WebOS 2.0 will include node.js - <AUTHOR> http://developer.palm.com/index.php?option=com_content&view=article&id=2109#services

<comment><USER2> I really wish palm phones and the webOS had more consumer demand because among all the smartphone platforms webOS is the most elegant of the bunch.

<comment><USER3> I got to develop for and use a Pre at a previous job and it's subpar. It feels kind of cheap, the screen is too small (physically, resolution is fine), the hardware keyboard is worse than some software keyboards, and it's a little bit geeky to be mainstream. A phone shouldn't have modifier keys, imo.

That said I think webOS itself is great. Put it on some good hardware and I'd seriously consider buying one.

<comment><USER4> > A phone shouldn't have modifier keys, imo.

You're entitled to your opinion, I guess, but every phone made with a QWERTY keyboard has had modifier keys.

The Blackberry has Shift, Alt and Sym; Nokia has shift plus an blue numeric shift, and the iPhone has Shift and "123".

I'm honestly not sure how you'd even have a phone without modifier keys; there's just no good way of cramming enough buttons in the right layouts onto the phone without them. At bare minimum, people want upper and lower-case QWERTY for text entry, the telephone-style 123/456/789/0 number pad for phone numbers, plus a reasonable number of easily-accessible symbols. Even with an on-screen keyboard, I don't think you're going to do it without modifier keys or something like them, and I think you'd be hard pressed -- given the familiarity users have with modifier keys -- to do better.

If we're kvetching, though, why don't more phones allow you to enter phone numbers as alphanumeric, and do the conversion to numbers behind-the-scenes? I shouldn't have to fire up some 3rd party app in order to dial "1800 GO FEDEX" ... I should be able to type that right in like any other number and have the phone figure out that G=4, O=6, etc. The Blackberry lets you hold down Alt and type, but that's awkward and doesn't let you easily recognize a miskey. It seems trivial, yet no manufacturer seems inclined to fix it.

<comment><USER3> Well, I meant modifier keys that require holding more than one key at once. I feel that's a bit different than shift on the iPhone, but I'll concede that technically even the iPhone's shift is a modifier. My issue is then with simultaneous modifiers (for lack of a better term).

I dislike Nokia's blue-number thing and I doubt I'd like BlackBerry's alt and sym since they sound like the Pre's orange and sym. iPhone's shift and "123" are just easier to use than my n810's shift and blue shift, and easier to use than my old HTC's shift, blue shift, control, etc.

It certainly does come down to preference. No argument there.

As a geek if I find something cumbersome or awkward I can almost guarantee that most of my less geeky friends & family will feel the same way about it though. I think it's a legitimate drawback to the Pre's tiny keyboard, and I don't even have large fingers.

</comment></comment></comment></comment><comment><USER5> What Palm really needs (and what I really wish it had) is a non-phone device carrying WebOS

It's unbelievable how important and how big the iPod Touch (it's 40% of all iOS devices) is for the iOS platform.

<comment><USER6> The iPod touch is about $3000 cheaper than the iPhone, and that's probably why it's important.

(In Canada, you probably pay $80-$90/month locked to a three year contract, which is around $3000)

<comment><USER7> Because so many people in the market for iTouches don't own a cell phone?

I agree that the cost is the reason, but saying that it's $3k cheaper is seriously misrepresenting things. The marginal cost of getting an Android phone over a normal one is $30/month for the data plan, so $720 in America and I guess $1080 if you're in Canada (that sucks, btw). And then you can probably subtract $50 or $100 or so because you'd probbly pay a bit more for an unsubsidized iTouch-oid than for the subsidized phone.

<comment><USER8> For me, it's relevant because I'd like to learn how to build apps for WebOS and Windows Phone 7, but I make my living developing iPhone apps, and I'm not about to sign a 2 year contract with another cell phone provider for the privilege of building for a platform that may never amount to anything.

<comment><USER9> You can buy a non-contract device at a small discount via the developer program. <http://www.palm.com/us/products/phones/developer-phones.html>

</comment></comment></comment></comment></comment><comment><USER10> Dumb question: does this mean WebOS will also include V8 (Chrome's JS engine)?

<comment><USER11> I wonder how Google, with its competing Android platform must feel about this. That is to say, are chrome and android for that matter more like the Nexus 1: designed to push other companies forward, or more like standalone products of their own? Or maybe Google is being even more forward thinking about it and realizing that they can derive competitive advantage from both scenarios.

<comment><USER12> This is Chromium's stated goal: "Join us in an open-source browser project to help move the web forward" <http://code.google.com/chromium/>

<comment><USER11> Yes but Android is a competitor to WebOS, so I was thinking more about how Google "feels" about its technologies being used in competitor's products.

<comment><USER13> What search engine does WebOS ship with as default?

Also, as a followup, what mapping program does WebOS ship with?

<comment><USER14> the google ones

</comment></comment></comment></comment></comment></comment><comment><USER15> I don't know much about node.js but have always heard about it in a server- side context - does anyone know what role node is going to play in the webOS ecosystem?

<comment><USER16> (correct me if I'm wrong, HNers)

In WebOS, "apps" are written in html/css/js, so it makes sense to have the capability of running a standalone js engine like node for GUI-less apps (background services).

<comment><USER17> I'm curious, can you provide some examples?

</comment></comment></comment><comment><USER18> There are few ways in which this is not exciting. Hopefully this means even more momentum for an open source project that already has a ton of it.

<comment><USER19> Can you explain the ways in which this is not exciting?

<comment><USER20> Bradly, I think he meant that this is really exciting. There aren't many ways that its not exciting. Hence there are very few ways it's not exciting. And then omitted the "very" in the sentence.

I don't think he meant "there are 3 ways this is not exciting".

</comment></comment></comment><comment><USER21> I always thought the vast majority of apps that are bought are games. Palm hasn't shown how they are going to compete in this arena...

<comment><USER22> The PDK uses the same tech as iPhone apps, they've already shown it's trivial to develop a game for iOS and port it over. That makes them much more competitive than Android, and already webOS has many more games available.

<comment><USER21> <\- hasn't been paying attention, apparently. It's time to look at the Palm again, it seems!

</comment></comment></comment><comment><USER17> Think about these features from a Tablet POV.

</comment><comment><USER23> I can't believe, but they finally got it and release c/c++ development kit, which means you can develop something really useful, instead of html/js BS.

<comment><USER24> Try to avoid negativity that doesn't contribute to the on-going conversation. (Etiquette here: <http://ycombinator.com/newsguidelines.html>)

Instead you could've said something to the effect of, "I'm excited about the C/C++ development kit as I've wanted to work on a project that does X and needed C/C++ because of Y."

Cheers!

<comment><USER23> Thank you for an advice.

But it isn't a negativity at all. It is my opinion. I'd said long ago, that making apps in Javascript for a phone is a ridiculous idea, and was nothing but a marketing illusion (they will tell you that Javascript is the most widely used language in the world just because any schoolchild wrote something with getElementById at least once.) But when you look at this approach from an system engineering point of view, you probably will see, that it is artificial abstraction level, with enormous overhead, and it wasn't designed for this purpose. (What's good for a PC cannot be pushed into ARM-world. That is why Flash for Android is a failure and why Android also released a C++ DK. ARM systems still cannot afford the overhead of all those artificial layers, such as Flash or other popular PC stuff.

Of course, with V8 which is producing an optimized native code for an ARM cpu, situation will look a little better, but still, you need an efficient resource management and control (think that there is no swap).

So, clang++ is the obvious answer (that is why Apple spend money to it), but ordinary getElementById developer cannot understand and code memory management. That's why all marketers are trying to push garbage-collecting artificial blobs.

The good side is that if you learn how to program you can use appropriate tools (C/C++).</comment></comment></comment>


Optar – OPTical ARchiver – a codec for encoding data on paper - <AUTHOR> http://ronja.twibright.com/optar/ <comment><USER2> This is awesome. I remember finding this a while back for some project.

> Optar fits 200kB on an A4 page, then you print it with a laser printer.

<comment><AUTHOR> I'm kind of surprised newer programs haven't come out since Optar (which is pretty old) that could store even more data on a page.

There must be research in the compression, optical recognition, or error correction fields that could improve on Optar's efficiency and/or reliability.

Optar itself is pretty bare-bones from a feature perspective, unpolished, and hasn't been maintained in ages. It has no official GitHub repo (or any other kind of source code repo) that I could find. The released tarball doesn't even have a version number. It only works with the obscure PGM image format (for which you need ImageMagick or GraphicsMagick to convert to/from) instead of something common like PNG.

It does actually work (or did when I tried it a decade or more ago), so by that measure it could be considered good enough, but it's sad that there's been no more modern open source alternative in the many years since it's been released.

<comment><USER2> I'd guess the limits of information theory have been just about reached. The only real improvement I can think of would be either the ability to scan and resolve smaller individual squares (and that is dependent on how much the printer ink bleeds), or printing in color.

It would be cool to update optar, and make it a little more flexible. It would be fun to make a python package that can output arbitrary data as a printable image.</comment></comment></comment>


The Big Business of Being Gwyneth Paltrow - <AUTHOR> https://www.nytimes.com/2018/07/25/magazine/big-business-gwyneth-paltrow-wellness.html <comment><USER2> I am really disappointed in humanity when not only a snake oil saleswoman is made successful, but is also seen as some kind of example to follow.

She is a con artist. End of story. I'd have more respect for conventional criminals - at least they don't pretend to be legit and don't give lectures to students.

<comment><USER3> Why is she a con artist? Mind explaining your rationale?

<comment><USER4> She tried to sell stickers for $60 that "promkte healing and energy rebalance". It was so bad that even NASA had to comment.

<comment><USER5> I'd argue she's no worse than the legion of alternative therapy purveyors all of whom are simply profiting from the placebo effect. Which, for the record, I'm fine with. If people spend money on a thing which works because they believe it will - it's unclear to me why I should consider it problematic?

<comment><USER6> It's problematic when people die because of bullshit marketing claims. A member of my neighbor's family got cancer. They tried to treat it with Juice Plus (MLM health food supplements). They're dead. They were a provider. The family is struggling.

The alternative medical/healthcare industry preys on ignorance and there are huge swaths of victims.

</comment></comment></comment></comment></comment><comment><USER7> I'm not sure how big e-commerce curation is as a market segment but I can definitely envision it growing significantly. Since Amazon decided they wanted to be "the pipes" of e-commerce it's almost as if they forgot that people have to find the right stuff to buy as well.

</comment><comment><USER8> I can't look at "Goop" and not immediately think of this: [http://goophandcleaner.com/](http://goophandcleaner.com/)

(Probably about as close to diametrically opposite the market of Gweyneth Paltrow's Goop as you can get.)

</comment><comment><USER9> We really shouldn't be holding up purveyors of lies and snake oil as examples to follow.</comment>


AudioSet - <AUTHOR> https://research.google.com/audioset/index.html <comment><USER2> First one I clicked on was tagged "bird, cheap" and was a 5 minute clip from some bollywood film.

</comment><comment><USER3> In case anyone on the team is reading this, the web page is broken on mobile Safari.

<comment><USER4> What issues are you seeing, and which device is this on? (I have no problem loading the page, searching the ontology and dataset pages, and playing videos on iPhone 4 and 5s)

<comment><USER3> An error bar at the top of Safari which says:

"A problem occurred with this webpage so it was reloaded."

The page can be seen below, but no interaction is possible, because the page is in the middle of a redirect/refresh/reload.

The reload finishes, and the same error appears again, a few times. And then Safari gives up, with a blank background and a message in the center that says:

        A problem repeatedly occurred on "https://research.google.com/audioset/index.html".

iPhone 7+, fully updated with latest iOS release 10.2.1, non-jailbroken, many GB of disk space free. Other sites are working fine including [https://research.google.com/](https://research.google.com/)</comment></comment></comment>


Hugelkultur: the ultimate raised garden beds - <AUTHOR> http://www.richsoil.com/hugelkultur/ <comment><USER2> Muhaha. Sepp Holzer on hackernews. That's something. He's quite a character.

[http://en.wikipedia.org/wiki/Sepp_Holzer](http://en.wikipedia.org/wiki/Sepp_Holzer)

<comment><USER3> Could you explain the context behind "if you don't prune your trees you'll go to prison"?

</comment></comment><comment><USER4> Hugelkultur sounds like in-situ composting to me, but with a tremendous amount of physical effort and machinery. Not easy for the average home owner to do.

> Besides, isn't this much better use of the wood than hauling it to the dump, > or chipping it,

Chipping wood to make it into mulch and then spreading it over your garden beds also helps to retain moisture in the soil.

> or putting it in those big city bins for yard waste?

Cities recycle yard waste into mulch or compost that residents can use in their garden beds for much the same purpose: nourish the soil with organic matter and help it retain moisture.

<comment><USER5> I have had excellent results on a 10,000 sq.ft. lot in California with an in situ compost process like you describe. Just put down 6 inches of chipped trees from a tree trimmer, or the city compost yard, and let it decompose. Keep layering it on, year after year (less needed after the first time).

You have to go thicker than you probably will imagine. The initial load of chips filled my driveway to a height over my head. And be careful to keep the compost away from the trunks of existing trees, or it will tend to rot the trunk, which will kill the tree.

It costs practically nothing. You should be able to get the chips for free.

</comment></comment><comment><USER6> In a similar theme, Terra Preta [1] is a type of rich soil found in the Amazon basin (otherwise notorious for its poor soil, washed out by the constant rains) similar to Chernozem [2], and is speculated to be the result of human action.

[1] [http://en.wikipedia.org/wiki/Terra_preta](http://en.wikipedia.org/wiki/Terra_preta) [2] [http://en.wikipedia.org/wiki/Chernozem](http://en.wikipedia.org/wiki/Chernozem)

</comment><comment><USER7> At least in North America you should not source your logs from as close as possible and no more then 50 miles away (possibly much closer based on your area) to prevent spread of any of these 53 pests or wood diseases spread by moving logs: Ambrosia beetle

        Asian Gypsy Moth
        Asian Longhorned Beetle
        Balsam Woolly Adelgid
        Banded Elm Bark Beetle
        Bromeliad Weevil
        Brown Spruce Longhorned Beetle
        Cactus Moth
        Chestnut Gall Wasp
        Citrus Longhorned Beetle
        Common Pine Shoot Beetle
        Cycad Aulacaspis Scale
        Emerald Ash Borer
        Erythrina Gall Wasp
        Eurasian Nun Moth
        European Gypsy Moth
        European Oak Bark Beetle
        European Spruce Beetle
        Golden Haired Pine Bark Beetle
        Goldspotted oak borer
        Harrisia cactus mealybug
        Hemlock Woolly Adelgid
        Larch Casebearer
        Larger Pine Shoot Beetle
        Lobate Lac Scale
        Mediterranean Pine Engraver Beetle
        Pine Flat Bug
        Polyphagous shot hole borer
        Red-Haired Pine Bark Beetle
        Sirex Woodwasp
        Soapberry Borer
        Spruce Aphid
        Viburnum leaf beetle
        Walnut Twig Beetle
        Ohi'a Rust
        Alder Dieback
        Amylostereum complex
        Beech Bark Disease
        Butternut Canker
        Chestnut Blight
        Dogwood Anthracnose Disease
        Dutch Elm Disease
        European Larch Canker
        Fusarium fungus
        Laurel Wilt
        Oak Dieback
        Phytophthora kernoviae
        Phytophthora Root Rot
        Pine Pitch Canker
        Port-Orford-Cedar Root Disease
        Sudden Oak Death Syndrome
        Thousand Canker Disease
        White Pine Blister Rust

More info here: [http://www.dontmovefirewood.org/the-problem/what-you-can- do....](http://www.dontmovefirewood.org/the-problem/what-you-can-do.html)

<comment><USER8> "Should not source" or "should source" \- typo?

</comment></comment><comment><USER9> We now have 2014 and widespread Unicode. _Please, please, please_ change the title to _Hügelkultur_ , as it should be.

It's hurting the eyes of anyone used to or fluent in german. Yuk.

On topic: Very interesting, but needs land. Urban people should use the _Hochbeet_ instead.

<comment><USER10> But where do you start? :)

Even most news outlets can't even get their micro-typography right in the age of Unicode.

It is "Foo", not "Foo". In languages where quotes are on the baseline, e.g. German, this is even more of an eyesaw. "Spiegel" instead of "Spiegel" (to make matters worse, the German closing quote is wrong in Verdana, somehow). And let's not start about - vs. – vs. — or the difference between ... and … (and that you have to put a space before an ellipsis). :)

<comment><USER11> You start where, to a native speaker, you might not even get what the word means - because u and ü are not nitpicking, but different letters.

Let's take the example of "fordern" vs "fördern" \- nothing in common, the former means "to demand" and the latter means "to promote/boost/foster".

</comment></comment></comment><comment><USER12> Watch out for this if you try it in a city, because you could run afoul of bylaws and angry neighbours. In Surrey, British Columbia, a family tried doing this. They had piled up bark mulch and manure, and one of their neighbours complained to the city, which then told the family to remove the piles under Surrey's Unsightly Premises Bylaw. I don't know the outcome (I haven't found any articles after this point) but if you start piling bark mulch in your back yard, make sure you don't piss off your neighbours doing it.

[http://blogs.vancouversun.com/2013/10/03/surrey-takes- action...](http://blogs.vancouversun.com/2013/10/03/surrey-takes-action- against-permaculture-vegetable-garden/)

<comment><USER13> I would also add that there are height restrictions on "fences" as well. At six feet, there is a setback consideration in the front in my city at least.

That said at the bottom of the article:

 _My HOA won 't allow anything like that, what do I do? (my neighbors would freak out, what do I do?)_

 _There are many possibilities. Some people dig a trench five feet deep, fill that with organic matter and have something that is either flush with the surface or it appears to be only one foot tall (which is in the comfort zone of neighbors and HOA folk). Other people will build something that is 18 inches high the first year, and add a foot each year. Still others will have so many neighbors build them all at once that it is difficult the buck the tide. And then there is always the back yard._

</comment></comment><comment><AUTHOR> I am not a gardener, but I thought this was nifty:

 _It 's a german word and some people can say it all german-ish. I'm an american doofus, so I say "hoogle culture". I had to spend some time with google to find the right spelling. Hugal, hoogal, huegal, hugel .... And I really like saying it out loud: "hugelkultur, hoogle culture, hoogal kulture ...." \- it could be a chant or something.

I learned this high-falootin word at my permaculture training. I also saw it demonstrated on the Sepp Holzer terraces and raised beds video - he didn't call it hugelkultur, but he was doing it.

Hugelkultur is nothing more than making raised garden beds filled with rotten wood._

<comment><USER14> 'Hügel' is just the german word for 'hill'. There's no such word as 'Hugel' in german, the dots over the 'u' make it an Umlaut and all the difference in pronunciation between 'hügel' and 'hoogle'. The pronunciation of 'hoogle' in english and 'hugel' in german is the same.

<comment><USER15> There's a difference in all variations he wrote to have stumbled upon. For demonstration, the Google Translate tool pronounces it correctly using the Listen button on the left [1]. The correct one, 'Hügel', is different from both 'Hugel' and 'Hoogle', which can be pronounced as in English (cf., Google) and German (e.g., comparable to Woog [2]).

Even if the 'right spelling' is still wrong from the german word origin, hoogle is probably easier to pronounce in english than using 'huegel' and most certainly easier to type without the umlaut anyway. Still, that remark ('[...] spent some time with google to find the right spelling') made me smile, as none of these variants are really correct.

[1] [https://translate.google.de/#de/en/Hugel%20ist%20kein%20Hueg...](https://translate.google.de/#de/en/Hugel%20ist%20kein%20Huegel%20ist%20kein%20Hoogel) [2] [https://translate.google.de/#de/en/Woog](https://translate.google.de/#de/en/Woog)

</comment></comment></comment><comment><USER10> From the source: "I had to spend some time with google to find the right spelling."

Apparently time not well spent.

'Hugelkultur' is not a German word. 'Hügelkultur' is. Or you can write it out as 'Huegelkultur'. ü->ue.

</comment><comment><USER16> "The best woods are even better when they have been cut the same day (this allows you to "seed" the wood with your choice of fungus - shitake mushrooms perhaps?)."

This is wrong, you need to wait a month before inoculating a fresh log. Less time than that and it will still have too many antifungal chemicals present. But more than a few months and it'll be colonized by something else.

</comment><comment><USER17> I love gardening. This is definitely on my list of must-try. I'm having a hard time with my pepper and tomato sprouts this year, not enough sun!

I would like to see the root system of such a hill, see how the plants and microorganisms work with/against each other. I'm pretty sure the nutrient dynamics are extremely complicated - and fascinating!

</comment><comment><USER18> The author mentions nitrogen loss from rotting wood. Does he supplement nitrogen until the wood is well broken down?

<comment><USER19> You plant legumes and clover and leave fallow while your other beds are raising a few cattle or growing corn.

</comment></comment><comment><USER20> Teletubbies!

Could be fun for perennials but I'd hate to maintain a summer vegetable garden like this.

</comment><comment><USER21> Awesome, I am definitely trying this. I just started preparing a new garden area for this growing season. I also have literally tons of dead trees and plenty of space. This is going to be fun!!!

</comment><comment><USER22> My kids recently created a few hugelkultur gardens at home. It's a great project because you get to see both the growth and decomposition occur simultaneously.

</comment><comment><USER23> If you like this sort of stuff, check out the two volume tome: Edible Forest Gardens. Fantastic overview of permaculture techniques.

</comment><comment><USER24> Does anyone know about the methane emissions associated with this? It sounds like a cool / compelling way for individuals to sequester carbon but methane emissions from decomposition of the wood if they're anaerobic may dwarf the carbon gains (because methane is ~28x worse of a greenhouse gas than CO2).

<comment><USER25> I'm not at all knowledgeable in this subject, but wouldn't those methane emissions occur, regardless of if this method is used?

<comment><USER24> It has to do with whether the wood is decomposing in the presence of oxygen or not--the bacteria that cause decomposition in anaerobic environments emit more methane than the bacteria that cause decomposition in aerobic environments.

</comment></comment></comment><comment><USER26> This is how you get termites.

<comment><USER27> {citation needed}

<comment><USER28> [https://www.google.com/search?q=hugelkultur+termites](https://www.google.com/search?q=hugelkultur+termites)</comment></comment></comment>


Show HN: Computer vision to detect phishing attacks - <AUTHOR> A few months ago, the Exploratorium in San Francisco had its network compromised due to a phishing attack. An employee hurriedly filled out her credentials in what looked like a Google Docs sign-in but was actually a hacker's fake site. The hacker then used her credentials to steal 54 other employee passwords.
Current solutions to phishing are limited to forcing employees to attend training to spot these hacks and attempting to judge the URL's reputation. People don't have time to pay attention to every url they click. This is especially true when faced with deadlines. Even the technical systems we have in place to detect these sites rely on the URL's reputation. This strategy fails in targeted attacks like the Exploratorium and is reactive at best.
I created Off The Hook to have a proactive response to phishing sites. Off The Hook is an extension that visually inspects webpages as a human would do and recognizes when pages look like valid sites. Rather than relying on reputation systems and employee training, I automated the behavior the training hoped to instill. If the page looks like a valid site but isn't a URL that we'd expect that site to be at, then we throw a red flag and get the user out of there. If you're interested, download the extension here:
https://chrome.google.com/webstore/detail/off-the-hook/ifjmdiningdigdchbidbjjpefhdadjeg
And give it a try by visiting these "bad sites" here:
http://ec2-35-165-195-195.us-west-2.compute.amazonaws.com/gSignin.png
http://ec2-35-165-195-195.us-west-2.compute.amazonaws.com/chase.png <comment><AUTHOR> The Exploratorium's blog post on being hacked:

[https://www.exploratorium.edu/blogs/tangents/we-got- phished-...](https://www.exploratorium.edu/blogs/tangents/we-got-phished-2)

</comment><comment><AUTHOR> Currently the extension supports login pages for: Facebook, Google, Chase Credit Cards, Linkedin</comment>


Where do Business Mafias come from? - <AUTHOR> https://marker.medium.com/where-do-business-mafias-come-from-34f47b33eecd <comment><USER2> I've seen first-hand how the density of talent and capital in Silicon Valley supports these "mafias" in the tech world. Coronavirus is causing a short-term exodus as people "temporarily" uproot for other cities. I'd like to think that they will take parts of the ecosystem with them, because it would be healthy for the Valley to have a real competitor; but I just don't know if it's possible.

</comment><comment><USER3> Mafias arise spontaneously everywhere. We see them when they are not continually rooted out.

There is no such thing as a natural free market, whatever the Libertarians insist. A functioning market is always a carefully curated garden.</comment>


Where are the African programmers? - <AUTHOR> http://nadjetey.github.io/2014/06/where-are-the-african-coders/ <comment><USER2> African programmer here, and left the country I was born in decades ago to find somewhere that had a demand for my skills.

You'll find there's a direct correlation between available jobs for a career and people qualified or qualifying for that career that remain there. The only places in Sub-Saharan Africa that need programmers are of the scale where they have a regional head office elsewhere in the region (ie. South Africa, where they centralise support services like IT, development, analysis etc.)

Combined with the fact that the power houses of development in Africa are about as immigration friendly to other Africans as some of them would have been to people by virtue skin colour not so long ago. To clarify, "African from a poor African nation" is the new black in South Africa/Namibia/Botswana I can't speak for anywhere in Central or Northern Africa as I've not tried them.

<comment><USER3> Mark Shuttleworth - Ubuntu Creator South African & sold Thawte to Verisign in the dotcom boom.

Elon Musk - South African, of paypal & spacex

Roelof Botha - South African, of paypal & Sequoia

Emanuel Derman - South African, of Goldman Sachs Quantitative strategies

Amazon Web Services - South Africa

Herman Chinery-Hesse - Ghana, of SOFTtribe

OffTopic - J. R. R. Tolkien - South African, Lord of the Rings

There is a lot more where that came from: [http://ventureburn.com/2014/03/20-kickass-african-tech- entre...](http://ventureburn.com/2014/03/20-kickass-african-tech- entrepreneurs-worth-your-time/)

You could go to a lot of the Compsci departments at many Universities in African countries and find a lot of good developers or potentially good devs. This is where Accenture , microsoft etc, get their devs from in Africa.

EDIT: PLZ downvote this post, my challenge to u guys is to make my Karma go to zero! You can do it guys.

<comment><USER4> Mark Shuttleworth: white, British descent,

Elon Musk: white, Canadian/British descent,

Chris Pinkham and Benjamin Black (AWS): white,

Emanuel Derman: white,

J. R. R. Tolkien: white, British descent.

\---

I'm not trying to say anything about race. But many of the examples you pointed out seemed to be of people of non-african descent. I don't think your examples say much about Africans in tech so much as it says something about people in positions of privilege having the opportunity to found companies.

I say this as a one-time white-foreigner living in South Africa, where I spent four years.

<comment><USER5> Having lived in South Africa, you will also know that South Africa houses an indigenous white population that has settled in the country ~ 400 years ago, roughly the same time that Europeans settled in America, and also the same time that the black tribes also migrated and arrived in South Africa (Zulu's, Xhosa's, Sotho's etc.)

But now for some reason "African" refers to only black people, and white Africans are priviledged and not worthy of mention. Would you follow that same logic for Americans?

*For technical correctness the Khoi-San settled in South Africa ~2000 years ago, but is a minority population in South Africa.

<comment><USER6> For what it's worth, the original title was asking where all the African developers are, and the top threads all so far talk about South Africa.

We're particularly myopic in the Northern Hemisphere when it comes to Africa, often seeing the Mediterranean coast and South Africa and skipping that middle part...

So while it truly is interesting to hear that there's a solid development community in South Africa, it doesn't speak to the larger question on why we see so little coming from the rest of the continent.

<comment><USER7> I can't really speak for anything north of the equator, but I have travelled fairly extensively in the southern half of Africa.

The impression I get as a visitor to many of these countries is that except for a few big cities it is just too difficult to guarantee power and telecoms access to bet your job on it.

Most people will find a job locally doing "boring" software since there is less risk. Working remotely for a company in the US/Europe requires them to understand your (african) problems which is always difficult.

If I am at the office and we have no power, my boss understands; If I am remote-working, will my "American/European" boss understand why I just lost a day?

The advantage of staying here (in SA) means that even if you are doing boring software, your salary is probably good enough to give you spectacular buying power compared to 99% of the planet.

As you move to more remote places, the salaries just keep increasing. I was recently looking at a job in Tete (Northern Mozambique) which paid around USD450k p.a.

So, I guess that doesn't really answer your question, but I think Africa is quiet mostly because the "boring" jobs pay disproportionately well --- the incentive to be an entrepreneur is mostly gone. (I say this as someone working at a startup of sorts)

<comment><USER8> I'm _extremely_ interested in working somewhere remote/strange in Africa/other underdeveloped areas of the world (not even looking for anything notably well paying). I've tried a couple of times to search for relevant job boards and the like but haven't been able to find anything halfway decent. If you could go into a bit more detail about where one would look for that sort of thing/what the typical process is in that part of the world or shoot me an email at public at disastero.us, I would be tremendously grateful.

Thanks!

Edit: The bigger the shithole the better, really. I've been trying to find a method for searching for jobs in adverse environments for a while, but haven't been in any way successful.

<comment><USER7> So if you want to move somewhere off the beaten track your job choices are going to be:

1) Mining 2) Power/Electricity 3) Support for the above.

Most companies don't hire in the countries they operate in, since the skills just don't exist. Most sites are populated by a mix of European/South African/Indian expats who are there for a limited period (typically < 5 years)

The way to get into these types of jobs is to get hired by the European or South African companies that operate in these areas, and then ask for placement at your shithole of choice. The current rule of thumb is to ask for your SA salary * 4 or * 5 depending on how bad the place actually is.

At the moment there is is a lot of activity in Northen Zambia (copper) with companies like Yokogawa/Siemens/ABB looking for people.

Northern Mozambique is pretty active (coal/gas) with Vale/Jindal being the major mining houses and ABB/Siemens etc. providing the tech.

On the power generation side - South Africa has quite a lot of activity on the renewable side with Spanish and Danish companies taking the lead (Abengoa for solar esp.)

There is currently also a bit of a power generation boom in Ghana and Benin, but I don't know anyone directly involved.

Most of the work is in hardware, project management, or process control though. It is going to be much harder to find software only work.

EDIT: I forgot to mention - there might be more opportunity for software only work in banking. I know Barclays is currently busy with a big push up into Africa, but I am not very familiar with that industry.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I moved to Tanzania recently (I'm a white western programmer with a remote job).

Some of the hurdles you have to jump over to become a professional programmer here:

\- Have access to a computer (several months, sometimes years, of salary). Obviously.

\- Have access to reliable power. I have 6+ hours power cuts almost daily here (and I'm in a rich town - not in the bush). Being a western Engineer, I could afford to build my own power backup system, but I'm the exception.

\- Have access to the internet. Sure, I can afford broadband here, but at 60$+ a month, it's _way_ out of reach for most people. Mobile is acccessible-ish, but most providers won't let you tether a computer (or charge through the roof for it).

\- Read English well enough to understand online material. The corollary being that your family has to be rich enough to afford to send you to school (that is, primary and high-school. I'm not even talking about university here).

\- Last but not least, actually learn programming (I met many westerners without any of the previous problems that fail utterly).

Once you pass all these, you still have to find a job, and that's not easy. Basically, some ISPs, some telco jobs, and very few regional things (web agencies etc...).

I hope working from home / remoting will continue to become more widespread - some very good programmers here are looking for jobs, and would love to stay.

Oh, and most of Africa shares timezones with Europe, too.

</comment><comment><USER10> There are many African programmers here in India (Pune at least, I hear similar things about Delhi). The general trajectory seems to be study here because schools at home are a disaster, then move to the west because the east is too racist.

Nearly every single one wishes they could find a good job at home.

(Let me emphasize that this is all secondhand knowledge. The only racist behavior I've observed has been a Russian making a "jungle fever" type comment to me, plus standard "rip off the foreigner" stuff.)

<comment><USER11> I was in a hostel with some africans (Tanzania/Kenya) in Hyderabad studying CompSci under ICCR (Indian Govt) Scholarships about a decade ago. Great guys, very sharp. Lost touch over the years.

</comment></comment><comment><USER12> > Yet, for some strange reason, these people are virtually ghosts on the > Internet.

That's not very strange in my opinion. Scott Hanselman spoke of Dark Matter Developers* who are the "Unseen 99%" who don't blog, tweet or attend conferences.

* [http://www.hanselman.com/blog/DarkMatterDevelopersTheUnseen9...](http://www.hanselman.com/blog/DarkMatterDevelopersTheUnseen99.aspx)

<comment><USER9> Also, attending conferences in "Africa" (such a big and diverse continent lumped together) is completely unpractical except for some edge cases: many flights will go to Europe and back (there is very little internal demand).

The price of such a flight is obviously also a problem.

</comment></comment><comment><USER13> African programmer here from Tanzania and one of my FOSS project is zuluCrypt[1]

[1] [https://code.google.com/p/zulucrypt/](https://code.google.com/p/zulucrypt/)

<comment><USER9> Hey cool!

What part of Tanzania are you from? Moshi here :)

<comment><USER13> Dar Es Salaam. I noticed in your other comment you said you moved to Tanzania recently, how is your Swahili :-)

Let see if you can derive meaning from the following swahili question.

Kati ya nchi zote ulizokuwa na uwezo wa kuhamia,kwanini uliichagua Tanzania?

If the above went over your head,i asked, "of all the countries you could have migrated to,why did you pick Tanzania?"

<comment><USER9> Ninajifunza kiswahili pole pole :) (Your question did go over my head, but it did allow me to learn many new words :) Asante sana!)

My wife and I chose Tanzania for various reasons, including:

\- We knew Moshi from some years ago (we climbed Mt. Kilimanjaro), and have sentimental attachment to the place (I asked my wife on Uhuru peak).

\- We knew our son (1 year old) would be safe (good medical care, few mosquitoes and nasty animals, varied food). He made friends with our neighbourhood kids pretty fast :)

\- She had some connections with a local NGO and so could work as a volunteer here.

\- We remembered Tanzanians to be the most welcoming and friendly people we've ever met (and we had the chance to travel a lot). We were wrong BTW, Tanzanians are even more welcoming than we remembered :)

\- Kiswahili is a challenge to learn, but we like learning new languages (we take lessons bi-weekly)

\- It's much more attractive than most places for our family to visit during their vacation ;)

\- I always echoed Mark Shuttleworth's sentiment that "Africa is the future", and I decided to put my actions where my mouth is :p

I could go on for a long time, we really like it here.

</comment></comment></comment></comment><comment><USER14> There is an interesting crowdfunding campaign for a documentation going on right now which will provide insights into this topic: [https://www.indiegogo.com/projects/africahacktrip-the- movie](https://www.indiegogo.com/projects/africahacktrip-the-movie)

<comment><USER2> That project is definitely cool enough to warrant it's own post! Why haven't I heard of this before?

</comment></comment><comment><USER15> Well I'm disappointed to not see a bunch more people promoting their local tech hubs, dev communities and such if they have them. Zambia has the people over at -> [http://bongohive.co.zm](http://bongohive.co.zm) and a few more that aren't involved with that hub.

I know I have many "dark matter" programmers as friends. A lot of Africa in my experience as tribaal pointed out has a great many hurdles that need to be overcome in order to be a programmer. For example I have to pay the same price he does for internet access, US$60 and it's only a 512k line. Worse, service has been so bad lately I'm lucky to have more than an hour of stable uptime at a time at an average of 10kb/s.

<comment><USER16> [http://www.siliconcape.com/](http://www.siliconcape.com/)

</comment></comment><comment><USER17> We are here!(Tanzania) Mostly working in sh __y demoralizing banking IT departments. I have began looking into immigrating probably to Canada or Australia due to their immigration policies.

<comment><USER9> Yay!

Many more Tanzanian programmers than I expected on this thread!

Out of curiosity - what kind of technologies do you use during your day job? Is it a typical choice for the banking industry in Tanzania, in your experience?

<comment><USER17> For my day job I use mostly SQL Server and a beast of an application which is written in VB and C#.Net by some developers in another country, I am only allowed to touch the configuration and scripting layer (C#) on this one and the thousands of configuration options it contains. But I do mostly Android in my spare time if I have the energy.

<comment><USER9> Pole sana.

I hope the android "app" concept catches on as adoption increases - I'd love to see the same kind of local intelligence applications as in Europe here!

I find buying things intelligently is hard here for example, since the knowledge of where things are at what price is not transparent (you must know people).

<comment><USER18> Habari, American new to TZ (but not E. Africa) here. Is there much of a tech community around? I stopped by Kinu and Buni. Both seem nice but sparse...

<comment><USER17> There is also [http://www.teknohama.or.tz/](http://www.teknohama.or.tz/). Their events seem to be geared mostly toward beginners and not to people already in tech. A lot of the events are organized at awkward times for someone with a 9-5, participants are also very young, I'm 31 and was probably the oldest at one of the Samsung events that was held at Kinu. This is not necessarily a bad thing though.

</comment></comment></comment></comment></comment></comment><comment><USER19> I follow some African programmers on twitter. They aren't totally unheard of. I suspect most emigrate to Europe or America to find work, and no longer identify as African Programmers.

<comment><USER2> A fair point, but as an African that emigrated and is naturalised, I still identify myself as very much African as opposed to anything else. I suspect most Africans have very strong identities in that respect, but I can only speak for myself.

<comment><USER19> I used identify in the outward sense, not the inward. I.e. in a tag-line on twitter one wouldn't have "A rails developer in Mombasa," if they were really in Antwerp.

</comment></comment></comment><comment><USER20> The dev environment in Africa (at least in Nairobi, where I live) is growing quite quickly. Co-working spaces (mostly with attached incubators) like the iHub[1], 88mph[2], etc. are extremely vibrant spaces. In the iHub, we have frequent talks by prominent figures from the technology community (Larry Wall, Marissa Mayer, and Eric Schmidt are some of the ones I knew about). IBM research opened an office in Nairobi, and I hear they're recruiting Kenyan programmers.

[1] [http://www.ihub.co.ke/](http://www.ihub.co.ke/)

[2] [http://www.88mph.ac/](http://www.88mph.ac/)

Edit: Fixed links.

</comment><comment><USER21> For what it's worth, Rwanda is attempting to become a local tech hub: [http://www.slate.com/articles/technology/the_next_silicon_va...](http://www.slate.com/articles/technology/the_next_silicon_valley/2013/12/rwanda_s_high_tech_future_20_years_after_genocide_the_nation_aspires_to.html)

</comment><comment><USER22> If you're an African programmer, or even a programmer living in some country where you do have internet access but little or no local market: _Please_ apply next time the 'who wants to be hired' thread rolls around. It's in my opinion one of the most direct ways in which HN can help you improve your situation, either by being noticed and to get hired remotely or by giving you a ticket out. Though the latter is a nice example of brain drain and evaporative cooling in action it is at the same time a very clear and direct way to get you into a substantially different situation. What you do if/when you get employed is up to you, I know plenty of stories of people that went abroad, made some money and then somehow found a way to leverage that into improving the situation for a whole slew of people back home. So I'm not adverse to this at all, in fact I think it is a good thing, it sure beats being unemployed.

</comment><comment><USER23> Okal Otieno [1], creator of hackershelf.com [2] a site I discovered on HN and get all kinds of value from.

1: [http://justokal.com/](http://justokal.com/)

2: [http://hackershelf.com/browse/](http://hackershelf.com/browse/)

</comment><comment><USER24> Africa is a large heterogeneous continent ... I'm a software developer from north Africa (Tunisia). You can find here some regular white-collar jobs. But the startups scene is nonexistent.

</comment><comment><USER25> "Where are the Ghanaian Programmers" would have been a more appropriate title. I'm Kenyan. Articles like these presume we're operating within the same market conditions when nothing could be further from the truth. The disclaimer in the first paragraph seems to acknowledge this, but talking about "African programmers" is neither useful nor helpful IMO. All we have in common is the fact that we live on the same land mass.

</comment><comment><USER26> Monocle did a great story last week on the female-oriented Jigeentech Hub in Dakar, Senegal (see the 2:00 point at [http://monocle.com/radio/shows/the- entrepreneurs/136/](http://monocle.com/radio/shows/the-entrepreneurs/136/)). This may not be the next Silicon Valley, but it sure seems like a start in the right direction and an inspirational model for other developing nations.

</comment><comment><USER27> Nigeria is the only African country where I'm familiar with the tech industry, they have some jobs available in Telecom and Petroleum for trained locals - though getting one of these is far from guaranteed even with a degree. Both industries require quite a few coders. There's also the computer crime industry which I suspect is one of the largest employers of programmers.

Anecdotally, Egypt produces a lot of high quality computer scientists.

</comment><comment><USER28> South African here, there are _plenty_ of African coders/hackers. If they are not blogging does not mean they do not exist.

Though, i have personally felt that community is lacking in other countries.

I have been traveling in other parts of Africa. I usually check in on Meetup.com before traveling to see for any interesting hacker events, out of 4 countries i have been too in the last 3 months only Kenya had events i could find.

</comment><comment><USER29> Zimbabwean. Bootstrapping couple tech startups (some profitable) here in Africa for way over a year now.

Most (good) devs I know are self-taught. Employment opportunities pushing code are so scarce it's hopeless for most which is why most move out or go into sys admin/networking. The jobs don't pay that good as well but you can strike out well with consulting.

Thanks to the internet Git, SASS, Heroku, AngularJS, Golang, NodeJS, Docker and all other hacker goodness is adopted just as much (by the few willing) so it's not like we're making sites with bash. We also have a few tech podcasts and the occasional meetup.

Just that our communities are much much smaller and far apart that it's like we're not there at all (thanks economy). Good developers are also hard to find because most see no point in developing skills you never get to use. Things are picking up though

</comment><comment><USER30> This is a cool project. But don't let the fact that you are building an app distract from the main goal (building a community).

I would suggest you first go to as many universities as you can, get their computer science students on-board, and then connect to their alumni network.

And start organising meetups, hackathons and other events. You need to start a small fire and it will kindle.

A simple website is good enough and you can start today. [http://www.hackcampus.io/](http://www.hackcampus.io/) is doing something similar in the UK.

A directory might not be so useful at this point.

I would also love to see the Tech space in Africa mature. I expect great things to come out of that continent, and building a community Is definitely a great place to start.

Put the code up on Github and I'll contribute.

</comment><comment><USER31> I suppose I too am an African programmer. I never thought of myself as one because I first touched a computer after I left the continent. However, here I am writing Machine Learning code.

</comment><comment><USER32> I'm amazed that posting this article here resulted in good discussion while posting it to Reddit's /r/programming ([http://www.reddit.com/r/programming/comments/276oxb/where_ar...](http://www.reddit.com/r/programming/comments/276oxb/where_are_the_african_programmers/)) only results in downvotes... That probably says something about differences in outlook between those two forums.

</comment><comment><USER33> The one point I do not see mentioned in the comments is that most Africans do not need software but probably something such as food, shelter, farming tools, books, medicine/clinics, roads, clean water.

I am a Comp Sci graduate but honestly cannot think of a software product that will make a difference to my cousins still in the village. I see software as a luxury.

</comment><comment><USER34> The problem of "missing" developers in Africa cannot be solved with another database (there's already DevelopersInAfrica [1], and I think there could be more). What I have identified as the problem since I started running DevCongress [1] with a couple of friends and the general community of programmers in Ghana is, ironically, community and activity.

You see, Ghanaians generally a quiet people, and it pierces all our circles. It's hard to shake that dumb silence off, it's hard. Just look at participation in our Google group [3] and how it's dominated by just me. That's not what we wanted, obviously. So we set out solve the problem of programmers restricting themselves to absolute silence. That familiarity among ourselves would lessen the barrier to participation was our riskiest assumption. So we started yet another project, namely, #eXchange (you can see episodes here [4]). So far we are engaging really well via the videos, and more importantly we're exposing the humans (and their humanness) behind the big names in the programmer community in Ghana. It's been successful so far.

Last but not least of our attempts is FORGE [5]. Oh I so love FORGE! We have plans to launch before the end of June but funds (we foot all the bills ourselves) are holding us back a little. We are preparing to approach GitHub Community [6] to ask for help. Since you're in Ghana we should link up to discover even more ways that we can pull ourselves up to an appreciable, non- mediocre level.

To all non-African programmers, please consider actively mentoring us even though we can't afford to pay you. Also think about offering us internship and job opportunities without paying significant attention to our CVs because tbh, they're mostly crap.

[1] [http://www.developersinafrica.com](http://www.developersinafrica.com) [2] [http://devcongress.com](http://devcongress.com) [3] [https://groups.google.com/forum/?hl=en#!forum/devcongress](https://groups.google.com/forum/?hl=en#!forum/devcongress) [4] [https://www.youtube.com/channel/UCJdep9xo0Y8UTvKehbhey2g](https://www.youtube.com/channel/UCJdep9xo0Y8UTvKehbhey2g) [5] [http://forge.devcongress.com/faq](http://forge.devcongress.com/faq) [6] [https://community.github.com/](https://community.github.com/)

</comment><comment><USER35> I suspect I'm one of the dark matter programmers Scott spoke of. I'm from South Africa by the way

</comment><comment><USER36> Some African programmers like me build products from Africa... but brand our products to look American/European. I guess some Asians do that also. This move increased our sales considerably.

</comment><comment><USER37> >A place where anyone can search programmers based on say, community, programming language, project interests, _gender_ , age brackets etc

gender? really?

<comment><USER38> If you can search by age,then why not gender? Both should have zero influence on your abilities, and yet it's ok to discriminate against one but not the other.

<comment><USER37> I can see your point, although your age can reflect your experience, whereas your gender provides no information about your ability. I guess you could argue that for a company willing to be more diverse (like Google recently), it actually IS important to know people's gender for a kind of affirmative action.

</comment></comment></comment><comment><USER39> A lot of them in Ghana go to this school: [http://meltwater.org/](http://meltwater.org/)

</comment><comment><USER40> I've been asking this question for a long time...any african programmer in Berlin or Germany ? check my contact :)

</comment><comment><USER41> They're all playing football.</comment>


Show HN: Sleep Therapy to Beat Insomnia - <AUTHOR> https://apps.apple.com/us/app/sleepedy/id1487849164 <comment><AUTHOR> Hey HN! I'm a former insomniac that went through a behavioral therapy program to sleep better. I teamed up with some behavioral therapists to create Sleepedy, an iOS app that connects you with a sleep coach and follows an evidence based program to help you sleep better.

Evidence-based treatment (EBT) refers to treatment that is backed by scientific evidence. That is, studies have been conducted and extensive research has been documented on a particular treatment, and it has proven to be successful.

Let me know if I can answer any questions regarding the product or our methods :)

To learn more about our therapy method: [https://www.sleepfoundation.org/articles/cognitive- behaviora...](https://www.sleepfoundation.org/articles/cognitive-behavioral- therapy-insomnia)

[http://ilya.sukhar.com/blog/an-algorithmic-solution-to- insom...](http://ilya.sukhar.com/blog/an-algorithmic-solution-to- insomnia.html)

</comment><comment><USER2> is there an android app?

<comment><AUTHOR> Not yet but we are working on it right now :)</comment></comment>


Reasoning by Lego: The wrong way to think about cryptography - <AUTHOR> https://www.cryptofails.com/post/121201011592/reasoning-by-lego-the-wrong-way-to-think-about <comment><USER2> Once upon a time, roughly the mid '90s, I attended a talk by somebody from the Horus Project ([https://www.cs.cornell.edu/info/projects/horus/);](https://www.cs.cornell.edu/info/projects/horus/\);) mercifully, I've forgotten who it was. Anyway, this person was blathering on and on about the Lego model of network protocol components and how you could build new protocols quickly by stacking different blocks and only needed to build your specific functionality into a block to re-use the other components. See Horus: A Flexible Group Communications System ([https://www.cs.cornell.edu/home/rvr/papers/HorusFlexible.pdf](https://www.cs.cornell.edu/home/rvr/papers/HorusFlexible.pdf)) for an example.

Anyway, in their slides, the example was two Lego bricks labelled "Encryption" and "Compression", which were shown stacked in the two different orders.

The problem is that doesn't work. You cannot compress something that has been encrypted. Those two blocks do not commute.

I was, unfortunately, too much of a gutless larval grad student to bring this up at the talk, though.

<comment><USER3> Even better, while compressing a good quality ciphertext doesn't work - enciphering a compressed stream may introduce more problems than if it had not been compressed first. This doesn't _look_ like a real world problem and I can believe that in "the mid '90s" a cryptographer who pointed out that it's a bad idea would have been dismissed for focusing on a purely academic concern.

In a cryptographer's model an adversary who is able to use your system to encrypt plaintext partially or entirely of their choosing is a reasonable hypothetical, but in the real world such adversaries were rare. Who lets somebody _else_ choose part of the messages they're encrypting?

The Web offers a concrete answer in the form of: Cookies, HTTPS and Javascript. Bad guys get to cause you to encrypt a mixture of their chosen plaintext plus a cookie value they don't yet know. Is that a problem? Well... if you compress the data before encrypting then the bad guys get to see whether it compresses more or less with their chosen input, and you've got CRIME (and later BREACH).

</comment></comment><comment><USER4> The author takes the following statement to be incorrect:

> I had written code for a constant-time text comparison of the MAC but then > realized that this is not an issue when using the MAC-then-encrypt method > because the MAC is only compared after decryption to verify that the data is > intact and the same as when it was encrypted. Since the correct MAC is only > exposed when the correct encryption key is used it doesn't matter whether > the text comparison is done in constant-time or not. Changing to an encrypt- > then-MAC method (requiring a constant-time MAC comparison) would not be > backwards compatible with the current version.

I don't see anything wrong with this statement. With encrypt-then-MAC the application is going to calculate the MAC on the ciphertext then compare it against the MAC included with the ciphertext. If the two match then the application will decrypt the ciphertext into plaintext. If the attacker doesn't actually know the encryption key then the data will be garbled but that might not matter for certain attacks. The key to the attack is getting the MAC correct and to do that timing attacks on the comparison can be done.

But in this case we are using MAC-then-encrypt. The application is going to decrypt the ciphertext to produce plaintext and MAC. Every time the attacker changes the ciphertext both the MAC and the plaintext will change unpredictably. Even with the timing leak, the attacker can't do anything with the ciphertext to make it such that the MAC verifies the plaintext

One of the key flaws of modern security protocols is making them robust to bad implementations and side channels. I don't see the problem as being reasoning by Lego but rather in neglecting that the information you wish to protect is not just in the ciphertext, it can leak out into everything, the length of the message, padding, MAC, timing...

<comment><USER3> > Every time the attacker changes the ciphertext both the MAC and the > plaintext will change unpredictably.

No. This system uses CBC so changes to the ciphertext have _predictable_ consequences for some of the plaintext including the MAC.

This is why padding oracle attacks on CBC work so nicely. You smash a random byte you don't care about in block N-1 and twiddle a byte in block N. The padding oracle tells you if you got that byte "right" by the padding rules and so you can deduce what it was before you twiddled it.

<comment><USER4> > This system uses CBC so changes to the ciphertext have predictable > consequences for some of the plaintext including the MAC.

Specifically they have predictable consequences for the next block so if the MAC is at the end of the Nth block you can change the ciphertext of block N-1. You still have the problem that this changes both the plaintext and the MAC so the attack would still fail. Or so I thought until I read through [https://gist.github.com/defuse/0822a9c6d70ab4939c95](https://gist.github.com/defuse/0822a9c6d70ab4939c95) to understand the attack. The MAC here fills at least a whole block allowing independent changes to the MAC and the plaintext.

</comment></comment></comment><comment><USER5> So where does one go to learn the good, practical ways to think about cryptography and authentication?

<comment><USER6> [https://cryptopals.com/](https://cryptopals.com/), by Matasano/NCC Group (originally @tptacek iirc)

<comment><USER3> There are a few problems with these exercises in their current form.

Firstly they have aged. They're a product of a specific period of time and things _do_ change in the real world albeit slowly. There's some modern stuff later on, but too much of it in my opinion is now a history lesson without further application.

Secondly they were written as a challenge-response type of situation. Thomas says do X, you say "Huh? But A" and then a day later Thomas explains yes A so technically he meant X' \- but as a web page you don't benefit from that. This means if you aren't already fairly confident of this material you may in some cases fool yourself into believing you did it correctly when you missed the point of the exercise - or worse, spend a lot of time thrashing around trying to do something that's impossible because you didn't understand what was intended.

e.g. you can find on the Web plenty of people who've "passed" Challenge 13 by granting themselves as attacker the ability to encrypt strings of their choice, not just user "profiles" from the imaginary target system. They aren't "cheating" which would be pointless, but without feedback they don't end up learning the intended lesson.

Thirdly (OK much less seriously) clearly in this more enlightened age we need different example plaintext. How about well known lyrics by Greg Camp which I believe featured in a Oscar winning animated feature around the turn of the century?

On the other hand (and more seriously again), I don't see a whole pile of _better_ training materials laying around if you're a confident programmer who wants to understand some practical cryptography issues at ground level.

<comment><USER7> As I said the last time you made this observation: we wrote cryptopals originally to train consultants to break cryptography as it exists in the real world, not to teach them to build new cryptography.

Since this is the second time you've critiqued them this way, I'd like to ask: what crypto-breaking challenges do you think it's missing? Is there a practical NewHope attack that actually appears in some deployed system on the Internet that cryptopals should walk people through? We don't have a set on signing crypto (none of the people who worked on it are blockchain people) so maybe that's an area to beef up.

<comment><USER8> Not parent.

As to the first point, I think it's missing Spectre/Meltdown vulnerabilities? Also something with EFAIL, and something with regards to all the JWT mess that's currently being used everywhere.

Hm.... But now, when I am reviewing them again (I last tried them in 2015-ish), I see they are mostly low lever crypto; things like JWT and EFAIL probably does not belong there.

<comment><USER7> That's correct. So, for instance, invalid curve attacks --- which broke JWT --- are in cryptopals 8. JWT isn't. There's probably a malleability-gadget challenge we could do that's abstract enough to fit and captures what's interesting about EFAIL, but then, the underlying cryptographic flaw in EFAIL is so simple it's already in there. Weird how relevant "historical" cryptography is when you're in the real world, looking at real systems.

</comment></comment></comment></comment></comment></comment><comment><USER9> Why do websites hijack the back button?

The article was interesting but I'm always turned off by pages to make me hit the back button like 20 times to actually go to the previous page I was visiting.

<comment><AUTHOR> I agree with you entirely, and in defence I've got into the habit of always, without exception, opening a link in a new tab. Then I can simply close the tab to return to my launch point.

<comment><USER10> My favorite website feature is when a button masquerades as a link via javascript so that CTRL+click doesn't open it in a new tab like I intended.</comment></comment></comment>


COVID Near You - <AUTHOR> https://covidnearyou.org/ <comment><AUTHOR> > How will my data be used?

> Public health officials will be free to view the anonymized data on our site > the same way you can (in fact, they are exactly the user we want looking at > this data!)

> What is COVID Near You?

> COVID Near You is a website that allows the public to quickly and easily > report COVID-19 symptoms or testing activity. Using participant-submitted > reports, COVID Near You maps this information to provide local and national > views of the illness.

> COVID Near You is a sister tool of Flu Near You, created by Ending Pandemics > and Boston Children's Hospital and maintained by the HealthMap, Boston > Children's Hospital team.

[https://covidnearyou.org/#!/faq](https://covidnearyou.org/#!/faq)</comment>


Faster R-CNN: Down the rabbit hole of modern object detection - <AUTHOR> https://tryolabs.com/blog/2018/01/18/faster-r-cnn-down-the-rabbit-hole-of-modern-object-detection/ <comment><USER2> Does anyone try to get accurate bounding boxes (rotation, correct angle) with these object detection models? Or does the greatly harden the problem?

<comment><USER3> That's exactly what Faster-RCNN does. Edit: Except for rotation — they are axis aligned bounding boxes.

Mask-RCNN (more recent) takes it a step further and also generates a per- object pixel segmentation mask, which is even better than a bounding box obviously. For that reason, Mask-RCNN is much more exciting to me, and incredibly impressive if you see examples showing what it can do.

That said, "under the hood" of Mask-RCNN are still axis aligned 2D bounding boxes for every object (and this occasionally creates artifacts when a box is erroneously too small and crops off part of an object). IMO we need to somehow get away from these AABBs, but right now methods that use them simply work the best.

</comment></comment><comment><USER4> Object detection is an interesting failure for deep learning. Systems such as these perform well but whenever you have something like non max suppression at the end you are bound to get hard to fix errors. I'm more optimistic about deep mask and similar pixel wise approaches as well as using RNNs to generate a list of objects from an image.

</comment><comment><USER5> I saw this today: [https://github.com/facebookresearch/Detectron](https://github.com/facebookresearch/Detectron)

</comment><comment><USER6> wansn't R-CNN already superseded by YOLO[1]? didn't read the article, but no mention of it to compare itself to, so seems outdated maybe.

anyone had the time to dig deeper into this?

[1] [https://pjreddie.com/media/files/papers/yolo.pdf](https://pjreddie.com/media/files/papers/yolo.pdf)

<comment><USER7> Tradeoffs: RCNN has better accuracy. YOLO is faster.

<comment><USER8> rcnn is two steps and ssd is single step.

</comment></comment></comment><comment><USER9> Is this what they use for self driving cars?

<comment><USER10> Faster R-CNN gives you only like 5fps on high-end GPU, so answer is no.</comment></comment>


Biologists grow human-eye precursor from stem cells - <AUTHOR> http://www.nature.com/news/biologists-grow-human-eye-precursor-from-stem-cells-1.10835

<comment><USER2> I look forward to the day when organs such as eyes can actually be replaced. Currently if you have a severe problem with your vision... well, you're mostly screwed.

<comment><USER3> Tell me when they can grow me a new inner ear and cure tinnitus. I want to experience the tranquility of true silence, and I want it from something other than the cold embrace of the grave.

<comment><USER4> Have a look at white noise. A friend of mine finds a lot of relief in it. Its like hacking your ears! [http://www.google.nl/search?aq=f&client=chrome- mobile...](http://www.google.nl/search?aq=f&client=chrome- mobile&sourceid=chrome-mobile&ie=UTF-8&q=tinnitus+white+noise+mp3)

</comment></comment></comment><comment><USER5> Impressive! I wonder if this technique has advantages over the "scaffolding" technique[1]. Maybe the eye doesn't have enough of a protein scaffold between its cells for that method to work?

[1]<http://www.pbs.org/wgbh/nova/body/replacing-body-parts.html>

</comment><comment><USER6> This no doubt also has implications for lab-grown meat because so far the stuff being produced is essentially just a homogeneous slab of tissue (e.g. would taste more like spam than fine meat). If full animal organs can ultimately be grown, including the textures, you could really imagine moving away from live-animal sourced meat.

<comment><USER7> And growing animal muscle for food is a good precursor to growing legs or hands or fingers for amputees.

</comment></comment><comment><USER8> "Some at the meeting had already tried and failed to reproduce Sasai's mouse experiment using human cells."

Hopefully this is temporary...

</comment><comment><USER9> Maybe this will convince the "Intelligent Design" community that an eye-ball actually could be the result of many iterations (via selection) of photo- sensitive cells.</comment>


Apple Working with American Express on iPhone 6 Mobile Payments - <AUTHOR> http://recode.net/2014/08/31/apple-partnering-with-american-express-on-new-iphone-payments-system/ <comment><USER2> Apple working with 'INSERT ANY CC PROVIDER' on iPhone 6 Mobile Payments...

More interesting is the question which technology will be used. NFC has to play a role here, because the technology is in the market and scalable. My weirder and more riskier bet is that NFC on the Apple wearable will refit all older iPhones with mobile payments. Until now noone has put NFC on a wearable, even though it makes most sense to have it on a wrist.

<comment><USER3> They just installed NFC-ready consoles at my local Whole Foods. It could easily be coincidence, of course.

<comment><USER4> It is a coincidence, and it is odd that Apple seems to get attribution for emerging technology trends.

All of the payment vendors are or have already embraced NFC. Here in Canada, NFC is ubiquitous, and I'd be surprised if it wasn't in the US. MasterCard's PayPass, for instance, is NFC.

<comment><USER5> I rarely use NFC payments for any purchases. If Apple gets into the payment space, I probably will.

The reason they get credit is that people actually use the solutions they provide.

<comment><USER4> _The reason they get credit is that people actually use the solutions they provide._

The entire payment industry is moving to chip / NFC, and the parent offers up that maybe Whole Foods is prepping for Apple.

No, they aren't. They're prepping for, again, the entire payment industry. Hundreds of products across all major payment vendors. You haven't used it because the US payment space in particular is very slow, but soon enough every card you carry will feature it, and the technology will be ubiquitous, with or without Apple getting involved.

This happens repeatedly: Apple is very good at choosing the right time to enter a market -- hitting it when it hits primetime -- and then they get credit for creating the market. Incidental, but I saw an incredible conversation the other day where multiple participants were vilifying Apple's competitors for copying Apple on wearables.

<comment><USER6> > This happens repeatedly: Apple is very good at choosing the right time to > enter a market -- hitting it when it hits primetime -- and then they get > credit for creating the market. I

I know. Remember when Microsoft started the tablet market in 2003 and then Apple comes along 7 years later and steals credit for tablets! Psh!

And remember when Apple got credit for smartphones when all they did was enter the market that BlackBerry had created and turn it on it's fricken head with a device so much of a leap-frog that blackberry management thought would never ship? [[http://mathiasmikkelsen.com/2011/05/blackberry-makers- though...](http://mathiasmikkelsen.com/2011/05/blackberry-makers-thought-the- original-iphone-was-impossible-to-make/)]

And remember when they strolled into the MP3 player market after the Rio players were crushing it with literally thousands of units sold every year? They step into that market right when it's about to blow up and next thing you know, everybody acts like Apple was the company that put the white buds in everybody's ears!

In all seriousness, yes, Apple does of course time their entry into a market. And when they do, they unleash a torrent of innovation, marketing, and brand goodwill. I bet name recognition for fitbit is under 50% on the street. What do you think that would/will be if Apple released a similar wearable? Like them or not, Apple products are iconic. My dad knows iPod and iPhone. Do you think he knows HTC One? Or even Galaxy S?

<comment><USER7> Nobody contests that Apple products are iconic. The trouble, a lot of people seem to think that since Apple popularized something, they "own" it now and any other company that enters the market (or was in the market before Apple!) is now "stealing" what rightfully belongs to Apple.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> "...as secure as traditional payment cards".

Are they referring to mag stripe or EMV by saying "traditional" payment cards?

</comment><comment><USER9> How many average joe's carry an American Express? They need Visa/Mastercard and some well-known retailers to make this work from the get-go.

<comment><USER10> An Amex card is no harder to get than a MC/Visa. Costco has done quite well in the relevant middle-class-american-suburb market with an Amex-only policy. This isn't the barrier.

The retail penetration, however, _is_ the barrier. If you can't use these things mostly everywhere, this service is going to be no more successful than Google Wallet.

<comment> k-mcgrady >> "An Amex card is no harder to get than a MC/Visa."

Do Amex do a debit card? In Europe (certainly in the UK) debit cards are in much wider use than credit cards and Visa and Mastercard debit cards are given with almost every bank account.

<comment><USER11> They do a particularly weird instrument called a "charge card." It's not a debit card because it's not pulling straight from a checking account, but there's no long-term line of credit either. It's like a credit card that you're actually _required_ to pay in full every month. So no different from responsible credit card use, but still not credit.

<comment><USER12> > They do a particularly weird instrument called a "charge card."

It should be noted that they also offer regular credit cards, in addition to the charge card, and these do not require payment in full at the end of the bill cycle.

<comment><USER13> And prepaid cards too, iirc, through Walmart.

Edit: ignore me, I see somebody else has already mentioned this further down...

</comment></comment></comment></comment></comment></comment><comment><USER14> Breaking News, Apple is working with Lada on self driving cars.

Seriously, Amex seems to have not heard of any tech progress since 1998. Their website is atrociously bad.

</comment><comment><USER15> I agree with @blutoot they need to focus on Visa and Mastercard. Then again maybe they're going for a higher HHI bracket?</comment>


User Management in Drupal 6 - <AUTHOR> http://www.packtpub.com/files/7580_10_SampleChapter.pdf 'User Management' is an article extracted from Travis Tidwell's new book titled' Flash with Drupal' by Packt Publishing. In this tutorial, users will learn one of the most important aspects of Drupal CMS; its ability to manage its users and protect the content of the site with a permission-based role system. <comment><USER2> Actually the posted title is just the title of one _chapter_ (#10) of a book entitled:

Flash with Drupal: Build dynamic content-rich Flash CS3 and CS4 applications for Drupal 6

Hopefully that'll help someone figure if they really want to go through the Scribd</comment>


Viruses, ET and the octopus from space: the return of panspermia - <AUTHOR> https://cosmosmagazine.com/biology/viruses-et-and-the-octopus-from-space-the-return-of-panspermia <comment><USER2> The theory as stated would seem to make it virtually impossible that life did not take hold and flourish on Venus. That it seems not to have looks like a near-insurmountable obstacle to the theory's acceptance.</comment>


VC Vinod Khosla trys to sell Martins Beach easement to state for $30M - <AUTHOR> http://blogs.mercurynews.com/internal-affairs/2016/02/19/3931/ <comment><USER2> _tries_

It seems Khosla and his legal team plucked $30M from where the sun don't shine. I hope the state _does_ use eminent domain to restore the public's access to one of California's most beautiful beaches.

Some background: [http://www.hmbreview.com/news/martin-s-beach-now-open- for-a-...](http://www.hmbreview.com/news/martin-s-beach-now-open-for-a- price/article_b054b0f6-2be1-11e5-b5fb-0bb390e48721.html)

<comment><AUTHOR> Have you ever been to Martin's beach? We tried to go one day but the gate was closed, were nervous about tickets since the status of it seems up in the air.

I fear Khosla has enough legal resources to just try and drag this out forever. It's really a shame.

<comment><USER2> I was quite young and I still remember the wide expanse of beach with nearly vertical cliff walls.

I'm not fully up to date on California Coastal Regulations, but generally public access to beaches is an important public right. The state will not back down from this either I suspect.</comment></comment></comment>


Show HN: Easiest Way to Run PHP Apps on AWS, DigitalOcean, Vultr and GCE - <AUTHOR> https://www.producthunt.com/tech/cloudways-2 <comment><USER2> Looks great. Its like a control panel that can help manage a server without using command line.</comment>


Saturn's moon Rhea may have a breathable atmosphere (unlikely) - <AUTHOR> http://io9.com/5699783/saturns-moon-rhea-may-have-a-breathable-atmosphere?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+kotaku%2Ffull+%28Kotaku%29 <comment><AUTHOR> Breathable only if you can tolerate frozen lungs and a ppO2 of nothing since oxygen is a liquid at the temperatures found on Rhea's surface (-174 C).

I realize io9 is a science _fiction_ blog, but I wish they would put more emphasis on the science sometimes.

<comment><USER2> Is oxygen a liquid under those temperature _and pressure_ conditions?

Not much is a liquid at the damn-near-zero pressure of Rhea's atmosphere.

<comment><AUTHOR> I thought of that not long after I hit the post button. And you are correct. But basically, there may be free oxygen on Rhea, but no stretch of the imagination is going to turn that into anything like a breathable atmosphere.</comment></comment></comment>


This GitHub URL makes it look like Linux has a rootkit committed to it - <AUTHOR> https://github.com/torvalds/linux/blob/b4061a10fc29010a610ff2b5b20160d7335e69bf/drivers/hid/hid-samsung.c#L113-L118 <comment><USER2> From Linus:

        Misleading URL. Not in my tree, just using github to make it look like it.

        These is no actual commit ID  b4061a10fc29010a610ff2b5b20160d7335e69bf
        in my tree, but when you pass github a SHA1,
        it doesn't do any reachability analysis whether that actually exists in the named tree,
        so it uses a completely unrelated commit from somebody elses tree on github.

        Linus

</comment><comment><USER3> [https://i.imgur.com/eowHfcx.png](https://i.imgur.com/eowHfcx.png)

Did you commit a rootkit to linux?

<comment><AUTHOR> No, it's a bug in GitHub. It should be a 404, or at least redirect to my fork, where that commit was actually made.

<comment><USER4> It is a likely sort of GitHub bug. It's pretty well known that GitHub stores all objects for all forks of a repository in a single git object database and it has added guards to git (some of which have been upstreamed into git itself) to keep it from navigating objects outside of a particular fork.

It's a small, easy to miss detail in this screenshot because you are looking for the lack of something, but under the commit title is where GitHub lists the containing branches and tags of the current fork, and in this case that line is entirely missing.

(GitHub should maybe have a more explicit negative message in this sort of case: "This commit does not seem to be included in any of this fork's branches or tags.")</comment></comment></comment>