Ask: Enterprise Heirarchy/Phone Navigation HOWTO? - <AUTHOR>

Whoever is good at this will most likely keep their cards close to their chest, but let's change that, shall we? What are your tips, tricks and techniques for navigating the bureaucracy and getting through to the specific decision makers?
I know about hotel chains; they're easier to get through outside big countries. For example, if you want to break into the Hilton or Marriott hierarchy, I recommend you call their offices in a country where they have just one hotel, and milk their representative there for information, instead of hitting the U.S. head quarters or a major European country. And from there you move to the regional representative; it costs dimes to call the Caribbean on Skype, and I found it a very interesting experience, learning everything I needed to know about their corporate business practices.
What are people's take on universities, hospitals, governments, airlines, banks and the like? How long does it take you to get to someone who has the authority to sign a check? <comment><USER2> Cold-calling into an enterprise really isn't as hard as it seems. There are some simple techniques to help. First, remember you have something of value to offer to someone within the organization and you just need a little help to find the right person to speak with. The gatekeeper (the receptionist or executive assistant) is your friend. Her/his job is to screen out unimportant calls to make time for more important calls such as yours. As the founder and domain expert in your space (that's you), you have a significant advantage over a generic salesperson. You can gain credibility by highlighting this fact coupled with your years of experience and passion for addressing this specific problem.

Here is an example intro: "Hi <receptionist name>, my name is Bob from SmartCo Software, inc. SmartCo is a software company that my partner and I co-founded to help companies in the <widget industry> who are facing challenges managing their <grommet inventory>. I am trying to find the appropriate person to speak with in your organization. Who would be the best person to contact about this? <wait for response>

More tips:

1\. Your tone should be friendly, confident, and business-like. If it sounds like you are nervous they will hear this and it and may perceive this as a sign that you would be wasting their management's valuable time. Smile wide on the phone (literally, it shines through on the call.)

2\. Keep it short and clear using plain simple words. You are not trying to sell the gatekeeper on your technology, product or service. You only need to convince them that the person you are looking for may be interested and that you sound professional enough that passing along your call won't come back and bite them.

3\. With both gatekeepers and prospects, use your passion and founder status to your advantage. Be a person and talk with the prospect as an equal.

4\. Old Sales Adage: "Telling isn't Selling" (i.e. Asking questions) Once you have identified a target buyer your goal is to give them just enough context about your company and the problem you are solving to get them thinking about the space, your goal then is to get your prospect talking. Ask open ended questions that cannot be answered with a simple yes or no. (e.g. I have been speaking with <CEO/CFO/COO/CMO>s in <prospect's industry> and many of them tell me that they are facing increasing difficulty <managing the cost of grommet maintenance>. Can you tell me how <prospect Co> has addressed these issues and what sort of initiatives you have considered? - take notes)

5\. There is a lot more but I've typed enough for now.

The keys to shortening the sales cycle are:

* good upfront qualification (and dis-qualification) of prospects,

* a very clear process and next steps defined by the seller (uncertainty as to what the product/service does, what it costs, and how well it will work will all work against you)

* Pro-active follow through on the part of the sellor

* Not all calls will go well, but remember the ocean of prospects is large. The rule of prospecting is: SWSWSWN (some will, some won't, so what?, next!)

</comment><comment><USER3> I can give you some tips for colleges and universities. Some of it varies based on what you're trying to sell.

1\. Go to the dean or department head. If it's administrative software, go to the dean of admissions or matriculation.

2\. Often times, approval hoops will vary based on the price of what you're selling. Smaller accounts can be approved at the college/department level. Larger stuff may have to be approved by the board. Even larger items may have to go all the way to the district (even if its a 1-school district).

3\. Get ready for a painfully slow sales cycle. You're essentially working with a government entity. The person who actually wants your goods has to submit a purchase request to their higher ups. If approved, that gets turned into a purchase order (PO) by accounting. You often have to treat the PO like cash as many colleges aren't going to even look at your invoice until your product is delivered and installed. There's probably a 20% chance that someone along the way will be on vacation or off for the quarter ... a document always sits on someone's desk for a week waiting for a signature.

Here's some bonus, inside baseball tips ... free to you!

4\. Go after community colleges. There are over 100 of them in California alone. Granted, CA's economy sucks right now, but they still buy stuff.

5\. If you do your research, you can find the schools that received various state and federal grants. Some of these grants are HUGE ... as in "how do we spend all this money?" huge. If you've got something that could remotely help them meet their grant goals, go after them. Usually the college will setup small departments just for the grant and you can call and ask for them.

6\. Hit up people (especially the grant people) in early June. Most schools end their fiscal year on June 30. You have to understand, if they have surplus cash in a budget somewhere, _they want to spend it_. When we did edu software, we literally had schools call us on June 20 and say "We want your $8K product be we need it approved and delivered by the end of the month. Can you do it?"

Hope that helps

</comment><comment><AUTHOR> FWIW, for hotels, if you want a residency music gig and want to book a band for a hotel, you need to ask for "Food and Beverage", get the person's name, stalk them on facebook or myspace and befriend them slowly then show them your band's repertoire.

Booking bands is an entry level sales project for hotels. But if you can get a band through, you can get more things later.

<comment><AUTHOR> It's also customary to get such deals through the local entertainment publications. Most big cities have a free newspapers about nightlife; the editors of those papers are bored 40-somethings, from my experience, and if you have a band, you can offer them a commission; if their band is booked within a month from a referral they make X amounts of dollars, to them personally, not the paper. The editors will plug your band and will mention you and your musicians to hotel chain managers. Nightlife papers are not exactly official newspapers, and their journalists are easy to play ball with. However, they guy as much access to local happenings as regular newspapers, if not more.

</comment></comment><comment><USER4> One thing that has worked well for me: ask the gatekeeper (usually the decision maker's AA) for the decision maker's email address. Tell her (or him) who you are, why you want the email, and what you plan to email. Make it clear that you do not want to get caught in a spam filter and politely ask that the decision maker be made aware that an email is coming. You haven't wasted anyone's time and you've made it easy for them to communicate with you.

I almost always get some kind of reply.

The key is to be yourself, be sincere, lay out all the facts, and make it quick and easy for the other people.

Another thing that has always worked very well is a hand written snail mailed note. But only _after_ you've already met. Otherwise, it's just junk mail.

</comment><comment><USER5> You might be amazed how many corporations have a dial by name directory accessible from their auto attendant.</comment>


Why we avoid throwing exceptions at StackMob - <AUTHOR> https://blog.stackmob.com/2013/03/why-we-avoid-throwing-exceptions-at-stackmob/

<comment><USER2> So they have created an mechanism that allows replacing a small subset of what execptions can do (communicate errors to the callers of a function).

The downside is they need to write all code in a non-standard idiom, need wrappers around standard libraries, cannot easily bubble up errors through multiple levels of the callstack when appropriate, and have made their typing system significantly more complex.

I cannot see an upside.

The example they gave, that division by zero is a "crafty little exception can sneak out of our net and crash our program", could just have easily been solved by wrapping division in a try/except block that caught the RuntimeException, and threw a MyDivisionByZero exception. Then the compiler would enforce that the exception must be caught, elimiating their handwaving argument that unchecked runtime exceptions are "the wild west".

</comment><comment><USER3> \- "Number 3 is the problematic one. If the exceptions are unchecked we're in the wild west again."

Hum, I'm going to argument at the same level: Wat?

</comment><comment><USER4> Exceptions are idiomatic, widely supported and immediately available. The convoluted alternative presented here is not. I have never seen inherent problems with exceptions. Another "exceptions are exceptional claim" without any convincing evidence.

<comment><USER5> "idiomatic, widely supported and immediately available"

So is McDonalds, but that doesn't necessarily make it good for you. What Doug is getting at in his post is that there are cleaner and more interesting (and often more useful) ways to deal with exceptions, apart from writing out incessant try-catch-finally blocks.

disclaimer: I work with Doug</comment></comment>


.NET Core 1.0 release – what you need to know to get started - <AUTHOR> https://raygun.com/blog/2016/08/net-core-1-0-release-get-started/ <comment><USER2> Are there any guides for OSX/Linux that don't end with printing hello world. A lot of what seems to be out there is very basic or starts talking about Windows when it starts to get interesting

</comment><comment><USER3> Too bad the tooling (e.g. restore, build, package) and (I think) the project files format is still preview.

So far, my experience has been that small isolated project seem to work fine, but as soon as I try to break a more complex solution out into separate nuget dependencies things start to get hairy.

Nuget dependency versions don't support npm-like syntax, so you can forget about the "^22.214.171.124" notation. Syntax like "[18.104.22.168-126.96.36.199)" might be supported, but honestly I've been fighting with other issues enough that I can't recall for sure if making the version syntax ugly makes it happy.

Another surprise to those from javascript/npm land is multiple versions of the same library in your dependency tree isn't supported. So you basically need to support redirecting to a commonly supported version (which, without examples showing version ranges, you're back at the version range syntax pains).

If anyone's tackled these pain points I'd love to hear.

<comment><USER4> I'm new to the CLR build system myself, and have sort of gotten stuck on project formatting. The F# side seems to have some newer build systems, and are trying to go towards a simpler build/project system.

For dependencies see Paket[1]. It allows versioning, and only the parent dependencies not the entire dependency tree.

For building much like Gradle there is FAKE [2]. It's an F# DSL for build tasks, and has type safety etc. But I've seen examples with C# project as well.

[1] [https://fsprojects.github.io/Paket/getting- started.html](https://fsprojects.github.io/Paket/getting-started.html) [2] [http://fsharp.github.io/FAKE/](http://fsharp.github.io/FAKE/)

</comment></comment><comment><USER5> Finally ! Goodbye php,ruby and go ! can't get rid of Python though, simply the best language for analytics.

<comment><USER6> What are the biggest benefits of using NET Core in comparison with Go, Ruby, Python?

<comment><USER7> Speed of course, and a huge standard library that works with multiple languages, Ruby and Python are dog slow compared to C#; can't speak to Go, haven't used it.

<comment><USER8> Core doesn't actually have a huge standard library. That's kinda the big problem with it. It's basically, at the moment, a really shit version of .Net 4.61.

For example in the 1.0 release the ORM is a complete joke at the moment. It can't do fairly basic stuff, like worse than ORMs from 10 years ago.

<comment><USER9> EntityFramework? In my 5 or 6 years with .NET I've had more problems with EntityFramework than not. Most of the time it's overkill or just not optimized for the queries I could write myself. I'm a huge fan of Dapper.Net. Looks like there's initial support for core as well.

<comment><USER8> No offence, but you're probably using it wrong.

These days, it's really very, very good. And it's been amazing since EF4, for about 5 years now. Trying to push it too far is a mistake and can cause performance problems, but, as with all ORMs, sometimes you need to drop down to raw queries.

<comment><USER9> Missed this comment but I don't take offense to it.

In all honesty, if you have a well designed system it's pretty good at what it does. I've used it without any issues on small personal projects and it was great at what it did. Although getting it to work with Postgres is needlessly "complicated". Not complicated per-say but not as easy as it just working with SQL Server.

What happens when you take a legacy system and move over to .Net and try to use EF on a poorly architectured data model? Chaos.

"Oh you want to search for orders that have these attributes that are stored in a bit-encoded string field that is only joined from 3 different tables?"

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I really wanted to give this a try, but the lack of first-class MySQL support makes it a non-starter for me at this point. There are third party drivers, but they don't seem to work with many Entity Framework features.

<comment><USER11> Trust me, you don't want EF--no matter how many times they say "vNext is gonna be great!!1 for real this time." Consider a micro-ORM like dapper[1].

[1] [https://github.com/StackExchange/dapper-dot- net](https://github.com/StackExchange/dapper-dot-net)

<comment><USER7> Yes yes yes, but better yet, write your own. Micro ORM's are "micro", it's pretty trivial to create something better than Dapper and there's no framework in the world better than your own, to you, because there won't ever be anything to complain about, just mold it to work exactly how you like.

Dapper..

        var dogs = connection.Query<Dog>("select Age = @Age, Id = @Id",
            new { Age = (int?)null, Id = guid });

yuk, I prefer

        var dogs = Dog.FindAll(And(IsNull("Age"), Equal("Id", guid)));

A touch of generics done properly, a bit of reflection, a static import, and you can do much better than onnection.Query<Dog>. Write the API you want, implementing what is basically an active record without relationships is not terribly difficult and will pay off for years to come in your own code.

Edit: Dappers API is ugly as fuck, that's an immediate non-starter for me, and the cost of reflection on loading objects is the wrong problem to be optimizing and would only show up in an absurd micro benchmark intended to show off speed that doesn't matter, it's small compared to the execution time of the queries. If you like it, use it, but lets not pretend it's so much effort it isn't worth redoing. It's certainly not the end all be all of ORMs.

<comment><USER11> No, there's no (technical) reason to redundantly solve the problems that dapper has solved. In particular the emitted IL which avoids costly reflection is not something many people will correctly re-implement.

> A touch of generics done properly, a bit of reflection,

Dapper avoids reflection, its performance is very close to a hard-coded SqlCommand.

<comment><USER7> If you're worried about the speed difference between reflection and a hand written command, you're spending your time in the wrong part of the code. Reflection isn't the bottleneck, the database is, by far.

Yes, if you speed test the difference between reflection and handwritten, it'll look slow, but such micro-benchmarks are unrealistic of production code. If you look for slowness you'll find it everywhere you look, but if you profile real code you'll find the only slow code that actually matters and you'll find that database IO is the bottleneck generally.

</comment></comment></comment></comment></comment><comment><USER12> I haven't been able to reliably/easily get a project to compile on Linux into a self contained executable similar to Go.

At one point this was advertised in blog posts as something that would be possible. Has this changed?

I think it's one of the killer features that help ease the burden of deployment for a lot of folks.

</comment><comment><USER13> Now is the time, Microsoft. Go for it!</comment>


Ruby Tips Part 2 - <AUTHOR> http://globaldev.co.uk/2013/09/ruby-tips-part-2/ <comment><USER2> Some interesting and useful syntax here! However...

 _I'm also partial to this trick for grabbing just the first element of an array._

      family, = socket.peeraddr

This is the sort of code that really turns me off when I'm digging through Ruby. It adds no clarity and actually looks like a typo. What's wrong with this?

      family = socket.peeraddr.first

It's much clearer what's going on.

<comment><USER3> (context: I'm the author)

I do agree with you, but through some failing of my own I still quite enjoy that trick. I included it to highlight the syntax, but I'll add a note saying it's maybe not the best idea to actually use it.

<comment><USER4> I often use it when I'm running through code in a console.

I put it in production code once, but removed it when I realised the "# This comma is important" comment was longer than just using `.first`

</comment></comment></comment><comment><USER5> You have to be careful with using Array() to transform a non-array into an array. Suppose for example you wanted an array of hashes:

      >> Array([{:a => "b"}])
      => [{:a=>"b"}]
      >> Array({:a => "b"})
      => [[:a, "b"]]

It doesn't work as you might expect with a Hash. I'd probably recommend sticking with something like either of these unless you know you aren't going to be getting a Hash:

      a = [a] unless a.is_a?(Array) # option 1
      a = [*a]                      # option 2

<comment><USER6> Or `Array.wrap` if you're using Rails.

</comment></comment><comment><USER7> Great article. One question:

> There's one final use for the splat ( * ); when overriding methods in a > subclass and calling super. If it turns out you don't need the arguments to > the method for whatever additional behaviour you're adding, you can accept > all arguments with a bare splat, then a bare super passes all arguments to > super.

I thought that was the default behavior of super. Isn't it the case that a bare super by default passes all the method's original arguments? I know this has bit me in the past where I've been forced to call `super()` with empty parentheses explicitly to prevent this behavior.

<comment><USER3> You're correct, that is the default behaviour of super.

My intention wasn't to say that super only works like that when you've defined the method like `def foo( * )` but rather `def foo( * )` is an alternative to having to name your arguments when you're not even going to use them as they are automatically passed with bare super.

<comment><USER7> Ah, yes, of course. I understand now. Skimmed a bit too fast there and misunderstood what you were getting at. Thanks!

</comment></comment></comment><comment><USER8> I think it would be neat to have a single place for all up-to-date tips/tutorials/techniques regarding Ruby & RoR (like Superhero.js)

Excellent resource BTW. Keep them coming.

<comment> kot-behemoth There's [http://pineapple.io/tags/ruby-on- rails](http://pineapple.io/tags/ruby-on-rails) which is getting updated quite regularly!

</comment></comment><comment><USER9> Nice write-up about some nifty tricks! Ruby tricks blogs are dime a dozen but I really enjoyed this post as well as Part 1 which was posted here few weeks ago. Looking forward to the rest of the series!

</comment><comment><USER10> Some of these "tricks" contradict the Ruby language philosophy.

<comment><USER11> Care to give some examples where you think this is the case?</comment></comment>


Netflix to Offer Mac Video Streaming By End of Year - <AUTHOR> http://www.macrumors.com/2008/10/02/netflix-to-offer-mac-video-streaming-by-end-of-year/ <comment><USER2> This and their recent deal with Starz may actually push me toward using their streaming service. I just can't wait to see if it can be adapted to the AppleTV.</comment>


Benchmarking PHP functions (in real time) - <AUTHOR> http://net-beta.net/ubench/

<comment><USER2> Author doesn't appear to understand what "tail recursion" means:

<http://net-beta.net/ubench/index.php?t=recurse1>

Interesting results anyway, though.</comment>


TSA encounter at SAN - <AUTHOR> http://johnnyedge.blogspot.com/2010/11/these-events-took-place-roughly-between.html <comment><USER2> I wish I had the means to do what he's doing. But the problem for me, and for many other people I'd imagine, is that when I'm at an airport, chances are I've paid a very large amount of money to be at a certain place at a certain time for what is probably an important reason. Risking losing that much money and the possibility of not getting to where I need to be, even for the noble goal of civil disobedience to protest a ridiculous and screwed-up system, is just too daunting for me. All it takes is one TSA officer having a bad day and misinterpreting something I've said to send me and my bags home--and even if they're in the wrong, the only thing that can decide that is an expensive court case, and I'll still have missed my flight.

I applaud people like this who remind the system that it works for us and not the other way around. I sadly can't take the risk of doing it myself.

<comment><USER3> i travel every few months and do have the means to do what he's doing. my main concern is that if i get kicked off the flight and my ticket refunded, what will happen to my checked luggage?

<comment><USER4> Checked luggage will not fly on the plane without the passenger. Especially if he refused screening! They might want to search it some more but it will stay at the airport where you are.

<comment><USER5> Incorrect. If you get a bite to eat and miss the last boarding call (flying US domestic) the flight will leave without you but with your luggage.

The system would grind to a halt if this was not the case.

<comment><USER6> Now, see, that's insane. If they were _serious_ about security, as opposed to security theater, they would never let baggage fly without its passenger. Even if they search everything, you can't tell me you couldn't build plastic explosives into the wheels of a suitcase or something.

<comment><USER7> That's a very good point, but I'm pretty sure that in response to Pan Am flight 103 a lot of work was put into making cargo holds and containers able to withstand a decent sized blast.

[Edited after fact checking. I know I've seen a documentary on this, but I can't find any further info at the moment. I've probably also been added to some watch list based on my searches over the last half hour]

<comment><USER8> Like you, I can't find the exact info, but I'm pretty sure it was an episode of _Aircrash Investigations_. I saw a repeat with that episode a few months ago.

I didn't come away with the impression that they'd actually implemented blast- proof though, just that they'd redesigned so that _some_ blasts wouldn't dramatically cause airframe failure.

<comment><USER6> Well, but that's still pretty cool. I didn't know this at all.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Good for him. Civil disobedience in defense of our liberties isn't just a good idea, it's a moral obligation.

<comment><USER10> The worst thing is that in this context, civil disobedience is _not_ consenting to either having naked pictures of yourself taken or being sexually assaulted by government employees.

<comment><USER11> It's not the naked pictures, it's the being microwaved. If the machine is improperly calibrated, you'd be cooked.

</comment></comment></comment><comment><USER12> If the goal of the new patdown is to make everyone so embarrassed that they opt for the backscatter machine(1), then I suggest turning the tables.

The next chance I get(2), I'll be pulling a When Harry Met Sally on the TSA employee checking my junk. Let's see how much he likes it when I loudly beg him to keep rubbing me just a little bit longer.

"Damn, that feels good, man. I hope you're enjoying this as much as I am."

(1) see [http://www.theatlantic.com/national/archive/2010/10/for- the-...](http://www.theatlantic.com/national/archive/2010/10/for-the-first- time-the-tsa-meets-resistance/65390/)

(2) DEN has the machine and I fly out every week or two, so I'm sure I'll be reporting back shortly.

<comment><USER13> You do realize that TSA workers are human beings too, right? It's not a video game. Messing with them is not going to do anything constructive, and will most likely make (1) their day worse, and (2) probably your day worse too, if your actions lead to more scrutiny and further "procedure".

<comment><USER14> _will most likely make (1) their day worse_

That's a feature. Like telemarketers, TSA agents assigned to grope duty have no justification for staying in their jobs. It _should_ be unpleasant for them.

On the other hand point 2 is well taken, and for that reason I agree that antagonizing them is a bad idea.

<comment><USER15> > It _should_ be unpleasant for them.

I would instead worry that natural selection will make it so that the only people left are those for whom this sort of thing is enjoyable, with everyone else quitting or transferring in disgust.

<comment><USER16> Having the TSA staffed by perverts whom nobody likes will likely speed the demise of the agency. For example, if it become known that more than one of the agents who pat down children are convicted sexual predators of minors, the public pressure would force the agency to shut down.

<comment><USER15> I sincerely hope that you are correct, because the alternative is too horrible to contemplate.

</comment></comment></comment></comment></comment></comment><comment><USER17> Everyone who is against this needs to understand that these are necessary preventative measures. What is stopping someone from replacing their testicles with 2 cherry bombs whose wicks are then threaded out the urethra? Wear some tight jeans and you'll generate enough friction to ignite the wick, resulting in an explosion that'll knock down the water cups of passengers across the aisle.

<comment><USER18> Poe's law in action. Given the level of response the TSA has to ridiculous scenarios, I'm almost entirely sure that a TSA agent would read this and immediately begin planning a program to defend against the very real, entirely probably threat of terrorist cojones transplants.

<comment><USER19> But would it do anything? Would the backscatter machine even see anything? What about something up the rectum. Knowing of these machines, terrorists will just find another place to stash the gear. If the backscatter machine doesn't protect against that, then what good is it, really? And, is that good sufficient for the invasion of privacy and health concerns?

I say it isn't.

</comment></comment></comment><comment><USER20> Old news that I didn't know: You can opt out of the backscatter machine, but you can NOT opt out of finishing the security screening (i.e., the patdown), once you've put any luggage on the belt. So says the Supreme Court: <http://www.wired.com/threatlevel/2007/08/court-says-trav/>

<comment><USER21> I'm not from the US, so maybe I'm misunderstanding your legal system, but that appears to be a ruling by an appeals court, not the Supreme Court. It also appears to predate the current security checks, where the alternatives of being virtually strip searched or sexually assaulted are each dubious on both ethical and, at least under other circumstances, legal grounds. It seems to me as a non-lawyer that such a ruling might be challenged on several grounds today, not least constitutional ones.

<comment><USER4> It's a ruling by the 9th Circuit Court, a step below the Supreme Court. The appellate courts have regional jurisdiction. As it happens, San Diego, where this incident occurred, is in the 9th Circuit, so this ruling would be the law unless or until it is overturned by the Supreme Court.

<comment><USER20> Woops, sorry, my mistake. I live in the area of the 9th Circuit so it's sort of the same to me.

</comment></comment></comment></comment><comment><USER22> One of my favorite quotes is "gradualness is very powerful." (Happens to be a PG quote.) It helps explain why most people don't seem all that phased by the latest TSA policy changes. Imagine how ominous this video would have been 10-15 years ago.

<comment><USER23> The frog will jump out when the temperature gets up there.

<http://www.snopes.com/critters/wild/frogboil.asp>

<comment><USER22> Well the temperature is getting pretty uncomfortable; let's hope we start jumping.

</comment></comment></comment><comment><USER5> How idiotic:

As he was leaving the airport after being escorted back to the ticket counter, an official told him to return and be searched, "he explained that I may have an incendiary device and whether or not that was true needed to be determined".

So could anyone else who just walked into the airport in that area.

Everyone should explain to their TSA patdown-partner that they have a headache and aren't in the mood.

<comment><USER24> These rules have a simple justification. If an attacker would like to breach airport security but is allowed to walk away once he has started the screening process, he simply needs to continue to try over and over again until he finds a vulnerable location. The Supreme Court has supported this idea [1] and I'm afraid that he may actually get legal action taken against him. :-/

[1] <http://www.wired.com/threatlevel/2007/08/court-says-trav/>

<comment><USER25> As someone else in this thread has pointed out, that was a decision by 9th U.S. Circuit Court of Appeals, not the U.S. Supreme Court. From the article: "The U.S. Supreme Court has never squarely addressed the limits of the Fourth Amendment in the context of airport searches."

</comment></comment></comment><comment><USER26> I'm based in India and am relatively unaware of how American politics work. I have always acknowledged America to be the 'land of the free' , where individual liberties champion everything else, so it's hard for me to imagine this happening. But doesn't Barack Obama have any power as President to stop this (from what I read) illegal act? I also thought he was the President that could change what went wrong with the Bush administration.

<comment><USER27> It not necessarily illegal... it's unchallenged in the court system as to whether it is legal or not.

Obama has, for the most part, turned a blind eye to much of the Bush-era paranoia. A lot of what was introduced is, I suppose, "convenient" to have around (like the PATRIOT Act). The only real thing that seems to have changed is closing the Guantanamo Bay detention center and trying detainees there in American courts, and that isn't going very well either.

<comment><USER26> But is there no law that outlaws groping. I understand that the passenger has to provide consent, but he/she is not exactly in a positive or healthy frame of mind about it. Like the other day I read about a rape victim going through emotional trauma when subjected to the pat-down. Aren't a collection of such incidents, along with medical reports and/or proofs enough to at least warrant challenging the existing law?

<comment><USER28> The fourth amendment:

 _The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized._

What _unreasonable_ means is up for debate but the line is somewhere. And my understanding is that you can't even "consent" away the bill of rights as much as that is argued by the TSA.

My opinion is that groping someone's genitals is clearly unreasonable and that the gradualism of the TSA rules has made this pass by unchecked. You might disagree with that though.

</comment></comment></comment></comment><comment><USER29> "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated..."

I would say that most people agree this is not a reasonable search.

continuing:

"...and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

So even if a search is authorized, there has to be probable cause.

One might say that you submit to this as part of the deal to get on the plane. But if that were true, it would be between you and the airline, not the government. That means it really should be the airlines that decide how intrusive searches should be. And you would be free to choose an airline whose policies you agree with. And the airline would be free to reject you as a passenger.

</comment><comment><AUTHOR> I wonder how much it would cost to start keeping an armed guard on every flight. That's what the Israelis used to do and it seemed like it worked fine for them (they might still do it, but it's been awhile since I've flown through Ben Gurion airport).

Actually, the Israeli security model seemed like it made much more sense with a lot less theater.

When you check-in, your bags are unpacked on a table and the contents are inspected with you standing there.

You pack your bag back up, they tape it with security tape and send it down the conveyor. The ticketing agent then does a short security interview with you regarding where you're going, did you pack your own bag, etc.

You get your tickets and go through the security screen - metal detectors, x-ray, perhaps additional screening if they suspect something. No genital grabbing, no pornoscans (although, my brother did get semi-strip searched once, due to telling a white lie and getting caught at security).

There's an additional interview with customs / immigration before you get to the gate, but that's mostly for passport control issues.

<comment><USER30> Main issue is one of scalability: they get a few conscripts covering their one airport and they're done.

Given some of the crap I've seen/faced going through various Israeli checkpoints though, it's just not a system I would want to see implemented in my own country. Anyone can feel free to disagree, but personally I think people should be able to travel freely within their own country without being treated as criminals (or sexually assaulted to prove their innocence, of course).

</comment></comment><comment><USER5> These new policies should improve TSA recruiting efforts, at least among the pedophile fraction of the population. Anyone who thinks the stories are exaggerated should check out:

<http://www.thousandsstandingaround.org/>

Folks experiences are consistent.

<comment><USER31> Do you even know what the word "paedophile" means? Hint: it involves "children", who would almost certainly be travelling with parents or an appointed guardian who would wish to be present at any physical exam.

You reckon that paedophiles would sign up just on the remotest off-chance that they get unattended access to a child?

<comment><USER32> Or maybe getting paid to watch a video feed of naked children?

</comment></comment></comment><comment><USER33> People should be reminded that this is exactly how the terrorists erode freedom. They don't have to kill us all or take us over to take our liberty. They can simply scare us into giving it away but the solution is as simple as not flinching to the terror and keep going forward.

</comment><comment><USER34> What happens if a passenger opts for the groping session, and then hits on the groper and insinuates loudly that the groper is gay? Is that arrestable?

Some people have to fly, but that doesn't mean they can't turn these situations into comedy highlighting the stupidity of the system.

</comment><comment><USER35> all that to get out of going to his in-law's

</comment><comment><USER4> What do you think are the odds that he'll actually get into legal trouble over this? Calibrate your model of reality!

<comment><USER36> 1 in 45 billion.

One thing the TSA has shown again and again is that they definitely do not want courts involved in their affairs. They certainly aren't going to take this guy to court, because when the ACLU and every similar organization gets involved, it's unlikely to be good for them.

I think the penis-groping requirement is the beginning of the end for them. Something good has finally come out of our nation's irrational fear of anything that could remotely be construed as sexual.

<comment><USER4> Wow, 1 in 45 billion? Yet today TSA announced an investigation into this case, the first step towards a fine. Sounds pretty likely that they'll go through with it.

<http://news.ycombinator.com/item?id=1911670>

If it happens, you will be one of the wrongest people in history! I should have bet you one penny, then you would owe me 450 million dollars.

</comment></comment></comment><comment><USER4> California is a "two party" state for audio/video recordings. He could get in trouble for posting these recordings made without the consent of all parties. And the records would not be admissible in court if he did get sued.

<comment><USER9> Doesn't the "reasonable expectation of privacy" rule apply in this case?

<comment><USER24> I'm not sure what rule or law you are referring do, but I'm guessing no. Illinois is a "two party" state as well and you cannot record audio of anyone with their consent, including a public official acting in a public capacity. However (at least in Illinois) this law does not apply to video. It is a relic from some wiretapping legislation that is being inappropriately applied to citizens attempting to document their experiences with public officials.

<comment><USER27> "Reasonable expectation of privacy" is refers to whether you are performing something in public or not. I can take a video of you standing in Main Street shouting about Hell opening up and devouring us all, because you don't have a "reasonable expectation of privacy."

However, Wikipedia [1] implies this is not civil, but in regards to the government's view of privacy to you, not yours to the government, and is highly unlikely to supersede areas where filming is expressly forbidden, and which is indicated to you when entering that area.

[1] [http://en.wikipedia.org/wiki/Reasonable_expectation_of_priva...](http://en.wikipedia.org/wiki/Reasonable_expectation_of_privacy)

<comment><USER24> That's not true for police officers in two party notification states; I'm not sure whether this applies to private citizens or not.

In Illinois and other two party notification states, you can't record audio of police officers in public places [1]. Video is fine, but since all video cameras record audio, it's a bit of a Catch-22. People get arrested all the time in two party notification states for video taping law enforcement and it's because of the audio function of their device.

[1] [http://www.aclu-il.org/featured/2010/Complaint- ACLUvAlvarez....](http://www.aclu-il.org/featured/2010/Complaint- ACLUvAlvarez.pdf)

</comment></comment></comment></comment></comment><comment><USER37> Vote with your money, not your antics.

There will always be bad apples in the bunch. When I was in Europe there were some cameras set up to monitor an entrance. They hired local nationals to monitor these cameras. Just so happens, there were residences near the entrance; and the 100x zoom didn't help. The people in charge of monitoring the cameras were caught gawking at women undressing and houses had to be black-bared.

Quis custodiet ipsos custodes?

</comment><comment><USER5> The really crazy thing about this is the technology itself. Back in the day in the back pages of Popular Science, you could buy "X-Ray Glasses" that would supposedly let you see through cloths (I assume they didn't really work but never tried them).

Now, the technology actually exists to see under peoples cloths! It is crazy, and what is crazier is that it actually uses x-rays to do so. Who would have thought.

</comment><comment><USER38> Problem with this whole thing is, air security is only really as good as the weakest link. If I take an international flight to america from anywhere that doesn't have these scanners, doesn't that negate the effectiveness of the scanners.

If the scanners are effective in preventing a planned attack won't the attackers just choose somewhere that doesn't have them as a departure point?

<comment><USER39> Given that highschool kids and reporters have repeatedly sneaked liquids, knives and other prohibited items past security and TSA in all of its existence has _never_ stopping a terrorist red-handed. We all should acknowledge that is just security theater.

The real reason we have these machines deployed is that someone in the government knows or plays golf with someone who owns the company that makes these machines. It is basically a contract handout to "cousin Ed". That's just how business is done in DC. Everything else is just propaganda and cover-up.

<comment><USER40> We can take it as given that potential bad guys have been stopped by the combined efforts of the TSA and other agencies. The questions is whether it's been the barbaric security theatre by a cast of hundreds of thousands or hard work by a few people based on human intelligence.

<comment><USER39> TSA does not have a track record of stopping a single bad guy. It was meant to do that but it hasn't, in all the years of its existence.

It wasn't designed to conduct surveillance, gather intelligence, produce scary propaganda, it was designed to catch the guy with the bomb red-handed, as in "Oh look, there is a bomb in an x-ray machine!" kind of situation. That that has never happened. So what do they do? As a proper and decent US govt. agency that they are -- they increase the number of rules and ask for more funds...

But no politician will ever dare dismantle it. Nobody wants to be "soft on terrorism". In case of an attack they need the TSA as a scapegoat so they can point to it and say "look, we are spending all these money, we have all the people groped and x-rayed, there is nothing more we could have done, it is _not_ our fault"

So I'll agree that FBI, CIA, NSA, air marshals, the flight crew, and just regular citizens have stopped bad guys. But not the TSA.

</comment></comment></comment></comment><comment><USER41> I recommend submitting comments about this via the ``Contact us'' page on whitehouse.gov

I also think we should be encouraging the White House to put Bruce Schneier in charge of the TSA.

</comment><comment><USER42> Crazy. If you go to reddit every tsa-critical comment is downvoted and the story has over 2.5k downvotes as of right now.

</comment><comment><USER43> I'm not in favor of the back-scatter machines but it is my understanding that once you enter the security area you are consenting to any kind of search the TSA deem necessary (even cavity if they had reason to feel the need to do one). While you can opt-out of the back-scatter you can't opt-out of any search, which he has done.

The law maybe an ass but he's probably on shaky ground, esp as you can't film or record the security checkpoints either.

<comment><USER44> If he's facing civil penalties, I doubt that's correct.

And you can definitely film and record in the security area as long as you aren't interfering.

<comment><USER45> Not so. Filming is generally forbidden, not by the TSA itself but by airport policy - so most do. I was surprised to hear this myself (figured it would be the TSA...)

</comment></comment></comment><comment><USER46> "Rosa Parks would be proud" indeed.

</comment><comment><USER47> What does the US court(s) say on TSA security check?

<comment><USER36> We don't know yet. The TSA seems to be deathly afraid of anything resembling a courtroom, though.

</comment></comment><comment><USER48> i would imagine standing up like that is a good way to end up on the no-fly list

<comment><USER36> I would imagine that it's not.

</comment></comment><comment><USER13> Ingredients:

1\. drama queen

2\. passive aggressive behavior

3\. poor TSA workers just trying to follow procedures and do their jobs

4\. people being imperfect, making mistakes, getting cranky -- _on all sides_

Folks: have y'all gotten the memo that they do security stuff at the airport? Seriously, they do that now. Deal. And if you want to _change_ anything about this fact, the way to do it is not by going to the airport and doing this kind of thing. The way to do it is through political action and Congress. And heck, through better engineering.

<comment><USER49> Many bad things are "just someone's job". I don't want to invoke the Nazis here, but it applies.

Congress isn't the only way to get things done, nor even the best. Assault on all fronts may be more effective than on one. Flanking was invented for a reason.

You're welcome to kid yourself into believing that this is just the way things have to be, and you can put up with people grabbing your kids and making them cry, and accusing your toddler of being a terrorist and/or explosives mule, but that doesn't mean the rest of us have to stand by and tolerate that shit.

</comment></comment><comment><USER50> _"I looked him straight in the eye and said, "if you touch my junk, I'll have you arrested."_

I stopped reading there. Way to be a douche and instigate trouble.

Edit: There are far more constructive ways to handle dislike of the policies than verbally assaulting front-line TSA workers. They're working hard to make a paycheck. They didn't implement the policies and certainly don't need people treating them like shit because of it.

<comment><USER51> What if the behavior of the TSA worker is reprehensible? The fact that they are working hard to make a paycheck wouldn't excuse their actions. And yes, I would make anybody who engaged in activity that I thought was morally unacceptable clear that I thought they should be ashamed of their current occupation.

Ironically, I have zero problem with strict security checks at the airport, so I'm completely polite to the TSA. But I understand, intellectually, how others could be offended at their activity.

<comment><USER52>
      >  I have zero problem with strict security checks at the airport,
      > so I'm completely polite to the TSA

Because airports and airplanes are dangerous things, but outside of the airport we live in a world free of bad things and bad people (and the possibility of being killed).</comment></comment></comment>


Meet the New Windows Azure - <AUTHOR> http://weblogs.asp.net/scottgu/archive/2012/06/07/meet-the-new-windows-azure.aspx

<comment><USER2> What's interesting about this is MS is charging more for their own products than for non-Windows machines.

<http://www.windowsazure.com/en-us/pricing/details/>

I'd heard a speaker at an MS event (codecamp event) talking about how web hosting companies (and virtual machine companies) would charge more for windows to take advantage of MS marketing, but that hosting on MS servers was overall much less expensive, because of all the management tools.

MS charges more for Windows than for Linux. Sort of makes sense, maybe, but I wonder why that is. These numbers look a lot like Amazon's EC2 pricing. Perhaps MS have some floor pricing in effect such that they can't undercut other resellers?

</comment><comment><USER3> Lots of really interesting things, I like they're bring git (although personally wish it supported hg) publishing, memcached protocol support etc.</comment>


15 HTML5 tools that saves time for developers - <AUTHOR> http://blog.psibertech.sg/2014/09/20-html5-tools-that-saves-time-for.html

<comment><USER2> This is cool</comment>


Ex-NSA hacker drops macOS High Sierra zero-day hours before launch - <AUTHOR> http://www.zdnet.com/article/apple-macos-high-sierra-password-vulnerable-to-password-stealing-hack/ <comment><USER2> I wonder what aspect of this is new or novel?

It's been possible to dump passwords from the current user's Login Keychain via "security dump-keychain -d login.keychain" or "sudo keychaindump" for a long time:

[https://tinyapps.org/blog/mac/201211030700_recover_keychain_...](https://tinyapps.org/blog/mac/201211030700_recover_keychain_passwords.html)

</comment><comment><USER3> It's almost like deliberately running malicious code is bad for your PC.

<comment><USER4> Or someone you lend your PC to for a few minutes

<comment><USER5> Is loaning your laptop to nefarious characters something you do frequently? Pretty much the only time I've ever "loaned" my laptop to someone, it was a co-worker who used it for a presentation, projected on the wall, with me and a room full of other colleagues watching everything they do. When it's not a co- worker presenting, it's my wife.</comment></comment></comment>


A Guide to WebAuthn - <AUTHOR> https://webauthn.guide/ <comment><USER2> This guide focuses on what WebAuthn looks like for the server. What does it look like for the user?

As far as I can imagine, it boils down to relying on the possession of a certain piece of hardware instead of knowing a certain password. That is, I have to carry around some kind of USB device and plug it into every computer I want to use. The device holds all my secret keys and does all the magic behind the scenes. But if I lose my device, then I can't log in. And if someone steals my device, then they can log in.

Maybe you can make it more convenient by using my phone instead of a specialized USB device, since everybody is always carrying around their phone everywhere they go anyway, right? But I just want to know that I understand the entire landscape first, from the point of view of the user, at a broad level. What are the user's options? What exactly does the user do? Is this only for smart users? If I made a web app for the general public, and my only method of authentication was WebAuthn, would the average user easily figure out what to do, or would they give up and walk away?

Some have mentioned "software-based" tokens, but then how are those kept safe? With a master password? Then we're back to passwords.

<comment><USER3> The most common use case today is 2FA, where WebAuthn is the standard way to do something U2F defined only for 2FA.

In this scenario where it's only a second factor, yes, it relies on you possessing a Security Key, and on the bad guys not possessing it. This matches the threat model, which is typically that bad guys are not your flatmate or your mother they live in another country and will never meet you.

WebAuthn (and U2F) were specifically designed to register multiple tokens, the server-side stuff described explains how a site insists "Look I need to register a _new_ token, not _these_ tokens which I already registered" while also being open to whichever token you have on login, "Any of _these_ tokens can log in, I don't mind which". So I have a token in my pocket, but if I got mugged I have a backup token at home that can substitute. Well designed sites let you nickname them during registration so you can go "I lost _green hulk_ token but I still have _Yubikey_ " later.

Yes, if you use the flows where both factors are handled by the FIDO token then you're "back to passwords" but with a very important difference. Very, very important:

Right now your password for news.ycombinator.com is known by the Y Combinator servers. Now, I'm sure they take good care of it, using a modern salted and pessimised hash for the purpose, but this creates many extra opportunities for vulnerabilities and a bad guy only needs to find a crack in one place.

Whereas if I have a PIN for my FIDO token the PIN lives on the FIDO token. Not on every web site I use WebAuthn with, not in a database that some poor new sysadmin accidentally uploads to the Cloud, it's not sent over the wire to some Java backend sevice that might accidentally log it, or whatever. The device can _insist_ upon rate-limiting attempts because it's a piece of hardware, like an iPhone.

<comment><USER4> Unfortunately for the user experience, those tokens typically can't be cloned even upon initial setup. The practical result of this is that if you intend to keep a second token as a backup, you need to remember to register the backup token individually for each service you use your primary one for. This is unlikely if you keep the backup at home, and it's downright impractical if you kept it in e.g. a safe deposit box.

I love FIDO tokens, but I'm not confident in my ability to keep myself from getting locked out of a service I use infrequently, and I'm a fairly technical user.

<comment><USER5> > Unfortunately for the user experience, those tokens typically can't be > cloned even upon initial setup. The practical result of this is that if you > intend to keep a second token as a backup, you need to remember to register > the backup token individually for each service you use your primary one for. > This is unlikely if you keep the backup at home, and it's downright > impractical if you kept it in e.g. a safe deposit box.

This right here is what drives me crazy about most 2fa implementations (and now apparently webauthn). I currently store 1 backup token offsite, and carry one with me. The problem is - I have no good way to access the backup device (so I can add it to my account) without having both in my possession, which destroys its abilities as a backup token.

I would love to be able to somehow have 2 fido keys use the same key, but I'm not sure how that's possible without exposing the private key externally, destroying some of the device's security properties.

<comment><USER6> You could have a single soft-U2F vault that contains all your accounts, and secure that vault with your hardware tokens. Using something similar to LUKS ([http://clemens.endorphin.org/TKS1-draft.pdf](http://clemens.endorphin.org/TKS1-draft.pdf)), you could allow multiple tokens to decrypt the vault without exposing the master key. The downside is that there's no way to revoke access to the vault if a copy leaves your possession.

</comment></comment></comment></comment></comment><comment><USER7> I see a lot of comments of people interested to test it out.

If you have a hardware token with NFC, you can now test it everywhere: Mac, Windows, Linux (), Android (all browser), iOS (Safari iOS 13.3+). This is a big achievement as less than 1y ago the story was sooo much different.

If you do NOT have a hardware token, here are some options:

\- Windows with TPM or Hello

\- Mac with touchID sensor, you have to use Chrome

\- Android phone, Chrome mobile, should work with fingerprint and face recognition

\- An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop.

Hope this list helps, please add if I forgot anything.

<comment><USER8> Chrome beta on mobile didn't work for me with either fingerprint or any other method, the call to navigator.credentials.create just fails. Firefox half- works.

<comment><USER9> Firefox mobile works for me on [https://webauthn.io](https://webauthn.io)

Which half doesn't work?

<comment><USER8> For me, authentication, though I see it works on that site. Maybe I made a mistake somewhere.

</comment></comment></comment></comment><comment><USER10> Why is the information that needs to be sent to the server so complicated? Specifically you need to send the rawId (raw bytes), clientDataJson (json), attestationObject (cbor) and the result of `getClientExtensionResults()` (js object). And then the attestationObject further includes an `authData` field which is itself a structure which contains another field which is CBOR encoded.

Why not a single CBOR object?

<comment><USER11> Can you clarify whether you mean _only_ the `attestationObject` should be sent to the server or that everything should be encoded as a _single_ CBOR object and then sent to the server?

<comment><USER10> I mean why are ther multiple objects that have to be sent instead of a single cbor object. And why is some of it cbor and some of it json?

<comment><USER12> Gets worse. Some of it is ASN.1 inside CBOR too. Some of it is custom binary format containing CBOR

The answer is as far as I know:

Backwards compatibility with bad decisions made in U2F

Also; relying on base64url is odd as there are no built in functions in JavaScript to encode and decode it.

<comment><USER13> > Also; relying on base64url is odd as there are no built in functions in > JavaScript to encode and decode it.

I'm probably missing something, but aren't window.atob and window.btoa just that? It's not available in Node though.

<comment><USER10> btoa is base64 not base64url. And even if it was base64url, it takes a "binary string", so using it on, say, a Uint8Array is non-trivial.

<comment><USER13> Thank you, I didn't realize the URL safe variant of Base64 had a name and that it was this!

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> What's the story here regarding software tokens? As I understand it, the WebAuthn standard doesn't preclude non-hardware tokens, but doesn't explicitly define support for it either. In particular, I would like to use my phone and its built-in Titan M chip for WebAuthn authentication over the internet, instead of using a hardware token. Is that possible or on the horizon?

<comment><USER12> That will already work right now!

Go to [https://webauthn.io](https://webauthn.io) on your phone and it will ask for your pin or fingerprint and then use the titan chip for the handshake! If it doesn't work. Select "Platform authenticator" in the drop down

Will also work on iOS 13 beta.

If your computer has a TPM 2.0 chip then it will also work on Microsoft Edge in Windows 10 (and maybe also other browsers. If they implement webauthb Microsoft Hello API )

Website is implemented with the excellent [https://github.com/duo- labs/webauthn](https://github.com/duo-labs/webauthn) library by the way

<comment><USER14> Thanks for the info. This is not really 2FA anymore though, is it? Now WebAuthn authentication is happening on the same device as the one I'm using to log into the service. Is there a way to use my phone as a completely separate factor for WebAuthn authentication?

<comment><USER12> Webauthn is not a 2fa API. It's an authentication API. One of its usecases is to enhance password login (2fa) but can also be used as a single factor.

That is up to the implementor.

The implementor can ask the browser for certain security features of the authentication device. E.g. is the authentication device the same device as where the authentication flow is happening; is there a biometric check on the device or a pin on the device (i.e. the second factor is there but device- local) who is the manufacturer of the device (with consent of the user; given this is privacy-sensirive info) etc. And the implementor can then make a decision whether a device is 'strong' enough for single factor auth. All this information is cryptographically attested by the device.

You can ignore all that and only use it as a second factor always though. That's totally up to you and how you use the authentication primitives that webauthn provides.

<comment><USER14> Thanks again for the info. Sounds like I have some more reading up to do on WebAuthn.

</comment></comment></comment></comment></comment><comment><USER15> So, I went on the demo website ([https://webauthn.io/](https://webauthn.io/)) to try it with a recent desktop Firefox.

I enter a username, press "Register" and Firefox gives me a prompt to "login [with a security key] and authorize", with only a "Cancel" button. And that's all that happens.

Wait, so I can only use this stuff with a hardware token ? Bummer !

<comment><USER16> Firefox lets you enable software tokens, and disable USB tokens: in about:config, set

        security.webauth.webauthn_enable_softtoken=true
        security.webauth.webauthn_enable_usbtoken=false

then the registration will go through without needing a hardware token.

<comment><USER17> In other words, I can't use it in production (yet), because I'd need to ask users to change browser settings for it to work. That's disappointing :(

<comment><USER10> You can use it in production for users who have hardware tokens (and it is used in production by many sites for 2FA). But if you mean you can't _exclusively_ use it in production, then yes that is probably true since not all users will have authenticators (yet).

</comment></comment></comment></comment><comment><USER18> In the future, what will prevent some random border officer from pointing my phone to my face and unlocking all my social media, google/Apple accounts, mail, bank etc?

<comment><USER19> What's stopping them from doing that now?

<comment><USER20> My password, pin, whatever, is in my head

<comment><USER19> In that case you should probably not use this, or if you do, sign out of your accounts. If you're worried about Face ID, you can actually temporarily disable it easily (without even looking at your device) by holding down the power button and volume up until it vibrates.

</comment></comment></comment></comment><comment><USER8> I am really excited about WebAuthn finally being the end of usernames/passwords and credential leaks/thefts, so much so that I've implemented a Django library for usernameless authentication with WebAuthn:

[https://pypi.org/project/django-webauthin/](https://pypi.org/project/django- webauthin/)

It's live on some of my side projects, if you want to try it out:

[https://www.pastery.net](https://www.pastery.net)

[https://www.eternum.io](https://www.eternum.io)

[https://www.deadmansswitch.net](https://www.deadmansswitch.net)

<comment><USER21> I love DMS! Thank you for implementing this on it. =)

<comment><USER8> Thanks, I'm glad you like it!

</comment></comment></comment><comment><USER22> > After the PublicKeyCredential has been obtained, it is sent to the server > for validation. The WebAuthn specification describes a 19-point procedure to > validate the registration data

19 points?! I haven't dug too deep into the details, but so far everything I've seen re: implementing WebAuthn seems so... over complicated? Compared to implementing, say, TOTP based 2FA, which is very straightforward.

<comment><USER3> Complicated certainly. But over-complicated would imply that there's a significantly simpler way to do it.

The nice thing about software is that it can be copied, so the complicated part only needs to be done once by somebody suitably skilled in the art.

</comment></comment><comment><USER23> So this is like BrowserID/Persona but instead of including the third-party email service to prove identification, the only credentials are on device/in- browser, right?

I assume that if you only connect one computer (authenticator) and lose the device, you're either SOL or the service has some workaround where you pre- register an email address or a separate "Login With" service.

<comment><USER8> No, it's a new standard where the site securely negotiates the login with the browser. What happens after that is the browser's job, all the site cares about is that it sees a correct credential.

Eg your password manager could implement this so all you'd have to do is click "log in" and you'd be in, without usernames or passwords to remember or steal.

<comment><USER2> So, how do you keep someone else from sitting down at your computer and clicking Log In? Am I right in guessing that fundamentally you're back to passwords, in the sense that when you are away you lock your computer screen and have to enter a password to unlock it (or some other implementation that still relies on passwords, like if your browser requires a master password to use its password manager, etc.)

<comment><USER24> You use some method of authentication, of course. How do you keep someone who has your unlocked password manager from using it? You just make sure nobody is ever in that situation.

The big win is that, with WebAuthn, you don't need to also hide your authentication from site operators, your OS, key loggers, phishers, etc etc.

<comment><USER2> Thanks. Like you said, this is safer, even if a password remains somewhere in the chain, like a master password for your computer. An advantage is that websites are not storing passwords (hashed or otherwise, because it's hard to do well).

<comment><USER8> I use a Yubikey, so there's no password for me (just a PIN that wipes the key if it's entered incorrectly a few times). You can also use a fingerprint scanner, face ID, etc.

</comment></comment></comment></comment></comment></comment><comment><USER25> This is a great, highly accessible guide. The biggest value add is in the description of the protocol, although the W3C standard ([https://www.w3.org/TR/webauthn/](https://www.w3.org/TR/webauthn/)) was also expertly written and is a great, relatively accessible resource. Duo has done good work in this space.

I've written an implementation of WebAuthn for Python-based webapps: [https://github.com/pyauth/pywarp](https://github.com/pyauth/pywarp) that may be useful to implementers.

</comment><comment><USER26> Is it fair to call this client side certificates 2.0?

</comment><comment><USER27> I really enjoy the server-client diagram [1].

I've always thought myself very able to explain technical things quite well to non-technical people, but always struggled to explain the public/private key exchange in a simple way. This is really neat.

1: [https://webauthn.guide/#authentication](https://webauthn.guide/#authentication)

</comment><comment><USER28> I didn't read the whole thing, but the first few paragraphs make it sound almost exactly like SQRL (ie. no secrets to keep).

<comment><USER29> SQRL used to be a nice protocol, now it's a completely unusable monster with more than 100 pages of technical documentation.

If you're interested in something similar that actually works and is very simple, take a look at [https://github.com/btcontract/lnurl- rfc/blob/master/spec.md#...](https://github.com/btcontract/lnurl- rfc/blob/master/spec.md#2-lnurl-auth)

</comment></comment><comment><USER30> What If I got multiple devices? Does the server have to store multiple keys per user?

<comment><USER31> Yes, that's what is recommended and most sites implement (AFAIK Twitter for some reason only permitting one :-/)

<comment><USER32> And how do you enroll the second device?

It would have to be something like;

1) Login on primary device

2) Generate a one-time code or link

3) Enter one-time code or click link on 2nd device

4) Click an "Enroll" button on the 2nd device which would generate a second enrollment saved in the account.

You would have to do this for each and every service so that seems like a total non-starter.

Alternatively, a way to share the private keys securely between the devices. But I'm not sure if there are site-specific salts as part of the WebAuthN signing process which would require additional state be sync'd between the devices in order to authenticate to a new service on both devices?

<comment><USER33> There's an ascending signature counter that's intended to prevent cloned devices (replay attacks are prevented seperately with server generated challenge). One way around it is clone (backup key) having very high initial signature counter set, so first use invalidates original (on loss). But yeah it's a UX problem that hopefully will find a better/non-hacky solution than "register multiple keys for each site".

<comment><USER5> > But yeah it's a UX problem that hopefully will find a better/non-hacky > solution than "register multiple keys for each site".

This seems like a huge blocker for adoption. I currently run into this issue with FIDO for 2fa - I store my backup key offsite, which means enrolling the second device requires me to make a special trip to retrieve the device. My current approach is to retrieve the backup token every few months and add it to all of the new services I have enrolled in, but I don't have a good system for remembering all of these services, so I inevitably forget one (despite only using the key on a few services)...

<comment><USER3> Write the services down. You don't need to keep the fact that you have FIDO tokens secret unless you're keeping them somewhere otherwise unsafe like under a rock in your garden. So a list titled "Services I've enabled for FIDO" with check columns for the tokens gets it done.

<comment><USER5> That's my current approach, but I'm not as disciplined about writing them down as I should be.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> How are these private keys being stored? It seems to be implied that there is a different public/private key pair for every website so are they stored in the browser? (or at an OS-level?)

<comment><USER35> They are stored on hardware tokens. There does not seem to be a way to have privately generated software keys, nothing like putty's pageant or .ssh/authorized_keys.

WebAuthn seems to be designed by big businesses to take control of the authentication ecosystem.

<comment><USER12> There are already open source hardware and software available by the people at SoloKey. Both Nitrokey and SoloKey sell the tokens.

<comment><USER36> If you are looking for a solution that supports FIDO2 and also functions as a hardware password manager (lots of sites still don't even support security keys) check out OnlyKey - [https://onlykey.io/](https://onlykey.io/)

OnlyKey is also open source here are some of the features: \- On device PIN \- FIDO2 (15 Resident keys) \- TOTP (24 accounts) \- Static passwords (24 passwords up to 56 char long) \- OpenPGP

</comment></comment></comment></comment><comment><USER37> If you have a Touch Bar MBP this works with Chrome and the Fingerprint Sensor out of the box. On iOS 13 you need a hardware token currently. MacOS Safari doesn't have support.

</comment><comment><USER38> This is about the same library:

[https://www.agwa.name/blog/post/always_review_your_dependenc...](https://www.agwa.name/blog/post/always_review_your_dependencies)

Claims there are it's written by people who don't understand Go that well.

</comment><comment><USER39> My spider-senses are tingling: Is this tracking I can't get rid of?

<comment><USER40> I mean, if you are logged in, the service already knows who you are.

I guess your public key could get associated with your identity. But the pub key is only sent when you register, I believe. So I can't see how this would be used for tracking.

</comment></comment><comment><USER41> Anyone know if this will let sites use TouchID / FaceID on ios?

<comment><USER42> When I last tried a couple weeks ago it looked like some basic support for hardware tokens existed, but not for Face ID.

</comment></comment><comment><USER43> Can WebAuth work on websites that do not use JavaScript?

<comment><USER44> No. The browser provides a client-side API that is exposed through JavaScript.

</comment></comment><comment><USER29> Why is everybody acting as if this is some kind of solution to password-based auth? Can you even imagine a world in which a big chunk of the population carry these tokens around and never ever lose them?</comment>


Build Real-World Games with Google Maps APIs - <AUTHOR> https://maps-apis.googleblog.com/2018/03/the-real-world-as-your-playground-build.html <comment><AUTHOR> You can also use Mapbox's APIS if you prefer to support a more open company :)

[https://www.mapbox.com/mapbox-unity-sdk/](https://www.mapbox.com/mapbox- unity-sdk/)</comment>


4b825dc642cb6eb9a060e54bf8d69288fbee4904 - <AUTHOR> https://ah.thameera.com/4b825dc642cb6eb9a060e54bf8d69288fbee4904/ <comment><USER2> couple of points:

1\. this is shorter "git mktree < /dev/null"

2\. magic value is useful if you want to diff from nothing "git diff-tree --numstat 4b825dc @"</comment>


Online conference for startups - 100things - Featuring PG, Joel Spolsky ... - <AUTHOR> http://carsonified.com/online-conferences/100-things/

<comment><AUTHOR> So what do you guys think? Worth $299 ? Does this concept work ? My point is that Mixergy videos are free and available all the time, why pay?

<comment><USER2> Thanks for the compliment. As helpful as I want my interviews to be, I think we need to meet in person too.

In person, you can build more meaningful relationships.

Also, people will open up to you in person in a way that they can't do in an interview.</comment></comment>


How to Write a Spelling Corrector - <AUTHOR> http://norvig.com/spell-correct.html <comment><USER3> I couldn't help but read this and think about all the "coding" initiatives I've seen in K-12 and shake my head.

What Norvig is doing is what we should be teaching. He is tackling this seemingly REALLY hard problem by thinking about it methodically, translating some intuition into code, carefully constructing an argument about how to solve it, and ways that it could be extended. This is what actual engineers look like.

Everything I've seen around "coding" though has become a masochistic exercise in teaching kids random syntax details and then calling them Coders and Geniuses and Computer Scientists when they successfully copy what the teacher showed them.

When you read Norvig's code (big fan of his Sudoku one as well), you realize how the actual "code" is secondary in the sense that what it is really doing is expressing an idea. A very nunanced, elegant idea, but ultimately the product of doing some hard thinking and exploration on a problem domain.

If we taught kids to just think about problems in this way, ohh what a world it would be!

<comment><USER4> By that reasoning, we should not teach kids how to spell, or about punctuation, and just aim for them writing essays/stories/novels.

<comment><USER5> "If you want to build a ship, don't drum up the men to gather wood, divide the work and give orders. Instead, teach them to yearn for the vast and endless sea."

<comment><USER6> That's a lovely idea although I can't help noticing that I know of no shipbuilding companies based on the teaching of yearning while I do know of some that seem based on organising a workforce. I suspect that this is one of those ideas that while beautiful is far from being literally true.

How about "if you want your citizens to fund a space program, don't gather the workforce to build a spaceship but teach them to yearn for the vastness and potential of the void."

</comment></comment></comment></comment><comment><USER7> Spell chequer

Martha Snow

Eye halve a spelling chequer It came with my pea sea It plainly marques four my revue Miss steaks eye kin knot sea.

Eye strike a quay and type a word And weight four it two say Weather eye am wrong oar write It shows me strait a weigh.

As soon as a mist ache is maid It nose bee fore two long And eye can put the error rite It's rare lea ever wrong.

Eye have run this poem threw it I am shore your pleased two no It's letter perfect awl the weigh My chequer tolled me sew.

<comment><USER8> In a way, I'm surprised I can read this so easily. Do our brains read by converting text to sounds, and then parsing the sounds?

<comment><USER9> I think many people do have brains that operate this way, probably because their understanding of language is grounded in conversation as a first experience. I suspect this is the reason you see confusion with "your, you're" and "there, their, they're."

I don't parse language in quite that manner, and even in speaking I have a different "mouth feel" for those homonyms. This creates a modest inversion of the idea of spelling errors for me, in that people who truly do say homonyms in such a way that to my hearing it is exactly the same require me to parse for context.

<comment><USER10> > I don't parse language in quite that manner, and even in speaking I have a > different "mouth feel" for those homonyms.

I believe in the (somewhat controversial) non-subvocalization-based text processing and even think I do it myself, but I'm wondering if you could describe more about the "mouth feel" issue. Do you mean that you believe that you pronounce them using different phonology (that another person would potentially be able to hear), that your muscles are doing something different but not in a way that makes an auditory difference, or simply that you're subjectively aware of the spelling while speaking but not necessarily in a way that makes a physically-observable difference? Or is it not quite clear which of these is the case?

I think this is an interesting question in the philosophy of language and also in the psychology of reading. (I've thought about this myself but haven't studied the academic literature about it.) If your answer is the first one, I wonder if you'd be willing to make an audio recording of yourself pronouncing these words that might show what difference you experience.

By the way, there are documented cases where spelling differences have created new pronunciation differences that didn't previously exist in the spoken language. Maybe something like that has been happening in your idiolect?

<comment><USER11> I have a similar feeling, when I pronounce a homonym/homophone. The word "mouth feel" resonates for me, although I suspect that sometimes it's just an awareness of the spelling of the word. Other times, I'll consciously choose to pronounce a word differently to try to disambiguate it. I'll say "aunt" as "ant"/"ont" (read those second as phonetically-spelled Californian American pronunciations) depending on the situation and flow of the sentence. "They're" is usually "They-er", "their" is sometimes "thur" (like "fur" with a /ð/), and "there" feels like it's pronounced the expected way. "To" might be "tə", but "two" and "too" never are.

Of course, that's all when I'm paying close attention to what I say. I'm sure there are times that I go against those. Also, sorry for the mix of layman phonetic spelling and IPA.

</comment></comment></comment></comment></comment><comment><USER12> Although not a spell checker specifically, I wrote an offensive language filter for a chat system used by the National Hockey League for a period when they hosted communal chat rooms during televised games.

The architecture I used is completely different from what is described here, but the goals are very similar. I had to handle any curse word in any language, including curses from one language translated into another language, as well as offensive phrases, and their translated equals, as well as offensive slang, and mispelt offensive slang translated from other languages.

I ended up with an offense dictionary of about 700K words and phrases. This was back in '99, so my memory may not be 100% here, but I remember using Perfect Hash to generate a compiled hash table for the dictionary, and then a trie to organize the dictionary lookups. The entire system was about 150K of a downloaded exe to access the NHL simulcast chat, as all the offensive language filtering occurred on the client side. Chatting anything that could be offensive turned into a series of words with their interiors all asterisk '*', and it ran in something like 500 ms. Fun times. That company and project died with the dot com bust.

<comment><USER13> > but I remember using Perfect Hash to generate a compiled hash table for the > dictionary, and then a trie to organize the dictionary lookups

But... but programmers on HN told me that tries are just useless pieces of trivia used to fail people in interviews, and if you need them a library is just going to do it for you in the most efficient possible way.

<comment><USER14> Tries are lovely little datastructures, don't let anyone tell you any different. It's not like you'll use them every day, but they're nice to have when needed!

</comment></comment></comment><comment><USER15> The code's been updated to more modern Python and to not try to smooth the probabilities. (Also it computes probabilities instead of frequencies now, though that shouldn't affect the result.)

</comment><comment><USER16> His python code styling is really awesome. So concise. Probably inspired by all the LISP he wrote in the past.

Although he does seem to be using doc strings incorrectly

<comment><USER17> Came here to say this. I've combed through his pieces many times over just to glean the way he structures his code. Here, he got my head spinning for a minute with

      return set(w for w in words if w in WORDS)

and made a mental note to use that idiom in the future.

As for doc strings, well, this is just a toy piece of code after all. The main purpose for the code is to be read, instead of actually used. _something something hobgoblin of little minds_

Edit: formatting.

<comment><USER16> that is a great idiom. i remember the first time i saw it (possibly in is very essay), i thought it was awesome. I use it all over the place now. it is similiar to the javascript ternary operator [1], which I also find to be very useful

       var varX = (boolean) ? 'X' : 'Y'

[1] [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Operators/Conditional_Operator)

<comment> nommm-nommm Pretty much every language has a ternary conditional operator: C++, Java, Python, C#, Ruby....

</comment></comment></comment></comment><comment><USER18> The last 9 times it was submitted: [http://goo.gl/mVSi7W](http://goo.gl/mVSi7W)

<comment><USER19> I want to see someone do a post on how they analyzed all of the top stories on HN (ones that got more than "x" upvotes) and calculated the ones that could be resubmitted after "y" time period had gone by. For extra bonus points figure out if any particular hn handle has gone in and resubmitted old stories in the past by a similar technique and analysis.

<comment><USER20> In Go.

</comment></comment></comment><comment><USER21>
      >>> import spell
      >>> spell.correction('ducking')
      'fucking'
      >>>

Yup, it works.

</comment><comment><USER22> I love it. Spell checking was pretty relevant to some of my work recently and I needed to correct heavily typo'd address text from Chicago parking ticket data. It used difflib to recursively find similarly typo'd address until it finds a matching address within a list of correct addresses. Definitely a lot more to polish, but I'm kinda proud of the naive approach.

[https://github.com/red-bin/tyop_fixer](https://github.com/red-bin/tyop_fixer)

      coumbia,columbia,0.933333333333
      argy,argyle,0.8
      menomee,menomonee,0.875
      newladn,newland,0.857142857143
      boulevard way,boulevard,0.818181818182
      sherwn,sherwin,0.923076923077
      lawrencec,lawrence,0.941176470588

</comment><comment><USER23> If people like this, also check out his course at Udacity - [https://www.udacity.com/course/design-of-computer- programs--...](https://www.udacity.com/course/design-of-computer-programs-- cs212)

</comment><comment><USER24> The D language compiler consults a simple spell corrector when encountering an unknown identifier. The dictionary is the list of names currently in scope. It's a nice improvement to the error message about an unknown identifier.

</comment><comment> r-c-r I added a spelling corrector to an application a while back. I tried a couple of libraries that implement these ideas. Problem is it can be slow for big words.

I stumbled across this algorithm which is much faster if you allow some time to pre-process your dictionary. [http://blog.faroo.com/2012/06/07/improved- edit-distance-base...](http://blog.faroo.com/2012/06/07/improved-edit- distance-based-spelling-correction/)

I implemented it here for fun in common lisp. Excuse the ugly code. [https://github.com/RyanRiddle/lispell](https://github.com/RyanRiddle/lispell)

</comment><comment><USER25> Reverse of the logic presented could be used to inject typos into a document per distributed copy of it to help identify anyone sharing documents online; basically each copy is unique to allow for attribution. Hash of each document could even be given to a third party and archived to provide if needed independent verification of the claim that the document and the document itself could be encrypted, loaded to another third party to log the IP and finger print of the download provide another independent verification of the exchange.

<comment><USER26> What is the application where typos in a document are acceptable?

<comment><USER27> Classified reports. This technique is called the Canary Trap, with the name (but not the technique) coined by Tom Clancy.

[https://en.wikipedia.org/wiki/Canary_trap](https://en.wikipedia.org/wiki/Canary_trap)

<comment><USER28> For that purpose you'd want to add typos that would be "corrected" into the wrong word by a typical spellchecker or that are actually correct, but atypical in context, words. Otherwise passing the document through a spellchecker would remove the watermark.

<comment><USER26> Heh, perhaps an easier way would be to have unique phrases in each document. Typos risk exposing you because they will stand out to the person who is reading the document - assuming such a person is more discerning than most, given that they're accessing classified docs.

</comment></comment></comment></comment></comment><comment><USER29> The date on the top says February 2007 to August 2016.

Does anyone know which parts are new in August 2016? I've read this before and it isn't sticking out to me.

<comment><USER30> The code has been updated stylistically, and I'm not sure what else has changed. Here's the old (Python 2.5) version from [http://web.archive.org/web/20160110135619/http://norvig.com/...](http://web.archive.org/web/20160110135619/http://norvig.com/spell- correct.html):

        import re, collections

        def words(text): return re.findall('[a-z]+', text.lower())

        def train(features):
            model = collections.defaultdict(lambda: 1)
            for f in features:
                model[f] += 1
            return model

        NWORDS = train(words(file('big.txt').read()))

        alphabet = 'abcdefghijklmnopqrstuvwxyz'

        def edits1(word):
           splits     = [(word[:i], word[i:]) for i in range(len(word) + 1)]
           deletes    = [a + b[1:] for a, b in splits if b]
           transposes = [a + b[1] + b[0] + b[2:] for a, b in splits if len(b)>1]
           replaces   = [a + c + b[1:] for a, b in splits for c in alphabet if b]
           inserts    = [a + c + b     for a, b in splits for c in alphabet]
           return set(deletes + transposes + replaces + inserts)

        def known_edits2(word):
            return set(e2 for e1 in edits1(word) for e2 in edits1(e1) if e2 in NWORDS)

        def known(words): return set(w for w in words if w in NWORDS)

        def correct(word):
            candidates = known([word]) or known(edits1(word)) or known_edits2(word) or [word]
            return max(candidates, key=NWORDS.get)

</comment></comment><comment><USER31> Is there any C++ version of a decent spell checker ? Been looking for sometime (mainly out of curiosity), most are either amateur school projects or too academic/phd-ish....would love to go through a good open source C++ based spell checker that can be used in practise (with little modifications if required)

<comment><USER15> You could make a good start with the ideas from [http://norvig.com/ngrams/](http://norvig.com/ngrams/) (a fancier corrector in the vein of the OP).

</comment></comment><comment><USER32> This is a beautiful example of pithy high-level coding. I feel compelled to mention, however, that the example word, 'thew', is in fact a(n archaic) English word: [https://www.google.com.au/#q=thew](https://www.google.com.au/#q=thew) :P

</comment><comment><USER33> I wrote one in PLV8 (Postgres) just for fun:

[http://blog.databasepatterns.com/2014/08/postgresql- spelling...](http://blog.databasepatterns.com/2014/08/postgresql-spelling- correction-norvig-plv8.html)

</comment><comment><USER34> I wrote a direct port in Golang with benchmark comparisons:

[https://github.com/montanaflynn/toy-spelling- corrector](https://github.com/montanaflynn/toy-spelling-corrector)

</comment><comment><USER35> This is really cool and I'm wondering if you could improve the ability of this by adding a markov chain/tree structure of most word usage patterns and doing contextual searching for your word. You wouldn't need your wordlist and your could compress and package this.

The way this would work is by looking at the previous word, and the next word is available. It would find every word combination that looks like that and then do a Levenshtein distance for all of the words that come between these two items.

Is this the way "big" spelling correction methods work or is it by other means?

<comment><USER36> Yes, using language models is how it's done.

Theoretically, it's not that hard, in practice, it's _really_ hard.

There is an online language modelling course from Stanford that you should check out if you want to take a stab.

</comment></comment><comment><USER37> That's not how Google does it. Try spelling errors with Google Search. Google does multi-word spelling correction.

<comment><USER38> I guess that Google looks at each word individually. And what Google does is intriguingly simple: When they see someone do two similar searches from the same person, where the second search has way more results, they record the first search as "wrong spelling", and the second one as "correction".

</comment></comment><comment><USER39> I wrote Rust version of spelling corrector sometime back to explore nitty gritty of language [https://github.com/vpanghal/spellcorrector](https://github.com/vpanghal/spellcorrector)

</comment><comment><USER40> Is this how modern spell checkers actually work? I assumed they would use a heuristic trying to match common misspellings to their frequent corrections. That or a combination of heuristic and Bayes.

<comment><USER41> For one, I'm fairly sure that modern spell checkers use n-gram language models rather than a 1-gram model to decrease perplexity. Disclaimer: I skimmed the article.

</comment></comment><comment><USER42> Versions in C, C++, Java, Haskell and Racket [https://github.com/jmoy/norvig- spell](https://github.com/jmoy/norvig-spell)

</comment><comment><USER43> Any article like this for grammar correction?

I've been interested to know why grammar checking and corrections can't be more accurate.

<comment><USER43> An open source grammar project written by CMU with LGPL license and links to current and future research: [http://www.abisource.com/projects/link- grammar](http://www.abisource.com/projects/link-grammar)

</comment></comment><comment><USER44> "why should they know about something so far outisde their specialty"

</comment><comment><USER45> Neat Code - expressing high-level concepts in such a concept manner.

</comment><comment><USER46> They don't seem to address keyboard layouts.

<comment><USER47> this is a good point I think.

sometimes, people type wrong words, because certain keys are too close on the keyboard.

another problem I found about the naive spelling corrector is, it doesn't take the pronunciation into account. certain wrong spelling looks different from the correct version by edit distance. but they sound similar.

</comment></comment><comment><USER48> Norvig's code is beautiful.

</comment><comment><USER49> Carefuly.

</comment><comment><USER36> I've done this before.

Sadly - the problem is _way_ harder.

First - you get much better results by using language models, n-grams etc. to predict the likely hood of words given previous words. That can be hard.

The _really_ hard part comes down to language that people use.

Colloquialisms, proper names, and mixed-languages ... make this stuff really, really hard.

Getting it 'mostly right' is not hard. Getting it really good is very difficult and depends a lot on context.

'Srinivas' will not be in most people's dictionaries, but it's a common name in India. 'Le' and 'la' are words in french and some similar in Spanish - <USER2> a lot of writers jam these in all over the place. Over-correction and beta- errors become a huge problem.

It's a really interesting premise and difficult for Engineers because it's purely probabilistic _there is no way to build a perfect spellchecker_ unless you can agree 100% on what 'language' is, precisely ... and trust me there is no agreement on that. Not even close.

<comment><USER50> Writing spell checkers is also hard in language that e.g. doesn't have spaces between composite nouns. In essence it makes it possible to make up a perfectly valid new word. We expect the spell checker to be able to recognise that word, because it knows the two words that the composite is made of.

Finnish is probably even worse because of it's conjugation.</comment></comment>