, not much.

<comment><USER5> Shrugs, people invoke freedom of expression where it simply doesn't apply, YouTube is a private entity, they can pretty much nuke any content for any reason.

Frankly they have a tough path to carve between objectionable content and damaging their platform.

YouTube's suggested videos is a tire fire, they suggest stuff I'm not remotely interested in and wouldn't watch at all.

I mean my interests aren't hard to profile, engineering videos, chess videos and programming stuff.

<comment><USER6> > Shrugs, people invoke freedom of expression where it simply doesn't apply, > YouTube is a private entity, they can pretty much nuke any content for any > reason.

You've got it mixed up, you're only supposed to deploy that snark when someone complains about a private company violating _First Amendment_ rights.

Seriously now, I think its very important to consider how the increasing concentrated private ownership of public communication affects the people's natural rights of free expression. The legal regime that was developed to protect free expression when there was only one entity (the government) with the concentrated power to widely censor may no longer be adequate for the modern world.

<comment><USER7> Outcasts and undesirables aren't invited to parties. Is that censorship or is that just how society works?

<comment><USER6> It could be if there's only one or a handful of groups throwing parties, and if going to parties is essential to political participation.

Put another way: what wasn't censorship when there were a dozen independent media outlets in every city becomes censorship when there are only a dozen or fewer independent media outlets in the whole country. We're not there yet, but that's the direction we're headed.

<comment><USER4> Is it? So far all of the outsider parties are full of exactly the kind of people who should be shoved into margins. When I start to see more physicists, doctors, artists, etc making the same complaints as trolls and dimestore Nazis, I'll worry.

<comment><USER6> You're in pretty dangerous territory when you start to justify censorship because the right people are getting censored. Censors, be they government or not, _never_ think they're censoring the wrong people, they always think they're doing the right thing.

Also, if media and network consolidation make non-government censorship as powerful as government censorship, and the "physicists, doctors, artists, etc making the same complaints," then it's probably too late to do much about it. It's much better to nip the problem in the bud, and prevent the infrastructure of private censorship from getting too developed.

Think of it this way: if you give too much power to good people in government, then when some crazy fucker like Donald Trump comes along, he can do a lot more harm because he has all the tools and precedents he needs to fuck things up, handed to him ready-made. It's the same for power generally.

<comment><USER4> _You 're in pretty dangerous territory when you start to justify censorship because the right people are getting censored. Censors, be they government or not, never think they're censoring the wrong people, they always think they're doing the right thing._

I'm not making that argument, and I'm not diving into the bottomless pit or what people "feel" is censorship, when it's appropriate, etc. HN exists by virtue of constructively and carefully applied censorship, with a specific and stated goal to avoid degradation and collapse. Censorship is a tool like any other, none of us should expect to be free from it. _Government_ censorship is a whole other matter, but fortunately the 1st ammendement protects against that.

To the rest, I've been hearing the same "if's" from the same bad actors for decades. After all, when a good argument or cause is absent, out come the slippery slopes. I'm just tired of it. It always seems to come down to a plea for assholes to be given deference, and anything short of that is "censorship". Please.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> What could CNN possibly write about a company relating to their advertising on InfoWars content that would outweigh the very real $$ savings now that there are less competitors to advertise to InfoWars's massive audience?

This is good news for any firm who just wants as many people as possible to see their ads, and I suspect this consequentially won't mean any real loss (and potentially a gain as other firms rush to fill the void) for InfoWars.

The way I see it, CNN only managed to scare off these big firms because the specific employees who manage their Youtube advertising campaigns were scared the (very real) possibility of being fired because a nasty article _might_ reflect badly on their firm and would "tarnish the brand" or some other such intangible reasoning.

</comment><comment><USER9> CNN is contacting and doxxing every individual brand/company whose ads happen to appear on the youtube channel. Isn't this a form of anti-competitive abuse of market position?

[http://dailycaller.com/2018/03/03/infowars-cnn-youtube- ads/](http://dailycaller.com/2018/03/03/infowars-cnn-youtube-ads/)

<comment><USER10> > Isn't this a form of anti-competitive abuse of market position?

No, for the same reasons Gordon Ramsay isn't "competing" with children making mud pies in the back yard.

<comment><USER9> Regardless of how tiny or slimy the little guy is, or how much they "punch up" at their mainstream competition -- isn't "punching down" effectively stooping to their level? You're either admitting you also engage in activism, or you're admitting to hard knock competitive practices.

I did not mean to imply it was illegal, or even immoral. But their sharing the same industry is facet of the story that many commenters seem to be glossing over.

<comment><USER10> Still no.

Groups like Infowars have a newsworthy impact on the political climate, and deserve coverage by news organizations. It's not about activism - <USER2> intersection of advertising and extremist content on places like YouTube is a very legitimate subject for journalism, if you ask me.

</comment></comment></comment></comment><comment><USER11> They are not the ones that took us to war with Vietnam, Afghanistan, Iraq, Syria, Libya.

The mainstream news is the one that is complicit in the spread of dangerous Conspiracy theories such as: "Saddam was behind 9/11 and has Weapons of Mass Destruction!"

Boom. 10,000's of US soldiers dead and many more crippled.

1 Million Iraqi people dead.

Infowars has more often than not been right on important matters. Is Alex Jones over the top? Of course!

Are their Chem Trails and other conspiracy theories "out there"? You bet!

But look up MK Ultra on Wikipedia and other programs that the US/CIA ran and you will realize that truth is stranger and much more dangerous than the "conspiracy theories and the penis pills" that Alex Jones is talking about.

At least those Penis pills aren't like the Opiates and depression medication that kills 10's of thousands a year that MSNBC, Fox, CNN et al peddle.

Use your ability to think: this is an information war and the MSM is the most dangerous kind of "fake news" and they are fighting tooth and nail to be the ones allowed to define their competing broadcasters as "fake" (since Infowars is now becoming huge)

<comment><USER12> >Infowars has more often than not been right on important matters.

Would you mind providing a list of those things it's been right on?

<comment><USER13> Gay frogs :D (although they claim this is a government plot, rather than the US gov refusing to ban use of certain chemicals at the behest of farmers)

<comment><USER14> Yes, that's the unfortunate problem. They often bring up issues and questions that won't be discussed anywhere else. Then ruin it by throwing in some heavy conspiracy without any supporting evidence.</comment></comment></comment></comment>


Must have CSS for HTML5 + Firefox - <AUTHOR>

header, section, article, hgroup, aside, footer, nav { display: block; }
This tripped me up the first time I made an HTML5 page while developing in chrome.. switching to Firefox everything looked messed up.
Just a tip for those of you considering switching or starting a new HTML5 site. <comment><AUTHOR> We're building our application HealPay in HTML5 so if you want to see a real HTML5 site in action, check back with us soon. Posted on HealPay on HN:

<http://news.ycombinator.com/item?id=2252214>

<comment><USER2> ubercool

</comment></comment><comment><USER3> Have you tried it in IE :P

<comment><AUTHOR> No yet :)

Evidently if you use html shiv, you should be able to support ie6+</comment></comment>


Unauthorized code in Juniper ScreenOS allows for administrative access - <AUTHOR> https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554 <comment><USER2> Hoo boy, most of these things don't worry me, but this one does.

I'm semi-responsible for some Juniper gear, thankfully all Junos (BSD) based, but I no longer trust any of it if this is malicious injection vs. a bad review. However, what the hell can I do? I can't audit the code. I trusted Juniper, and now I'm stuck with that trust being burned. Running to any other proprietary network vendor is just as uncertain.

If Junos gets a bulletin, I have a lot of work on my hands very soon, as do a good chunk of service providers. I remember there being rumors of a certain three-letter agency saying they had some type of exploit for the Cisco ASA as well; I wonder if it was something this deep, vs. just a run of the mill RCE vuln.

This is one more reason to use open-source products for actually security- sensitive systems, maintain a good amount of defense in depth, and do a little bit of auditing of the code you're using yourself. More often than not these days, it sure pays to be paranoid.

EDIT: At the same time, this also really makes me respect Juniper more than I have previously. A company that finds this internally, on their own audit, could have patched it silently and said nothing about it to anybody. It probably would have been better for them PR-wise. The honesty is worth me not jumping ship to another (probably compromised) proprietary vendor, but you betcha if I can get away with it, I'll run something open-source and community audited when I can.

<comment><USER3> I've always regarded networking equipment as outside my security boundary. All it does is forward packets to the right places; an attacker can deny service by shutting that down or sending them to the wrong place, but nothing else. All my connections are encrypted and authenticated at a higher level.

Do you terminate SSL or something on yours? Or have open unauthenticated services running on your internal network? If not, what's the actual threat here?

<comment><USER4> \- Plenty of services that can't adequately be secured any other way are often mitigated by restricting access to VPN users coming in over a network device. I appreciate that "just secure the service" is supposed to be the best practice, but when you're talking about things like IPMI interfaces or SCADA devices the alternatives approache zero

\- Controlling the networking equipment can open you up to things like sslstrip

<comment><USER5> "things like IPMI interfaces or SCADA devices the alternatives approache zero"

My strategy with IPMI has been to assign IPMI non-routable, private IP addresses, then block that address space at the interior of the network (which is sort of redundant) and then require folks to SSH onto an interior host and connect to IPMI that way.

I would be very interested in, and receptive to, criticisms of this model ...

<comment><USER3> The argument there would be that it's very hard to secure all access to a network - anyone compromising any network device, or e.g. physical access to the cable runs in the building, then had access to IPMI.

In a high security situation I'd keep the IPMI network physically segregated, with a small number of machines acting as access to it. Or maybe connect IPMI only within each (locked) rack, and require using something like ansible if you want to perform an operation across more than one rack. Whether the cost/benefit fits for your circumstances is another question of course.

</comment></comment></comment></comment></comment><comment><USER6> I work for a company which makes network devices. We've detected many hostile intrusions in our network. If you make hardware or software that runs in enterprise datacenters, someone is surely going to be trying to steal your source code to find exploits and possibly put backdoors in.

We use multi-factor authentication just to get in the corporate network and a separate, airlocked engineering network to store our IP. From what I've talked to from my colleagues at other major device manufacturers, this is becoming the industry standard (seven years ago I scoffed at Ericsson's paranoia for having a sequestered engineering network. Turns out they just saw the attacks earlier than we did).

In our case, doesn't seem to be the NSA. Looks more like China. Could easily be either one, or yet another party. This is the world we live in.

<comment><USER7> When I set up the Stock Options system at Netscape (as the Desktop Support guy) back in 1997, It consisted of two computers, connected to each other via a switch, in a Locked room, with a wall all the way to the ceiling to reduce false-ceiling access, with that room also located inside the Secure Legal Office Space. Systems were backed up daily by the users, using encrypted backups to Zip Drives.

It's interesting how when you don't know what the hell you are doing, you sometimes do something reasonably secure by pure happenstance. (Also, I had probably read too much Bruce Schneier when I was a teenager.)

<comment><USER8> What exactly did the Stock Options system do? Was it the registry of options? Did the accounting department have such a secure setup?

<comment><USER7> I'm not 100% familiar with what precisely they were tracking. The software was called "Equity Edge", and it involved employee stock options. I do recall contacting their support organization when I realized the data files they were storing on the hard drives didn't seem to be encrypted (the systems were Windows 95). Netscape had two employees whose sole job seemed to be the care and feeding (and data integrity) of this system.

Data was sent to the Accounting Department (and other Lawyers) on Printouts.

</comment></comment></comment></comment><comment><USER9> Holy shit. You thought you'd read the important security news of the day on HN, but, nope: Netscreen VPNs were backdoored!

<comment><USER10> Yeah but Thomas, this isn't a million dollar bug.

<comment><USER11> Points.

</comment></comment></comment><comment><USER12> This might not mean anything, but NetScreen-5GT 6.2.0r15 (The first affected version) was the first release with a SHA-1 sum. April 2015 is the first archive of this page I could find.[0]

I wonder if the reasoning behind the SHA-1 is (possibly) that they were starting to notice some strange activity.

I applaud them for disclosing all of this. That could not have been an easy thing to have to do.

[0] [https://web.archive.org/web/20150422145246/http://www.junipe...](https://web.archive.org/web/20150422145246/http://www.juniper.net/support/products/screenos/ns5gt/6.2/#sw)

Archive link:

[https://archive.is/jdw13](https://archive.is/jdw13)

</comment><comment><USER13> Your government is illegaly modifying commercial software so they can spy on you without warrants. Your government is doing this through illegal breaking and entering, or by paying people to defraud their employers, or by using extortion to force people do these illegal acts.

Your government put CISA (Warrantless Wiretaps) into the budget bill.

Wake up.

Vote against any elected official that supports these things. Tell your elected officials you want your privacy and you will work to put them out of office if they don't defend it.

<comment><USER14> They aren't _my_ government. This is the actions of a foreign government.

<comment><USER15> How do you know?

<comment><USER14> Because my government is bad at technology.

</comment></comment></comment></comment><comment><USER16> [http://arstechnica.com/security/2015/12/unauthorized-code- in...](http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper- firewalls-decrypts-encrypted-vpn-traffic/)

<comment><USER17> _" It's not clear how the code got there or how long it has been there. An advisory published by the company said that NetScreen firewalls using ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 are affected and require immediate patching"_

If the use a Subversion/Git code repo to maintain their codebase, they should be able to track down who wrote the code and when.

<comment><USER18> export GIT_AUTHOR_NAME="Barack Obama"

export GIT_AUTHOR_EMAIL="email@example.com"

<comment><USER19> That's the who not the when or how

<comment><USER20> For the when:

GIT_COMMITTER_DATE="Tue Dec 8 12:33:03 2015 +0000" git commit --date="Tue Dec 8 12:33:03 2015 +0000"

That will change the commit and author dates.

<comment><USER21> Shouldn't the server log incoming pushes so you can find when the commit arrived, not just when the commit claims to have been made?

Maybe they _don 't_, but this seems like something they ought to do.

<comment><USER8> You could have them do it, but it's just going deeper down the rabbit hole. The eventual question is "who/what do you trust?" \- maybe it was the git server that got pwned?

A PGP-signed commit with a key generated on a smartcard (and never exposed) is a little better, but ... Someone pwned RSA before, and I'd be surprised if Gemalto and Yubico (just two examples) don't have some Three-Letter-Agency backdoor (and .. I'm sure those TLAs have equipment that can read modern smartcards).

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Should we take that as a dysphemism for "code that wasn't security-reviewed by someone who should have been Cc'd on the review" instead of the much more obvious "malicious commit, either from an employee or an attacker"?

<comment><USER23> The former would be authorized but unreviewed, unauthorized seems to mean they got owned.

<comment><USER24> I doubt they would be so open if that were the issue. My bet is unreviewed code or including an open source library without proper oversight.

A revelation that their code repositories have been compromised and injected code has been released would call into question all of Junipers products.

<comment><USER25> If it was an open source library that was imported there would be a link to the CVE affecting that library most likely and that CVE would've been updated to announce that it affects additional systems (JUNOS/ScreenOS) this would usually not trigger a completely new CVE from being issues (i.e. Heartbleed and Shellshock which got updated for weeks and even months when new systems were discovered to be affected). The "unauthorized code" also introduced 2 separate and unrelated vulnerabilities one which allows you to bypass the authentication by some means (logs you in as a SYSTEM user), and another which allows you to decrypt VPN traffic. The overall phrasing (knowledgeable attacker), the fact that a fresh CVE was issued, and the fact that 2 unrelated but very specific vulnerabilities were introduced into the system makes me think that this was more intentional than just an issue with importing code from a 3rd party.

<comment><USER24> Then all Juniper code should be thought of as tainted. It's really as simple as that. Juniper has announced that everything they have released can not be trusted.

EDIT: > it was an open source library that was imported there would be a link to the CVE affecting that library

That would only be if it was a error in the library that caused this and not the way it was used.

I just do not see Juniper coming out and so casually saying, "Our source code was clearly compromised, and this is the one instance of them changing our released code that we found."

<comment><USER25> If it was poor implementation that's not unauthorized code. Also I don't remember the last time that "unauthorized code" was used to describe the cause of a vulnerability, and code being committed without undergoing the full code review and compliance process is quite a common occurrence and also a common cause for some security vulnerabilities, especially ones that are easily caught by static code analysis.

The phrasing, the very specific nature of the vulnerabilities, the "knowledgeable attacker" requirement which means that you can't just fuzz your way into it just like any other zero-day and the fact that some of the Snowden documents that were published mention an NSA specific backdoor for Juniper firewalls means make me think that this wasn't an internal process failure.

If the process would've failed we would've gotten an advisory at the most without any specifics, the fact that they've intentionally mentioned that unauthorized code managed to get there is almost like a canary, they said that they've been breached without effectively saying that.

</comment></comment></comment></comment></comment></comment><comment><USER26> An attempt at a diff: [https://gist.github.com/hdm/107614ea292e856faa81](https://gist.github.com/hdm/107614ea292e856faa81)

</comment><comment><USER27> Isn't this somewhat unprecedented: a major vendor announced their source base has been actively compromised by a malicious party?

If so, this is a potentially industry-changing event.

<comment><USER28> Not really:

[https://en.wikipedia.org/wiki/Operation_Aurora](https://en.wikipedia.org/wiki/Operation_Aurora)

[http://www.nytimes.com/2014/03/23/world/asia/nsa-breached- ch...](http://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese- servers-seen-as-spy-peril.html)

<comment><USER29> There was also [https://lwn.net/Articles/57135/](https://lwn.net/Articles/57135/)

<comment><USER30> That is a certainly a compromise attempt, but I wouldn't call that 'actively compromised'—looks like a secondary CVS mirror repo was pushed to, and it was noticed "quickly". No damage done there.

</comment></comment></comment></comment><comment><USER31> "Unauthorized" seems strangely vague - does that suggest something was released without code review, or that an attacker actually managed to get something into their codebase?

<comment><USER32> Lots of network devices don't do any kind of real validation of the updates they get from a remote server, beyond using SSL which only checks that the origin is correct.

A while ago I accidentally stumbled upon the file servers that served updates for a major router manufacturer. The host vulnerability itself was reported and fixed, but I doubt they told their clients (the router company) anything.

In that case, anyone who found the vulnerability could have modified the binary blobs, I wonder if this is a similar case.

<comment><USER33> It sounds much more like someone made their own "contribution" to the source code.

For JunOS, updates are digitally signed (and verified when installing) so any modifications would have had to occur before the images were built, but I really can't remember if ScreenOS updates are signed or not (it's been a long time).

</comment></comment></comment><comment><USER34> Sounds more like an insider committing an obfuscated exploit, or a plausibly deniable bug.

Props to Juniper for owning up. Unless that is part of the con...

</comment><comment><USER35> Can someone explain how the code is able to decrypt VPN traffic? I'm no expert on VPNs but I thought they provide end-to-end security and the protocols could detect tampering?

<comment><USER36> There is speculation it compromised the cryptography used for VPN traffic, enabling someone with access to that traffic to decrypt it through brute force:

[https://twitter.com/matthew_d_green/status/67787100435437158...](https://twitter.com/matthew_d_green/status/677871004354371584)

</comment></comment><comment><USER37> There's no proof at this stage that a government agency is behind this. It could easily have been an employee inserting this code in an attempt to blackmail the firm, or perhaps to gain financial advantage by learning corporate secrets that would allow them to beat the stock market.

Hopefully there are source-control logs that show when this alteration was made and by whom, but given how hardware companies treat software I doubt it.

</comment><comment><USER38> If anyone is interested, I have been working on diffing the code for the backdoored vs patched versions: [https://github.com/hdm/juniper- cve-2015-7755](https://github.com/hdm/juniper-cve-2015-7755)

</comment><comment><USER39> tl;dr Project aurora was a series of attacks in 2010/11 where Chinese attacked the SCM of major companies. Juniper _may_ have had its SCM polluted without going through normal review processes

And so signing code patches looks like a good idea.

<comment><USER40> Juniper hasn't released nearly enough details to conclude that this was related to Operation Aurora.

<comment><USER39> I meant that the implication seems to be the code got there not by an authorised committer adding bad code, but by external party adjusting the SCM - the conversation seemed to be heading off into wilds of "code review practises"

</comment></comment></comment><comment><USER41> I think a lot of the focus here is on technical penetration of organisations. Much easier in many cases to just do a human intelligence penetration of an organisation to put the code in place.

</comment><comment><USER42> TLDR: ScreenOS was backdoored.

</comment><comment><USER43> Can someone detail how widely Juniper/ScreenOS is deployed in the wild?

<comment><USER44> It was a best seller before Juniper started using JunOS on their new firewalls (SRX) and it continued for a while due to being rock solid and their ability to do pretty much anything in a fairly easy way.

I remember working with my first SRX in 2009 and nowadays I still talk to customers rocking ScreenOS devices. I've lost any trust on them due to this news, of course, but boy their OS and feature set was awesome... I did like them so much that I bought a tiny NetScreen 5GT a few months ago for £10 only to gather dust on my desk for weeks, until I gave it away to a colleague that had a better use for it :)

Anyway, I derailed. They were everywhere and they're probably still around in many SMBs.</comment></comment>


Samsung Galaxy S2 launches finally in US on August 29 - <AUTHOR> http://www.i4u.com/47500/galaxy-s2-release-august-29-confirmed

<comment><USER2> It looks just like an iPhone.

That not exactly a bad thing. Most new cars are similar variations of other cars in their class (sedan/suv).

But if I saw someone carrying it, I would just think its another iPhone 4.</comment>


The death of optimizing compilers [pdf] - <AUTHOR> http://cr.yp.to/talks/2015.04.16/slides-djb-20150416-a4.pdf <comment><AUTHOR> I really liked the Knuth quote at the end.</comment>


Ask HN: A company gave my business data to a client without consent. Can I sue? - <AUTHOR> Ask HN: A company gave my business data to a client without consent. Can I sue?
Any lawyer recommendations along with advice would be very helpful.
I run a marketing consulting agency that purchases ad inventory from another ad agency. I then resell this inventory to my consulting clients.
One of my clients contacted the ad agency that my consultancy uses (they figured out who I used) and requested data from my business account relating to their website. The ad agency gave them impression data and the financial costs that my company incurred for those impressions. This was done without my consent.
I was told before in writing that no one would be able to access my account except myself. Also from their privacy and data policy on their website this is made clear as well. My client is not a part of my company and the account is under my own company name. However my clients website name is listed in my clients section of my account.
After my client received the data including the costs I incurred (I mark up the prices) they decided to terminate their relationship with my company and purchase direct from the ad agency. This was a client for over 5 years, my largest client, and has ruined my company.
Am I able to sue the ad agency and reach a financial settlement of some kind? Their actions have ruined my business financially and I'm not sure what will happen with me personally because of this. Further, is what they have done illegal? Perhaps against US or GDPR data laws? I am a US company and they sent the data to Europe.
Any help would be greatly appreciated. <comment><USER2> This sounds way to complicated to solicit advice on HN about, however there are definite things that you should probably go talk to a lawyer about to get clarified what your options are. Especially that told in writing part, if you have the communication and the context was something to do with signing a contract with the agency they may very well be screwed.

<comment><AUTHOR> Thanks for the response. I figured this would be much too complicated for direct advice on HN. However, I posted here because the company has been talked about a lot on HN before and I wasn't sure if any lawyers were here with experience in tech/data who would reach out. Frankly, I'm not even sure what kind of lawyer to contact.</comment></comment>


Browser DOM Api in JavaDoc style - <AUTHOR> http://krook.org/jsdom/

<comment><USER2> You also have the (probably outdated) actual w3c javadoc [1] and GWT docs that closely emulate the dom [2]. I believe yours is a tad bit more complete (and not all_java related), but less documented.

1 - <http://www.w3.org/2003/01/dom2-javadoc/index.html> 2 - [http://google- web-toolkit.googlecode.com/svn/javadoc/latest/...](http://google-web- toolkit.googlecode.com/svn/javadoc/latest/com/google/gwt/dom/client/package- summary.html)

<comment><AUTHOR> The link is _not_ java api. It is javascript dom api available in the browser. But, the API is documented in javadoc style. Ofcourse, w3c has more detailed documentation. But it is hard to refer quickly. javadoc style api is very easy to navigate and refer.</comment></comment>