CrypTweet: Strong Encryption for Twitter DMs - <AUTHOR>

It's been a while in the making, but this is well worth some attention.
I've been lucky enough to be an early tester on CrypTweet - http://plexusproject.org/ - a public-key based method for encryption of Twitter DMs.
A base version is now available on the site linked above. It works nicely out of the box, but is kind of raw - minimal functional set, and all that.
For anyone interested in this kind of thing, for any number of reasons, may I (mis)quote that great Australian music commentator, Ian "Molly" Meldrum, and suggest you do yourself a favor by checking CrypTweet out.
trib --
@trib about.me/trib <comment><USER2> \- Website contains no details of the cryptography.

\- Stores private key by: a) SHA384-ing your passphrase, and choosing a sub- sequence of the output depending on one bit of the output (this is poor for brute-force resistance compared to PB-KDF2), b) DES3 in CBC mode with a fixed IV and PKCS5 padding (insecure for CCA2 and providing no authenticity. This is vulnerable to recovery using the padding oracle attack).

\- Messages are encrypted with RSA-PKCS1.5 in signing mode (in other words, RSASSA-PKCS1-v1_5, not RSAES-PKCS1-v1_5). That means messages are trivially recoverable through KPA.

So: don't use this for anything other than a toy. The crypto is misdesigned.

<comment><USER3> This is awesome feedback. Thank you very much. Your comments are noted and will be reflected in the next revision.

</comment></comment><comment><USER4> Are you serious? If you need secure messaging, surely you have other options than twitter?

Just copy and paste a PGP encrypted message to pastebin.ca and and tweet the link, if you must.

<comment><USER5> sure good idea. Oh wait I was just shot in the face while I was distracted staring at my phone for 20 minutes figuring out how to do that.

<comment><USER6> Please describe a realistic scenario in which all of the following are true:

1) You are in imminent danger of being "shot in the face" or similarly harmed;

2) Your best means of salvation from (1) is communication via Twitter DM;

3) The absence of a means in which your message could be encrypted on the client side beyond the HTTPS connection to Twitter's servers would significantly increase the chance of (1).

This is a serious question.

<comment><USER5> Protests in which you are faced with policemen who have guns, and your survival depends on efficiently communicating and organising 1) without police intercepting your messages 2) without your communications being held as evidence against you in prosecution

<comment><USER7> You probably should have sat down and figured out how to encrypt your communications beforehand.

Ofcourse it'd be great if twitter did the job for you, but I don't necessarily see why it ought to be Twitters position to fulfill this edge case rather than say a protester who knows they are about to go into a life threatening scenario and need to organize--both beforehand and during the escapade.

<comment><USER5> I don't see how anyone has implied that twitter is responsible for anything.

</comment></comment></comment></comment></comment></comment><comment><USER8> I just gave it a quick scan and found some issues: 1\. PKCS1 verification looks vulnerable to a timing attack. 2\. They're using plain RSA to encrypt message data without any padding like OAEP. This is not semantically secure. 3\. They are not generating strong primes for RSA keys.

</comment><comment><USER9> sweet jeebus. If you really need strong crypto for Twitter DM's, for god's sake just use PGP or GPG.

For the children.

<comment><USER5> I think you are discounting the level of thought and care that went into this. Meh, fail.

<comment><USER10> The level of care and thought put into creating a secure encryption scheme doesn't matter if the cryptography is broken. There's a reason you constantly hear cryptographers telling everyone to never invent their own crypto-systems; it's extremely difficult to do right.

<comment><USER5> so copy pasting PGP is somehow getting it right?

<comment><USER11> Parent made no mention of PGP, only that care and thought are meaningless if the crypto is flawed, which from the looks of some of the more knowledgable commenters, is the case.

It's understandable that you have a personal obligation to defend your friend, but it really isn't necessary. Sit back, relax, and allow the author to reflect on the constructive feedback here.

</comment></comment></comment></comment></comment><comment><USER12> Assume for a moment that the implementation of the encryption and decryption processes are perfect. You've now completed the easiest part of the problem (to be very generous, let's call this 10% progress).

You still need to solve the problem of distributing public keys in a way that both parties can be sure they're receiving and sending messages from the correct entity. Do you trust all of the certification authorities that are automatically trusted in standard browser or operating system distributions? If not, how do you communicate public keys securely between two or more parties?

And how do you distribute the application and ensure that users aren't tricked into using a modified/backdoored version?

How do you ensure that users aren't tricked via a phishing attack into inadvertently handing over keys, downloading software from the attacker or otherwise compromising their own security?

If one party to a conversation is compromised, do you care if the identities and messages from other parties to the conversation become compromised as a flow-on effect?

How do you ensure that parties to a conversation are receiving all the messages sent -- is an adversary blocking random messages? Is an adversary reordering the delivery of messages to change the overall meaning of the conversation?

Have you carefully considered the implications of replay attacks?

Do you care if the system is leaking important side channel information such as the frequency of communication and time between responses?

Have you considered what users will resort to in the event that their communication method is deliberately denied? Will users fall back to a weaker method of communication? Will users tend to perform a Google search that returns a maliciously placed help/reference page that executes malware on their system?

Does the system have a means for users to expose the presence of an adversary that has compromised the system?

Algorithm implementations are just a minor (but still highly important) aspect of a full crypto system implementation.

</comment><comment><USER13> Why even bother breaking the crypto? They say right on the site that they use HTTP for public key retrieval so a MITM would simply serve up bogus public keys to the clients.

</comment><comment><USER14> We built something very similar a couple years ago except all encryption/decryption is done broswer side, so no keys are ever sent through our server. Also, it uses actual tweets as opposed to DM's.

<http://cryptwit.com>

You can see an example here:

<http://cryptwit.com/decrypt>

Enter "yickster", then passphrase "hackernews"

<comment><USER12> Users need to verify the source code to cryptwit.com on every single page load to ensure that the "client side" code is not leaking the key/plaintext. There are many highly creative methods for leaking this information that would pass unnoticed through a quick code review. For this reason (amongst numerous others) the site is useless at best and harmful at worst (false sense of security for unsuspecting users).

</comment></comment><comment><USER15> Nice initial attempt. Besides the encryption issues mentioned here, here's my suggestion. This needs to be built into a mobile twitter application (non- jailbreak), I use pgp encryption/decryption programs on my iPhone and they are fast. Also, you should allow the use of any key server that the user wants, as known public key server access can be blocked by a country.</comment>


Feds give Google OK to test Project Wing drone deliveries - <AUTHOR> https://www.engadget.com/2016/08/02/feds-give-google-ok-to-test-project-wing-drone-deliveries/ <comment><USER2> > Though the FAA released its final rules for drone operations in June, > deliveries still aren't allowed. However, Alphabet has reportedly been > testing them in the US anyway, skirting the regulations via a NASA waiver

You see, all American's are allowed to be innovative. Some are just more allowed than others.

<comment><USER3> That's always been true. Figuring out where the rules are flexible and bending them is part of the game (in almost all games, really).

<comment><USER4> Something of a difference between finding the flexible nasa waiver rule and actually obtaining a nasa waiver.

</comment></comment></comment><comment><USER5> From my perspective, it's pretty clear that "Delivery by drone" is going to happen. It might not be this year, or next year, or even in the next 5-10 years, but eventually it's going to happen.

I think that if the FAA doesn't keep up with the pace that other countries are setting (in terms of regulation, laws, and rules surrounding out-of-sight drone usage), then eventually they will be pressured to rush some solutions which will probably have some bad consequences.

<comment><USER6> From my perspective I think it is pretty clear that drone delivery is never going to happen and is just a fad.

Firstly, let me just say, technologically drone delivery could definitely happen. There's no technical reason why not.

But if we look at the history of freight it has always been about efficiency, and new competitors have always competed by finding ways of being cheaper.

We already have less technical "drone delivery," it is called a courier, but outside of New York and a handful of other places they're niche. Nobody wants to pay to deliver just a single package, it is too expensive.

Even services like "next day delivery" work on the principle of economy. You have trucks which are on other deliveries (economical ones) just drop off the "next day" packages between them. That makes these "unnaturally cheap."

What do drones offer that a human courier doesn't? It cannot deliver inside most office buildings, you're still paying for fuel/maintenance/development/lost drones/etc. It likely has limited capacity.

Plus let's look at competing technology coming up: Automated vehicles. How long until a delivery van can drive itself to your home, and then send you a text to meet it outside? That technology is coming with or without drone development, and solves some of a drone's inherent issues (poor capacity, lower maintenance, better economy, etc).

I really think drones for deliveries won't go anywhere. It is just a fad thing because companies want to be cool. Too many problems/limitations/high costs, and few benefits. And as I said automated vehicles will kill any remaining shot drones may have had.

<comment><USER7> Except a lot of deliveries to residential areas happen when nobody is home. So getting a text to go outside and get my package from an automated vehicle won't help me at all. And this is where drones can come in handy. The drone could deliver the package from the truck to my doorstep. Sure, it may not work in urban areas with high rises but it will work just fine in single family house neighborhoods and that's a huge part of the country.

<comment><USER8> I think this highlights an important idea. The driverless vehicle and drone tech aren't mutually exclusive. You could potentially have a driverless box van that parks on a street corner and has drones pick packages off it and take them to your door.

<comment><USER9> Without doing any of the math, this actually seems like the right solution. An automated truck that can drive around while a swarm of drones are continuously dropping off packages - basically an aircraft carrier.

<comment><USER5> I deal with writing software for some shipping and logistics as part of my job.

This is already how a lot of this stuff works.

A manufacturer ships stuff to a DC, which ships stuff to a 3rd party pool provider, which ships stuff to a store, which then ships stuff to the customer (via "regular" mail).

Each step can be thought of as trading throughput for latency. Some manufacturers only ship things to the DC like once every few months (sometimes thousands of containers at a time), the DC to pools once a week (generally in tractor trailers), the pools to stores once a day (in either trailers, or delivery trucks), and the stores to customers multiple times a day (regular mail)

Adding another step on the end of that seems like the most likely "end goal" to me.

Get around the problem of the inefficient "last mile" of delivery by making the delivery truck a drone platform.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is pretty sloppy reporting. The single-wing tail-sitter drone design depicted in both the picture and video accompanying this article and discussed in the text had been abandoned as of last year: [http://blogs.wsj.com/digits/2015/03/17/google-working-on- new...](http://blogs.wsj.com/digits/2015/03/17/google-working-on-new-drone- after-wing-design-failed/)

They do still have a program for drone delivery, but we know nothing about the drones involved except that these aren't them.

<comment><USER11> It looks like they show different prototype designs on their webpage: [http://www.solveforx.com/wing/our- approach/](http://www.solveforx.com/wing/our-approach/)

[including the old design. But in the image, they show something with helicopter-style rotors]

</comment></comment><comment> david-given Every time I read Vernor Vinge's _Rainbows End_ I find myself wishing that someone would invent Up/Ex --- big pneumatic cannons which fire disposable cardboard gliders into the air; they glide down autonomously to the delivery site and then you tear then open and remove the package. Last mile delivery.

I don't care that it probably wouldn't be practical, or feasible. They'd still be awesome.

</comment><comment><USER12> Package delivery is one of the highest profile uses for drones, but I don't think it's a lasting one. Drones are unlikely to become cheap and efficient enough to eclipse current delivery techniques on a mass scale. Especially because traditional techniques will become much more effective as autonomous cars become feasible.

However, lots of the technology being developed (robust autonomous flight, improved endurance & range, lower costs) will speed up developments for other applications that make better use of their strengths. Even more importantly, companies like Google are finally forcing the FAA to craft realistic regulations that don't completely cripple commercial applications. The FAA's lethargic pace has already severely hampered domestic development to the degree that Google had to do most of their development in Australia.

</comment><comment><USER13> Google's Project Wing and Amazon's Prime Air are great projects and their advancements should be encouraged not discouraged. Now as far as the feasibility goes, "delivery by drone" should be limited to remote areas only where traditional delivery services do not have good infrastructure and network. Think a ranch in eastern Texas or Colorado vs a condo in Austin or New York.

No one need these guys swarming the skyline of Manhattan when the city has one of the best delivery networks in the nation as many other major metropolitan cities would enjoy.

</comment><comment><USER14> I'm amazed with fixed wing vertical takeoff. And landing. There don't seem to be any moving parts other than the rotor blades. There ought to be some clever software in there.

</comment><comment><USER15> Well, it looks like some Narcos already did (and without the Feds approval): [http://mexiconewsdaily.com/news/smugglers-used-drones- since-...](http://mexiconewsdaily.com/news/smugglers-used-drones-since-2012/) Wonder how this new delivery method affects street prices for illegal substances?

</comment><comment><USER16> My guess is that this article is just indirectly referring to the six UAS test sites that most companies can already test at for interesting UAS projects.

[https://www.faa.gov/news/fact_sheets/news_story.cfm?newsid=1...](https://www.faa.gov/news/fact_sheets/news_story.cfm?newsid=15575)

</comment><comment><USER17> I still can't figure out how these things actually deliver the package. Do they just drop it on my front lawn? That doesn't seem desirable. Does it drop it at a centralized location because my street has thick tree coverage? Don't most streets have thick tree coverage?

</comment><comment><USER18> Let us hope that this doesn't turn into a protectionist regulatory nightmare.

</comment><comment><USER19> first question in my mind; "in exchange for what?"

<comment><USER20> Google partnered with the government for data sharing (PRISM), so the Government could probably easily get any data that Google will be collecting...</comment></comment>


How the Boehm Garbage Collector Works - <AUTHOR> http://discontinuously.com/2012/02/How-the-Boehm-Garbage-Collector-Works/ <comment><USER2> Does anyone have data on how much it leaks in practice? Also, could maliciously crafted input result in a DoS vector for Boehm using applications?

<comment><USER3> My story is similar to nield's; I worked on a project that used the Boehm- Weiser collector in a 32-bit process.

Once or twice a tear, we'd have an unbounded memory growth to trace. Most of the time, we were able to solve it by providing layouts for structures that mixed pointers and pointer-like data. The debug facility it provides for providing a random backtrace to a root was helpful in those cases.

However, more than once we had a leak that it was beyond our ability to trace, despite a significant amount of diagnostic work. We found some workarounds that were specific to our app, which helped.

In the end, the costs to us were high enough that we rewrote our codebase in C# (our software was Windows-only). It was pretty much a line-for-line conversion, but it worked and we no longer had any memory leaks (except for one, in .NET timers, that took only minutes to trace using readily-available diagnostic tools).

I do believe a 64-bit process using the Boehm collector would be much less likely to suffer these issues, but this was before x64 was prevalent in corporate server rooms.

On your second question: Crafted input can indeed result in significant memory retention, if you aren't careful to exclude user input from the GC and have large, cyclic structures to collect, on a 32-bit machine, with almost any text encoding.

<comment><USER4> Correct me if I'm wrong, but the GC isn't the _only_ thing that frees memory, is it? You can still free it manually (and are supposed to), so those leaks would have happened without a GC too, and it can only help things.

I'm getting the impression that posts here imply you're better off without a GC, I'm not sure if that's the intention, but it strikes me as wrong.

<comment><USER3> Your parent post spoke about going from one GC to another and having the problems disappear. Hence, it only implies that changing GC can have a useful effect.

Your message does betray some confusion about garbage collection. The basic principle of GC is that you do not deallocate RAM manually (and, under most GCs, cannot), and programs written under it expect deallocation to happen automatically. You are not 'supposed to' free manually, as that would be wasted effort, and some standard configurations of the Boehm collector actually ignore all calls to free().

There is a very useful description of garbage collection at [http://blogs.msdn.com/b/oldnewthing/archive/2010/08/09/10047...](http://blogs.msdn.com/b/oldnewthing/archive/2010/08/09/10047586.aspx) which includes and expands on the useful mental model that "garbage collection is simulating a computer with an infinite amount of memory".

</comment></comment></comment></comment><comment><USER5> One of the biggest problems with this style of "scan all memory" GC is that you have to stop all threads (flush all pointers to memory) to perform a collection. Pointers held in registers in other active threads are inaccessible to the GC thread.

Failing to stop the world (or ensure all pointers are in memory rather than registers) can result in live objects being collected. This happened to Ruby at one point: <http://timetobleed.com/the-broken-promises-of-mrireeyarv/>

Edit: This boils down to breaking the compiler's model of memory as specified by the C standard; all bets are off.

<comment><USER6> Um no. First, it doesn't "scan all memory". It scans the root and fans out. You can do read/write barriers and such to avoid blocking GC. It doesn't matter what value registers have in them. What matters is what is on the stack and what is reachable from said stack. If you have control of malloc, you can be far more clever than what you are describing. Ruby had a crummy implementation of GC, but you'll notice, for example, that most JVM's do "scan all memory" without forcing all active threads to be blocked at once.

</comment></comment><comment><USER7> This would fail badly on a <http://en.wikipedia.org/wiki/XOR_linked_list>

<comment><USER8> You really shouldn't be using a XOR linked list anyway. It has a lot of disadvantages and none of them weigh up to the only advantage of a lower memory footprint per list item.

<comment><USER9> The point is that this garbage collector is unsound. It may collect memory that is still in use. That's bad.

<comment><USER9> To be clearer: safety is no longer compositional in this system. To safely use the Boehm garbage collector, it's not sufficient that my own code doesn't use "disguised" pointers: I have to verify that my libraries don't either. That's impractical and contrary to good software engineering at best, impossible at worst.

<comment><USER10> No, you have to verify that your libraries don't keep disguised pointers to objects you allocated via the GC, that you don't yourself keep pointers to. It's quite unusual in C to give a reference to an object to another piece of code then drop all the pointers to it that you hold, because the usual discipline is that the module that allocates an object frees it.

<comment><USER9> Not if you build the GC with --enable-redirect-malloc to use with existing libraries/code bases. Which should be fine because, after all, this _is_ a "conservative" garbage collector. Right?

</comment></comment></comment></comment></comment></comment><comment><USER8> I've often wondered how a garbage collector can scan the entire memory in a reasonable time. The article doesn't explain that particular operation. With a quick look at the source code I couldn't figure it out either.

Can anyone enlighten me? Is it only the stack that is checked because that seems possible in a reasonable time.

<comment><USER5> Boehm controls malloc; it knows where the heap is. In general, yes, the more memory you have allocated, the slower BoehmGC will be.

It checks both stack and heap.

</comment></comment><comment><USER11> Neither in the article nor it the paper they mention cycles in references. Does it solve it in any way?

<comment><USER12> Garbage collectors have no problem with reference cycles.

A GC works by finding all objects that are reachable (referenced by some other object or a root), then discarding all other objects. So a cyclic data structure is completely discarded as soon as there are no live references to any of its objects.

As usual, Wikipedia has lots more information: [http://en.wikipedia.org/wiki/Garbage_collection_(computer_sc...](http://en.wikipedia.org/wiki/Garbage_collection_\(computer_science\))

GC roots are generally things like: static/global variables, active stack frames (function parameters and local variable), CPU registers.</comment></comment>


Show HN: Slingcode live-reloading web IDE to make, run, and share web apps P2P - <AUTHOR> https://slingcode.net/ <comment><USER2> The author also added this blog post explaining the reasoning behind it. Worth a read: [https://mccormick.cx/news/entries/slingcode-personal- computi...](https://mccormick.cx/news/entries/slingcode-personal-computing- platform)

</comment><comment><USER3> So am I right in thinking that this is for browser only apps, as it doesn't include a server? At Yazz Pilot we made the ability to output apps as a HTML file, but to have the whole dev environment client side is pretty amazing!

<comment><AUTHOR> Thank you for checking out the project. That's correct it's for browser only apps with no back end. Browsers are now capable of doing so much of what you want from an app.

My guess is there is a large class of users for whom client side apps are good enough for the job they're doing. Some of the use-cases where Excel is used today for example, and video games too, which are often self contained. Clay Shirkey's "situated software" article explains these ideas very well.

Even data storage and sync is possible fully client side using WebRTC peer-to- peer tech.

<comment> vertex-four The "problem" with these systems is sharing changes - if I change the system you share with me for myself, it's really hard for someone to use those changes along with other changes. Integrating changes together involves handling merge conflicts in code we don't necessarily understand.

I think separating the data the system operates on from a series of smaller systems is the key here.

<comment><AUTHOR> Yes, that is a problem. It is one which is solved by git and other version control software. If you are building something with an online editor like Slingcode and you get to the point where change management becomes an issue then it is probably time to switch to a more comprehensive development environment.

<comment><USER4> Excellent work! I am happy for you, this is really cool.

Take a look at posts, blogs and videos by Joe Armstrong, one of the inventors of Erlang. Some things that stand out are "immutable code" and globally accessible code.

The other one is the research around CRDTs.

[https://dl.acm.org/action/doSearch?AllField=crdt](https://dl.acm.org/action/doSearch?AllField=crdt)

</comment></comment></comment></comment></comment><comment><USER5> Is there a github link for the source? I see it's under MIT License.

<comment><USER6> The github repo is here [https://github.com/chr15m/slingcode](https://github.com/chr15m/slingcode)

</comment></comment><comment><USER7> That reminds me how simple it was to start programming with QBasic. The slingcode video on its website is well done, explains how it works why it's great in a few minutes. Love it.

</comment><comment><USER8> I love all this P2P software being built, but it seems like if your peer to peer is just static html and friends. You are as much P2P as github pages.

<comment><USER9> No, they use WebTorrent</comment></comment>


Facebook's ties to India's ruling party complicate its fight against hate speech - <AUTHOR> https://time.com/5883993/india-facebook-hate-speech-bjp/ <comment><USER2> "Shreya Singhal v. Union of India shields Twitter from any liability for failing to take down content unless a court order is passed asking it to do the same."

source: [https://internetfreedom.in/joint-letter-to-twitter-about- rem...](https://internetfreedom.in/joint-letter-to-twitter-about-removal-of- prashant-bhushan-tweets/)

<comment><USER3> Those are better free speech protections than in Germany, where after a mere complaint (not court order) platforms are liable for up to 5 million euro if they fail to remove illegal posts within 7 days, and "obviously illegal" posts within 24 hours: [https://en.wikipedia.org/wiki/Network_Enforcement_Act](https://en.wikipedia.org/wiki/Network_Enforcement_Act)

</comment></comment><comment><USER4> It is a strategically risky move for Facebook to take an active role in shaping India's political landscape. I imagine that the Indian population might object to American companies deciding what is and isn't appropriate to discuss.

<comment><USER5> I've always wondered why Facebook's role in the US elections is such a hotly debated topic but Facebook's role in the elections of all the other democracies in the world is not touched upon at all.

<comment><USER6> It's certainly a topic for discussion in the other democracies. Before COVID-19 sent everything haywire, Canada's parliament was holding sessions on the question of American electoral interference on social media.

Once it's back on track, Mark Zuckerberg and Facebook's management have a good chance of having arrest warrants issued if they don't start actually testifying and cooperating.

</comment></comment></comment><comment><AUTHOR> Here's a report by Equality Labs about Facebook India and Hate speech.

[https://www.equalitylabs.org/facebookindiareport](https://www.equalitylabs.org/facebookindiareport)

<comment><USER7> That's extremely disturbing how can they justify banning tik tok for inciting ethnic violence yet give facebook a free pass?

<comment><USER8> It's a geopolitical issue, probably not one of hate speech.

India is not concerned about US Government spying on them, so much.

All large Chinese companies have strong ties to the CCP (they have internal staffers who are party members, essentially acting as internal party oversight). Ergo, TT is definitely an organ of the state. It's just a matter of 'how much' in practicality.

So TT gets the ban.

<comment><USER8> FYI to be more clear - the Chinese Communist Party has party officials placed within corporate organisations in order to maintain control, and to require businesses to adhere to CCP Policy.

As of 2019 - 70% of Chinese business had 'CCP organs' placed within the company for oversight, and Xi wants to put it to at least 95% very soon. [1]

From the Guardian: "Central Organisation Department, the party's personnel body, found that 68% of China's private companies had party bodies by 2016, and 70% of foreign enterprises. Although these figures sound high, they don't match the targets the party has set for itself. In Xi's old stamping ground of Zhejiang, for example, officials set a target in August 2018 to have cells inside 95% of private businesses."

There is no ambiguity here: while the state may allow private enterprises to manage day-to-day affairs, all private businesses are subject to controls and scrutiny by the CCP - directly from agents within the company - so that they meet CCP objectives.

Given that, all Chinese companies are de-facto CCP companies from the perspective of national security and strategic policy.

The parallel would be Trump putting a 'special team' of CIA or Republicans inside every American company to ensure oversight of his agenda.

This is very material to the nature of Social Media operations and global influence.

Edit: which is why India et. al. are going to be much more concerned about TikTok than other apps and that the primary concern is not issues over speech.

[1] [https://www.theguardian.com/world/2019/jul/25/china- business...](https://www.theguardian.com/world/2019/jul/25/china-business-xi- jinping-communist-party-state-private-enterprise-huawei)

</comment></comment></comment></comment><comment><USER9> This can only be solved when more and more people understand the threats not just for the present, but for the future.

What Facebook and WhatsApp have enabled are convenient and useful for those in power. So while there may probably be some words here and there, we can't expect a lot of change on the ground.

Disappointingly, the Indian Supreme Court is also lethargic and chooses to look at more trivial matters than give importance to things that could affect the freedom and political landscape for generations — examples are the Aadhaar petitions, cases against the electoral bonds and other matters not being heard for years. The court may actually find merit in holding this commenter in contempt for criticizing it, as if the judiciary is somehow sacred and beyond any criticism (anyone interested can search online for recent news on what the court is doing).

The effect of "absolute power corrupts absolutely" is seen in many corners!

<comment><USER10> > What Facebook and WhatsApp have enabled are convenient and useful for those > in power.

I'm sure they are, but are they more useful than what was before? Facebook & Co have some random element, it's not a one-way-communication device like classic media (TV, radio, newspapers) are/were.

The government has much less control over Facebook. You can't just go in and take it over like you could with a radio station, you can either use it and accept that others can as well, or you can block it in your country, but then you can't use it either.

<comment><USER3> > I'm sure they are, but are they more useful than what was before? [..] TV, > radio, newspapers

False dichotomy. Lets not skip over irc, xmpp, and all sorts of free, variously encrypted communication platforms that Facebook muscled out.

<comment><USER10> But those were for individual communication, I understood the parent comment to mean mass media ("useful for those in power"). I don't think the powerful feature of Facebook is the messenger, it's the ability to rapidly disperse information through sharing. IRC & similar communication tools weren't made for that.

WhatsApp is a hybrid, I suppose, but even there I think the share/forward feature is what drives the political usefulness, which is also why they're limiting that for some media, so you can't spread messages as easily (if it has been forwarded five times, you can only forward it individually, not to multiple contacts/chats, from what I understand).

</comment></comment></comment></comment><comment><USER11> Hate speech is very common in Indian social media.

Also, This is not just a problem with Facebook India, Even Twitter India's heads have very close ties to India's ruling party.

<comment><USER12> Are you sure about this? From what I gather the current ruling dispensation in India is opposite of left, and Jack Dorsey has stated in the past about Twitter having left leaning bias. [1] Might not translate to their India operations but I strongly doubt it wouldn't.

[1] [https://www.washingtonpost.com/technology/2018/08/19/twitter...](https://www.washingtonpost.com/technology/2018/08/19/twitter- ceo-jack-dorsey-admits-left-leaning-bias-says-it-doesnt-influence-company- policy/)

<comment><USER13> BJP, India's right wing party, has super majority seats in parliament and looks to be the only relevant party in the foreseeable future. So I think if they want to deal with India, they'd have to deal with BJP regardless of their political leanings.

</comment></comment></comment><comment><USER14> Also, FB's proximity to the mega corporation that's known to be very friendly to the ruling party. FB's WhatsApp pay getting clearances / approvals soon after they made a large payment to Jio Platforms.

Timeline:

26Nov2019: India puts WhatsApp's impending payments service on ice due to data localisation fracas. Both the security breach by Pegasus malware and WhatsApp's reluctance to adhere to India's data localisation norms have caused it to sit on the sidelines of one of the hottest digital payments markets in the world. [1] [1] [https://www.zdnet.com/article/india-puts-whatsapps- impending...](https://www.zdnet.com/article/india-puts-whatsapps-impending- payments-service-on-ice-due-to-data-localisation-fracas/)

24Apr2020: Facebook is spending $5.7 billion to capitalize on India's internet boom. [2] [2] [https://edition.cnn.com/2020/04/22/tech/facebook-india- relia...](https://edition.cnn.com/2020/04/22/tech/facebook-india-reliance- jio/index.html)

08June2020: WhatsApp gets a raw deal from India in payments. WhatsApp needs a nod from the National Payments Corporation of India to throw open the switch. [3]. [3][https://cio.economictimes.indiatimes.com/news/enterprise- ser...](https://cio.economictimes.indiatimes.com/news/enterprise-services-and- applications/whatsapp-gets-a-raw-deal-from-india-in-payments/76252903)

16June2020: WhatsApp launches payments service, 2 yrs after it began testing in India. [4] [4][https://economictimes.indiatimes.com/magazines/panache/whats...](https://economictimes.indiatimes.com/magazines/panache/whatsapp- launches-payments-service-2-yrs-after-it-began-testing-in- india/articleshow/76400100.cms)

03Aug WhatsApp a step closer to pay play. [5] [5][https://www.livemint.com/industry/banking/whatsapp-a-step- cl...](https://www.livemint.com/industry/banking/whatsapp-a-step-closer-to- pay-play-11596419325500.html)

04Aug2020: WhatsApp Pay has now met all data localisation rules, NPCI tells RBI [6] [6][https://economictimes.indiatimes.com/small- biz/startups/news...](https://economictimes.indiatimes.com/small- biz/startups/newsbuzz/whatsapp-pay-has-now-met-all-data-localisation-rules- npci-tells-rbi/articleshow/77343179.cms)

05Aug2020: 'NPCI gave ICICI Bank go ahead for WhatsApp Pay in June', RBI informs SC [7] [7][https://www.medianama.com/2020/08/223-npci-approves- whatsapp...](https://www.medianama.com/2020/08/223-npci-approves-whatsapp-pay- rbi-supreme-court/)

</comment><comment><USER15> India is a very lucrative market for FB and other companies.

1 billion people, 2 billion eyes. No privacy laws, can easily share and sell data, govt is in the hands of Reliance (in which FB, Google and others are all investing a lot), most Indians are just getting used to the vast internet and are easily tricked.

<comment><USER16> Ideally they should have some morality to put basic human rights and safety above profits. Even from long term perspective if they continue to ignore hate speech against Islam on their platform I am sure they would lose a lot of users.

<comment><USER15> They won't. You don't know the kind of nationalism that exists in India. Just check out twitter.com/explore every night via an Indian IP. It's full of hate speech against Hindus and muslims. Some random guy/girl tweets some shit against a religion. All the media/bots/politicians jump on it and blame it on each other. Everybody is outraged by tiny things, they don't know to ignore things.

Indian media thrives on these things. Half the nation is jobless/students . Most accounts are paid bots.

The only good thing is that the situation are getting better, as the older gen goes away slowly.

<comment><USER17> > The only good thing is that the situation are getting better, as the older > gen goes away slowly.

I do want to believe you, but most of the time it seems I am clutching at straws. The Hindu right is doing a pretty good job of catching them young and indoctrinating. At the same time there is ton of money flowing in from Saudi Arabia to do the honours for the other side.

</comment></comment></comment></comment><comment><USER18> You can see many comments here justifying anti-Muslim actions of the govt by whataboutery. Now imagine that happening at scale on whatsapp/Facebook and MSM.

With most Indian family having access to smartphones, the amount of hatred and brainwashing that happens through this platform is unstoppable. Recently, Hindus were told not to buy from Muslim vendors, saying that Muslims are purposely spreading corona. Hindu sellers were provided with saffron flags for identification. Concentration camps are being built using the same people as workers, who would eventually end up in the camps. MSM openly spews anti- muslim venom during prime time. India is openly heading towards either a genocide or a civil war.

One can try their best to un-brainwash people, but one can't do much against a paid online army of twitter/whatsapp/facebook users.

</comment><comment><USER19> Zuck tried to do the same with China, but for whatever reasons never disclosed, they seem did not reach an agreement for FB to enter China.

I suspect, China asked something that might undermine Zuck's political ambition.

</comment><comment><USER20> Is there a single thing that has been defeated by prohibition and censorship?

This is a losing strategy

</comment><comment><USER21> For failure of legislation, judiciary, administration, media in India to protect minority, Facebook is not the primary actor. Indeed minorities failed to get support from top courts in India where habeas corpus (the most fundamental basic right of Freedom in Indian constitution) litigations are pending for over 1 year and constantly being postponed, and the topmost court is busy prosecuting a lawyer with urgency for a tweet. His main offence is to use public interest litigation to help minorities, question govt and courts and bring to the front the tyranny of majoritarian politics of suppression. He is in cross-hairs of the current govt, so it's one another way to silence him from questioning govt or courts for decisions.

Agree that Facebook should act decisively to say no to things which incites violence and suppress the voice of minority.

The least it can do is to remove people immediately in the company who appear in slightest to promote or ignore hate and violent information on platform resulting in loss of life. Here Facebook is duty bound to act internally within its company to make sure it's staff are responsible for their actions. I don't see any of this indeed the whole Facebook team in India who did it are promoted based on research in WSJ and this article. Getting cozy with richest man closer to right wing is just to secure profits and market at the expense of principles.

Also right wing politics in India enjoys a substantial support, especially the Hitler style (reflected in many govt decisions). Facebook is just reflection of what's in the society at present. Majority of the people are happy that a temple built will make India no. 1 in the world, talks and real actions on COVID-19 has become boring and not important as it inches towards no. 1 in the world for COVID-19 infections.

<comment><USER22> > * Facebook is just reflection of what's in the society at present.*

Facebook is a company that makes a profit off of engagement, even if that engagement is driven by hate. Facebook alone chooses what they promote on their platform. It is not some kind of mirror that just reflects what goes on in society, it is a company that distorts the truth, outrages and pushes paid propaganda on its users in order to turn a profit.

<comment><USER21> That's the reason mentioned in my comment that Facebook chose profits and market over principles in India based on WSJ research and this article.

In India they choose the side of the govt, political party and an ideology, it's again a reflection of the kind of staff managing Facebook in India and although they are duty bound to punish such staff they rewarded them and still defending them to secure the market and profits.

</comment></comment></comment><comment><USER23> Hate speech is a core part of political discourse today. It's no longer out of the mainstream. Expecting Facebook to deal with that is asking too much of a private company. Whom should Facebook muzzle? ISIL? Le Pen? Trump?

</comment><comment><USER24> Facebook's actions in India are absolutely despicable. The head of policy at Facebook in India is a radicalized member of the Indian rightwing and recently put up a post stating that Muslims are a "degenerate community" and was forced to apologise just a couple of days ago because of pressure on FB from their employees.

She gave a half hearted apology. Facebook should have immediately suspended her or sacked her:

[https://www.huffingtonpost.in/entry/facebook-ankhi-das- anti-...](https://www.huffingtonpost.in/entry/facebook-ankhi-das-anti-muslim- post_in_5f45de23c5b6cf66b2b02390)

She and her sister (who is a politically connected to the ruling BJP party) have publicly been hobnobbing with the BJP and have actively been involved in propaganda. [https://twitter.com/SaketGokhale/status/1294653379046596608](https://twitter.com/SaketGokhale/status/1294653379046596608)

During the recent riots in Delhi where many died, the incitement of violence was by a member of the ruling party but has taken no action against Kapil Mishra's account which is still active:

[https://www.facebook.com/watch/?v=283365149510764](https://www.facebook.com/watch/?v=283365149510764)

His account is still active and he still continues to try and make the Hindus fight the Muslims:

[https://www.facebook.com/youth4justice](https://www.facebook.com/youth4justice)

<comment><USER25> Imagine a White person, who is the head of the organization in a country sharing a post that African Americans are a "degenerate community". In any western country, the person would not only be promptly sacked, but would also become untouchable in mainstream organizations.

The Indian politics and judiciary have been compromised by right wing Hindu nationalists and it is impossible to expect anything from them. However, I expected better from Facebook. In a western country Facebook wouldn't think twice about firing any employee who shared such a post.

<comment><USER26> See.

"The Southern Strategy" [https://en.wikipedia.org/wiki/Southern_strategy](https://en.wikipedia.org/wiki/Southern_strategy)

Dog Whistle Politics [https://en.wikipedia.org/wiki/Dog- whistle_(politics)](https://en.wikipedia.org/wiki/Dog-whistle_\(politics\))

</comment></comment></comment><comment><USER27> Removing posts by elected officials is running really close to foreign interference in domestic affairs. Given the history of the East India Company, I am sure India is especially sensitive to foreign companies trying to influence or curtail the speech of their elected officials.

<comment><USER28> > _Removing posts by elected officials is running really close to foreign > interference in domestic affairs._

No, it's not. If anything, it's _opting out_ of interfering in domestic affairs.

Facebook is not an official channel. The elected official has many other platforms, including the country's media, that will publish their message. They can create a blog if they want.

If Facebook _is_ the only viable channel for reaching a large part of the electorate, the core issue is having only that one channel. You solve it by forcing competition, not by stifling Facebook's right to decide what they want to allow on their platform.

I deeply loathe Facebook and think they're undermining democracy in every country, but there should never be a way for a government to force a publisher to distribute an ideology that the publisher disagrees with.

<comment><USER29> > stifling Facebook's right to decide what they want to allow on their > platform.

Is indian govt really proposing this though? who is stifling their right?

<comment><USER28> The comment I was responding to seemed to be proposing it.

I don't know about India, but in the US, there's been a major debate about whether govt can force platforms to retain posts and several attempted lawsuits over it.

<comment><USER29> > The comment I was responding to seemed to be proposing it.

I don't think so. comment wasn't merely presenting its take on things not proposing govt should force fb to do something.</comment></comment></comment></comment></comment>


Near-future advances in functional brain imaging will make torture obsolete - <AUTHOR> http://www.defenseone.com/technology/2015/02/white-house-project-will-yield-brain-based-lie-detectors/105021/

<comment><USER2> > _Still, it is imperative that we gather intelligence from captive terror > suspects in order to prevent heinous crimes from taking innocent lives both > at home and on the land of our allies abroad._

There are a lot of false implicit assumptions here:

1) The image system is good enough to get any information: It' a new technology. I expect that it is overhyped usual and you will not get very much information for a long time. Have you seen my flying car?

2) Torture methods produce accurate information: It's well known that people make false confections and incrimination under torture. Just Google "witch hunt" for an old enough case that is not currently politized.

3) The interrogators are reliable: It's easy to use low quality information extracted from the suspect to incriminate whoever you want. Sometime it's not evil, only that if the interrogator has some previous ideas they can cause a big confirmation bias.</comment>


Google Nexus 7 obliterates every reason for buying the Kindle - <AUTHOR> http://www.washingtonpost.com/business/google-nexus-7-obliterates-every-reason-for-buying-the-kindle/2012/07/11/gJQANGaGdW_story.html?tid=pm_business_pop

<comment><AUTHOR> I am really eager to see Amazon's response!</comment>


Verizon API To Give Apps 'Turbo' Bandwidth Boost For a Fee - <AUTHOR> http://www.pcmag.com/article2/0,2817,2395728,00.asp#fbid=DqfakR8C12X

<comment><USER2> _"I think you could anticipate that maybe you'll have a Skype call that starts going bad," Fletcher said. "Wouldn't you like to be able to hit the turbo button and have that come back up to be a good call?"_

This is the most blatantly bad product vision I've seen in a while. Network neutrality issues aside, why would I want to have my Skype call go bad and have to hit a button that says "fix it"?

</comment><comment><USER3> Doesn't this violate the open access rules that went into effect when Google bid this spectrum above a certain value?

</comment><comment><USER4> This would be a good idea if it wasn't app-specific. Giving users a way to pay more for better service is good; classifying traffic based on application is bad.

</comment><comment><USER5> Is my understanding right? Verizon is saying that they will kick people off/restrict their bandwidth, when somebody pushes the 'turbo' button?

<comment><USER6> No no no. You have it all wrong.

Verizon will degrade YOUR bandwidth if you are using services that interfere with their business plan (facebook, twitter, skype: SMS and VoIP).

Now pay extra to "fix" what we degraded for our business sense.

</comment></comment><comment><USER7> This isn't any different from ISPs wanting to control bandwidth depending on traffic type.

<comment><USER8> And, even worse, Verizon soon has a financial interest in not improving their network capacity.</comment></comment>


Atlas and Cuba - <AUTHOR> https://stripe.com/blog/atlas-cuba?ref=hn <comment><USER2> A few months ago I inquired about using Stripe from Puerto Rico, a US territory for over 100 years, and was told that it wasn't available in the unincorporated territories yet.

[https://support.stripe.com/questions/can-i-use-stripe-if- my-...](https://support.stripe.com/questions/can-i-use-stripe-if-my-business- is-based-in-an-outlying-territory-of-a-supported-)

And now I see Stripe getting friendly with Cuba.

I don't have a clear point to make, as I'm writing this while still upset, but I just felt like I had to get my word out there perhaps to get some perspective or perhaps to start a discussion.

<comment><USER3> Hi, I work at Stripe. We are actually now able to support Puerto Rican businesses. (We need to update that support page!) Shoot me an email at firstname.lastname@example.com and we can get you set up.

<comment><USER4> Was there actually a good reason for this?

The limitation seems completely arbitrary or stems for a misunderstanding about the difference between a state and a territory. For better or for worse, Puerto Rico is virtually a state (with residents who can't vote for the president with some minor other caveats), but legally there shouldn't be any difference.

</comment></comment></comment><comment><USER5> This is really incredible.

Many of small actions by a small number of focused people in Washington, in the Whitehouse, and entrepreneurs and bankers, may have a profound impact on millions of Cuban lives in a very short period of time.

Another good reminder (to abuse a quote), "chance favors the prepared" \-- Stripe had already laid a lot of groundwork before Atlas to handle the systems required for this, and then they launched Atlas to handle many of the regulatory requirements, and so when this opportunity came along for Cuba, they were quickly able to take advantage of it.

<comment> k-mcgrady >> "Many of small actions by a small number of focused people in Washington, in the Whitehouse, and entrepreneurs and bankers, may have a profound impact on millions of Cuban lives in a very short period of time."

While this is true don't forget that this also applies to the last several decades in Cuba too. They're fixing something that they created in the first place.

<comment><USER6> Every other country in the world was free to trade with Cuba. Cuba is a disaster because of Communism, not the US embargo. Communism failed everywhere else, why would Cuba have been any different but for the embargo?

<comment><USER7> Communism failed everywhere... BUT most of those countries have started down the path to a more market driven economy primarily through external trade... its weird to have trade with USSR and China but not allow trade with Cuba at this time.

<comment><USER8> The embargo was never about communism itself, it was a response to the seizure of assets owned by Americans without compensation. I think these other countries either didn't do this, or at least didn't do it as much.

</comment></comment></comment></comment></comment><comment><USER9> "SVB will share more details about your account's complete fee schedule and functionality once your bank account is open."

???

\- I'd like to open an account. What are the fees?

-> well umm I don't want to tell you until you open the account

\- good luck with your chickens

<comment><USER3> We definitely agree that startups should have a clear understanding of fees before they get started. To make things simple as a company gets started, Silicon Valley Bank is waiving account maintenance fees for Atlas users for the first 24 months. Other fees vary depending on which services customers choose to use, so we can't post a one-size-fits-all rate card. We'd be happy to walk you through the details — feel free to get in touch with me at firstname.lastname@example.com.

</comment></comment><comment><USER10> The sad thing about Atlas is... why should it be so complicated anyway? If you can prove your identity, and can pay the franchise fees, it should be completely trivial to setup a legal entity and start paying taxes in any country. You just file the paperwork.

Is it the bank account that's the hard thing to get? If you have a Deleware C corp with a statement of good standing and an annual report identifying the corporate officers, and you're the President setting up a bank/merchant account, is this not just a routine affair?

</comment><comment><USER11> Cuba will have to step up its game with their Internet access, which is almost non-existent.

<comment><USER12> That assumes that the Cuban's in charge want to get it fixed. The Internet is not non-existent in Cuba because of some technical problem.

<comment><USER13> Almost right. It's both a political and a technical issue. Like you don't get a whole country with access to the internet from one day to the other without signing a contract with the devil (whatever that is). So, it takes time, but it is happening, Cuba is getting online, and there's no step back.

<comment><USER12> What contract with which devil?

Cuba already has a fiber optic cable to Venezuela, so they can get all the Internet they want and need into the country.

Cuba already has a national backbone, so they can get the bits distributed to every city.

Cuba already provides Internet access to government and educational institutions and some businesses, so they already have the capability to provide intenter access, even if so far it's been in limited quantities.

There are plans to provide ADSL service and Internet access can also be provided via existing wireless networks. There are also informal wireless networks that could be used to,get Internet out there to the people.

The Chinese will sell them as much network equipment as they want. They already provide the most of it anyway.

There are very few technical issues. All the Cuban powers that be need to do is unrestrict access and allow the use of existing infrastructure.

EDIT: all of Cuba could have some level of Internet access right now if they just allowed satellite usage.

<comment><USER13> Nice. And you didn't take my parenthesis as a warning! Give me 10..

</comment></comment></comment></comment></comment><comment><USER14> awesome!!!</comment>


Lara Croft Has Company: More Female Heroes Appear in Big-Budget Games - <AUTHOR> http://www.nytimes.com/2015/12/29/arts/lara-croft-has-company-more-female-heroes-appear-in-big-budget-games.html <comment><USER7> Surprised they don't mention _Life is Strange_ or _Heavy Rain_ in their examples of female protagonists. They pushed that angle quite a bit when they were released. I also liked _Remember Me_ from Capcom quite a bit, even though it wasn't a commercial success.

Personally I usually prefer playing female characters, even though I'm a guy. Currently rockin' a female character in _Sunset Overdrive_ right now. I was always a fan of the novelty (to me) and the different approach female characters often had to the gameplay (like lightning-fast kicks with Chun Li in _Street Fighter II_ , for example).

</comment><comment><USER8> I find these sorts of articles misleading, since there were quite a few old school games with female main characters that rather conveniently get forgotten about when making arguments like this.

Like Dixie Kong and Tiny Kong from the Donkey Kong Country series. It's funny how many people ignore franchices like that for their political screeds because the casts aren't human.

Heck, you could say Super Mario Bros 2 had a 'female hero', because it was the first game to have Peach go from being a damsel in distress to playable character.

Or the numerous games where you choose the gender (and general appearance) of the main character. It's pretty common in Western made RPGS, and it's getting about as common in Eastern ones (Pokemon has this since gen 2). How about games where there's a party of people and some/most of them are female?

I find this attitude that female characters are somehow a 'new' thing for gaming being rather unfair, and find the attempts of trying to then mix in crap like 'gaming's war on women' as even worse.

<comment><USER9> Not sure why you're down votes. But I know what kind of people are doing it though.

You're right. Female protagonists isn't a new thing. This is overblown. No one would give two shits if it was Gabrielle Freeman or Gordon. A good game is a good game.

And a shitty game with a female main is still a shit game. No down votes will actually change they. That's the satisfying part.

</comment></comment><comment><USER10> I fail to see the significance of the main character's gender, unless it relates directly to the story in some way (i.e., being male/female affects their social standing). It strikes me as silly that so many people raise hell over a detail that should be meaningless.

<comment><USER11> It's relevant for at least two reasons, in my opinion. The first is that video games, like novels, are stories told through the the protagonist/s. If this character is always male, you miss out on a whole class of stories which are women's stories. Just as literature rarely told women's stories upon a time, video games up to the present time rarely tell women's stories.

The second reason is that having a female protagonist changes the entire meaning of the story. Consider Pierre Menard, author of Quixote ([https://en.m.wikipedia.org/wiki/Pierre_Menard,_Author_of_the...](https://en.m.wikipedia.org/wiki/Pierre_Menard,_Author_of_the_Quixote)), which discusses how the particular context of the author effects the meaning of the work.

Wikipedia had an excellent article about gender representation in video games [https://en.m.wikipedia.org/wiki/Gender_representation_in_vid...](https://en.m.wikipedia.org/wiki/Gender_representation_in_video_games) . One part of the article notes:

> 60% of girls but only 39% of boys preferred to play a character of their own > gender, and 28% of girls as opposed to 20% of boys said that they were more > likely to play a game based on the character's gender.

So it may not matter to some people, but it matters greatly to others.

<comment><USER12> Agreed, but it also kind of assumes stories are actually important and integral to the video game. Most stories in the current dominant video games follow the John Carmack mantra of "Story in a game is like a story in a porn movie. It's expected to be there, but it's not that important."

To go deeper into the problems of story telling in games, see Jonathan Blow's Conflicts in Game Design Talk.

[https://www.youtube.com/watch?v=mGTV8qLbBWE](https://www.youtube.com/watch?v=mGTV8qLbBWE)

But as for actual story telling games with female protagonists, go back to King's Quest IV: The Perils of Rosella. Designer Roberta Williams said a lot of interesting things about it, like how it was more uncomfortable designing deaths for her, and how she was worried there would be a fan backlash to playing a female character (but never happened).

Hell, since I mentioned both Jonathan Blow and King's Quest, somebody just did a big ass Sierra retrospective applying Blow's talk to Sierra games, examining both why Sierra was able to successfully do story telling games for 20 years and how they differ from modern adventure games. Highly recommended.

[https://www.youtube.com/watch?v=wua96SI6SBE&list=PLPAVYgFfed...](https://www.youtube.com/watch?v=wua96SI6SBE&list=PLPAVYgFfeddJzax1X4VUj69Z1Vs4PqGlA&index=1)

</comment></comment></comment><comment><USER13> _sigh_. Because none of the following exist.

Samus Aran - <USER2>

Joanna Dark - Perfect Dark

Jill Valentine - Resident Evil

Rayne - <USER3>

Tifa Lockhart - <USER4>

Yuna - Final Fantasy X

Elizabeth - <USER5>

Bayonetta - <USER6>

[Range of Characters like Marta, Presea, Shina, Colette] - Tales Of ____ Series

And this is a pitiful list I came up with in a minute.</comment>


Post-quantum RSA - <AUTHOR> https://eprint.iacr.org/2017/351 <comment><USER2> THIS PAPER IS:

a nice, thought-provoking paper that is nevertheless _purely speculative_ , and also more than a little tongue-in-cheek in parts. (Note that one of the keywords is "Make RSA Great Again".) It's basically pointing out that there is a small gap between the costs of legitimately using RSA and factoring via Shor's algorithm. With truly massive keys, this gap can be exploited to provide concrete security guarantees for RSA even in the presence of fast quantum computers.

THIS PAPER IS NOT:

a revolutionary new quantum factoring algorithm. They show how to apply quantum Grover search to a particular step of a known factorization algorithm based on elliptic curves.

QUANTUM COMPUTING DOES:

break public-key cryptosystems based on the hardness of factoring and finding discrete logarithms. Additionally, it gives a quadratic speedup in generic search problems (via Grover search) which effectively halves the key size of symmetric encryption schemes and yields faster algorithms for things like finding collisions in hash functions.

QUANTUM COMPUTING (PROBABLY) DOES NOT:

break all asymmetric cryptography. There is no known proof of this, but it's widely believed that asymmetric cryptosystems based on different hardness assumptions are not vulnerable to (non-generic) attacks by quantum computers.

<comment><USER3> "With truly massive keys"

My favorite quote from the paper on that topic is

"Something expensive might nevertheless be useful if it is the least expensive way to achieve the user's desired security goal"

Post quantum crypto isn't the end of crypto, is the end of the meme that nation-state-proof cryptography is "too cheap to meter" (A nuclear power phrase from the old days)

The pre-quantum landscape is cheap unbreakable algos implemented in easily breakable ways as a part of easily breakable systems, so there's quite a bit of criminal activity going on out there. The post-quantum landscape is very expensive unbreakable algos implemented by professionals because the cost (computational and financial) is large. The involvement of professionals indicates that criminal activity based on breaking crypto implementations is likely to drop.

Its likely that Hollywood style multiple levels of crypto will soon exist. The days of being able to keep the NSA out of your wifi access point will be over unless you're willing to spend ridiculous amounts of money. However, for a very modest expense it'll still be possible to keep your neighbor off your wifi, wide open to nation states, sure. But my wifi leaching neighbor is a more realistic adversary than the entire NSA.

<comment><USER4> I disagree with the premise. There's no reason to assume that we can't implement a quantum-resistant asymmetric encryption system that is no more computationally expensive than what we already have.

Hell, there's already work out there ([http://eprint.iacr.org/2014/599.pdf](http://eprint.iacr.org/2014/599.pdf)) for a quantum-resistant key exchange algorithm that's fast enough to have only 21% less throughput than traditional elliptic Diffie-Hellman.

<comment><USER3> Thats a good paper. I thought about it awhile and would retract my remarks of it being expensive and replace it with being expensive or risky. Also there's the problem of "what is the definition of post quantum" where a lot of people call 1995 or so after Shor "PQ", and maybe I'd retract that part of my comment and call it something like "way way long time in the future, which by whatever definition of post quantum, is also post quantum, lets call it 3000 AD"

The trick in the big-key RSA paper is knowing how Shor works, because the average big-O is low for a randomly selected large number, but the maximal number of ops that could be required is extremely large and yet that number is "easily" constructible. So merely intentionally and methodically (and expensively) manufacture a "poison pill" composite that Shor can't possibly factor because that number was constructed specifically to make Shor algo fail, and you're RSA system will be good.

The algo in your linked paper is very convenient. However its newer and not as seasoned and the wolves are snapping at its heels there was that paper around Thanksgiving last year (which did get retracted) claiming to partially quantum break LWE.

[https://arxiv.org/abs/1611.06999](https://arxiv.org/abs/1611.06999)

I'd like to see a proof that there exists no possible theoretical quantum speedup against LWE. Yes I know there isn't one in currently described or implemented, I mean I can't find a proof that there cannot exist an attack against LWE. Or, a proof that a non-quantum attack against LWE cannot exist because in the end that would imply 1=2 or something invalid so by induction its unbreakable.

In the year 3000 I think the odds are good that algos will still have a large ratio between the average ops when run against a random number vs the maximal ops when run against a constructable poison pill designed to require maximum number of ops. Yet in the year 3000 I would not put faith in any one algo that hadn't been broken by mid-2017 will never be broken. It seems better to bet on math as a field continuing to have algos with a wide spread, than to bet on any one algo.

In that way I think it likely we'll get stuck with something like big key RSA over a long enough time period.

While at the same time I can agree with you, yes in the post-quantum world starting in '94 and LWE starting in 2005 there was a post-quantum era from 2005 to at least mid 2017 where LWE was a fast unbroken post-quantum system. Will that end-date continue to 3000 AD?

Right now I'm thinking about if the Shor trick could be applied to a theoretically quantum broken RLWE-KEX. Random Discrete Gaussian Sampling is random... Is it possible to calculate poison pill samples that would mess up a theoretically broken RLW-KEX (depending a lot on the characteristics of an imaginary break?) I found slides by Peikert online about how those samples are selected, which I haven't made sense of yet.

<comment><USER5> LWE isn't the only problem that's believed to be quantum-hard that can be used for a reasonably efficient DH primitive. Curve isogenies also appear to work, and they can take advantage of a tremendous amount of optimization work we've already done for curve math. There are also other CVP/SVP lattice problems. And this is sticking to problems that give us the same protocol-level interface; there are also quantum-hard public key algorithms that don't do that.

The more important point here, though, is that there's nothing particularly "expensive" about this stuff. It's all slower than RSA and curves, but (in particular) curves have gotten much faster over the last 10 years, and obviously computers are getting faster and silicon offloads less expensive, so the performance setback here isn't that big.

I'm also not sure why you have so much confidence in the conventional strength of RSA.

<comment><USER5> ... not, by the way, that I'm willing to stipulate that LWE is all that risky; the underlying problems in LWE are also very well studied, preceding concerns about QC by a long time.

</comment></comment></comment></comment></comment></comment><comment><USER6> > this paper introduces a new quantum factorization algorithm, GEECM,

Am I blind or did they not include the actual algorithm in the paper? I'm not very knowledgeable in this sort of stuff so to be fair I was skimming for just a simple writeout of the algorithm, I may have just missed it.

<comment><USER7> page 7 has it

</comment></comment><comment><USER8> > As part of the attack analysis, this paper introduces a new quantum > factorization algorithm that is often much faster than Shor's algorithm

Isn't that also huge news, depending on the definition of "often"?

<comment><USER9> IANAC (I am not a cryptographer), but this would seem to be big news, given the hardware to run it.

I wonder if a quantum computing revolution would cause a resurgence of research into symmetric encryption algorithms?

Because doesn't Shor's algorithm basically destroy asymmetric encryption (i.e., integer-factorization schemes like RSA are solvable in polynomial time), while symmetric encryption is only weakened? Namely, I think I remember reading that a quantum computer can search through a space of size 2^n in time 2^(n/2) for AES & friends.

<comment><USER10> > _Namely, I think I remember reading that a quantum computer can search > through a space of size 2^n in time 2^(n /2) for AES & friends._

I believe you're thinking of Grover's algorithm, which as you remember offers the ability to search for a value in a function domain in O(sqrt(N)). This is trivially countered just by doubling the key length, a 128-bit key probably couldn't be considered secure (average 2^64 evaluations) but a 256-bit would still average 2^128 and 512-bit 2^256. I vaguely recall there was some speculation that applied de Broglie–Bohm theory, if it was accurate, could allow a mild improvement but even then it only changed it to cube-root, which again could be countered with slightly larger keys (in practice 512-bit would still be plenty even then).

At least for now there don't appear to be any major algorithmic implications for symmetrical encryption from a theoretical future scalable general purpose quantum computer. Granted, there may be some practical historical ones, and in a few cases they could be of significance. If agencies have archived data of interest encrypted with 128-bit in the past, they may gain the ability to gain access to it within the next decade or two. A lot of it might be well past its proverbial sell-by date but not all if those using it were counting on it last much longer then they'd be alive.

<comment><USER2> There is a lower bound by Bennett et al. ("Strengths and weaknesses of quantum computing", SIAM JoComputing 1997) that shows Grover's algorithm is optimal for the generic search problem, so further lowering the asymptotic runtime is probably impossible.

EDIT: Also note that quantum cryptanalytic attacks may be able to break _specific_ symmetric ciphers by exploiting some structure specific to the cipher. But you're correct that QCs don't generically break symmetric cryptography.</comment></comment></comment></comment>


When can Quantum Annealing win? - <AUTHOR> http://googleresearch.blogspot.com/2015/12/when-can-quantum-annealing-win.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+blogspot/gJZg+(Official+Google+Research+Blog) <comment><USER2> > from the paper > [http://arxiv.org/abs/1512.02206](http://arxiv.org/abs/1512.02206) : _we > report the total computational effort of QMC in standard units of time per > single core._

That's an interesting way to compare quantum and classical computer "substrates" on the same footing: running time.

> _Based on the results presented here, one cannot claim a quantum speedup > [...] as this would require that the quantum processor [to] outperform the > best known classical algorithm. This is not the case... because a variety of > heuristic classical algorithms can solve most instances of Chimera > structured problems much faster than SA, QMC, and the D-Wave 2X_

So no quantum revolution yet, but potentially for larger problems and when the quantum "substrate" becomes more expressive, we'll see classical heuristics fail and quantum annealing win.

<comment><USER3> I'll add that I could cram a bunch of ASIC's with accelerators for annealing problems in a machine the size of D-Wave. You'd see magnitude-higher speedup without anything quantum at all. I'm not sure if they looked inside of one to see exactly what's running in it but I'd rule out classical acceleration methods first.

<comment><USER4> I base my speculation on this comparison: [http://bitcoin.stackexchange.com/questions/36412/what-is- the...](http://bitcoin.stackexchange.com/questions/36412/what-is-the- difference-in-speed-between-a-gpu-and-an-asic-per-dollar-of-cost) between GPU and ASIC bitcoin mining and on [https://en.bitcoin.it/wiki/Non- specialized_hardware_comparis...](https://en.bitcoin.it/wiki/Non- specialized_hardware_comparison) for GPU and CPU comparison.

From this the difference between between GPU and ASIC solution is about 10^4.

Google tested against Intel(R) Xeon(R) CPU E5-1650 single core, so it would be roughly 10^3 slower than GPU.

So one could say that ASIC solution for bitcoin mining is about 10^7 times faster than single core CPU solution.

So in this sense parents claim checks out.

Now I do not know if it is possible to generalize these finding to the problem in question.

<comment><USER4> It looks like the actual difference is 10^6.

</comment></comment></comment></comment><comment><USER5> Since I didn't know the naming scheme for D-Wave products, they are testing the "D-Wave 2x" which is the latest generation, 1,000 qubit quantum annealer, from the press release when it was launched (Which I just noticed was also linked in the Google post..):

        In addition to scaling beyond 1000 qubits, the new
        system incorporates other major technological and
        scientific advancements. These include an
        operating temperature below 15 millikelvin, near
        absolute zero and 180 times colder than interstellar
        space. With over 128,000 Josephson tunnel
        junctions, the new processors are believed to be
        the most complex superconductor integrated circuits
        ever successfully used in production systems.
        Increased control circuitry precision and a 50%
        reduction in noise also contribute to faster
        performance and enhanced reliability.

[http://www.dwavesys.com/blog/2015/08/announcing-d- wave-2x-qu...](http://www.dwavesys.com/blog/2015/08/announcing-d- wave-2x-quantum-computer)

</comment><comment><USER6> Curious what effect a doubling in the DWave machine's "qubits" would have on this factor and how soon that's likely to be achieved. Does the complexity / cost of building such a machine scale linearly with the number of qubits involved?

Are there problems that are reducible to quantum annealing that become attractive with such a performance improvement?

</comment><comment><USER4> I guess it is good time to recall this news: [http://phys.org/news/2014-11-largest-factored-quantum- device...](http://phys.org/news/2014-11-largest-factored-quantum-device.html)</comment>


How Much Do You Get Paid? - <AUTHOR> https://medium.com/tech-culture-briefs/775bd2f1c689

<comment><USER2> Disappointing. The problem is important but I was expecting the author to purpose some sort of solution. Instead the article just... ended.</comment>


Justice Dept Files Suit Against Company for Not Hiring Americans - <AUTHOR> http://www.foxnews.com/politics/2017/09/28/doj-files-suit-against-company-for-allegedly-not-hiring-americans.html <comment><USER2> So I assume they'll also go after the Trump Organization then.

[http://www.npr.org/2017/07/20/538387033/trumps-private- clubs...](http://www.npr.org/2017/07/20/538387033/trumps-private-clubs-in- florida-are-seeking-visas-for-foreign-workers)</comment>


The Outline - <AUTHOR> https://theoutline.com/ <comment><USER2> Outline is nice. But, imo it must be javascript free(atleast not that loading animation) for maximum satisfying user experience.</comment>


Show HN: Cursor that Screenshot - ed-bit http://edward.codes/cursor-that-screenshot <comment><AUTHOR> Some comments:

Add the cursors for more OS. For example, the in a Win8 screenshot the cursors look wrong.

Add more file formats to download. Now the only option is jpg that is not good for very crispy artificial images like screenshots. The letters get some noise due to the compression. At least add png (and gif (I don't hate gif.)).

What about a blinking caret or a spinning hourglass?

\--

I don't think that there is a very big market for this. It's nice to have something like this with a link to your main page to get some visibility. Anyway, do you have any idea about using the same code and changing the details to create something that appeal to more general public?

For example, can you write "Star that Photo" that allows someone to add stars of different colors? (I think it's a bad idea, but it has more public.) Emoticons? Funny eyes?What do people want to add to photos/images?

</comment><comment><USER2> I have a hard time finding a proper use case for this app... Maybe it would be more useful if you could add annotations to the screenshot as well.

Did you make this as an exercise in JS or do you intend to polish this off and make it into a real product?

</comment><comment> ed-bit Easily add a cursor to your screenshot using just a simple web app.

Any feedback is appreciated!

</comment><comment><USER3> A strange app.</comment>


Show HN: Ludigraphix, geometry-oriented vector drawing software for Mac - <AUTHOR> https://www.ludigraphix.org/ <comment><USER2> It'd be really, really sweet if this exported the drawings to CoreGraphics code (swift or objc). I'm really looking forward to giving this a try when I have some free time and a bit of cash.

<comment><AUTHOR> It's an interesting idea. I will have to look at it in the future.

</comment></comment><comment><USER3> This is similar to Vector Graphics Complexes: [https://www.vgc.io/](https://www.vgc.io/)

<comment><USER4> How is it similar? VCG seems to be about time varying topologies for animation. Ludigraphix seems to be about hierarchical relationships between geometries with a fixed topology.

Apart from both using curves to represent geometry I don't really see any overlap in features or application/target users.

Maybe I'm missing something?

<comment><USER4> On that note: I think Vector Graphics Complexes and Ludigraphix should join forces.

Those two core features in a single app would open the door to a lot of opportunities.

</comment></comment></comment><comment><USER5> Is there a demo available? I'd really prefer to test this out before committing to roughly $30.

And why is the docs page on Github when the source apparently is not? Are you hoping the users will write the documentation?

<comment><AUTHOR> I have made a demo version (without save/exports) but binaries are not signed :

[https://drive.google.com/drive/folders/1jhpub6pfIS0tvbFzoiBq...](https://drive.google.com/drive/folders/1jhpub6pfIS0tvbFzoiBqRsqEb98qa5Ny)

</comment></comment><comment><USER6> I _REALLY_ like this. Is there any chance of a windows version someday? Regrettably, I've gone back to Windows owing to Apple's inability to make a functional keyboard.

<comment><AUTHOR> I will try to put it on Windows Store soon. I can send you a binary if you send me a mail (support at ludigraphix dot org).

<comment><USER6> Hey, thank you for the offer. I was able to grab one of your promo codes for OSX. (I still have a 2012 mac mini that works). When you decide to put it on the windows store, or however you do I'll purchase a copy!

Thank you kindly!

</comment></comment></comment><comment><USER7> Sounds a bit like the awesome Geometer's Sketchpad?

<comment><AUTHOR> I don't know Geometer's Sketchpad but I see my software as a drawing software with geometry features and not as an educational geometry software.

I have always been frustrated with vector drawing software because shapes are not linked together (except for grouping) and this make complex drawing very hard to modify. This is an attempt to solve this.

I originally wanted to add some generative capabilities like contextfree ([https://www.contextfreeart.org/](https://www.contextfreeart.org/)) but I have not gone in this direction at the moment. The more "generative"-like feature is currently path effects ([https://www.ludigraphix.org/path- effects](https://www.ludigraphix.org/path-effects)).

<comment><USER8> Sounds like your ideas are somewhat similar to what CAD programs do with relations and dimensions etc. For example in SolidWorks you can define the following types of relations between features in the sketch, in addition to basic dimensions (length/radius/angle): [https://help.solidworks.com/2019/english/SolidWorks/sldworks...](https://help.solidworks.com/2019/english/SolidWorks/sldworks/HelpViewerDS.aspx?version=2019&prod=SolidWorks&lang=english&path=sldworks%2fc_Description_of_Sketch_Relations.htm&verRedirect=1)

</comment></comment></comment><comment><USER9> Hey, any chance of a non MAS-link? Some of us still vastly prefer that method of installation. Also, this seems neat!

</comment><comment><AUTHOR> Here is some promotion codes:

       9KJ9RFYF9ARW
       KWXLKFPWKA9J
       TPWWHEWTYTH6
       H67F7TH6LRXR
       FTE9H9J3X96K

(for info the codes will expire on 2019-07-22)

<comment><USER10> FYI all codes are now redeemed.

<comment><AUTHOR> Here is 10 more :

      W3TATT7TYTEE
      7ETJWA4RWHYN
      NP7PNA99N4AH
      T4HAXMLWKRNJ
      6YMKRNLK96FE
      69FJJKL3PXJ7
      A3NKEXNK99NA
      3NJRARYXARWF
      F7FTW3Y343Y7
      4AF7PARPJ9HJ

<comment><USER11> All seem to be used - bummer - looks amazing.

<comment><AUTHOR> Here is 10 more :-)

      3XERMFTW3JP3
      3NAJNRKXJ4WW
      NM7TELFXHEE7
      4H9KJ346LMMT
      9WEFW7TRXE3M
      WJY6KXN4M9Y7
      A46TE7PHN74F
      LP9PJL4TFL4L
      FX9AHKWHWXLR
      YMPEYYRPKM44

<comment><USER12> Anyone trying to use: they've all been redeemed</comment></comment></comment></comment></comment></comment>


Using smart-cotracts to create the platform as a virtual accelerator - <AUTHOR> https://email@example.com/hack-ether-camp-2016-fda56c006f8d#.2amalzb0la <comment><USER2> I am curious if they are going to create a coin for this stuff, it looks very natural.</comment>


Berkeley to be granted long-sought CRISPR patent, reviving dispute with Harvard - <AUTHOR> https://www.statnews.com/2019/02/08/the-university-of-california-gets-its-key-crispr-patent/ <comment><USER2> Is there a version of this article that doesn't require subscribing?</comment>