Bezos Investigation Says the Saudis Obtained His Private Data - <AUTHOR> https://www.thedailybeast.com/jeff-bezos-investigation-finds-the-saudis-obtained-his-private-information <comment><USER2> Putting aside the politics / personal matters here, a nerd question (this is HN after all!):

Does anyone have a sense (even broadly) of the specific methods that were used to intercept Bezos' texts? Did he use an iOS or Android device? Were the cell towers attacked? Was he the victim of a good 'ol zero day piece of malware? (I presume Bezos isn't the kind of guy to click on random email attachments on his phone).

Just curious what universe they were playing in.

(Speculation welcome!)

<comment><USER3> Keeping in mind that we have seen exactly zero evidence that Bezos's texts were ever intercepted at all. Hopefully at this point we're long past taking claims in an op-ed at face value?

<comment><USER4> No, sorry, I don't agree at all. I consider Gavin de Becker to be exceptionally credible, and think any idea that "all op-eds are the same" is beyond disingenuous.

<comment><USER3> I don't know anything about Gavin. Not that I particularly trust journalists but they are supposed to be neutral third parties reporting facts.

I agree that something that I didn't say would have been disingenuous, but I'm not sure why you would bring it up.

I'm sure you would agree that it being an op-ed tells us primarily that this article was not written by a neutral third party. We would not be surprised if it makes little to no effort to present opposing views. As an op-ed it is free to make unsupported conjectures and should probably be approached with a higher bar of skepticism and should be expected to provide facts or evidence to back up any of its novel claims.

In short, op-eds are not news, and should not be treated as such. Not that "news" is particularly deserving of the distinction these days.

I said simply that we should not take op-ed claims at face value. You said you don't agree at all. I mean, you are perfectly free to take the claims at face value if you like, but appeal to authority is hardly compelling and perhaps even a bit disingenuous itself.

</comment></comment></comment></comment><comment><USER5> "Experts with whom we consulted confirmed New York Times reports on the Saudi capability to "collect vast amounts of previously inaccessible data from smartphones in the air without leaving a trace—including phone calls, texts, emails"—and confirmed that hacking was a key part of the Saudi's "extensive surveillance efforts that ultimately led to the killing of [Washington Post] journalist Jamal Khashoggi.""

<comment><USER6> Horseshit, if I've ever seen it. Both sides used Apple Messages, which is encrypted end to end. Not even Apple can "intercept" anything.

<comment><USER7> End to end encryption isn't super useful if one or both endpoints are compromised.

<comment><USER6> Exactly my point. If someone else other than Sanchez had access to her phone, E2E encryption won't do shit. But to say that anyone is able to magically "intercept" E2E encrypted communications out of thin air is total bullshit. If I were Bezos, I'd refuse to pay for this "investigation".

<comment><USER8> > Our investigators and several experts concluded with high confidence that > the Saudis had access to Bezos' phone, and gained private information. As of > today, it is unclear to what degree, if any, AMI was aware of the details.

Note the words "Had access to Bezos' phone". E2E encryption means bugger all when someone has access to one end. There's other comments in the article that give the impression Bezos' phone was compromised.

</comment></comment></comment></comment></comment><comment><USER9> If even half of this is true we clearly need _stronger_ encryption and security, not back-doors and anti-encryption laws.

Democracy depends on freedom of expression, freedom of association, and privacy - all of which are threatened by espionage and blackmail.

</comment><comment><USER10> I wonder how companies like Twitter (mentioned in the article), Google, Apple, Microsoft and even Amazon protect themeselves from rogue employees. If I, for example, was responsible for an OS's TCP/IP stack, I can imagine ways that I could compromise security with a very low probability of the compromise being detected. I hope that all companies are taking this kind of risk very seriously.

<comment><USER11> not sure. seems dangerous because you don't want a red scare with chinese employees for instance but there has been instances already where they've been caught

</comment></comment><comment><USER12> It was rather obvious even back then (or at least when Bezos first published his piece) that it was the Saudis that hacked his phone, I'm not entirely sure the significant of this message by De Becker.

Furthermore, at least the way I see it, the more important party at fault here is AMI. I mean we can't really be surprised that a dictatorship is using their powers against powerful and influential people (especially those that have publicly opposed and blamed them of crimes). But we should be outraged when an American corporation cooperates with them, and we should do what we can to stop and punish them, both the Saudis (in whatever way we can), and more easily, the entire AMI group, it's executives and everyone involved.

<comment><USER13> Yes, AMI deserves outrage and prison.

But big as they are, they're a tool. Saudi ordered the hit. As far as I, a lowly democratic individual contributor, can see.

<comment><USER14> Saudi Arabia ordered the murder of an American journalist six months ago. That journalist was attacked and cut into small pieces by a 20 man kill squad.

Now, clear evidence has come out showing that the Saudis are willing to attack even the world's wealthiest man, Jeff Bezos. If the founder of Amazon is in their crosshairs, it is clear that no American is safe.

The traitor Trump is a big supporter of Saudi Arabia and is currently planning on selling them advanced nuclear technology. Saudi Arabia is as dangerous as Iran or North Korea or Russia – their financial backing is what made the World Trade Centers attack possible on 9/11.

Saudi Arabia is an evil dictatorship and it must go. No American is safe.

<comment><USER15> Correction: Jamal Kashoggi was Saudi but had permanent residence in the US ("green card"). It was reported at the time that the US administration took umbrage in his non-citizen status as they were reluctant to take punitive measures

</comment></comment></comment></comment><comment><USER16> Why are there family run countries still in 2019?

<comment><USER17> You're welcome to go over there and tell them to stop it. They usually have a lot of power and resources, and they're unwilling to give it up.

As an American, I don't want to see my fellow countrymen dying in another pointless war, so my view is that we should generally mind our own business.

I've spoken with someone who claimed to be a monarchy proponent and they suggested I read: "Democracy – The God That Failed: The Economics and Politics of Monarchy, Democracy and Natural Order (Perspectives on Democratic Practice)", by Hans-Hermann Hoppe. I don't know anything about the author, nor have I read the book, but perhaps that might help provide some insight into why some support a monarchy.

<comment><USER18> I suggest you do look up the author, because he is rather infamous for saying and writing stuff like this:

"In a covenant concluded among proprietor and community tenants for the purpose of protecting their private property, no such thing as a right to free (unlimited) speech exists, not even to unlimited speech on one's own tenant- property. One may say innumerable things and promote almost any idea under the sun, but naturally no one is permitted to advocate ideas contrary to the very purpose of the covenant of preserving and protecting private property, such as democracy and communism. There can be no tolerance toward democrats and communists in a libertarian social order. They will have to be physically separated and expelled from society. Likewise, in a covenant founded for the purpose of protecting family and kin, there can be no tolerance toward those habitually promoting lifestyles incompatible with this goal. They – the advocates of alternative, non-family and kin-centered lifestyles such as, for instance, individual hedonism, parasitism, nature-environment worship, homosexuality, or communism – will have to be physically removed from society, too, if one is to maintain a libertarian order."

(Yes, the man seriously calls himself a libertarian.)

</comment></comment></comment><comment><USER19> > advising on controversial murder cases. I've seen a lot. And yet, I've > recently seen things that have surprised even me, such as the National > Enquirer's parent company, AMI, being in league with a foreign nation

I honestly don't know how to feel reading something that ranks politics above actual state sponsored murder.

And having to accept that as the uncontested norm.

</comment><comment><USER20> The title does not match the article at all. He didn't find anything. He found that Saudis don't like Bezos and that they hack phones. It's quite a stretch to go from that to saying they hacked the Bezos phone.

<comment><USER21> I don't think that's the case. The article makes a very specific claim:

>Further, to respect officials pursuing this case, I won't disclose details from our investigation. I am, however, comfortable confirming one key fact:

>Our investigators and several experts concluded with high confidence that the Saudis had access to Bezos' phone, and gained private information. As of today, it is unclear to what degree, if any, AMI was aware of the details.

He claims there is direct evidence that they accessed Bezos' phone. It may not be true, but opting to not disclose evidence doesn't mean none exists. I also doubt Bezos and his lawyer would make such a major accusation like that without confidence that it's true.

<comment><USER3> I thought "claim with high confidence" is intelligence speak for _we don 't have a fucking clue but it's the narrative we're running with_. </s>

This is really no better than citing anonymous sources. There is a story if and when, and not a moment before, actual evidence (with some respectably chain of custody) is actually provided.

EDIT: The word "evidence" only appears once in the editorial, talking about an AP article reporting that the Saudi's were sent an advanced digital copy of the pro-MBS magazine.

Read it carefully, Gavin never equivocally states he has any _evidence_ that the Saudi's had access to Jeff's texts. They interviewed people. They were told by other people that the Saudi's had this capability. SA apparently "unleashed their cyber-army on Bezos". And AMI has done [presumably highly lucrative] work for MBS. And AMI is bad because they caught-and-killed a story for Trump, and have done things for Trump in the past. That is all we get here, aside from the ominous ending of Saudi Arabia controlling our media.

I'm just so tired of the conspiracy theories.

Not knowing why AMI started talking to Michael Sanchez is not the same as knowing that the Saudi's told them to talk to Sanchez.

<comment><USER22> Ironic, because you claim without any supporting references that you "thought" that the statement ("claim with high confidence") is intelligence speak for no evidence, and then use this assumption to conclude that it's no better than citing anonymous sources.

<comment><USER3> The first sentence was sarcasm. But if you need a reference, how about Iraq WMDs.

I'm not on the hook to prove anything. TFA provides literally zero evidence of their claim other than to assert it strongly.

In my opinion, the most strongly asserted claims accompanied by "we can't tell you the evidence, but we turned it over to someone else who also can't tell you"... well, haven't we seen how that turns out enough already over the last 2 years?

My point is simply that TFA asserts a lot and backs it up with nothing but hyperbole.

<comment><USER23> Funny you should mention the Iraq WMDs. WMDs were cited as justification to go to war against Iraq, a war that the Bush administration had a variety of political, ideological, strategic and economic reasons for wanting to engage in.

What incentives do de Becker and Bezos have that would cause them to falsely accuse the government of Saudi Arabia? It seems that such an action would be risky to say the least.

Of course, the potential risk doesn't mean that they _don_ ' _t_ have such reasons (or even that their inference based on whatever data they have is _correct_ ), but I am curious as to what you think are the likely explanations.

<comment><USER3> Bezos' initial medium post seemed to me like wild conspiracy theory born of Messiah complex.

But the incentives are massive. The world's richest man had a huge PR problem with stories coming out about how his wife actually was instrumental in helping build Amazon in the early days.

Half his fortune on the line. Perhaps his controlling stake in Amazon, too? How many Amazon shares will his ex-wife walk away with at the end of this? Aside from the divorce which will be the most damaging event in Jeff's life, the PR hit is not insignificant.

If Jeff can tie AMI to illegal spying he can possibly take down the entire company. Is revenge not a good enough motive? He is certainly not a disinterested third party.

This is a great albatross to distract from an otherwise big story.

<comment><USER24> We know there was a conspiracy to murder and dismember a journalist. Your suggestion that it's outlandish to consider a conspiracy to blackmail an owner of a newspaper is intellectually dishonest. Frankly it's insulting.

<comment><USER3> To propose such a strawman of my position, and then accuse me of being "intellectually dishonest" and "insulting". Wow.

I never said outlandish. I said people claiming Gavin said he had evidence were incorrect, because TFA literally never claims to have evidence. Let alone direct evidence. Let alone incontrovertible evidence.

I think it's absolutely incumbent on the accuser to provide at least some general description of the form and substance of _evidence_ that was obtained to support a claim such as this. This is not asking too much from a private citizen who apparently had unlimited funds from his boss (the richest man in the world) to exact revenge on someone who attacked him in one of the most financially damaging ways imaginable.

Since when does HN accept conspiracy theories with absolutely nothing to back them up? I've seen the post "extraordinary claims require extraordinary evidence" upvoted to the top of many discussions. Why does that not apply here? Doubly so in a case where the accuser is so personally vested in the outcome.

You propose that because we know conspiracy A (through tremendous amounts of actual evidence) so therefore we must entertain a tenuously related conspiracy theory B without any evidence?

Please don't accuse me of being insulting and dishonest on the basis of frankly basic skepticism of a conspiracy theory, particularly if that is the extent of your rebuttal.

The political skirmishes of the worlds richest men don't really concern me. What does concern me is the posited existence of a remotely installable no- touch root access zero day for a presumably up-to-date iPhone, and secondarily, that it's being weaponized by foreign government against private US citizens — meaning it apparently doesn't require the carrier's cooperation to deploy, which is what would shock me the most, because baseband exploit would be the most obvious vector.

<comment><USER24> You called it a _" wild conspiracy theory"_. You're using "conspiracy theory" as a thought terminating cliche, which is intellectual dishonesty.

> _" absolutely nothing to back [..] up [the theory]"_

More intellectual dishonesty. The Saudis had the means, the motive, the opportunity _and the disposition, as demonstrated by their murderous tendencies._ The House of Saud are a family of thugs who are known to conspire to murder journalists. It's entirely rational to consider the strong probability that they've also conspired to blackmail people.

<comment><USER3> It is _incontrovertibly_ nothing more than a wild conspiracy theory at this point;

\- A remote access no-hands zero day iPhone rootkit.

\- An international plot to expose an _affair_

\- A plot potentially involving the President of the United States in cahoots with the National Enquirer to expose the richest man in the world

\- A blackmail attempt to cover it all up

\- Perfectly executed parallel construction to account for the source of the photos

Last week the President was accused of clandestinely exploiting the intelligence apparatus of the United States to steal Bezos' photos. Now that we _know_ (the only actual evidence that we've seen -- in this case statements from the brother himself and AMI) that the photos were provided by the brother, a new theory emerges that this was merely parallel construction after the affair was exposed through spying by the Saudis.

To reach that conclusion, you would have to (1) have evidence that the Saudi's contacted AMI to give them the lead, (2) have evidence of the zero-day on the iPhone, and (3) be able to link some sort of network activity back to Saudi Arabia carrying the exfiltrated data. ('AMI was tipped off', 'by the Saudi's, 'after they spied on Bezos by exploiting his phone' are three separate facts which each need supporting evidence).

Instead... You use the words "means", "motive", "opportunity" in a colloquial which is at odds with their meaning in a court of law. "I think this guy doesn't like that guy" is true of an untold number of people in Bezos' orbit, including his ex-wife.

"I think this guy can remote root international iPhones at the click of a mouse" is not _means " \- it's utter speculation. _Anyone* who knew Bezos was having an affair with Sanchez would be in the exact same position to approach the brother and ask for kompromat.

I don't know what you are claiming is the evidence of "opportunity" in this case?

I certainly don't support Saudi Arabia, and I'm looking forward to the day where there's no one left to buy their oil and they sink back into the desert. It is absolute fact that Saudi Arabia has murdered and blackmailed in pursuit of their political goals.

But you have literally nothing but a cute story and a blog post of a guy who said trust me because I have high confidence that they hacked Bezos' phone to give AMI the lead on his affair other than "Saudi Arabia bad".

You have not come even remotely close to substantiating any sort of claim, other than to basically say that it's not impossible that it was them. I actually agree that it's not _impossible_ that agents of Saudi Arabia remotely accessed Bezos' iPhone using a no-hands zero day to root his iPhone, discover the affair, and then call someone at AMI to tell them to track down the girl's brother to get a copy of the texts. It's not _impossible_ but there's also no evidence that any of us has seen it actually happened. I think that's pretty much the definition of a conspiracy theory right there! The correct response, IMO, is absolute skepticism, and to wait for _evidence_ to be presented.

Or at the very least, a general description of the sort of evidence which _allegedly_ has been found?

And I really think you should cut it out with the ad hominem. There's nothing dishonest about my skepticism, and I am not insulting you, just your utter lack of an cohesive argument.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> It's surprising that someone as wealthy and famous as Jeff Bezos would be storing such photos on his phone.

I already kind of treat my phone as though it's public domain. The amount of software which runs on most devices today is unfathomable. Keeping your devices completely secure seems almost impossible.

<comment><USER26> What do you suggest CEOs of big companies should use to communicate with other people? They need phones and laptops. If you trust it with company data why wouldn't you trust it with your private data? It's nice to separate the two but that's besides the point.

<comment><USER27> You need technology to conduct business. Just like many people need to drive, even though it is rather dangerous to drive or ride in a car.

There are very few reasons to take and store naked photos of yourself on your phone. So I submit that it's usually a bad idea to do so.

<comment><USER28> As someone who frequently takes and stores such photos, I would argue that mutual arousal between partners is an extremely strong human drive/need.

"I like things that make me feel good" is generally considered a very, very satisfactory reason by 99.999% of the population.

This is getting close to saying "Sexual intercourse is very dangerous. Outside of reproduction, there are very few reasons to have sexual intercourse, so I submit that it's usually a bad idea to do so."

<comment><USER27> >mutual arousal

I think there are probably better, safer ways to do that then taking and sending photos. Unless the thing that gets you worked up is the very likely danger that these photos are being collected and stored somewhere for others to see and or use against you.

</comment></comment></comment></comment></comment><comment><USER29> Would a VPN have prevented this?

</comment><comment><USER21> (removed, see below)

<comment><USER30> HN has a way of self correcting. Come back in a few hours and most of the bad comments should be killed by down votes.

Sometimes when a thread or story is killed, though, the comments survive and multiply because the broader community can't moderate them.

<comment><USER21> True, good point. I've seen that before. I'll come back later.

Also, to be clear, disagreement and skepticism about what's written in the article is a healthy and good thing. But the disagreement should take into account the full content of the article, since many counter-arguments here were specifically discussed in it.

</comment></comment></comment><comment><USER31> And now the US wants to give M. Bone Saw nuclear tech. What could possibly go wrong?

<comment><USER32> Probably not much, as I suspect the Israelis will keep a _very_ close eye on the project and intervene if/as needed. They have a more realistic long-term view of the region IMO, and are capable of handling these issues effectively, if not quietly or gracefully.

<comment><USER33> Wait? What?

Are you seriously suggesting that in lieu of cutting the problem off at the source by _NOT_ giving a dangerous man like MBS nuclear weapons, we should rely on other nations in the region to clean up the mess?

<comment><USER32> No, that isn't at all what I'm saying, and you can tell that's the case because it bears literally no relation to what I did say.

<comment><USER34> You say "no problem, Israelis deal with it ... probably."

<comment><USER32> In response to _What could possibly go wrong?_.

That has nothing to do with whether or not it's a good idea, just that I believe very little can go wrong I'm the context of Mossad oversight. I'm certainly not endorsing the deal.

<comment><USER35> _That has nothing to do with whether or not it's a good idea, just that I believe very little can go wrong I'm the context of Mossad oversight_

This is the most eye-opening naive piece of rhetoric I've ever read on HN.

Mossad couldn't stop Iran from developing nuclear technology, only delay it. And that was with every country in the world agreeing to sanctions.

There is no chance they can stop the Saudis, especially since the Saudi's probably already have a technology transfer agreement with Pakistan.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> What is the motivation of Saudis?

</comment><comment><USER37> Why is it news when a billionaires privacy is invaded, but not ours?

</comment><comment><USER3> > _You know him as Jeff Bezos; I know him as my client of 22 years. ... To > understand where this story goes, some background is needed._

Eyeroll. Why is Gavin writing this? In the Daily Beast? The narrative voice sets off immediate alarm bells, reading like a Tom Clancy novel;

> _What was unusual, very unusual, was how hard AMI people worked to publicly > reveal their source's identity._

It really isn't all that unusual, when you feed a salacious story to a conspiracy-theory-mad media which is frothing at the mouth to bring down Trump by any means possible, and then claim the President cooked it up as political revenge. When the FBI has a non-prosecution agreement with you that any misdeed could throw you under a microscope... It would have surprised me more if AMI insisted on absolute secrecy of their source. This is classic "makes you look guilty either way" rubbish.

The world's richest man got caught doing something that could literally cost him half his fortune in the ensuing divorce. I certainly wouldn't want to be on the wrong side of that particular counter-strike.

<comment><USER38> Interesting questions, why is he writing this, and why here? A few guesses:

1) Bezos had made claims in his original post that AMI and the Saudis were in league on the Bezos attack. That got walked back a little in this post when he admitted that (paraphrasing): it is unclear how much AMI knew, but it was still totally the Saudis. Maybe there won't be any evidence coming to back that up other than the AMI lawyers' strange request.

2) Bezos had given some of the credit for these claims to de Becker before, but now the weight of any truth or not is squarely on GdB.

3) Setting the record straight(?) that Michael Sanchez was not vile but rather a semi-victim of a larger plot might be helpful to Jeff the human in love.

Why The Beast? Well as you can now see every news wire picked it up within hours, so maybe they're just conveniently easy to use as the first publishing spot.

</comment></comment><comment><USER6> There was nothing to "intercept" I think. Sanchez's brother copied them and forwarded them to The Enquirer in exchange for a decent sized bag of cash.

<comment><USER39> Apparently not conspiracy theory enough.

From my reading this is exactly what happened. Reported by AP News, CNN, Fox News, and The Verge.

<comment><USER40> If you read the linked article, it's clear that somebody told the enquirer to approach the brother-in-law to buy the photos —— somebody already knew that Bezos and his mistress were exchanging inappropriate texts before the brother- in-law. Bezos's investigators claim to have forwarded evidence to the US government that shows the Saudis were behind it. We'll see what happens given how close this administration is to MBS.

This is just privatized parallel construction weaponized against a critic of the Saudi government.

<comment><USER39> Let me start with saying that in no way do I think the Saudis are not nefarious or clear of any guilt in this case.

However, the original post asked how the digital material was obtained. The post, and many others, imply some technical wizardry was used to obtain said info. Who is to say the Saudis did not employ traditional human intelligence to learn that the brother had access to the 'dirt'?

My point is simply: just because the Saudis knew which stone to turn over does not mean they used some technical prowess to turn over said stone.

[edit] clarify my stone turning over analogy.

<comment><USER40> De Becker (who is as credible as technical investigators get) said that his investigators along with outside experts developed evidence that showed that the Saudis had access to Bezos's phone. He turned this evidence over to Federal investigators.

Without knowing more, it's hard to say exactly what happened, but there is plenty of evidence of the Saudis, along with other repressive regimes, spending huge sums of money buying and weaponizing zero-days to target critics. So they had the means, the motive, and the opportunity to target him..

</comment></comment></comment></comment></comment><comment><USER41> I read it...or so I think. No details on how hacking was done, method, time etc. They hate Bezos (obvious,) they have capabilities to spy on phones, and they do retaliate /blackmail, but a phishing message sent or a spyware would have sealed the proof.

<comment><USER42> He turned over details to gov, more will be coming I would imagine.

</comment></comment><comment><USER43> Am I the only one that feels this is a bit far fetched? Perhaps because it is light on technical details, or more so, what the point of the article is. If Jeff Bezos paid for the investigation given how publicly he came out with his first statement, why would he not be the one issuing the follow up?

And if he did pay this person what is the point of this coming out here, and on the daily beast.

Just doesn't quite add up for me.

<comment><USER44> You are skeptical that Bezos would delegate publicly describing the results of the investigation to the person he publicly hired to investigate?

</comment></comment><comment><USER45> I don't know what he's so concerned about. He knows as well as the the rest of us that "If you've got nothing to hide, you've got nothing to worry about."

</comment><comment><USER46> This is great, but I take issue with the phrase "the Saudis".

There are about 33 million Saudis. I doubt most of them had anything to do with this, and I think it's important to maintain a mental distinction between the government of a country and its people.

<comment><USER47> Sorry for being pendantic but Al-Saud or 'the Saudis' are literally the ruling family: [https://en.wikipedia.org/wiki/House_of_Saud](https://en.wikipedia.org/wiki/House_of_Saud)

The 32m+ citizens are called 'Saudi Arabians'... calling them 'Saudis' is, erm, informal at best, lazy at worst?

<comment><USER48> Well Americans like to call themselves "Americans" even if that technically refers to all of the inhabitants of the American Continent (from North, Central and South America), so...

<comment><USER49> > Well Americans like to call themselves "Americans" even if that technically > refers to all of the inhabitants of the American Continent (from North, > Central and South America), so...

 _Technically_ , they're overwhelmingly correct, and your definition is in fact the uncommon one. For example, see the primary definition for both adjective and noun usages in the Oxford Dictionary of British & World English (not even US English).

[https://en.oxforddictionaries.com/definition/american](https://en.oxforddictionaries.com/definition/american)</comment></comment></comment></comment>


A supercomputer often won't make your code run faster - <AUTHOR> https://lemire.me/blog/2017/12/11/no-a-supercomputer-wont-make-your-code-run-faster/ <comment><USER2> I see this so often with academics. They're not developers and only have basic coding ability. So they make all kinds of basic mistakes like trying to load a bunch of images converting them to float (IR images for example) and wondering where their memeory went. I took some spaghetti code that took a couple of days to process thousands of IR images, in batches, and wrote one that ran in under a minute simply because they didn't manage their memory at all.

Even something as opening CSV files quickly can have a massive effect.

Lots of Universities switched from FORTRAN to Matlab in the last decade but many of the researchers who learned FORTRAN try to write Matlab like FORTRAN with messy nested for loops and no knowledge of vectorisation.

<comment><USER3> I'm one of those people: I'm not actually a scientist, but I studied mathematics and build my own agent-based macroeconomic models (amongst other things). I am also a fairly autodidact programmer, meaning my code is an ungodly spaghettified mess that can be used to scare small children.

I am very much aware that my 'programs' are of the "big untidy spaghetti script" variety, and I simply consider them a kind of work-in-progress, notepad, or prototype for later professional implementation. I also have a couple of professional programmers ( _cough_ ahem, coders, they desire to be referred to as _coders_ ) that are entirely adept at taking my horrid final 'thing' and converting it into production-quality code that doesn't take down the enterprise (with the same tools I use, incidentally: _Mathematica_ , Python (>3.3) including SymPy and NumPy, and ABAP/SQL/Java for interfacing with the SAP ERP system).

The important part of this is that I never be under any illusion that I something that I toss together and make capable of 'running' be definitive code that can be put into production or used as-is, and that under no circumstances must the coders have any bright ideas about fudging the underlying mathematics.

<comment><USER2> > The important part of this is that I never be under any illusion that I > something that I toss together and make capable of 'running' be definitive > code that can be put into production or used as-is, and that under no > circumstances must the coders have any bright ideas about fudging the > underlying mathematics.

But there should be some cross germination between you and your coders? You must have learned ways to make your spaghetti code less cumbersome for them and they probably have learned something about the underlying economics so that they know what it is you're doing and how to keep everything to your needs. Similarly you're not reinventing the wheel each time so you must be using tools developed by them more and more as time goes on?

<comment><USER3> Most definitely. We communicate and collaborate and to a certain degree cross- pollinate (mainly I learn, there's not so much extra macroeconomic depth to add)... but what I was emphasising was the clarity about the separation of rôles.

<comment><USER2> That's great. It sounds like a practical and productive setup.

</comment></comment></comment></comment></comment><comment><USER4> It isn't just badly done math loops that can cripple performance. Years ago, some users were complaining that it was taking forever to load their data into their analysis program. It turned out they were reading thousands of structs, _one element at a time_ with the Unix read(2) _system call_! I taught them about buffering and the read time went down by a factor of ten or more, I forget the exact numbers.</comment>


Show HN: Tag-based approach to connect programmers who have the same interests - <AUTHOR> http://tagmask.com/vladimir/posts/101

<comment><USER2> I realise that you might be wanting to gain users to your project, but I do believe that having half your recent submissions being liks to tagmask.com is a bit excessive. I haven't counted, at least 8 times in the past few weeks.

<http://news.ycombinator.com/submitted?id=pankratiev>

<comment><AUTHOR> > to gain users to your project

Actually, no. I just wanted to share this idea of tag-based approach and to get a few comments that it's absolutely stupid and useless, and I should stop working on it. I am working on Tagmask for over a year and I am almost burned, it seems that it's absolutely useless idea because nobody cares. Thank you for your comment. Now I'll stop posting on HN.

<comment><USER3> >> ... to gain users to your project

> Actually, no.

Well, to my naive way of thinking, there's your first problem. You've done the usual thing of creating a site, and then wondering why no one turns up. You need to "market" your site.

And that doesn't just mean telling HN about it several times. You need to create content, you need to get a few people to play with it, you need to make sure they immediately find something interesting and useful, you need to engage with them, _etc._

And to me, the problem is as I say in my other comment - I don't see how tagging items with language names helps. Binary Search is Binary Search in any language, and most of the important and interesting things to say have nothing to do with the language of implementation.

So you have three problems:

* Content - you need to work harder to create more

* Marketing - you need to get a few users who immediately see the value

* Tags - I know they are the basis, but I'm not convinced language tags are the way to go.

YMMV - I'm often wrong - free advice is often worth exactly what you paid for it.

<comment><AUTHOR> Thank you so much. Yes, these are my main problems. But it seems that I cannot find right solutions, as I said I am almost burned.

</comment></comment></comment></comment><comment><USER3> My concern is that while I program in C, Python, ARM assembler, AWK, Bash and more, I'm not really drawn to articles specifically tagged with those things. I'm drawn to things that transcend any particular language, and are about bigger ideas.

I don't see how tagging can work at all.

<comment><AUTHOR> > I'm drawn to things that transcend any particular language

You have control over it. You can add to your filter tags "algorithms", "programming", "compilers" and see more wide set of posts. In addition, you can exclude posts with unwanted tags. For example, you can see posts with the tag "web-development" except posts with tags "php", "asp.net" etc.

<comment><USER3> This was completely unclear to me from your site, although having re-visited it's less unclear. It's certainly unclear what tags exist, how you deal with synonyms, how I edit my tags, whether I can change the order of filter-out and filter-in, and so on.

You need a _much_ better interface to the editing of the tag-based filters.

And content.

Another question - suppose there's an item about an algorithm in PHP. How do I know it will get given the "algorithm" tag? How are tags assigned/chosen?

<comment><AUTHOR> It's about filtering posts submitted by users on Tagmask. Tagmask is a community site for programmers. So, content should be created by users. It's a problem of chicken and egg.

> How are tags assigned/chosen?

If you submit a post you should give it correct tags. For example, if you submit a post about some algorithm on PHP you should attach to it tags "php" and "algorithm". And in this way any user who subscribed to tag "php" or "algorithm" will see it in his feed.

<comment><USER3> If I see an article and I think it's mis-tagged, what can I do about it?

<comment><AUTHOR> For now, nothing. It's a problem of the user who submitted the post. If he submits a post about "node.js" and give it just tags "programming" and "web- development", it's just his problem because people who are interested in node.js will not see his post. And, probably, it also means that quality of a post is not so good.

</comment></comment></comment></comment></comment></comment><comment><USER3> Why are usernames not allowed uppercase?

<comment><AUTHOR> Username used in user's post address: <http://tagmask.com/vladimir/posts/101>

Initial idea was to make all Tagmask's URLs in lowercase in order to make them more unified. But it seem that it's a bad idea.

<comment><USER3> You need to say it before people type in something that's against the rules, and then passwords, only to be thrown back again and have to do it all over.</comment></comment></comment>


Unconventional Ideas for learning new Language? - <AUTHOR>

I am looking for some unconventional and innovative ideas for learning German language. I know there can't be better place then HN to ask this question.
Why unconventional because I think my language part of brain is not normal or so. So in school they tried to teach me English grammar for 10 years but still I do not remember any grammatical rule. By accident I learned(sort of) English while watching Hollywood action movies and commentary of cricket matches.
Now the problem is that I am not addictive to TV any more specially action pack movies which makes it impossible to watch daily some German movie to learn German.
Another problem is that I cannot do rot-learning for memorizing the vocabulary. May be because of ADHD or my laziness.
As an example what I have done in past. Once preparing for GRE, I had to memorize huge vocabulary of English, so I wrote a program to which given a ebook as input, adds meanings of difficult words in footnotes of each page. Difficult words were the words from GRE word list. That helped me a lot. But this cannot be used for German as I am in the beginning.
I am using a Polyglot chrome extension for German and doing customizations according to my needs. But still I need some other ways to quickly start communicating.
Now I am looking for other ideas. I am in Germany and started working part time in a software house. Can I involve my German colleagues somehow? Or what other methods you used for learning a foreign language? <comment><USER2> 1) There's a vibrant japanese learning community on the web that likes to talk about language learning in general; sites of note are <http://www.alljapaneseallthetime.com/> and <http://www.antimoon.com/> (about english learning).

2) Get a copy of Anki (<http://ichi2.net/anki/>) and load it up with the things you want to remember. If I were starting a new language, I'd do this with sentences from a textbook. As you get better, you can take sentences from things you're reading or from dictionaries, wikipedia, twitter (my favorite), or anything else.

There are lots of theories on language learning, and it's hard to pin down what works. Some people thing the above suggestions are crazy and will tell you so, loudly. But you since you're doing things yourself, you can just try stuff. If you don't like something or if you don't think it's working for you, then change it.

You might structure it something like Scrum: have a fixed study iteration that starts with a planning session and culminates with an assessment. The assessment could be a different depending on what you're studying; maybe a conversation with a native speaker on the subject of what you've been studying that week. Maybe a trial run of a standardized test you're studying for. Maybe watching the same TV show at 3 week intervals to see how much your comprehension improves. Depending on the result, then plan your text 2-3 weeks of study accordingly. For me at least, that seems like about as long as I can stick to any particular study plan without burning out anyhow.

... actually, I kind of like this idea, maybe I'll try it for my Japanese. :)

</comment><comment><USER3> You've already done one of the most important parts: move somewhere where that language is spoken. Next: get everyone around you to speak German to you, and speak German to them (obviously, ask when you don't understand or need a term). Instruct them to always correct you, and when they do, repeat the correct sentence a few times out loud. Watch television. Read. Socialise with locals, not expats. Look up or ask about anything you don't understand. The idea is total immersion.

By the way, if you need techy reading material in German, Heise are great. I've been a subscriber to their c't magazine for years.

<comment><AUTHOR> Thanks for these tips. Bad thing is that I am damn introvert and know only other few foreign people only. Any ideas on socializing with locals?

<comment><USER3> Scout for likeminded people nearby on Twitter. That's what I did when I moved to Vienna, not knowing hardly anyone here. Go to any sort of meetup where you might meet interesting people.

</comment></comment></comment><comment><USER4> You learn by conversation. As soon as you understand or are understood - whamm! You got it. I am German (although I'd spend a kidney to get out of here) and I know lots of English people who learned the language at an incredible turn of speed by just trying to get along. Use your belly instead of your brain. I must admit that most of them don't get the grammar right but it doesn't matter at all and it should get better reading an interesting book once in a while.

And don't get scared. I remember when I travelled to the Netherlands and as soon as I tried to speak a few words in Dutch I got the hot hints where to get a lovely, cheap place to stay. People just LOVE it if you try to learn their language. Remember that. Get out. Have a drink (not too much of course). And check out <http://dict.leo.org> :)

</comment><comment><USER5> Look up the blog by Benny the Irish Polyglot and read his posts. I think you might do well with his style.

<comment><USER6> I checked out his site and it seemed like more hype than substance. He claims to be learning a language every three months for the past seven years but so far his list of languages is not terribly impressive, at least by European standards. There are eight languages in the list (aside from his native English). Out of the eight, one is still being learned (Hungarian) and four are from the same language group (French, Spanish, Portuguese and Italian). It's not a huge leap to become conversationally fluent in Portuguese after learning Spanish, especially if you can live in Portugal. I'd like to see how far he gets with Korean or even Mandarin in three months.

</comment></comment><comment><USER7> Something that always helped me was to look for similar words in my native language (or another language I know a little of) and make that the mental link rather than the one you typically see in translations. In German, window is "fenster" and in French it is "fenetre" (with some symbol over the second e indicating that there used to be an S before the T in old French). So that makes "fenetre" easier for me rather than remembering it directly as "window". In German, "flasche" is usually translated as "bottle". I remember it is "flask" first and foremost, which makes it easier for me.

I also transliterate rather than translate -- ie translate word for word instead of translating it actually into the grammar of my native language. When I took classical Greek, we had interlinear bibles that showed each word in English below the word in Greek. I had no trouble making sense of this, though it didn't make sense to other people. I was the only person in my Greek class who could read a passage in Greek and then tell you what it said in English. I was the most fluent person in that class. It also helps me familiarize myself with the grammatical differences between two languages.

Good luck with this.</comment>


Major Remote SSH Security Issue in CoreOS Linux Alpha - <AUTHOR> https://coreos.com/blog/alpha-security-incident-subset-of-users-affected.html <comment><USER3> For those who are interested in the actual technical error: [https://github.com/coreos/coreos- overlay/pull/1965](https://github.com/coreos/coreos-overlay/pull/1965)

Very easy to make such a mistake, and it never made it into a stable release.

<comment><USER4> > it never made it into a stable release.

True, but...

> Based on log data from the CoreOS Linux Update Service roughly 3% of online, > auto-upgrading, hosts were affected.

If hosts are configured to autoupdate to a release, you're treading a fine line if that release could have issues like wide-open SSH access. Though I'd hope that no one is hosting sensitive data on an OS in alpha, that compromise may be used as a jumping-off point for a more serious attack.

<comment><USER3> I guess having a lot of machines using the newest alpha releases is a double edge sword. It is great to have many users that are able to report bugs early, but then again a security issue like this is actually a somewhat serious issue.

I really hope people that use anything of alpha status know what they are in for. Maybe a bug like this every now or then is required to remind people of the inevitable consequences of doing so.

According to [https://twitter.com/mjg59/status/732221095051296770](https://twitter.com/mjg59/status/732221095051296770) it affected about 1400 machines.

</comment></comment></comment><comment><USER5> Reminds me about the 2002 bug in Debian Unstable where something in PAM incorrectly allowed password-less ssh logins for all the system accounts, because "*" in /etc/passwd was parsed as "empty" instead of "no valid password", so you could ssh in as "nobody" and be greeted with a shell :)

[https://www.debian.org/security/2002/dsa-177](https://www.debian.org/security/2002/dsa-177)

</comment><comment><USER6> We use CoreOS but I'm still not sold on automatic updates. We've seen too many issues running disparate versions of etcd or docker. To their credit - <USER2> seems to be getting better but still not prime time.

Plus, we really want to push for an 'immutable' production model which is counter to automatic updates.

<comment><USER7> And then we run into the xscreensaver issue, where upstream gets fed up about redundant bug reports.

</comment></comment><comment><USER8> I still wonder (and this one of many reason I'm not using CoreOS, because I don't now how to secure it as good as Ubuntu/Debian) how do you install a simple Fail2Ban (ssh) implementation on CoreOS? Are there any practices how to make the server which runs all containers more secure? Or do I simply rely on CoreOS team for all that ssh securing and firewall stuff (it seams it is this way now!) ? I have the feeling that hardening a CoreOS server is not the main priority for CoreOS.

<comment><USER9> There's no point in using fail2ban if you use public key authentication. It's a kludge which helps against brute force attacks, which are limited to password login.

Since CoreOS enforces public key authentication, and the SSH server is the only external attack surface, they're doing just fine. Security is _definitely_ a top priority for CoreOS, and they're doing a great job at it - image signing, Docker container signing, ASLR binaries, a clean build system (based on Gentoo)...

<comment><USER10> I tend to agree. One reason to use something like it, though, is that it clogs up logs. But I'd tend to want to tie it down with iptables and limited IP ranges and/or just move ssh to another port (the latter as a quick and dirty way to avoid the steady annoying log nonsense if you for whatever reason can't limit ip ranges, not because I have any illusions it does much for security)

<comment><USER11> When filtering your logs, filter for only successful attempts. You really don't care how many people failed to login on a server with only pubkey enabled. It's the ones who succeeded you want to know about.

<comment><USER10> Exactly, but it's nice to be able to follow your logs without all that clutter. Though with journald I mostly look at logs on a per-unit basis anyway (or via e.g. an ELK setup), so it's a slight nuisance rather than something essential.

</comment></comment></comment></comment></comment><comment><USER12> 99% of systems patched in under 12 hours. I know CoreOS doesn't have a high number of instances in existence, but that's still an insanely fast turnaround.

</comment><comment><USER13> In other news, it looks like CoreOS is finally adding PAM support, which means we might be able to use it in an LDAP-enabled environment soon. That's great news!

<comment><USER14> You realize that you didn't need to wait for PAM? That you could read NSS `shadow' table from LDAP in the same way as `passwd' is?

<comment><USER13> On all the Linux distributions I've used in the last 15 years, NSS has never been responsible for authentication, though. It's only been responsible for _resolution actions_ like getpw* and getgr* (i.e. uid/gid to name), whereas PAM has been responsible for authentication and auditing. You have to configure both to support LDAP, not just one.

</comment></comment></comment><comment><USER15> A post-mortem has been posted regarding this issue: [https://coreos.com/blog/security-brief-coreos-linux-alpha- re...](https://coreos.com/blog/security-brief-coreos-linux-alpha-remote-ssh- issue.html)

</comment><comment><USER16> I get that coreos wants to be transparent, but isn't this the point of having an alpha release?

</comment><comment><USER17> "Major bug found in alpha release" ... SURPRISE!

</comment><comment><USER18> I quit using coreOS a while a go when I realized how unprofessional some of the top devs were. I don't want to name names but one in particular seems to spend all their time writing blog posts bashing any and all competition, no matter how disingenuous they have to be to get their point across.

Most people seem to use coreOS for security. When the devs seem more concerned about slinging shit at Canonical and Red Hat it just makes the CoreOS team seem unprofessional and when it comes to security I demand professionals.

<comment><USER19> That's a pretty bold allegation to make without support.

<comment><USER20> Really, the dev in question has been a vocal critic Canonical and others for a while. It's much of a reflection upon CoreOS beyond their decision to ignore it when hiring the person.

</comment></comment></comment><comment><USER21> I feel like this being #1 on hacker news is someone's way of trying to say it's damning evidence against CoreOS' security model and why you should steer clear of it.

Of course they found issues in an alpha release. Happens all the time.</comment>


RIP Google Inbox - <AUTHOR> https://davidyat.es/2019/03/21/rip-google-inbox/ <comment><USER2> So weird to see "remnants" of old products, years after they're shut down. I can't remember exactly which product like this I was looking at and it was depicting kinda the zeitgeist of those 2008-2009 years — wish I'd have a name but it doesn't come to me now

Probably we'll look at this article the same in 10-20 years

</comment><comment><USER3> As the deadline looms I keep searching for alternatives to Google Inbox and I must agree with article. They are none. I guess I am going to have to get used to traditional Gmail.</comment>


Functional programming and looping - <AUTHOR> http://railspikes.com/2008/7/29/functional-loops-in-ruby-each-map-inject-select-and-for

<comment><USER2> This is a pretty decent summary, I think. It uses Ruby, and it's worth noting some of the procedures are also known by other names:

 _map_ \-- Perform a function on every value in a list individually, _as a transformation_. As an easy example, map square [1, 2, 3, 4, 5] -> [1, 4, 9, 16, 25]. This is usually just called "map" (it's short), but is different thing than a key->value map. The sequence of execution here is deliberately unspecified, and for potentially expensive/time-consuming operations this can be an easy operation to parallelize.

 _list.each_ \-- Iterate through a list, doing something for each value. AKA foreach or List.iter. This is different from map in that it discards the result; it is just used for side-effects.

 _select_ \-- AKA filter, called remove-if-not in Common Lisp. This returns a list of all values in a list meeting some criteria (a predicate, a function that returns a bool, is passed in): filter even [1, 2, 3, 4, 5] -> [2, 4].

 _reduce_ \-- AKA fold - Starting with a default value (often the identity for a function, e.g. 0 for adding and 1 for multiplication), successively apply a two-argument operation to the current total and the values of the list, _reducing_ it down to one overall result: reduce * 1 [1, 2, 3, 4, 5] -> (((((1 * 1) * 2) * 3) * 4) * 5). NB: Some languages make a distinction between a left fold and a right fold, which refers to whether it starts at the beginning or the end of the (potentially infinite!) list.

</comment><comment><USER3> Of course, one of the common knocks on Ruby is that naively referring to a function executes it, and to pass functions around avoiding

      list.map { |i| process i }

one must write

      list.map &method(:process)

or, as the Rails guys have done [1], open up Symbol#to_proc so that

      list.map &:process

works. This will be part of core Ruby in 1.9, but last I heard it's slow [2].

[1] [http://github.com/rails/rails/tree/master/activesupport/lib/...](http://github.com/rails/rails/tree/master/activesupport/lib/active_support/core_ext/symbol.rb)

[2] <http://www.ruby-forum.com/topic/161089></comment>


Tell HN: Google.com down (at least in MA) - <AUTHOR>

Seems to include apps and search front page. <comment><USER2> google.com not down here (Germany) and here too: <http://twitpic.com/1jfxey> , check from <http://www.websitecheck.org>

</comment><comment><USER3> Working in NYC. Not affected or back up?</comment>


Flipped Classroom - <AUTHOR>

I am building a free resource center for those who believe in flipping classroom using technology. For students, for teachers and for entrepreneurs working in education.<p>If you are doing a education related start-up or planning about one, i would love your participation at
http://www.flippedclassroomblog.com <comment><USER2> What does it mean to "flip a classroom"?

<comment><USER3> The "flipped classroom" is an instructional technique where students watch a lecture or some other instructional resource on their own and then come to class to work on problems with the teacher. This is an alternative to the traditional classroom where the teacher lectures and then the students leave to do homework.</comment></comment>


Data Science RSS Feed – Do you have enough data about your data - <AUTHOR> https://www.dataradar.io/ <comment><AUTHOR> Hi, I have been maintaining this RSS Feed Online Viewer about data for more than 2 years.

I share with you today my work for the past 2 years. It's been a quite a long work for me.

Feel free to send me any blog post / article that you would like to see featured : contact(at)dataradar.io Let's make it bigger all together.

If you have any idea to make it better. Don't hesitate : contact(at)dataradar.io

Cheers my friends !

Jonathan DEKHTIAR</comment>


Show HN: Node.js users/permissions app with email verif, on f1-micro - <AUTHOR> http://devtest.awful.email/ <comment><AUTHOR> Code template is here: [https://github.com/cris691/servedata](https://github.com/cris691/servedata)</comment>


Exactly Once Writes for Non Idempotent Requests - <AUTHOR> https://medium.com/@mridul_40234/exactly-once-semantics-with-non-idempotent-requests-23ab88bedfd1 <comment><USER2> Couldn't this be solved easier by using a simple version field? If the remote version != client version then request is rejected with an http 409 response...

<comment><AUTHOR> I think you are talking about optimistic concurrency, but optimistic concurrency does not perform well in cases of high contended keys.</comment></comment>