USB wall outlet - new standard for DC plugs? - <AUTHOR> http://store.fastmac.com/product_info.php?products_id=458

<comment><USER3> Anyone know more details about this, and if it's been approved? My understanding is that everything that's part of a home wiring system (like this) needs to go through a bunch of test (UL, etc.) before it can legally be installed in a house - and that seems like a lot of work for a small-ish third-party accessory company to go though.

EDIT: Looks like it's not yet - from the ordering page, "This item is currently waiting on final UL Approval. It is scheduled to begin shipping in early 2010."

<comment><USER4> "before it can be legally installed"

Does that only count for wiring that is attached to a public grid?

E.g. if I have a homebrew energy system that doesn't touch a grid, am I free to attach anything I want including such USB outlets?

<comment><USER5> The UL is a certification program, They can't really tell you what you can/can't install in your own home. They can't even tell you what you can/can't sell to someone else. The issue is that most distributors won't buy/sell things w/o UL approval (for good reason). I'd most certainly guess that the creators have had them in their home for some time.

When I worked in commercial electronics, it was very typical for engineers to install development products in their home, long before UL approval.

</comment></comment></comment><comment><USER6> Now we need a USB surge protector.

<comment><USER7> ...and a company like Monster to charge 10x what it costs to make the damn protector because it's "better quality".

<comment><USER8> But the connectors are plated in GOLD!

<comment><USER9> Give me a 10ft gold cable, _then_ I'll believe it has anything more than a negligible effect on impedance.

<comment><USER5> and gold connectors on both ends and gold pcbs and solder...

<comment><USER10> My understanding (from memory of an electronics class a few years ago) is that gold is used for the connectors because it resists oxidation better. Copper is actually a better conductor of electricity.

<comment><USER5> For sure. corrosion just isn't a big problem for most consumer or home electronics though. Where it is, it's a problem in more than just the connectors, because most electronics aren't sealed. (it's especailly useless if the connectors on the $100 board aren't protected... and the $3 cable is..)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Only problem with this is that now mains wiring is going to be part of the obsolescence cycle.

<comment><USER12> I remember seeing USB ports on cheap computers in '98 and you can still get normal to mini adapters like [http://electronics.become.com/6ft-usbamini-b- device-usba-to-...](http://electronics.become.com/6ft-usbamini-b-device-usba- to-mini-b-2-0-compatible--compare-prices--c204735781) that fit in those slots.

I don't believe the power spec has changed in that time.

<comment><USER13> I thought they were bumping the power spec for usb 3.0?

</comment></comment></comment><comment><USER8> Does anyone know if there are any plans or way to add universal DC to the standard electrical system? It seems with all the electronic devices it is wasteful to generate AC and then convert to DC in switching power supplies and in wall-warts, etc. This plug device looks like it just puts the transform in the wall so does nothing to solve the conversion losses. Would it be practical to add a DC offset, say +5v to the AC sine wave to directly drive electronics in the home? I'm not an EE so maybe the idea is crazy but I hope someone can explain.

<comment><USER14> A DC offset would have the negative side effect of causing AC wall transformers to saturate, redering them useless. Also, as far as I know it would cause problems for many kinds of AC motors. True, you could bypass the DC offset with a series capacitor, but then you would suffer efficiency losses in larger appliances, in addition to added cost and complexity. The problem with having +5V centrally regulated and then distributed throughout the house is wiring resistance losses. Let's say you decide to use 16AWG wire, and have a run of 100' to a hypothetical outlet (not uncommon in even a mid sized house). that means your round trip length is 200'. Given the resistivity of copper, the resistance of such a wire is 1.26Ω, and with .5A of current your voltage drop would be .63V. Therefore, 5V would leave the distribution box, and only 4.37V would be available at the outlet. Worse, Pin=5V _.5A=2.5W, Pout=4.37V_.5A=2.19W. Efficiency of just the transmission system is 87%. You can get a good power factor corrected switching converter that can do better than this just plugging into the standard wall outlet.

<comment><USER8> Thanks

</comment></comment></comment><comment><USER15> Cool, but too bad that 5V is on the low side to run all electronics. It's easier to downgrade 12V->5V than to step up, so I'd prefer if we make new building wiring it be 12V.

<comment><USER16> While there's some truth to that, I'm not aware of a de-facto standard 12V connector.

I guess SATA power could be interesting as it has 12V, 5V and 3.3V rails, but I don't think it's designed to withstand as many plug cycles as USB.

Firewire can supply power at 12V, but that's not standardised, so no device can rely on it.

Many devices use 12V, but they use a vast spectrum of different plugs and sockets - many are coaxial power connectors of different shapes and sizes, some are not. USB is a surprisingly good choice, as it's standardised at 5V with a minimum of 100mA and the option to draw up to 500mA. It's also vastly more popular than any other similar connector.

<comment><USER17> I'd say the closest thing we have a 12v standard is the barrel plug used in a car cigarette lighter port. Of course, that's a pretty ugly solution for an outlet.

<comment><USER16> "Pretty ugly" is an understatement. I don't think I've seen a single plug design that is less reliable.

</comment></comment></comment></comment><comment><USER18> My favorite airport would be the first to start using these.

<comment><USER19> SJC has USB outlets in the terminal. Not quite as slick as this one, but eh.

<comment><USER20> I can verify that. Did you see these & wonder if they had data connections ready to snare the unwary?

</comment></comment></comment><comment><USER21> > the USB ports only draw power when something is physically connected to the > port.

Am I mistaken that this is a physically impossible claim?

<comment><USER9> Technically speaking yes it will draw power, all wiring draws power (the wires develop capacitance, but there's also electrostatic leakages around the bare connectors, but at 110/240V it's negligible, this is a concern around 10,000V+, with DC it likely has no electrostatic leakage, and very little drain due to capacitance.

However, what I believe you're thinking about is the transformer required to turn 110V->5V and yes you're correct. An old school transformer would drain a few watts when inactive, however the current types of transformers used in Wall->USB devices provide virtually no drain, perhaps less than a watt, so will have no noticeable effect on your electricity bill.

Simply put, changing say 20 wall sockets in your house to one of these USB devices will likely have less effect on your electricity bill than plugging in a 7W night light and leaving it in.

</comment></comment><comment><USER22> Could possibly be a waste of power depending on the design. If you replaced all outlets with something like this that may have another transformer plus the power regulation circuitry your outlets would be burning power 24/7 (not just when you use it).

At least with an adapter you may only have one and unplug it when its not needed.

<comment><USER23> from the page:

"Please also note that the USB ports only draw power when something is physically connected to the port. We didn't want a vampire port that continually sucks and wastes power when not in use so this was one of the features on the top of our priority list during the design phase."

</comment></comment><comment><USER24> Someone could probably make something like this themselves. Of course the "non-vampire" energy saving technique would be slightly harder to implement, but I don't see any other reason why this would be too hard to implement.

Of course without UL approval you might not be covered by fire insurance if your house burned down....

<comment><USER25> in fact, people already have, but the cost is about 10 bucks anyway!

[http://www.instructables.com/id/Outlets-of-the-Future-aka- in...](http://www.instructables.com/id/Outlets-of-the-Future-aka-in-wall-USB- Charger/)

</comment></comment><comment><USER26> Something like this seems a little more flexible, assuming it works just as well:

[http://www.amazon.com/Belkin-BZ103050vTVL-Surge-Protector- Ch...](http://www.amazon.com/Belkin-BZ103050vTVL-Surge-Protector- Charger/dp/B0017HF3XO/ref=sr_1_1?ie=UTF8&s=hi&qid=1260131000&sr=8-1)

<comment><USER27> Umm...actually, this just replaces the little AC -> USB adapters that many devices come with already. I'd rather have it integrated into the wall so I don't have to worry about losing it.

Of course, I still have to remember the cord. I think wireless data _and_ power is the future.

</comment></comment><comment><USER28> All that and I still can't get a house built with 3 over 3 wall jacks instead having to deal with 1 over 1 like everybody else.

Anybody who can't find enough wall outlets in their home, raise your hands!

</comment><comment><USER29> I'd wait until it supports USB 3.0 at least; for now, I'll be content with a simple adapter.

<comment><USER7> What exactly does USB 3.0 have to do with charging? Will it not be backwards- compatible with 2.0?

<comment><USER29> Yes, but with 3.0 devices won't the outlet allow more power?

<comment><USER20> Er, yes: 50% more power is provided for unconfigured or suspended devices (150 mA up from 100 mA), and 80% more power is available for configured devices (900 mA up from 500 mA). Via <http://www.everythingusb.com/superspeed- usb.html#4>

<comment><USER19> I suspect that the outlet will give you more power than that anyway - <USER2> amperage limits restrict what devices should expect to get, not what hubs may provide them with.

</comment></comment></comment></comment></comment><comment><USER30> what are usb power ports used for? i mean, what devices use them, or is it that devices should use them for some reason?

<comment><USER31> Mobile phones and digital cameras etc often come with USB cables for charging. The intent is that they be charged from the ports on a computer but there's no reason they can't be charged directly from a socket. The exception is the iPhone, some versions of which will not draw any current from the USB socket until a handshake protocol with the PC is complete, and so they will not charge from this kind of arrangement.

<comment><USER32> my iPhone came with a little transformer that plugs into the wall for charging. obviously there isn't going to be any handshaking there. i was under the impression that all iPhones were like that. are you saying that some aren't?

<comment><USER33> My iPhone charges from the home adapter that came with the phone, of course. I also have a 3rd party USB charger that I bought two or three years ago for my iPod. It came with both a home adapter and car adapter. The car adapter will charge my iPhone but the home adapter won't.

<comment><USER34> Your home adapter probably uses the old FireWire power pins, which the iPhone 3G can no longer charge from.

There is also a handshake, but that's separate and (as of the 3GS) only displays a "product not designed for iPhone" warning - even if it displays the warning, it still lets you use the device.

</comment></comment></comment></comment></comment><comment><USER35> But isn't this sipping power ALL DAY.

</comment><comment><USER36> Or a new way to set a house on fire.

<comment><USER37> At 5v & 600mA? ...OK.

<comment><USER38> I think perhaps he means when the "lowest bidder" electrolytic capacitor in the AC/DC converter, with the 2000 hour specified life span (83 days)[1], overheats, bursts, and shorts the AC wiring inside your wall.

Presumably you installed it in a proper outlet box (I like steel) and it will be able to handle the energy released while waiting for the line's circuit breaker to trip without reaching the ignition point of anything inside the wall.

[1] Not that these people would use them, but you find them in a lot of gear. Especially dramatic when their tops are close enough to a case or heatsink to short when they burst.</comment></comment></comment>


Show HN: Single property website tool (Beta) - <AUTHOR> http://www.visualhomelistings.com

<comment><USER2> There's nothing on the site except a form leave email ..</comment>


Brit Watchkeeper drone crashed because blocked sensor made algorithms crash - <AUTHOR> https://www.theregister.co.uk/2019/04/15/watchkeeper_drone_crash_wk042_moisture_blocked_pitot/ <comment><USER2> I have been teaching myself SPARK 2014 and there are a couple of article on writing different parts of drone software in SPARK. Rust also has my attention, but Spark goes beyond Rust's current capabilities in proving a program. I started to look at F* and F# as a possible toolset, but SPARK has a lot of work behind it. It's like the Python of the safe and secure programming world. I work on specialized machinery and rides, and we always perform a very formal HRA (Hazards Risk Analysis), and FMEA (Failure Modes and Effects Analysis), and I can't believe nobody said what happens if the sensor fails!

</comment><comment><USER3> I always wonder by pitot sensors are so independently important to determining stalls. Why is it so hard to detect a malfunctioning pitot, and then more heavily weigh inertial or GPS velocity data? You could even use all of these in a filter, adjusting the weights based on confidence in the data. We could even call this filter a Kalman filter.

<comment><USER4> This suggestion comes up repeatedly, but I think the practical problem is that the vertical air velocity is unknown, and in turbulence, the naturally- occurring short-term variation in it is comparable to the range of the vertical component of the airspeed over the operating range of angle of attack. Maybe with an accurate model of the airplane's response to both gusts and control movement, and data about control movements together with acceleration and rotation of the vehicle, one could estimate this with sufficient accuracy, but the first thing to consider would be more (and heated) sensors (and more robust sensor-driven software, apparently, that can survive the failure of one of its sensors.)

I would guess that with GPS, an additional problem might be the timeliness of accurate-enough data. I would be interested if someone could comment on the state of the art in this regard.

In addition to pitot tubes and AofA vanes, there are various stall warning sensors that detect the movement of the wing's stagnation point as a stall is approached, and these are widely used, at least in the general aviation category. To be fair, they are also vulnerable to the effects of icing.

Update: On reflection, just holding a reasonable attitude would probably be a reasonably effective response to pitot failure, though if your sensors are failing on account of icing, you probably have other problems.

<comment><USER5> You're right about vertical airspeed, but this also applies to horizontal airspeed. Flying into the wind, you could have a very small groundspeed and yet be nowhere near stalling, or flying with a tailwind quite quickly and be on the verge of stalling anyway.

I agree about holding a reasonable attitude and throttle setting. It won't work forever in shitty wx, but it'll give you a chance to try to figure out a different plan at least.

<comment><USER4> Good point - I originally did that comparison in a context (MCAS) where the pitots were working, and just assumed it was the right answer here. I later found, from the report, that this drone does estimate airspeed as a function of throttle position, pitch, engine speed and air density, but doesn't make full use of it as an alternative.

</comment></comment></comment></comment><comment><AUTHOR> I think it was interesting since, as inferred from the article, it look like the same failure as the one from the 737Max

<comment><USER6> Similar to how that Tesla car decapitated it's driver a few years ago because it decided a truck trailer was empty sky.

The combination of bad software and bad sensor data seems to be lethal.

<comment><USER7> > Similar to how that Tesla car decapitated it's driver a few years ago > because it decided a truck trailer was empty sky.

This isn't that different from bad biological sensory input that causes a person to think they are stepping on the brake when they're actually stepping on the acceleration pedal. The main differences being that 1) human beings tend to be able to respond to a wider range of scenarios than software and attempt creative problem solving and 2) we have significantly more sensory inputs and they tend to be quite reliable.

<comment><USER8> Human sensory input fails remarkably quickly if you ever try instrument flying.

<comment><USER9> True, but in VFR conditions it works quite well. There's no such thing as IFR for cars (yet).

</comment></comment></comment></comment></comment><comment><USER10> Why can't an internal gyroscope substitute for an external AoA sensor?

<comment><USER11> Gyroscopes measure angles in respect to your velocity. AoA sensors measure angles in respect to the direction in which air is hitting the wings.</comment></comment>


Exploiting the Windows Cryptoapi Vulnerability - <AUTHOR> https://blog.trailofbits.com/2020/01/16/exploiting-the-windows-cryptoapi-vulnerability/ <comment><AUTHOR> There is a bit of irony here; as the article mentions, the RSA key that windows uses for updates is safe.

Why is that ironic? Well, Trail of Bits also published this article last year:

[https://blog.trailofbits.com/2019/07/08/fuck- rsa/](https://blog.trailofbits.com/2019/07/08/fuck-rsa/)

(Note, the points there are still valid. I just find it funny.)

<comment><USER2> I 100% recommend watching that talk near the top of the article. It's a short talk of 20 minutes but even if you have only time to watch the first 3, that's where the most entertaining part is so still recommended.

</comment></comment><comment><AUTHOR> So, it sounds like (please correct me if I misunderstood something) the issue is:

      # cache signing objects and get chain
      cache, chain = parse_chain_from_cert(full_cert)

      root = chain[-1]
      validate_root_authenticity(root)

      # go up chain from leaf to the root
      for cert in chain[:-1]:
        parent = cert.parent()

        # Wrong Signing object retrieved here:
        signing_object = cache[parent.public_key]
        signing_object.validate(cert)

So the leaf signing object is used instead of the roots, as they share the same public key, but that doesn't contain the parameters of the curve.

<comment><USER3> Interested in how exactly it was fucked up I looked at crypt32.dll. It's more like (heavily-adjusted to demonstrate the problem without >9k unrelated details):

      from the_heavy_lifting_crypto_heavy_module import verify_signature

      def is_known_trusted_ca(cert):
        # BOOM
        return cert in root_ca_cache[cert.pubkey]

      def verify_cert(cert, issuer):
        # BOOM
        if verified_cache[(cert.pubkey, issuer.pubkey)]:
          return True
        if not verify_signature(cert, issuer):
          return False
        verified_cache[(cert.pubkey, issuer.pubkey)] = True
        return True

      # This has to be a search instead of simple chain-walking because servers
      # do not send a "chain", they only send several additional certificates and
      # let the client find a trusted path out of them, it is also how cross signing
      # works. This justifies using a cache above.
      def try_to_build_cert_chain(cert, cert_store):
        if is_known_trusted_ca(cert):
          return [cert]
        for possible_issuer in cert_store.find_certs_with_dn(dn=cert.issuer_dn):
          if verify_cert(cert, possible_issuer):
            chain = try_to_build_cert_chain(possible_issuer, cert_store)
            if chain:
              return [cert] + chain

Then someone tasked with (why?!) "adding unnamed curve support" added (correct!) code to `the_heavy_lifting_crypto_heavy_module.verify_signature` but didn't know this breaks an assumption made in another module.

The exact detail does not matter though, you can build up working exploits even if you don't know the details listed above.

<comment><USER4> The servers _are_ supposed to send a chain ("SHOULD" is the strongest language an RFC uses about chains) but, in practice, the only way to get where you're going as a client is to treat it as one leaf and then everything else is hints that might help you construct the chain.

The reason is that a server doesn't know which roots you actually trust, so maybe it thinks you trust X and X->A->B->C so it sends X->A, A->B, B->C but actually you trust A so you only needed to receive A->B, and B->C - X->A doesn't help you make a decision so your code needs to disregard it.

<comment><USER3> In a more convoluted scenario (cross sign) a server can really send you two (or more) chains so I'd take that "SHOULD" with a grain of salt.

For example, Let's Encrypt Authority X3 is signed by both ISRG Root X1 (their own root CA) and DST Root CA X3. The server could send you:

      1. Server cert
      2. Let's Encrypt Authority X3 (Signed by ISRG Root X1)
      3. Let's Encrypt Authority X3 (Signed by DST Root CA X3)

Combined with:

      4. ISRG Root X1
      5. DST Root CA X3

If the client trusts 4, then it could form a path of 1-2-4. If it does not but trusts 5, then 1-3-5 would be viable.

</comment></comment></comment></comment><comment><USER5> Curious, why don't we integrate the algorithm and its parameters into the public key?

<comment><USER6> That's a general description of the problem, but the more pragmatic question to ask is "why do we support explicit curve parameters at all?". In practice, nobody uses them; virtually no organizations are even qualified to use them. Many platforms don't support them at all; it's not as if there's a serious compatibility argument for them.

The right response to this vulnerability is to jettison support for anything but named curves.

This is probably an inside-baseball argument for people who don't pay attention to elliptic curve implementation details. But it's easy to quickly understand.

Go to SAFECURVES.CR.YP.TO; you'll see a big long list of curves, each with their parameters and some implementation details. In reality, only a subset of these curves are commonly used (P-224, P-256, Secp256k1, and Curve25519 probably account for 95% of all curves).

Further, most specific curves are implemented not as parameters plugged into a generic elliptic curve scalar multiplication routine, but rather as curve- specific code (one of the major reasons we have different curves is to allow specific implementation optimizations). A browser that supports Curve25519 certainly uses Curve25519 code, not generic code.

The "explicit curve" feature that blew up on Microsoft is designed to allow people to specify their own parameters, not for well-known curves but for curves they themselves generated. Nobody does that. There was a time, in the long long ago, when people thought that might be a good idea; nobody thinks that anymore; everyone thinks the opposite thing. If anything, we're trying to _get rid of_ a bunch of curves. Certainly we shouldn't be randomly supplying new Weierstrass curves.

So that's the problem here. A lot of cryptography engineers were probably surprised this CryptoAPI feature even worked. We had considered it awhile ago as a cryptopals challenge (and Sean actually did add it as one in Set 8 a few years ago), but we never dreamed anyone would be crazy enough to let this bug happen in the real world.

<comment><USER7> My feeling is that there has been a change in crypto. It seems in the past, crypto was a la carte.

Over time, this has been shown to open up a big security vulnerabilities such as this one, and also issues with key agility in TLS, etc.

I think the tendency today is to make make crypto more omakase where there are a few well studied, well implemented algorithms that you use for everything.

The Windows CryptoAPI is from that older time.

<comment><USER8> A small part of the problem is that the omakase options do change over time with changes in threat models and knowledge of vulnerabilities. One example is the recent push away from the NIST Curves to the more open knowledge Curve 25519, in part because of reasonable concerns that the NIST Curves were backdoored by NSA for easier cryptoanalysis. So you still need "low level" a la carte tools underlying and backing the omakase experiences.

Part of the problem of the Windows CryptoAPI in question is that it has to serve "both customers", the omakase sort that need the best option, and the a la carte needs to higher level tools serving as the omakase option. That is, for some traditional/legacy C/C++ users that CrpytoAPI is about as high level as they will get, and it's up to the documentation to steer its consumers to the best omakase options. But crypto32.dll _also_ is the low-level backend of tools like WinRT's Windows.Security.Cryptography and .NET's System.Security.Cryptography (on Windows).

The push towards omakase and somewhat getting applications away from micromanaging the a la carte stuff, definitely seems the smart path. Handling the onion of it all in what needs to be supported at a low level to keep the high level omakase shop running smooth seems like it still has a lot of pitfalls.

<comment><USER6> Without addressing the thing about the NIST P-curves being backdoored, which is an extremely dubious proposition, I'll just say that whether you trust NIST or not, nobody should be using custom curves with TLS. Cryptographers have spent an inordinate amount of time working out, proposing, and competing with each other about what the best curves are, and what the best mechanisms for generating them are, and there are a wealth of named curves to pick from.

I'd be happier if nobody used the P-curves (they're unsafe for other reasons). But that's got nothing to do with whether people should literally be plugging their own Weierstrass coefficients and base points into X.509.

Standards should immediately deprecate support for explicit curve parameters.

<comment><USER8> > Without addressing the thing about the NIST P-curves being backdoored, which > is an extremely dubious proposition

I don't believe it exactly either, I just know it as a zeitgeist reason why some of the dialog about curve changes has been happening. In hindsight I supposed I'd have been better off not mentioning it.

> Standards should immediately deprecate support for explicit curve > parameters.

I agree and that wasn't the intent of my post, if it came across that way. While elsewhere in the thread it is mentioned that many named curves are implemented standalone, my understanding is that not all of them are.

I was only suggesting that crypto32.dll is intended to be low level enough that it is possible that some of the higher-level APIs that Microsoft has built that _do_ focus on named curves only (such as the UWP/WinRT and .NET APIs I mentioned) may rely on the explicit parameter support in the lower level library. I don't envy Microsoft the task of balancing what is in a low- level API like that versus backwards compatibility, "upwards" compatibility with high level components, etc.

</comment></comment></comment></comment></comment></comment><comment><USER9> Correct me if I am wrong, but it seems like firefox (and maybe chrome) would never have this vulnerability as they use their own cryptography libraries for everything.

<comment><USER10> Maybe. The question isn't "are you using your own cryptography libraries for cryptographic operations." The question is "are you using Windows's native certificate chain validation API, or did you write your own?"

Even if Firefox/Chrome use their own implementations of cryptographic algorithms, there's a decent chance that they are still using Windows's native API for certificate chain validation in order to plug into the enterprise certificate management features that come baked into Windows, which IT teams sometimes use to distribute internal PKI's. Without having seen how Firefox and Chrome deal with their chain building, I can't say "yes" or "no" definitively.

<comment><USER9> Looking at it they don't even load crypt32.dll so unless one has a modified version of firefox, or an external plugin, it seems unlikely they have the vulnerability.

<comment><USER10> It looks like Chrome does: [https://github.com/chromium/chromium/blob/ccd149af47315e4c6f...](https://github.com/chromium/chromium/blob/ccd149af47315e4c6f2fc45d55be1b271f39062c/net/cert/cert_verify_proc_win.cc)

Credit to this person's comment in the Reddit discussion: [https://www.reddit.com/r/netsec/comments/eooyil/cve20200601/...](https://www.reddit.com/r/netsec/comments/eooyil/cve20200601/feexbtt/)

</comment></comment></comment></comment><comment><USER11> Interestingly it's apparently Windows 10 (and corresponding server) only.

<comment><USER12> Are servers only affected if they use the browser or is IIS affected too?

<comment><USER4> Any software which might validate ECC certificates is affected. That could include IIS if your setup uses client certs _or_ if you have software which connects to other sites over HTTPS, or similar situations.

It could also affect document signing (less commonly used, this is digital signatures not electronic signatures) or code signing (e.g. updates for software other than Windows itself might be affected, or installing new software you haven't separately validated as safe).

</comment></comment></comment><comment><USER13> How long did the NSA know about this vulnerability?

</comment><comment><USER14> For the short version, see our branded vulnerability page: [https://whosecurve.com](https://whosecurve.com)

<comment><USER15> The test site doesn't specify whether we have to use a specific browser to test the vulnerability? I somehow doubt this affects all desktop browsers IE, Edge, Chrome and Firefox.

[https://bad.whosecurve.com/](https://bad.whosecurve.com/)

<comment><USER16> It affects IE and Edge on Windows 10.

It should also affect Chrome on Windows 10 if you haven't updated either your browser or your OS.

It won't affect Firefox on either platform.</comment></comment></comment>


A Thought on Communication - <AUTHOR> http://al3x.net/2011/01/10/a-thought-on-communication.html

<comment><USER2> Most people I know prefer texting to talking on the phone. It's easier to multitask or defer your response. Video communication is even more invasive than audio. I seriously doubt that _communicating with your peers by text is now considered archaic_ will hold true (at least compared to video).

<comment><USER3> It grieves me when someone texts me and says "do you want to do lunch?" and I text them back saying "sure, where and when?"... and then I end up having to pick the time and place, and usually the first three or so suggestions get knocked back.

I mean, if it was a woman, I would understand, but when a bloke does that to me I'm always thinking to myself "Dude, take off the lipstick and put on some trousers for goodness sake".

Texting _should_ be a more efficient means of communication, but alas, is still imperfect. :D

</comment></comment><comment><USER4> I've read a book by Niel Postman where he points out that the medium your working in changes how you craft a message. I believe he was right in stating that a text-based medium promotes reasoning to a greater degree.

The same sort of idea is present in the receiving of a message as well. Your input is going to be processed differently based on the medium your in. Think of ebooks versus paper based books. When you use ebooks you have a better searching and storing experience, but paper based books have an edge when taking notes.

What I'm trying to get across here is that switching from one medium to another doesn't mean were going to be put at an advantage or disadvantage necessarily. We could be putting everyone at a disadvantage by switching to a medium that isn't as good, which means those of us who weren't using the new medium from birth are at advantage over those of us who were.

To make this point in another way, imagine Hacker News in a futuristic video world. Note that now that your dealing with video you have new biases being put in. For example, you might not be able to hear all the comments at the same time or the pretty girl is being upvoted despite a not so compelling content contribution. It becomes a pretty different site. So different that I would say, "I'm glad I got to have the text-based Hacker News" instead of "I think those of us who aren't use to video comments are at a disadvantage."

<comment><USER5> _I've read a book by Niel Postman where he points out that the medium your working in changes how you craft a message. I believe he was right in stating that a text-based medium promotes reasoning to a greater degree._

I think Marshall McLuhan's views on this are worth revisiting as well, though he's currently a bit out of favor among media-studies and communications- studies folks. He's admittedly a bit extreme in parts (he seems to sometimes really believe that the "medium _is_ the message"), but there's a lot of good stuff in _Laws of Media_ on how different technical choices for representing and conveying information will structure and influence the information that's conveyed, as opposed to being mere implementation details.

</comment></comment><comment><USER6> We've already shown that remote and non-present communication works, but the difference between delayed and instant communication is huge. It's not so much text vs. video but that text gives you the ability to think and write/rewrite, while audio or video forces you to be real-time. IM, text, email, letters, and comments have more in common with each other than the issues of presence or remoteness, as do telephony and video.

Text-based communication won't disappear. Video may replace audio-only, but they're intrinsically different and each has their advantages and purposes. The medium or means may change, but we'll always have a delayed and an instant method of communication.

</comment><comment><USER7> Regarding "the inevitable future": why the heck would we bother? The post itself gives precisely the reason that this won't happen:

> This world of pervasive video necessitates beauty. It values physical poise, > wardrobe, and the tenor of one's voice.

I can answer the phone in my underwear. I can't video-call someone in my underwear. That's a reason to avoid video-calling, not a reason to get dressed.

The kinds of new technologies that see instant adoption are the kinds that make ordinary life _easier_ and _more comfortable_. Video calling is _harder_ and _more formal_ than voice-calling (which is itself harder and more formal than textual communication.) It won't get used in the majority of situations, where the informational content just needs to be efficiently pushed to another person with as little personal effort expended as possible.

The one use it _will_ have is in _status signaling_ , in situations where one needs to show they really care and are expending a lot of energy on the call (calling your wife, calling your grandparents, doing a phone job interview in a suit.)

<comment><USER8> _I can answer the phone in my underwear. I can't video-call someone in my underwear. That's a reason to avoid video-calling, not a reason to get dressed._

Under current standards in the current time, I agree. But from a historical perspective, it's likely that standards will change over the long-term, as they did for, say, women's beachwear or corporate dress.

If we reach a time when almost _everyone_ is working from home in their PJs, we should also wind towards such dress being accepted in semi-formal contexts. Consider jeans in the workplace now. Even 30 years ago, a CEO wearing jeans at a board meeting couldn't be taken seriously whereas now it's almost a cliché in tech firms (compare early 80s and 2010 Steve Jobs). The dress of the typical tech CEO now would probably induce fainting or rage in the board members of the typical pre-1960s corporation..

<comment><USER9> If working remotely and video calling become that pervasive, I have no doubt that various filters on your appearance will become commonplace. You could answer a call in your pjs and appear to be in a suit for a business call, or in jeans and a t-shirt for your friends, etc.

</comment></comment></comment><comment><USER10> There isn't much room for half-commitment while on a video call and the interpersonal aspects of the job come to the front. This changes the way one works.

But it isn't quite that novel. Face-to-face interaction we have in the real world can be viewed as high-quality "video communications". Technology is merely making it affordable to do the same at a distance and without losing much of the quality.

So, most of the old etiquette simply migrates to the new medium. For example, if you don't go to work in pyjamas you probably won't take a video call at home while in your pyjamas either.

</comment><comment><USER11> I find it novel that the stereotype of the person who will benefit least from this transition is also the stereotype of the person who will comment on HN.

</comment><comment><USER12> Hm, this might explain something. In old B&W videos people's impromptu speech seems much more eloquent than today. I wonder if the luxury of instant text communication has something to do with it.

</comment><comment><USER13> Video communication would also solve the biggest issue with tablet computers: text production is just too cumbersome.</comment>


Is Sapiens Worth Reading? - <AUTHOR> https://www.mattswain.co.uk/blog/is-sapiens-worth-reading <comment><AUTHOR> Read the full version at [https://www.mattswain.co.uk/blog/is-sapiens-worth- reading](https://www.mattswain.co.uk/blog/is-sapiens-worth-reading)

Pretty much everyone recommends reading Sapiens: A Brief History of Humankind. Tim Ferris's podcast interviewee's often say that Sapiens is the book they gift the most and Amazon's 20,000 ratings give it 4.6 stars. But, with over 400 pages of dense content, is it actually worth reading? Or is it just 400 pages of boring, unenlightened, irrelevant history? Lets find out.

Early on in the book, it became clear to me that I didn't know much about the history of humans. It isn't studied in classrooms or discussed in modern day conversations or popular content. Most people seem to shrug off how we got here and do not seem too bothered to understand. You are therefore working off a bit of a blank slate. Yuval Noah Harari does an excellent job of building up the story and scenes with visual language depicting what an average day looked like hundreds of thousands of years ago. Essentially, a detailed, visual timeline is created in your mind showing the transformation of early humans to where we are now.

In summary, this book condenses lots of research, ideas and the whole of human history into a logical, easy to read and understand, visual way that gives you an overview into a topic in which simply doesn't get taught elsewhere. I think it is definitely worth reading, although this is is not a life-changing book, in the sense you won't become enlightened or change the direction of your life. But, importantly, it does give an appreciation into how we got here. Be prepared for a slow patch in the middle and go into the book knowing that you probably have very limited knowledge of the topic and you will learn lots.

I inspire thinking without limits with my Infinity Thinking email newsletter. I share insights to get you thinking, pose questions, quotes, book and podcast recommendations. Get inspired and check it out at [https://www.mattswain.co.uk/newsletter](https://www.mattswain.co.uk/newsletter)

</comment><comment><USER2> I really enjoy books that span over human civilisation as it's a nice reminder how much we've achieved as a species as well as the destruction we've caused along the way. Have you ever read Bill Brysons a short history of nearly everything?

If you enjoyed that then I would say you would definitely enjoy Sapiens as I found it more interesting and less "text booky". I'm currently reading Homo Deus and enjoying it.

<comment><USER3> The first half of Homo Deus is basically a rehash of everything but the last chapter of Sapiens. And the last half is basically an expansion of the last chapter. It's still great, though.

</comment></comment><comment><USER3> Guns, Germs, and Steel, which is once of Noel's heavy influences, is absolutely worth reading, too.

</comment><comment><USER4> No one can decide for you. I prefer to read business books, so to me it's a big NO. But if your interest aligns, you may read.</comment>


Vulnerabilities in Password-Manager Apps - <AUTHOR> https://team-sik.org/trent_portfolio/password-manager-apps/ <comment><USER2> A theme of this work is vulnerabilities in the "internal browser" some of the mobile password managers provide. Mobile password managers have internal browsers because it's not easy to extend the standard mobile browsers, and password managers want to automate the entry of passwords into form fields.

Don't use the internal browser of your password manager, no matter which one you use. There's too much that can go wrong, and the small convenience just isn't worth it.

<comment><USER3> Which way of passing the password to the browser is better?

If I use the clipboard, many apps can read it (there's no foreground-only clipboard permission on Android).

If I let the password manager be my accessiblity service, I've given it power to do literally anything on my phone, and introduced a new interface between it and other apps (which can try to exploit it by producing confusing screen layouts).

If I let it be my keyboard, I'm giving it everything I type. This might be the least bad option of the three.

Are there any other options?

<comment><USER4> Well you can just have it show you the password, and then enter the characters yourself.

Password management is not equivocal to automated password input. Even if that seems to be the primary feature of many password management apps.

<comment><USER5> I think a lot of people (myself included) use password managers to manage very long and random passwords. Typing in 100 random characters every time I need to login to something (especially on a phone) would be pretty annoying.

<comment><USER6> Reconsider how much entropy a password really needs and why?

<comment><USER7> I wonder if anyone has a formula to convert estimated $ loss if a password is cracked to a suggested level of password entropy. In other words, you could probably calculate that a given password format (say, 8 random characters with about 70 possible values each) would require X CPU cycles, with Y% certainty. Then, you could convert the CPU cycles to an estimated opportunity cost to crack that password. That would be the maximum value that this password format would be sensible to protect. Drop a couple orders of magnitude if you want to err on the safe side (or adjust Y). I expect you'd reach a number beyond all economic activity on Earth before you hit 100 characters, 15 probably exceeds most people's net worth, and 8 characters probably suffice for the majority of sites requiring a password.

I think the bigger win of using a password manager is being able to use different random passwords for each site, rather than using particularly long ones. That alone gives you sufficient entropy to beat brute force attacks and isolation of your other accounts from a single site leaking your password from their end.

<comment><USER8> > about 70 possible values each

The norm is 95 values. That's the all ASCII printable characters, or just count them on your keyboard.

(I'm not sure if that includes the <space> character.)

<comment><USER7> Fair enough. I erred low due to many sites restricting symbols. Also considered leaving out symbols entirely and going with 62 for that reason. Fewer possible symbols just means extra characters, and probably doesn't even have a huge impact on that number. Nine alphanumerics (62 possibilities) beats eight characters with 95 possible values, and if you want something easy to type manually, could be preferable. Depends on usage and site requirements.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> So, all three of the LastPass issues have been fixed, and within two weeks of being reported, to boot:

      * 2016-08-22 Vulnerability Discovered
      * 2016-08-24 Vulnerability Reported
      * 2016-09-06 Vulnerability Fixed

<comment><USER10> The folks over there work really hard and care a lot. I'm sure that's the same with all the password managers too, but I know personally having worked at LastPass how much the founders care.

<comment><USER11> Hard-coding the symmetric encryption key used to store your master password isn't just a minor slip up. This is the kind of mistake that I for one wouldn't do and I'm no security expert.

At least for proprietary apps, security is about trust. Given their other slip ups in the past, along with present design choices like making certain administration tasks available only through the web interface, I wonder how people can trust LastPass.

Of course, it's better than not using a password manager at all. But one has to admit the bar for that is pretty low.

<comment><USER12> I get baffled at how such basic security mistakes are made. Either who did them doesn't care or doesn't know, of which neither is good for - at least - applications that store such sensitive information.

<comment><USER13> To be fair, unless I misunderstood, the symetric key is only used when you save your master password (so you don't have to re-type it) and use a PIN instead.

I believe LastPass app encourages you to NOT do this.

This obviously doesn't excuse the implementation (it shouldn't of gotten past CR). Just pointing out the attack vector is not as severe as it seems (at least from the issue's title).

<comment><USER11> Without a strong master password, encryption is useless. It's recommended to have a master password of at least 16 chars including digits and special characters. Otherwise a global enemy with the right resources, like the NSA, can brute force it from a distance.

My password is 24 chars in length, includes digits and special characters and isn't made of dictionary words. Typing such a password on my laptop with a normal keyboard is fine, because I touch type, but typing it on my phone every time I need it is simply not doable. Using a PIN on the other hand is easy and should be fairly secure if the app is designed to fallback to the master password after X failures, preferably with hardware support.

So in all fairness, not only did they screw up a basic feature, but this also encourages people to use weaker master passwords.

</comment></comment></comment></comment></comment></comment><comment><USER14> One of the 1Password ones ([https://team-sik.org/sik-2016-040/](https://team- sik.org/sik-2016-040/)) about leaking URLs is marked as fixed, however, that's a little misleading. It's fixed if you use their newer vault format, which has limitations, and is _not_ selected by default when you create a new vault. I wrote this about it a while back: [https://myers.io/2015/10/22/1password- leaks-your-data/](https://myers.io/2015/10/22/1password-leaks-your-data/)

<comment><USER15> _> and is not selected by default when you create a new vault._

I just tried creating a new vault and it created a .opvault. It became the default with version 6.1, released in Nov 2015 [https://app- updates.agilebits.com/product_history/OPI4#v6100...](https://app- updates.agilebits.com/product_history/OPI4#v610012)

<comment><USER16> > It became the default with version 6.1

yea, but still the problem is that all users who created a vault _before_ Nov 2015 never got any message neither is their database upgraded automatically. They will unknowingly keep using the old database format.

Seems alarming for a company who's business is security/privacy.

<comment><USER15> _> and is not selected by default when you create a new vault._

I was clearly only responding to this part, which is still useful information. Nowhere I said there is no issue, there is no need to always nitpick on everything. I'll go back to not commenting on anything for another year.

<comment><USER16> i probably worded it poorly, in my defence, English is not my native language :)

I agreed with your post and was just supplying additional info.

<comment><USER17> You didn't, guy just seems incredibly sensitive.

</comment></comment></comment></comment></comment></comment><comment><USER18> This is why I still go to the trouble of PGP encrypting a file with my passwords, rather than relying on a password manager. I keep wanting to switch, but damn it, I just can't bring myself to have that much trust in them.

Edit: Thanks for the informative replies, the links, and the advice. I'm going to explore all of my options and re-think this.

<comment><USER19> You may want to look at pass, which is pretty lightweight scripting around gpg to store passwords in multiple files. Some tradeoffs required, but works well and fully auditable

<comment><USER20> Pass¹ is very nice, and you can even share a part of your password library with someone else by using their GPG public key (encrypting just those files with both your keys) and sharing the shared directory via some sharing utility such as SyncThing².

Pass also supports using git for change management.

1: [https://www.passwordstore.org/](https://www.passwordstore.org/)

2: [https://syncthing.net/](https://syncthing.net/)

<comment><USER21> why use syncthing when pass supports git?

<comment><USER20> Because with git you have to explicitly push. Both have their valid uses; I use the git solution for a devops password database shared with a small number of colleagues. I use SyncThing to share a common subdirectory of a private password database with my partner.

SyncThing has the benefit of transparently handling the synchronisation behind the scenes for me. Whenever I place something in pass in the 'shared' subdirectory, it will end up in her database as well as soon as both our devices are online.

</comment></comment></comment></comment></comment><comment><USER22> Some older papers on security vulnerabilities of password managers:

[https://www.schneier.com/blog/archives/2014/09/security_of_p...](https://www.schneier.com/blog/archives/2014/09/security_of_pas.html)

Any thoughts on Bruce Schneier's PasswordSafe password manager?

<comment><USER23> Another password vault analysis paper found that one to be the safest they found.

<comment><USER24> Would you have a reference for that?

<comment><USER23> [https://www.cs.ox.ac.uk/files/6487/pwvault.pdf](https://www.cs.ox.ac.uk/files/6487/pwvault.pdf)

</comment></comment></comment></comment><comment><USER25> What about enpass? That would be very interesting since they also promise to be very secure.

<comment><USER26> They all do, don't they? I don't imagine some Password Manager saying "We're kind of secure. We take security seriously-ish".

<comment><USER8> Typing "Secure password manager" requires keyboard skills. Developing one requires much more.

</comment></comment></comment><comment><USER27> Tangentally related:

[https://github.com/SirCmpwn/pass-rotate](https://github.com/SirCmpwn/pass- rotate)

I posted it on here the other day but it didn't go far. It's like youtube-dl but instead of downloading videos it changes your password on various online services. If you get your password compromised by vunlerabilities or whatnot it makes it easy to mass-rotate your passwords. Could use some help adding support for more websites if you're interested.

</shameless promo>

</comment><comment><USER28> I looked at the LastPass ones (all for Android) and they look relatively minor. The only real wtf is [https://team-sik.org/sik-2016-022/](https://team- sik.org/sik-2016-022/) \- hardcoding keys should be a big nope. Still, it happens only if you use a PIN rather than your master password; I hope this does not happen in iOS if you use TouchID...?

<comment><USER11> I have such a strong password that typing it repeatedly on a mobile device isn't doable. And so I use PINs or fingerprints, depending on device. I find this acceptable because I worry less about physical access to my device, versus somebody gaining access to my encrypted database, which is also stored on Dropbox.

But I still expect that storing the master password locally is secure, otherwise why the fuck am I paying them for?

Speaking of LastPass, I've noticed them doing stupid things like this in the past and the problem is that I feel those bugs wouldn't have been discovered and made public if they weren't so popular. And I expect such a company to take security seriously, because _this is what they sell_. Hard-coding a symmetric encryption key isn't a minor slip up, this is the kind of mistake that I for one couldn't do, even though I'm no security expert. If they could do such an obvious mistake, then I can't trust them, regardless of their response time.

</comment></comment><comment><USER29> Looks like all of the 1Password issues were discovered and fixed last September.

</comment><comment><USER30> I just use iCloud keychain. The third party ones can never be as secure. For non-safari usage a little less convenient but worth it.

<comment><USER31> Why can they "never be as secure"? Especially compared with iCloud, which I believe has a history of being vulnerable to all sorts of attacks...

<comment><USER32> Why do you "believe" this?

Is this like a "belief" in the healing power of crystals, or of the bumps on your head being indicative of your personality, or do you have something substantial to share?

<comment><USER31> My healing crystals are mumbling something about 'social engineering' ([https://www.hackread.com/apple-users-icloud-phishing- attack/](https://www.hackread.com/apple-users-icloud-phishing-attack/)), 'poor access controls' ([http://mashable.com/2014/09/04/i-hacked-my-own-icloud- accoun...](http://mashable.com/2014/09/04/i-hacked-my-own-icloud- account/#h8v_cYPZJGq1)) and 'poor authentication controls' ([https://www.google.co.uk/amp/www.cultofmac.com/280189/icloud...](https://www.google.co.uk/amp/www.cultofmac.com/280189/icloud- hacker-calls-apples-response-little-late/amp/)).

Seriously though, I'm more interested in the assertion that any password manager can _never_ be as secure as iCloud, even ones which don't upload data to the 'cloud'.

</comment></comment></comment></comment><comment><USER33> Site's down. Text-only cached version at least lets you read some of the content: [http://webcache.googleusercontent.com/search?q=cache:kJ5Zk-7...](http://webcache.googleusercontent.com/search?q=cache:kJ5Zk-7KPswJ:https://team- sik.org/trent_portfolio/password-manager- apps/&num=1&hl=en&gl=us&prmd=ivn&strip=1&vwsrc=0)

<comment><USER34> Better archive link: [http://archive.is/mt4mq](http://archive.is/mt4mq) (the site works fine for me, though)

<comment><USER33> Seems to be good for me now too. For a while I was just getting an error page in German after a long delay :)

</comment></comment></comment><comment><USER35> We need the same kind of investigation for iOS, this kind of research was so much needed because after all this is where we store all of our entire internet identities, good job!

</comment><comment><USER36> Just my brief experience of 2-3 hours with LastPass today. Broken javascript errors when trying to import. Searched for customer support, couldn't find any! How do I file bugs? Sign up and post to their web forum?

I noticed their website is made entirely in php. Not that php is bad, but this is possibly the worst choice for a web platform that holds secrets. At only $12 a year, they probably aren't trying very hard.

<comment> nommm-nommm Ehhhh...? Took me less than 30 seconds

[https://lastpass.com/support.php/support.php?cmd=showfaq&id=...](https://lastpass.com/support.php/support.php?cmd=showfaq&id=5616)

>you can find the link to open a support ticket in the bottom right of this FAQs page under "New Ticket".

</comment></comment><comment><USER37> Anyone seen anything similar on Roboform? Been using them for years but I wonder how much vulnerability testing it has gotten.

</comment><comment><USER38> I have moved from LastPass to Dashlane and rarely have issues. Its been fairly solid for me the past year or so. Anyone had issues with Dashlane?

<comment><USER8> How do you know if it's secure? How do you know if someone is accessing your passwords?

</comment></comment><comment><USER39> Avast are still working on vulnerabilities reported in November 2016. They seem by far the least responsive of the apps mentioned.

</comment><comment><USER40> [https://ssl.masterpasswordapp.com/](https://ssl.masterpasswordapp.com/)

</comment><comment><USER41> shocked I didn't' see bitwarden in here?

I use Bitwarden for some things (lots of testing, nothing serious). Given its OSS nature, i thought it might have had more traction.

For reference: [https://github.com/bitwarden](https://github.com/bitwarden)

</comment><comment><USER42> Too bad 1Password doesn't encrypt title and URLs.

</comment><comment><USER43> Password Safe is missing …

</comment><comment><USER44> Not surprising. Password manager give you convenience at the expense of security.

<comment><USER45> Well, yes and no. If it leads to you using more secure passwords than without, then in theory you'll have higher security.</comment></comment>


Ask HN: What would you like to see in a modern GUI toolkit? - <AUTHOR> Having played with both GTK and QT I've found most desktop GUI toolkits unpleasant. I can see why a lot of devs end up using tools like electron, while the javascript stack has it's problems on the whole I'd say that it's easier to get started building a UI using that tooling then trying to build a new gnome app.<p>So if there was a new GUI toolkit, something that could compete with electron and GTK, what could it look like? <comment><AUTHOR> I think that the DoM/html style nested-tree-of-objects system actually works pretty okay, that flexbox is a pretty good way of laying objects out, and that "web components" are a pretty good idea.

I'd use capnproto to expose a simplified "DoM" set of interfaces for manipulating a scene-graph of objects. This would be vastly simplified over what the web provides, and the main way of laying objects out would be flexbox-derived.

I'd name all the colors in my theme, probably following bootstraps example of (primary secondary success danger warning info). Semantic names that tell you what the color should be used for, instead of saying (red green blue whatever).

</comment><comment><USER2> I think Xaw (the X Athena widget set) is not so bad. It supports bitmap fonts, and you can use the X resource manager file to alter the stuff.</comment>


A Rigorous Comparison Between Mathematicians and Engineers - <AUTHOR> https://people.maths.ox.ac.uk/porterm/writing/compare.txt

<comment><USER2> You seem to know nothing one could call rigorous.Engineers fall under mechanics like astronomy while analysis algebra and number theory are mathematics and there would be geometric analysis..</comment>


Algorithm/Coding Interview preparation course - <AUTHOR> https://getinterviewed.online/ <comment><USER2> I feel this is just catering to a major problem the industry has with interviews.

Interview questions are largely irrelevant to the main job. When was the last time you needed to code from scratch a mergesort in your job? A binary tree? A LinkedList?

Sure, there's _some_ value in asking those questions - can they problem solve, can they communicate their solution effectively, etc... I just think there are way better ways to find out whether a candidate is suitable for a job than to ask them to code up an algorithm they haven't had to do since CS 101.

The kinds of technical questions I find more effective are:

* How does a cache work?

* When would you use a HashMap/Dictionary/Hash/Object over an array/slice/collection?

* How would design an HTTP API to do X

* How would you design a database table to do Y

<comment><USER3> Those are good for design questions for somewhat experienced candidates..but I guess you still gotta test the problem solving or algorithmic approach of the candidates.</comment></comment>


Websites 'keeping deleted photos' - <AUTHOR> http://news.bbc.co.uk/2/hi/uk_news/8060407.stm <comment><USER2> Here are the results for different sites:

[http://www.lightbluetouchpaper.org/2009/05/20/attack-of- the-...](http://www.lightbluetouchpaper.org/2009/05/20/attack-of-the-zombie- photos/)

</comment><comment><USER3> Facebook just switched their photo storage system to rely less on CDNs. This may or may not change their cache revocation policies, but that should be considered in the study. I suppose they should be retested in a few months or a year, just to be sure.</comment>


Ask HN: Landing page that made you desperately want to buy a product? - <AUTHOR> Mine was Landen.co (I HAVE NOTHING TO DO WITH THISE GUYS)
I've been searching for a landing page builder for my SaaS for 2 days. Scrolling through so many google pages.
All I saw was either not for SaaS, or our is my budget.
I bought a one year subscription, and did not regret a second.
Btw, after this landing page, I had the best onboarding ever. <comment><USER2> [https://pitch.com](https://pitch.com) for me. The typography, illustrations, and the motion are so great!

<comment><USER3> The design is indeed really nice, but copy could be greatly improved. It took me a really long time to understand what their product is. Their hero text tells me nothing: "All hands on deck.". Their description doesn't help a lot either "Pitch helps teams build better presentations: collaboratively, effectively, and beautifully.". The only useful words are "teams, presentations, collaboratively". The others are just fluff as I assume no such tool has the goal of ineffectively creating ugly presentations.

From what I understood, it is like Google Slides? I expect to see some UI/demo, but it is a pre-launch page I guess.

</comment></comment><comment><USER3> I have no idea what this is, but it's really cool: [https://makespace.fun/](https://makespace.fun/)</comment>


Scale your web app with Chef   - <AUTHOR> http://blog.superfeedr.com/chef/configuration/deployment/infrastructure/scale-with-chef/

<comment><USER2> Interesting. What about Puppet? Also, this really seems like a hammer for small architectures. What is the "critical-mass" where it starts to make sense?

<comment><AUTHOR> Haven't really tried puppet. We're a ruby shop, which helped the choice ;)

For the critical size in terms of servers, I'd say 1 is enough if you need to start/stop it often. But yeah, the benefits only show up after at least 3 of them I'd say.

<comment><USER3> Puppet is written in Ruby too.

I've yet to see a compelling reason to use Chef rather than Puppet, but maybe I've just not been looking hard enough. Puppet is great, and we're a Python shop..

<comment><AUTHOR> Ha? we missed that Puppet was Ruby as well. I will check it out also when I have some time.</comment></comment></comment></comment>


Amazon out of powdered milk in the US - <AUTHOR> I tried buying the last one at a reasonable price and it was gone before I could choose shipping (a transaction isn't finalized until the shipping is chosen). There won't be any more that will ship before 1-2 weeks, depending on the item. <comment><USER2> Their Prime Pantry service is grouping shipments together regardless of the guaranteed delivery date, which means that your order arrives on the latest date among the advertised delivery dates for items in your cart.

This is recent behavior and not a function of order preferences. I have placed three orders that were grouped together (send order as one shipment) despite having selected the earlier Prime delivery option. This started on the same day that I received an order that was broken up (ship as available), which is what usually happens with Prime Pantry orders to my address.

In other words, my Prime orders make me think that Amazon is experiencing a massive ordering surge, and is grouping items together in an atypical way because they want to reduce the shipping strain.

<comment><USER3> Possible... Amazon is probably seeing higher than typical sales of items they probably don't do high volumes of and are trying to manage that logistical issue as best as possible.

People are starting to get just a little nuts on these things... Shouldn't need to stock up months of stuff... a few weeks of food and water with some rice and beans and/or lentils and lard as backup staple items for core items with other canned goods.

I, personally, cannot handle legumes and not really a fan of grains... that said, having enough hand sanitizer for a year is a bit nuts. Having more food than you will cycle through in a regular time-frame will only serve to add undue pressure to short term supplies because of over-stocking up... then the relief may not come, or can kill the other end of the line, or increase tainted supply.

Panic just isn't a good idea.

<comment><USER4> It's a tragedy-of-the-commons thing? You don't get any, there won't be any to have in a little while.

<comment><AUTHOR> Hand sanitizer going for $50, $100, $200 is what hoarding hath wrought. Luckily, I found a mom-and-pop etailer in CT that sold me 8x 32 oz 70% for $5 each with free shipping. (My mom, I, her neighbors and her church needed some.)

</comment></comment></comment></comment><comment><USER5> I'm assuming this is a typo for powdered milk, given that cows aren't usually plugged into mains voltage.

<comment><AUTHOR> ?

<comment><USER6> "powered" vs. "powdered"

"Powered milk" sounds like some kind of bodybuilder beverage that contains no actual milk.

<comment><AUTHOR> Thanks. Autocomplete changed it silently. Cheers.

PS: It's either "Beefcake. Beefcake! Weight Gain 4000!" or Impossible Milk.

</comment></comment></comment></comment><comment><USER7> This is an item that's usually not much in demand, so while it being sold out may be a canary in the coal mine to indicate that many people are prepping, I wouldn't start to worry about shortages until they start to run out of beans and rice.

Even then, the shortage will likely be short-lived as preppers stock up and stop buying more.

</comment><comment><USER8> I flagged this because this because the title sounds much scarier than the actual content; "I couldn't buy this thing on amazon"

So...?

<comment><AUTHOR> That's your inference. It's a sign of panic buying and the inability of the supply chain to handle it. Regular buyers cannot buy things they normally buy because quantities aren't being limited and more people than usual are rushing around purchasing items they may not need. It shows the fragility of the total retail supply chain ecosystem.

</comment></comment><comment><USER9> The title in my RSS reader says "powered milk". I guess the title was fixed later.</comment>


Firefox 4's JägerMonkey JIT status - <AUTHOR> http://www.bailopan.net/blog/?p=735

<comment><USER2> Grrr. Graphs without labeled and meaningful axes and graphs without legends bother me a little too much I think :(

Anyone know what the other lines are?

<comment><USER3> They're given better context here: <http://www.arewefastyet.com/>

<comment><USER2> Thanks!

</comment></comment></comment><comment><USER4> Once this is merged into the main dev branch of Firefox, I'll build that and switch off of Chrome. The main advantage of WebKit at this point is that their JavaScript implementation is an order of magnitude faster.

Considering Chrome's GTK integration is god awful (on my box anyways), I can't wait.

<comment><USER5> Wow, what do you do with your browser that you absolutely need to have a JS performance which is an order of magnitude better than FF 3.6? Just curious...

<comment><USER6> High performance isn't just about getting stuff done faster, it can also be thought of as getting the same amount done in less CPU time. When I'm running on batteries, my laptop's CPUs are running at 800MHz, and I get about 8-10 hours of battery life. If something's making my computer work, my CPUs go up to 2.4GHz, and my battery life plummets. More efficient javascript engines should be able to do the same work with less battery use, which makes me happy.

</comment></comment></comment><comment><USER7> I like the metal umlaut. <http://en.wikipedia.org/wiki/Metal_umlaut>

<comment><USER8> Actually "Jäger" is the german word for "hunter" and it's always written with umlaut. No metal umlaut for you. ;-)

</comment></comment><comment><USER9> Looks promising. Has anyone done benchmarks on Canvas performance in Firefox 4?

<comment><AUTHOR> Not sure if there's any graphs on the web, but my own benchmarks have shown it (with hardware acceleration enabled) slightly better than ie9 preview 3, which is many orders of magnitude ahead of everything else (opera's actually not bad though). Keep in mind I have a pretty good graphics card, so that helps with the acceleration.

</comment></comment><comment><USER10> Now they need to address the rendering performance.

<comment><USER11> They've landed "lazy frame construction" which improves rendering performance by an order of magnitude in some cases: [http://tinikkel.wordpress.com/2010/05/24/lazy-frame- construc...](http://tinikkel.wordpress.com/2010/05/24/lazy-frame- construction/)</comment></comment>


Show HN: CrowdSync – Automate Repetitive Processes with People - <AUTHOR> https://www.crowdsync.io <comment><AUTHOR> We created CrowdSync to help automate tedious, repetitive process with people, things like sending emails, requesting documents, scheduling time, requesting payments, and more!

This came out of my experience as a user researcher, where we'd spend hours onboarding people into studies - having them sign consent forms, be sent study information, scheduling time, sending reminders and payments.

As it turns out, this problem exists in a number of domains, especially any kind of onboarding of employees.

One question we get often is "Can't people just do this with Zapier?"

The answer to that is, not really, for a couple primary reasons:

\- Zapier is fantastic for people who are somewhat technically minded, however, falls quite short with lay audiences (think about a membership coordinator working at a non-profit, or an HR assistant). While some of these audiences are adept at using tools like Zapier, a huge portion aren't. They need a single, centralized place.

\- Zapier (and related) aren't particularly good at handling _people_ through a process. They're great for shuffling data around, but not great at both showing where people are, as well as providing people-oriented interactions (automated reminders, etc).

In short, CrowdSync is for helping to put a number of people through the same process, where repetitive work can easily be systemized and tracked.

Would love any feedback, thoughts and questions!</comment>


TripleSec – Symmetric Encryption in the Browser Combining AES, Salsa20, Twofish - <AUTHOR> https://keybase.io/triplesec/ <comment><USER2> I wouldn't say this is bad or anything, but it is focusing on the wrong problem. Block ciphers like AES are the very strongest piece of the puzzle. This is kind of like putting three huge locks on your front door. It doesn't hurt, but the second and third locks have limited utility.

The best attack on this scheme (in a purely offline scenario) is probably just cracking weak passwords, just like it would have been with only one encryption pass.

EDIT: One more point. The FAQ says something about plans for a future streaming API. Please do not do this, at least for the decrypt operation. Streaming decryption APIs expose application developers to not-yet- authenticated plaintext.

EDIT EDIT: I think it's an API mistake to leave key generation in the hands of the user, especially by using a PBKDF. PBKDFs are a measure of last resort. If you can just generate key material randomly, you should do so.

<comment><USER3> > I wouldn't say this is bad or anything

I would.

The idea might not be bad, but the implementation is.

They use a pure software AES implementation that, due to its reliance on S-boxes, opens the door for cache-timing attacks.

Offending file: [https://github.com/keybase/triplesec/blob/master/src/aes.ice...](https://github.com/keybase/triplesec/blob/master/src/aes.iced)

Permalink: [https://github.com/keybase/triplesec/blob/bb0b2f449cc28ca402...](https://github.com/keybase/triplesec/blob/bb0b2f449cc28ca402f031486ae3671669daa05c/src/aes.iced)

Issue: [https://github.com/keybase/triplesec/issues/47](https://github.com/keybase/triplesec/issues/47) (opened March 17, still collecting dust)

Reference: [http://cr.yp.to/antiforgery/cachetiming-20050414.pdf](http://cr.yp.to/antiforgery/cachetiming-20050414.pdf)

AES-NI or bust.

> The FAQ says something about plans for a future streaming API. Please do not > do this, at least for the decrypt operation. Streaming decryption APIs > expose application developers to not-yet-authenticated plaintext.

I've written a streaming PoC to encrypt/decrypt file handles in PHP. During the decryption process, it first recalculates the HMAC over the entire file then verifies it with the one stored before decrypting. (Yes, in constant time too.) It's slower than just blindly decrypting, but more trustworthy.

Not quite the same as streaming network resources, but I figured that bit of nuance is worth mentioning.

The experiment lives here if you're interested in schooling me on some matter I overlooked, though I'm going to significantly rewrite it before I propose it to the project I was PoCing it for:

[https://github.com/paragonie-scott/php-crypto- stream](https://github.com/paragonie-scott/php-crypto-stream)

(For starters, the actual pull request won't be using CBC.)

<comment><USER2> I was mainly commenting on the design. I actually haven't looked at the implementation.

Also, I would put AES side channels somewhat low on the list of practical vulnerabilities.

<comment><USER3> > Also, I would put AES side channels somewhat low on the list of practical > vulnerabilities.

Sure, but if they're concerned about weaknesses in AES enough to cascade it with other ciphers, ignoring the side-channel inherent to the AES design is pretty silly and indicates a lack of research or foresight.

Combine that with no response from their team for threee months after I opened the issue, and I think we can safely conclude that this library is not currently trustworthy.

(in b4 "TripleSec Considered Harmful")

</comment></comment></comment></comment><comment><USER4> The construction of the cipher doesn't solve the biggest problem with using these stream ciphers, re-use of the IV. Depending on your architecture it is very hard to guarantee that you'll never re-use an {IV, Key} pair.

Encrypting results in P xor S xor T xor A (where P is plaintext, S is Salsa, T is Twofish, A is AES (or rather, the key streams produced by each cipher)). If two different plaintexts were encrypted with the same IV and key pair then I can xor these two cipher texts together:

(P1 xor S xor T xor A) xor (P2 xor S xor T xor A) -> P1 xor P2

And I've now removed all of the crypto. AES-SIV aims to solve this problem, but is slower than something like AES-GCM because it needs to process the plaintext twice. Obviously, it is much faster than the scheme proposed here and removes the biggest implementation flaw in nonce-based stream ciphers.

Another pitfall here is that encryption == decryption (modulo the HMAC step) which means that if I have an encryption oracle that I can feed {IV, Key} that automatically becomes a decryption oracle. (The YubiHSM I believe was vulnerable to an attack like this, so they do happen in the real world)

</comment><comment><USER5> Somebody from the security community could shed some light on why this is a good/bad idea.

<comment><USER6> With respect to the browser, _What's wrong with in-browser cryptography?_ [1] and _Javascript Cryptography Considered Harmful_ [2] may still be relevant.

[1] [http://tonyarcieri.com/whats-wrong-with- webcrypto](http://tonyarcieri.com/whats-wrong-with-webcrypto)

[2] [https://www.nccgroup.trust/us/about-us/newsroom-and- events/b...](https://www.nccgroup.trust/us/about-us/newsroom-and- events/blog/2011/august/javascript-cryptography-considered-harmful/)

<comment><USER7> Both of the articles have some flaws (that Matasano one is really bad/dated actually).

Here's a good one about the problems with JS Crypto: [http://rdist.root.org/2010/11/29/final-post-on-javascript- cr...](http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/)

<comment><USER8> It's curious that you follow up a "really dated" article from 2011 with an article from... 2010.

<comment><USER7> The article that I posted, while older, presents a more realistic and objective look at the JS crypto problem. I chose to criticize the matasano article as "dated" because some of the positions it takes are no longer accurate. The older article does not depend on dated information to make its points.

</comment></comment></comment></comment></comment><comment><USER9> In my opinion, Keybase needs a Warrant Canary on their website.

See [https://canarywatch.org/faq.html](https://canarywatch.org/faq.html) for more information.

<comment><USER10> I'm waiting for the first publicly released case against warrant canaries. From everything I've seen, and based on the site you linked as well, they're essentially untested. Other cases involved compelled falsehoods or compelled speech exist, but not in the same or even relatable context: in this case, it's clear that the recipient of the gag order made premeditated statements designed to allow them to make a compelled speech claim that sidesteps a gag order.

I suspect that the judicial system will not rule favorably on such a clear attempt to get around the gag order, and the end result may very well be a limitation on warrant "canaries" being published in the first place.

And, given that it's likely a case involving warrant canaries would be handled with the same level of secrecy as the actual proceedings leading up to it, this could have already happened without us even being aware.

<comment><USER9> What if there was a warrant canary service that killed the canary for you, unless you kept it alive on a regular basis (e.g., weekly, monthly) by providing a secret key and a message. The feds might be able to order you not to take the canary down, but they can't force you to post _another_ update to a third-party canary to keep it alive. And, if they can, it might be time to revisit the role of our government.

<comment><USER10> My point is that given the clear connection the prosecution can make "they set up this system specifically so that if we served them an NSL with a gag order then they could circumvent the gag order", the odds of the judge saying "nah, they got you" is low.

I expect either they receipient would be compelled to post updates, under the grounds that by not posting updates they are speaking (the case would be that the 3rd party system does not count as speech, and in fact not posting an update would be speaking, because not updating is what conveys meaning to the audience) or they'd find that speech can't be compelled _and_ you can't try to end-run gag orders by using a "canary", so all the warrant canaries would vanish more or less at once

<comment><USER9> I'm pretty sure [https://www.law.cornell.edu/supremecourt/text/430/705](https://www.law.cornell.edu/supremecourt/text/430/705) covers your first case, and [https://www.law.cornell.edu/constitution/first_amendment](https://www.law.cornell.edu/constitution/first_amendment) covers your second.

<comment><USER8> Let me guess. Only a 2L? Gonna cover constitutional law in your third year? You may wish to read a bit more about the first amendment and its exceptions.

<comment><USER9> It's actually pretty simple and the text is pretty short. You should have a read sometime. There are no exceptions, and it's pretty clear about that.

Now, that isn't to say that our judicial and executive branches of government haven't ruined its enforceability, but that's a story about the resolve of our citizens, not about the first amendment.

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances."

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I've always assumed that a browser plugin would be the only way to establish even a semblance of integrity with regards to any security model attempting to encrypt/decrypt in a browser.

Is that not true?

<comment><USER12> It is – any claims made about security are extremely hard to verify and even if you were to do so the code could change without notice, particularly if you're targeted Bryan advanced attacker.

Trust would require a managed crypto module which can provide strong assurances with a UI outside of the page's control.

</comment></comment><comment><USER13> Does it increase the cost of the proverbial wrench?

</comment><comment><USER14> >authenticates with HMAC to protect against adaptive chosen-ciphertext attacks

Okay...

>TripleSec "macs" with a concatenation of two HMACs: HMAC-SHA-512, and HMAC- SHA3

Why?</comment>


Tesla electric car catches fire in Toronto; company has not yet explained - <AUTHOR> http://www.theglobeandmail.com/report-on-business/tesla-says-cause-of-toronto-garage-fire-not-yet-determined/article16898563/ <comment><USER2> I understand that this is new and scary technology and that gives Tesla some more scrutiny than others, but come on, how many cars caught fire that day in Toronto alone, and where are the comments from those manufacturers?

<comment><USER3> I noticed that USA media is mostly trying to undermine Tesla for some reason. Almost every article only mentions the fires and distorts the circumstances they were in.

<comment><USER4> It can be easily explained by how ravenously hungry they are for controversy and fear-generating topics. US news media unfortunately has a lot in common with reality TV.

</comment></comment></comment><comment><USER5> Seems like they're taking the right approach: offer compensation, figure out what went wrong, then fix it.

New technology will always have problems; how you approach those problems will determine how successful you ultimately are.

<comment><USER6> Which is funny because (according to random citation needed sources), gas- powered cars have electrical failures and resulting fires quite a lot compared to Teslas.

<comment><USER7> This is the part that gets me. In my life I can think of 3 instances of cars catching on fire that I witnessed personally. One was a neighbor who's suv caught on fire in their garage and burned their house down. I dont even remember what brand the car was but with Tesla it's headline news worthy.

</comment></comment></comment><comment><USER8> "Tesla said it has "definitively determined" that the Toronto fire did not originate in the battery, the charging system, the adapter or the electrical receptacle, noting that these components were untouched by the fire."

So... what exactly did catch fire?

<comment><USER9> There is info on /r/TeslaMotors [1] indicating it started near the front of the vehicle. Either an electrical component forward of the passenger compartment, or something in the front luggage compartment (where the motor typically would be in an ICE vehicle).

[1] [http://www.reddit.com/r/teslamotors/comments/1xuwx7/tesla_fi...](http://www.reddit.com/r/teslamotors/comments/1xuwx7/tesla_fire_in_toronto_garage/cfev2h0)

<comment><USER10> I forget exactly what it is but there is an important component of the charging system in the front right wheel well that you are not supposed to cut through if you are attempting a rescue of the passenger in a Tesla. They demonstrated that in their emergency responder training videos, saying that it's different from normal cars where you can cut right through the wheel well and here you should not since there are high voltage wires there.

<comment><USER9> [http://www.teslamotors.com/firstresponders](http://www.teslamotors.com/firstresponders)

[http://www.teslamotors.com/sites/default/files/downloads/201...](http://www.teslamotors.com/sites/default/files/downloads/20130214_ModelS_Emergency_Response_Guide.pdf)

<comment><USER10> Yup. Check out pages 9 and 10. Looks like it is the 12 volt battery.

</comment></comment></comment></comment></comment><comment><USER11> This reminds me of what Elon Musk stated in an interview (paraphrased): It's not enough for new technology to simply be as good or 2x better than incumbent technology; it needs to be 10x better to overcome industry standard inertia.

</comment><comment><USER12> With 17 car fires per _hour_ in the USA, it seems quite obvious that some of those would be from a Tesla. It's unfortunate that these are the only ones that make the news though.

Relative to other cars, Tesla car fires are quite rare.

<comment><USER13> How many of those are spontaneous? The concern over Tesla is understandable if you consider the voltage and currents associated with running the motor.

<comment><USER14> Anecdote alert! A friend of mine told me a story about how his car spontaneously caught on fire sitting in his driveway while he was sleeping. The fire department had to investigate. I don't recall the cause though. Wasn't anything too crazy.

</comment></comment></comment><comment><USER15> Why is Tesla, when it catches fire, the only car to make it on hackernews?

<comment><USER16> Because it's a new technology and of interest to Hacker News, and because other cars don't generally spontaneously combust.

<comment><USER17> > other cars don't generally spontaneously combust

They do. Check out YouTube, or the anecdotes in the other comments here. I'll throw in another -- one of my neighbors' cars spontaneously caught fire sitting in his driveway after midnight. The fire department had to come put it out, along with the front of his house it started to set fire to.

<comment><USER6> Car drove by my house way back when, smoking rather alarmingly. Stopped a few dozen meters further on, fire from under the hood, firefighters dropping by to extinguish it. Adventures in one's youth. No clue what caused it; probably a short circuit, and given how there's oil and gasoline everywhere, it kinda keeps going.

</comment></comment></comment></comment><comment><USER18> Funny how a Tesla catching fire always makes the news. Were I a conspiracy loon, I'd swear there is a disproportionately thorough coverage of those events by the media.

</comment><comment><USER19> It's weird but I've seen a number of Tesla's on the streets of Toronto. A close neighbor of mine has one too as I see him pulling out of the street parallel to mine on most mornings. Is there a dealership in Toronto or something?

<comment><USER20> There's one at Yorkdale.

<comment><USER21> They're also building one in Scarborough.

</comment></comment></comment><comment><USER22> People drive electric cars in Toronto? I can't imagine they get much range in the winter...

<comment><USER17> Model S is the best-selling car in Norway, which is further north than Toronto. Very low temperatures means it runs a battery heater; it still gets 175-250 miles range in well-below-zero winter days with the cabin heater blasting. There are tons of great Model S winter performance videos on YouTube, as well as independent reviews. Consumer Reports did a Model S winter range test you can read about IIRC.

<comment><USER23> Note, however, that further north doesn't necessarily mean colder. For instance, looking at the climate data on Wikipedia indicates that Oslo and Toronto have about the same average highs/lows in the winter months.

Meanwhile, Winnipeg (Winterpeg) is a full 10 degrees latitude south of Oslo, but is much, much, colder.

As as aside, though Europe's warmer climate is often attributed to the Gulf Stream, evidence suggests it's actually a consequence of angular momentum. See, for instance,

[https://www.americanscientist.org/issues/issue.aspx?id=999&y...](https://www.americanscientist.org/issues/issue.aspx?id=999&y=0&no=&content=true&page=5&css=print)

and the paper in PDF form here:

[http://www.ldeo.columbia.edu/res/div/ocp/gs/pubs/Seager_etal...](http://www.ldeo.columbia.edu/res/div/ocp/gs/pubs/Seager_etal_QJ_2002.pdf)

</comment></comment></comment><comment><USER24> Not much to say until we have more info. With all the amazing advancements that Tesla has made, I can't help but be reminded of Apollo 1's fire. And I have no doubts that they will recover as swiftly as NASA did.

<comment><USER25> > With all the amazing advancements that Tesla has made, I can't help but be > reminded of Apollo 1's fire.

What the hell?</comment></comment>


Is It Crazy to Think We Can Eradicate Poverty? - <AUTHOR> http://www.nytimes.com/2013/05/05/magazine/is-it-crazy-to-think-we-can-eradicate-poverty.html?_r=0 <comment><USER2> The goal is not crazy, as long as you use definitions that would stun most Americans. Most of what is called "poverty" in the United States is called "wealth" in much of the rest of the world. The article explains the definition of "eradicate poverty" being used as a worldwide development goal: "The World Bank aims to raise just about everyone on Earth above the $1.25-a-day income threshold. In Zambia, an average person living in such dire poverty might be able to afford, on a given day, two or three plates of cornmeal porridge, a tomato, a mango, a spoonful each of oil and sugar, a bit of chicken or fish, maybe a handful of nuts. But he would have just pocket change to spend on transportation, housing, education and everything else." As it happens, Zambia is an apt example country to consider. The year my wife was born, her birthplace (Taiwan) was poorer than Zambia in that same year. Taiwan has made more progress year-on-year, more steadily, than Zambia in the decades since then, and Taiwan is now a wealthy country. So a country doesn't have to start with a lot to gain a great deal of wealth in less than one human lifetime. Encouraging diffusion of knowledge and technology and especially encouraging civil liberties and better governance all around the world could do much to raise the living standards of people everywhere.

That said, if "poverty" is defined as having less than what "average" people have in a particular country, it will be difficult indeed to eradicate poverty anywhere. As Thomas Sowell has written, "The first lesson of economics is scarcity: There is never enough of anything to fully satisfy all those who want it. The first lesson of politics is to disregard the first lesson of economics."</comment>


With "Project Nutshot," Zenefits Plans a Move into Payroll Processing - <AUTHOR> http://www.buzzfeed.com/williamalden/project-nutshot-zenefits-move-against-ad#.ukOmnvAzgl <comment><USER2> Having been deeply disappointed with Zenefits for employee health care setup, I think I'll stick with Zenpayroll (which is absolutely outstanding!).

:unicorn: :poop:</comment>


Laptops and Other Electronics May Be Seized on Entry to US - <AUTHOR> http://news.yahoo.com/s/livescience/20110407/sc_livescience/laptopsandotherelectronicsmaybeseizedonentrytous

<comment><AUTHOR> For the record, I didn't submit this to start a flame war. I get the whole concept of "if you cross the border, you're subject to a full search" -- after all, that's the entire purpose of customs: to control stuff moving across the border.

The thing here is that government took the guy's computer, _then sent it off to some lab 150 miles away for analysis_. If I understood the article correctly, the judges said that was fine to do, even without probable cause.

Since a notebook computer is a tool for my trade, I'm left with the conclusion that not only can I be fully searched, but the government can also take my tools away from me for a long period of time while they examine them. There's no guarantee that the tools I left with will be allowed to re-enter.

Lesson? The U.S. government is effectively killing the personal PC, at least as a centralized place to keep my stuff. Move everything to the cloud, and make the notebook, phone, tablet, etc disposable.

Amazing. I must be missing something somewhere.

<comment><USER2> Here's an idea:

Take your primary hard drive out of your machine when crossing borders and put some vanilla install of whateveer on the machine. Fedex the primary drive to your destination or keep all your shit in the cloud.

Some years ago I did a design spec for what is now the atrix -- I wrote a paper and tried to get some google eng contacts to work with me on the idea that all machiens are jsut a KVM for your data - and that our primary data device would be both our phones and datasets in the cloud...

Sadly, I couldnt convince them this was true then - but i is clear now.

So it would be great to have a /home/ on your mobile that you can sync to your machine when they are close. If the machine dissapears, no big deal.

Here is how I would model that today:

You carry three devices - laptop, mobile and a USB stick and cloud storage.

Under normal operating circumstance, you work on your laptop as you would any other time.

The mobile has some 32GB of storage -- this is a clean install backup of all your installed apps.

The USB has a BASE install of your OS and whatever apps you can fit -- in a live USB install.

All your personal data is in the cloud, such that if you lose any of the three devices - none of your data goes with it.

Swap the HDD of the laptop when travelling to a clean install drive with no data - do not sync till you get to the destination.

Should you lose your laptop, you can use the USB to run a live session on any machine you can boot to it from.</comment></comment>