Edward Snowden interview: 'Smartphones can be taken over' - <AUTHOR> http://www.bbc.co.uk/news/uk-34444233 <comment><USER3> Everybody talks about the OS, buy nearly everyone forgets about the base band, the hidden OS on every phone that you have almost no control over.

Whilst the media is worrying about Apple iCloud and phone encryption, GCHQ are quietly delving into your base band and enjoying the smoke and mirrors.

To use analogy, we are worrying about the government looking under our clothes, whilst in fact they are peeling back or skin and skulls and peering into our humanity.

<comment><USER4> People talk about it less these days because modern modem/baseband chips are sandboxed. In older phones they had bus master access and could do whatever they wanted, hence their frequent targeting by unlockers. But they didn't need all that access and have since been locked down a fair bit. Also, Qualcomm at least got more serious about security and started hardening their firmwares.

Also, intelligence agencies tend to be after stuff that the baseband doesn't have any convenient access to, like photos and files on disk. Even though an un-sandboxed baseband could theoretically access the hardware, it'd be doing so in parallel with the real OS and that'd be super painful to implement.

Finally, why bother when the OS is such a bigger surface area? The IC's aren't magic, even if they developed some impressive tricks under the cover of secrecy. They attack systems in the same way as your average defcon presenter does.

</comment></comment><comment><USER5> Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone if asked by the government. As long as you don't control the backend and even the frontend, you're at the mercy of whoever controls it (Apple in this case). That's why all the Apple talks on privacy lately sounds like not much more than good marketing to me.

<comment><USER6> Google can do that, too, through the "Play Services" framework, in case others weren't aware of it. We know this because Google has already used these "powers" to uninstall apps/malware from phones (non-Nexus).

<comment><USER7> Yeah--reading the Ars Technica review of Marshmallow terrified me with some of the things they are doing there. Like the fact that users have more granular control over permissions now, but internet is always on for apps no matter what, there's a whole slew of permissions that aren't exposed through the user-controllable permissions that are pretty bad, and there's new stuff in there that allows screenshots to be sent from an app to Google for "searching in the app." I try to read this stuff without a tinfoil hat, but they sure don't make it easy.

<comment><USER8> What permission are you referring to, that allows apps to send screenshots to Google?

<comment><USER7> Not sure it is actually a permission so much as a feature of Google Now.

Paragraph 2 of this page: [http://arstechnica.com/gadgets/2015/10/android-6-0-marshmall...](http://arstechnica.com/gadgets/2015/10/android-6-0-marshmallow- thoroughly-reviewed/3/)

</comment></comment></comment></comment></comment><comment> rm_-rf_slash None of this should be a surprise. We should expect that any device with Internet access can be hacked by someone, regardless of their intentions. If it isn't the NSA it's Chinese "patriot hackers" or Russian cyber-criminals operating with the consent of their governments. Or many others. Instead of seeing this security state as a binary, we should always consider two questions:

1: How much do we value our privacy and security versus the needs of society (in the case of backdoors and so on), and,

2: How much do we trust the people whose business is having the ability to break into our phones? I don't like how invasive our security agencies are but if they end up preventing major crimes or terrorist attacks I can't say what they do is wrong.

At the end of the day, I want the people defending me to be more powerful than the people attacking me, but I don't want my defenders to use their same tools against me.

<comment><USER9> > I don't like how invasive our security agencies are but if they end up > preventing major crimes or terrorist attacks I can't say what they do is > wrong.

What if they're just using the information to further their own personal power and fortune and forestall any potential rivals?

<comment><USER10> Depends.

If it's the Chinese or the Russians then it's bad. And you never hear about _them_ being in the business of preventing major crimes or terrorist attacks.

If it's the NSA then it's either hype, speculations without any real evidence, right up until there is, and then it's "not surprising".

</comment></comment></comment><comment><USER11> "Describing the relationship between GCHQ and its US counterpart, he said: "GCHQ is to all intents and purposes a subsidiary of the NSA.

"They [the NSA] provide technology, they provide tasking and direction as to what they [GCHQ] should go after." "

This is the juciest part. This is the confirmation we've been suspecting for a long time: CGHQ is the NSA, and all of their programs are shared. This means that we can pin the worst abuses of GCHQ onto the NSA, and also confirm that US citizens are directly targeted by even the most outrageously invasive surveillance efforts-- there is no exempt population, proving the NSA's PR lies once again.

<comment><USER12> Snowden wasn't a liaison between CGHQ and the NSA. How would he know if it were a subsidiary of the CGHQ. If it's from documents he took, then were is the documents showing it?

I'm sure there is a lot of cross sharing of information, but to call it a subsidiary is a bold claim.

Snowden was a database admin, not John Brennan.

<comment><USER11> I don't have the ultimate answer here, but why were the (highly classified, some marked "no foreign national viewing") GCHQ slide decks on NSA servers?

I also assume that their slides reference each others programs frequently. Maybe this is incorrect.

<comment><USER12> They obviously work together very closely. I'm just objecting to the idea that the UK spy agencies are just American outposts and that each agency is responsible for the mistakes/crimes of the others.

Maybe they are really pushed around by the US, but I'd have to see more than Snowden making unfounded statements about it. In the past, he's made some illogical leaps based on some of the information he took. It's very easy to do that when you expect the worst of someone/thing.

<comment><USER13> > I'm just objecting to the idea that the UK spy agencies are just American > outposts and that each agency is responsible for the mistakes/crimes of the > others.

The UK agencies aren't US outposts and the US agencies aren't UK outposts.

They're all AUSCANNZUKUS/Five Eyes outposts.

</comment></comment></comment></comment></comment><comment><USER14> My understanding may be dated, but I have often wondered if the battle for privacy is a lost cause in the mobile phone space. Even with a ground-up open platform for the phone and OS, current regulation requires blob of 'certified' hardware and software between you and the antenna/network. Short of using my phone to acoustically-couple a 2400baud cryto-stream (the call meta-data of which still being snitched), I'm really not sure if privacy is possible.

<comment><USER15> Not total privacy since the network knows who's on both ends, or at least that you're on one end, but as long as you can tunnel encrypted traffic over it via a hotspot, I'm not sure how that could be cracked.

<comment><USER7> One way that I've been wondering about is all these new keyboards coming on the market. Things like Swype, Swiftkey etc.

They have cloud storage for storing data to feed predictive algorithms, but it essentially becomes a cloud-based keystroke logger.

So you may be sending encrypted traffic via hotspot, but your keyboard process running in the background has the raw input data and is feeding that to a server.

I'd love to read a more detailed writeup on the security of such apps, which ones are trusted (ie. only using local encrypted storage, no phoning home), etc.

</comment></comment></comment><comment><USER16> I would be surprised if Apple has let a vulnerability of "send text message, pwn phone" linger for very long. Article doesn't mention brands or versions, but it is quite important to fully understand.

Or does this work at a lower level? I've heard the radio chips themselves are untrustworthy, but how would they control the main OS on another chip?

<comment><USER17> Enter "the baseband". A dark, undocumented, hardly accessible, obfuscated piece of code that has access to your microphone, GPS, battery management and lots of other gimmicks.

[https://news.ycombinator.com/item?id=6722292](https://news.ycombinator.com/item?id=6722292)

If I were a three-letter-agency I knew where to hide dead bodies while everyone was arguing over operating system security.

<comment><USER18> That sure goes a long way toward showing how powerful Stingrays are, and why Harris and the government really, _really_ don't want information about them getting out. I got a chuckle out of this near the end of the article:

> Whenever someone does dive into baseband software, many bugs and issues are > found, which raises the question just how long this rather dubious situation > can continue.

Well, the baseband software was written in the 90s, the article was written in 2013, and I'll bet nothing has changed in the last two years.

<comment><USER7> Really have to wonder how many of these bugs and issues are "bugs" and "issues."

</comment></comment></comment></comment><comment><USER7> What about 3rd party keyboards like those that have recently made their way to iPhones and have been on Android for a while?

All of them (even Samsung's swype style keyboard) seem to have some sort of cloud-based storage for your data so it can remain equally predictive across your devices. Is there any good security research out there on how safe these keyboards are and which ones are the worst offenders? Seems like it is essentially a user-installed cloud-based keystroke logger ripe for abuse.

I love the functionality of some of them, but man do they terrify me.

</comment><comment><USER19> I'm surprised HN readers don't already know this. It still astonishes me how so many so called "tech savvy" users are content with surrendering their privacy and freedoms to Google or Apple so that they can run the latest "apps".

This is why I'm backing the Neo900[1]. It might be a bit pricey and low spec'ed by today's market (a consequence of it catering for a niche market meaning it won't be mass produced) but in my opinion that's a small price to pay to actually own your phone (it's actually more akin to a mobile computer than a phone).

[1] [http://neo900.org/](http://neo900.org/)

<comment><USER20> You're not accomplishing what you want to accomplish with this

> are content with surrendering their privacy and freedoms to Google or Apple > so that they can run the latest "apps".

You have the choice of not running apps. Get a feature phone.

You can create a fake account on Google (or even better, get an Amazon fire phone, or some Chinese one that is based only on stock Android). Or just Ubuntu Phone/Cyanogen mod it

> it's actually more akin to a mobile computer than a phone

Based on the original N900 let me say it is going to be a _much worse_ experience than your Average android phone, especially running Debian and having a resistive touchscreen.

And the phone company will still know your location

<comment><USER21> > Based on the original N900 let me say it is going to be a much worse > experience than your Average android phone, especially running Debian and > having a resistive touchscreen.

The N900s resistive touchscreen is more sensitive and accurate than any capacitive touchscreen I've ever used. Also, unlike capacitive screens, you can use it when your fingers are sweaty, wet, or gloved, and anything in arm's reach can be a stylus, rather than having to wait for Apple to grant you one.

Using a capacitive screen after getting used to the N900s resistive one feels like I'm navigating with my elbow. And that elbow had better be completely dry, and not a pencil eraser.

I have no idea how Apple managed to force the meme that capacitive screens are not shit compared to resistive ones. Maybe at some point there was a glut of cheap Chinese tablets and phones with crappy resistive screens?

<comment><USER20> Maybe because of the n900s form factor resistive screens were better

I remember other Nokia phones with resistive screens and they were passable at best, and not comparable with capacitive ones (at least most of them, I remember seeing a Motorola phone with an awful capacitive screen)

You don't need to wait for Apple for a stylus, really

Swiping on a resistive screen is a frustration as well

<comment><USER21> > Swiping on a resistive screen is a frustration as well

Not on a ancient N900. I can't imagine that this is an area in which technology flows backwards.

</comment></comment></comment></comment></comment><comment><USER22> What strike me most is the amount of people around me who don't care about this.

<comment><USER23> Well, it's a sort of institutionalized resignation... I mean, if there's nothing you can do about it, what should you be doing? Switching to a blackphone? What if your organization doesn't support a truly secure option?

It's like hearing that Microsoft and the NSA had a backdoor 20 years ago - <USER2> the time I didn't have an option for my work machine, so I just grunted and went along.

</comment></comment><comment><USER24> "Nosey Smurf is the 'hot mic' tool. For example if it's in your pocket, [GCHQ] can turn the microphone on and listen to everything that's going on around you - even if your phone is switched off because they've got the other tools for turning it on."

Are they implying that all/most smartphones still communicate with cell towers when turned off? (obviously this isnt happening) - Or do they pwn the device before hand to have it fake that its turning off while remaining on?

<comment><USER25> Well, it can happen: [http://www.tomsguide.com/us/nsa-remotely-turn-on- phones,news...](http://www.tomsguide.com/us/nsa-remotely-turn-on- phones,news-18854.html)

and [http://www.osnews.com/story/27416/The_second_operating_syste...](http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone)

<comment><USER23> Next up: Explosion of sales of Faraday cases for smartphones (and the subsequent banning of sales through ITC and/or legislation).

Oh, who am I kidding.

<comment><USER4> When Snowden met Greenwald+Poitras he apparently just used a fridge to store the phones.

</comment></comment></comment></comment><comment><USER26> I'm trying as good as I can to protect myself against such attacks. My android smartphone is permanently in airplane mode and I don't use a sim card. Do you still see a security risk?

<comment><USER27> I keep the battery out at all times, even when I'm using it. Just to be safe.

</comment></comment><comment><USER28> If a device is known it can be hacked. Anonymity is the key. Use roaming sim card (it will require some cooperation of the remote operator, so kinda makes it harder). What to do to mitigate - no sim card. If have to use sim card - imei randomizer. Wifi mac address randomizer.

</comment><comment><USER29> It seems strange to me that the Snowden is only now mentioning the "text message" attack vector, after everyone already knows about Stagefright. Is he out of things to leak? or did he mention it before and go unnoticed?

<comment><USER30> The kind of attacks that he is referring are located at the lower levels of the phone, at the SoC level, not at the operating system level.

It's something that neither Apple nor Google can control.

<comment><USER31> Allow me to quote the first sentence from the Wikipedia article linked to below:

        Apple Inc. has developed a range of
        "System on Chip" (SoC) as well as
        "System in Package" (SiP) to power
        their mobile consumer devices.

[https://en.wikipedia.org/wiki/Apple_system_on_a_chip](https://en.wikipedia.org/wiki/Apple_system_on_a_chip)

<comment><USER32> That's still only the processor that runs iOS. They don't make their own cell processor.

<comment><USER29> what? By "cell processor" do you mean radio hardware? Because that is indeed contained within the SoC.

<comment><USER33> If you pull up a tear down of an iPhone 6 you will see the Qualcomm MDM9625M is clearly an entirely separate chip from the Apple A8, and is halfway across the circuit board.

</comment></comment></comment></comment></comment></comment><comment><USER34> > Mr Snowden said GCHQ could gain access to a handset by sending it an > encrypted text message and use it for such things as taking pictures and > listening in.

Are there hardware GCHQ keys in the phone for verifying the encrypted text? I imagine there would have to be, otherwise anybody (with enough time and research) could construct one of these messages to gain control of the phone.

<comment><USER35> > otherwise anybody (with enough time and research) could construct one of > these messages to gain control of the phone.

Which is exactly one of the strongest arguments against building backdoors into products, eventually you won't be the only one with the keys.

</comment></comment><comment><USER27> The question I have is the issues around crashing a device via texts[1]. Was that part of this scheme? Was it put in there on purpose?

1\. [http://www.techtimes.com/articles/55893/20150527/one-text- me...](http://www.techtimes.com/articles/55893/20150527/one-text-message- crash-iphone-heres-fix.htm)

<comment><USER36> That's doubtful, 'effective power' (incidentally that bit of the text was completely arbitrary) was (seemingly) a hard crash caused by an error in the text shortening for the banner notification pop down. Tom Scott has a good speculation video on what might be going on that seems pretty sound.

[https://www.youtube.com/watch?v=hJLMSllzoLA](https://www.youtube.com/watch?v=hJLMSllzoLA)

</comment></comment><comment><USER37> Looks like Vysk's QS1 is aiming to mitigate the baseband hacks - [http://www.theguardian.com/technology/2014/jul/25/startup- cl...](http://www.theguardian.com/technology/2014/jul/25/startup-claims-to- have-built-an-un-hackable-phone-case-that-encrypts-your-calls)

</comment><comment><USER38> HN regulars may well be aware of all these things, but it's good to see this on the pages of the mass media.

</comment><comment><USER39> The all seeing eye...

</comment><comment><USER40> Top Comment Paraphrase: "I knew about this before it was cool."

When someone posts a new python/lua/lisp feature intro, no one says "I knew that already!" or "No new info here!" But if it's about security or privacy, the HN zeitgeist wants to denigrate it as "old news."

<comment><USER41> Nerds tend to operate in a sphere of "once I know something, nobody must ever tell me again."

So, they know something and, just by feelings, assume everybody else knows it too. They assume hearing repeated information wastes the time of _everybody._

The truth is, average people don't even pick up on ideas until the 5th or 8th time they hear them.

Even the Snowden revelations weren't _revelations_ per se. We knew about Carnivore before and about the AT&T splicing room and even in the 90s people would half joke half serious comment about how the government watched all online communications.

The Snowden documents just solidified the nerd fears. Plus, since the 90s, the Internet grew so big and so popular that people just kinda gave up on the idea that it could even be monitored or tapped en masse. The benefit of the Snowden dump was showing it _is_ possible and it _is_ happening (instead of just being conspiracy theories) and you can't do squat about it.

<comment><USER40> I see the mechanism you're talking about, but as I said, this doesn't seem to happen with technical information. For example, if some one writes an intro to AsyncIO, there are basically never comments like "this should be obvious to anyone who read the PEP," or "there's nothing here that you couldn't infer from the source." It seems to be something about privacy/security stories.

I think that it stems more from a nihilist-chic then a borderline autistic inability to understand that other minds contain other information.

<comment><USER41> _nihilist-chic_

Yeah, as this comment node pointed out, the whole " _I_ knew about it first" force is in full effect here.

The other root cause here: when people have self-pride over the information they are sharing as if it were new, but you knew the new information a long time ago, and you just want to knock them down a few prideful rungs.

Or, just [https://xkcd.com/1053/](https://xkcd.com/1053/)

</comment></comment></comment></comment><comment><USER42> As much as I admire Mr. Snowden for what he did, he is not an expert outside of the documents he took with him. He isn't privy to anything happening now. He didn't build anything or code anything. All he did was steal from some idiots that should have known better how to secure information. This does not make him omniscient.

<comment><USER43> What are you arguing here? Is something he said incorrect? I don't think anyone is claiming he is a deity.

</comment></comment><comment><USER44> Old, old news: [http://www.theguardian.com/world/2014/jan/27/nsa-gchq- smartp...](http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone- app-angry-birds-personal-data)

<comment><USER45> Yes, but it certainly bears repeating, until it is also widely known.

<comment><USER46> Personally, I did not remember this capability until I saw this article, and I've followed the whole deal a lot closer than my circle of friends. People either don't know or don't care and don't know that they _should_ care.

In the presidential debates and primary campaigns, how many times did you see someone say that this is a major issue? I can definitely point to presidential hopefuls making the opposite point, however.

</comment></comment></comment><comment><USER47> Edward Snowden is not a hero IMO, anyone who cared to look knew for years the government had vast surveillance powers. Is anyone else tired of seeing his headlines? The guy seems to really want to be a celebrity? Does he deserve that? I'm not trying to be rude, only suggesting we rethink our attention to him.

<comment><USER48> He's the one who provided the evidence. Without evidence you're just a conspiracy theorist. (Note the theory part.)

And frankly he doesn't deserve the fame, and I don't particularly think he wants it either. But the data he provided (illegally, at continuing risk to himself) opened up a much-needed conversation.

<comment> vezzy-fnord _He 's the one who provided the evidence._

The evidence was there for a while. Most people could not suspend their disbelief long enough to take it seriously.</comment></comment></comment>


Arduino Zero Pro released - <AUTHOR> http://www.arduino.org/products/arduino-zero-pro

<comment><USER2> Interestingly this isn't on the official arduino.cc site, but rather the "other" arduino site.

more info here: [https://www.techdirt.com/articles/20150217/10345530055/is- ar...](https://www.techdirt.com/articles/20150217/10345530055/is-arduino- heading-towards-first-open-hardware-fork.shtml)

<comment><USER3> It seems to be there now. Not sure why one is pro and the other one not.

[http://arduino.cc/en/Main/ArduinoBoardZero](http://arduino.cc/en/Main/ArduinoBoardZero)

<comment><AUTHOR> That has been there for some time now. In the board overview you'll find it listed as coming soon.

</comment></comment></comment><comment><USER4> Nice, I've been surprised the ATMega chips have lasted as long as they have given how much more powerful ARM Cortex-M chips are, and they are about the same price. For sp332 there are three "general" groups of the Cortex M series,

M0/M0+/M1/M2 - ARMv6 - basic peripherals

M3/M4 - ARMv7 - optional floating point

M7 - Basically everything on steroids

I find the M4 feels like a sort of blend between the 80286 and the 68010.

<comment><USER5> What do you mean by your last sentence? Looking at simplest benchmark - Dhrystones both 286 and 68000 reach ~2K. Arm M3 does ~1K _per MHz_, M4 1.2/mhz.

We are talking Pentium 100MHz performance out of Arm M4 150-200MHz (freescale 150/st 168/nxp 204 MHz). Even <$2 STM32F103 (72MHz) is faster than Intel DX4 100MHz.

16MHz Atmels lasted so long only due to Arduino :/

<comment><USER4>
       > What do you mean by your last sentence?

From a programming model perspective. Granted pure performance is higher. The programming model though of a 'large' address space, modest memory protections (not remamping but some execution protection etc, a simple 'user' and 'kernel' mode, and modest I/O channel bandwidth.

<comment><USER5> I love flat address space, its perfect for embedded. As for IO its not that grim once you go up to fatter chips (STM32F42*). FSMC, high speed usb, 100mbit ethernet, dedicated camera/LCD interfaces, high speed GPIO with dma. Super cheap STM32F1xx does about 7MB/s over GPIO, almost ISA speed.

</comment></comment></comment></comment><comment><USER6> I don't know how much this thing will cost, but you can get any ST Nucleo board (up to Cortex-M4, detachable ST-Link programmer/debugger and headers for all I/O, including Arduino headers) for $10. Hard to beat that.

<comment><USER4> Yup, the Nucleo F411RE is my current go-to board for starting a new project ($10.44 in singles from Digikey with both an 'Arduino compatible' connector on the top and a bunch of other I/O from the chip on the 'outer' connectors.

<comment><USER6> > the Nucleo F411RE is my current go-to board for starting a new project

Well stop it! Distributors keep running out of that one when I want one.

</comment></comment></comment><comment><USER7> It's too bad there is no ATMega chip to pull off and plug into a bread board.

I liked the idea of using the Arduino as a programming centre. Put the chip into a project and then grab another chip to program for the next project.

<comment><USER8> You won't find many powerful ARM chips that are in a DIP package. There are a couple from NXP (like the LPC810: [https://learn.adafruit.com/getting-started- with-the-lpc810/i...](https://learn.adafruit.com/getting-started-with-the- lpc810/introduction)), but otherwise it's just not worth the chip manufacturers time to build something that would have such low demand (relative to all the other stuff they make).

</comment></comment><comment><USER9> Why must ARM have the most confusing part names? Where does the M0 fall in their lineup?

<comment><AUTHOR> There are several Cortex chips.

Cortex A (with rather high numbers) are relatively high performance chips, commonly found in one board computers, something like the BeagleBoard.

Cortex M are microcontrollers for embedded usage, slower clocks, but geared towards periphery like CAN, SPI, I2C etc. You can find a lot of those in industrial use.

Cortex R are less common, I think they are geared towards automotive, for real-time stuff, although -M is also used for that.

Above all those sit those big ARM9/ARM11 chips.

Within the M family there are 0 for relatively tiny footprint, 1 is special (synthesized into your FPGA), 3 is the "normal" one, and 4 has DSP capabilities and a bit more performance.

<comment><USER10> Some more info:

A stands for application. These chips are full featured processors which are runnning big operating systems (e.g. Linux)

M is microcontroller. These are running either with no operating system or with a lightweight realtime operating system (e.g. freertos)

R is realtime. These are probably the most niche controllers and are used for things with realtime constraints. Besides automotive safety you can also find them used as SSD controllers.

<comment><USER11> What makes a chip realtime? I thought that was more a feature of the code running on a chip than of the chip itself (for 'normal' designs)

The only feature I can think of there is 'no support for demand-paged virtual memory', but even that isn't strictly needed for a real-time system.

<comment><USER12> The official Cortex-R page lists three main items:

        - Fast, bounded and deterministic interrupt response
        - Tightly Coupled Memories (TCM) local to the processor for fast-responding
          code/data
        - Low-Latency Interrupt Mode (LLIM) to accelerate interrupt entry

I haven't cross-compared the relevant features to the Cortex-M cores, but the M cores are certainly more common and definitely perform well too.

</comment></comment></comment></comment></comment><comment><USER13> 3.3V, like the Due, that's unfortunate. This means it won't be compatible with most of the Uno shields, or 90% of the sensors on the market.

Kinda wish Arduino had gone with something with wireless stuff built in, like the Linkit One or RFduino.

<comment><USER6> > This means it won't be compatible with ... 90% of the sensors on the market

Are you sure about that? 3.3v is extremely common in the industry, to the extent that a lot of hobbyist 5v stuff has to be level shifted.

</comment></comment><comment><USER14> I'm not sure why anyone would buy an Arduino considering products like Teensy 3.1 or Maple. Maybe the slightly lower cost is what is keeping Arduino alive.

<comment><AUTHOR> Good enough. Everyone has exactly this board. I don't have to worry about whether the compatibility promises carry some footnotes with them.

Arduino is about having a common baseline. People who are more experienced can "upgrade" to other boards.

<comment><USER15> don't forget the community and libraries you can leverage. Personally I'm still using arduino for the excellent acelstepper library.

<comment><USER14> Teensy and Maple are software compatible with Arduino.

</comment></comment></comment></comment><comment><USER16> So the stripped down little brother of the Due, which has been around for some time?

I don't see price mentioned. Hopefully it's proportionally cheaper as well.

<comment><USER17> It can't be too crazy expensive, there's not a lot of expensive parts on the board.

</comment></comment><comment><USER18> Special mention goes to the 32KB of SRM, the 12bit ADC and the analog outputs. Love it!

<comment><USER5> yes, its 'almost' as good as $5 chinese ARM M3 Maple clones

[http://www.ebay.com/itm/STM32F103C8T6-ARM-STM32-Minimum- Syst...](http://www.ebay.com/itm/STM32F103C8T6-ARM-STM32-Minimum-System- Development-Board-Module-For-Arduino-DHUS-/321569700934)

[http://www.ebay.com/itm/Hot-Sold-New-STM32-ARM- Cortex-M3-Lea...](http://www.ebay.com/itm/Hot-Sold-New-STM32-ARM- Cortex-M3-Leaflabs-Leaf-Maple-Mini-Module-For-Arduino-/311248450407)

<comment><USER19> So frustrating that here in the US, you can't even buy those individual components for that price, even if you buy them on reels.

I'm not sure if it's the distributor's profit margins, counterfeit parts, yuan-to-dollar advantages, or what.

Probably a combination of all that and more.

I doubt the STM32F103 is a knockoff though.

And they cost over $3 here in the US even on reels of 2400 pieces.

</comment></comment></comment><comment><USER19> Arduino team(s?): Atmel now has an L21, a lower power version of the D21.

Should drop right in.

</comment><comment><USER20> Why is there no USB port ?

</comment><comment><USER21> 256K of flash? They must have to try to get chips that small. Is it an addressing problem?

<comment><USER22> They are talking about the flash memory built into the microcontroller itself, not about external flash storage. Generally this stores the device's firmware. 256K is a completely reasonable size for this class of microcontroller.

<comment><USER21> So it's, what, 180nm?

<comment><USER22> No idea. Can't recall ever hearing anyone discuss the fab processes used for microcontrollers; people only really care about that in the high end PC world.

edit: here's Atmel's page with the mcu specs, if you're curious: [http://www.atmel.com/devices/ATSAMD21G18A.aspx](http://www.atmel.com/devices/ATSAMD21G18A.aspx)</comment></comment></comment></comment>


Show HN: Mixily is a privacy-conscious alternative to Facebook events - <AUTHOR> https://www.mixily.com/? <comment><USER2> I think it would be better to have the mobile number as another way of logging in the website.

People generally have the mobile numbers handy, as compared to email ids, which we generally don't have, for acquaintances, or friends.

Plus, it would be easier to invite, share, etc. Good for adoption, I think.

</comment><comment><USER3> Very cool! Thanks for making this - every week I hear someone mention that they want to stop using Facebook or Google products. (Too invasive.) How do you see this being different than Eventbrite?

<comment><AUTHOR> Thanks! That's exactly our motivation.

Eventbrite is good for ticketed corporate events. We're building a great product for consumers—events like book clubs and dinner parties.</comment></comment>


Ask HN: How long do carriers store the content of SMS messages? - <AUTHOR>

This issue came up in a conversation I was having with someone who is currently in the midst of an ugly divorce.  I seem to recall reading some Verizon or AT&T law enforcement documents on Cryptome indicating there was a period of 90 days or so that they are stored in case LE agencies need to request them.  Am I remembering that correctly?  Would this work the same in a civil proceeding? <comment><USER2> Given the willingness of the carriers to roll over for any quasi-legal government demands, I'd be surprised if the answer is not "forever". But I'd also be surprised if you were able to get access to them in a purely civil proceeding.

</comment><comment><USER3> Mobile operators normally keep text message logs for a short period of time (a few hours or days depending on the operator). After that, they usually keep a CDR (Call detail records, which is information about the subscriber billing activities kept by Network operators) with data such as the time of the text message and the originator and destination of the message. But for privacy purposes the complete logs with the content are no longer available. Regarding matters such as lawsuits I know that text messages can be shown as evidence during the course of a trial in some countries, however, I am not sure when it is legal to get in touch with the operators to get SMS records from a particular user and for the phone companies to show their records for legal purposes to certain parties. I believe this also will depend on the country and legislation applicable.</comment>


Entrepreneurshit? Bitch Please - <AUTHOR> http://blog.davidkatz.me/post/36010138674/entrepreneurshit-bitch-please

<comment><USER2> Not everyone is like you, who's satisfied with a small business making enough money to get by with a relatively satisfactory life. People who risk everything to make something happen don't deserve to hear "Bitch please". The people who wake up at 4am are the ones do it because they chose that life, never because VCs push them to.

<comment><USER3> Author here. Everyone can make their own choices. My 'Bitch Please' (which was perhaps an over reaction to 'Shit') is in no way addressed to Entrepreneurs, but to Mark Suster, who paints Entrepreneurship as shitty.

About VCs - they don't push anyone, but they enable it.

</comment></comment><comment><USER4> I never want to see "Bitch Please" on the HN frontpage.

<comment><USER3> Sorry about that. I'm not a native english speaker. To my ear, 'Shit' and 'Bitch' has about the same potential offense.

<comment><USER4> It's not that it's a swear word, it's that "bitch please" feels to me like something straight out of memes/rage comics. Things like this impacted hugely on reddit's quality downfall, and I wouldn't be too avid to see this happen here.

<comment><USER3> Gotcha. Next time, I'll watch my swearing more carefully.</comment></comment></comment></comment>


Ask HN: What concepts in your field are the most difficult to explain simply? - <AUTHOR> <comment><USER2> What I actually do. My job is super interesting, but I can't find a good way to explain it to outsiders. I am a software engineer in the games industry. If I worked on gameplay it would be a bit easier, but I work on core tech/central engine tools. A layperson has no idea what that means and any examples I can think of to give them are just as confusing unless they already have some familiarity with AAA game dev infrastructure and workflows. This is surely a failure of me not being able to find a good way to explain it yet; it feels like I'm working on so many different things in this area that there isn't a single clear-cut description I can come up with that an outsider would easily understand.

</comment><comment><USER3> Why it's so difficult (impossible) to accurately estimate software projects and why programming does not fit the "assembly line" model.

</comment><comment><USER4> I'm working mainly with machine learning field, if there is something difficult for me, then it means I dont fully understand it. Then I'm trying to improve my knowledge. The good test of understanding is to try explain it to the wife :)</comment>


Ask HN: How do you find out about new tools? - <AUTHOR> I am trying to figure out the best way to find out about new tools or techniques in data engineering and was wondering what are some good sources? <comment><USER2> I found this weekly news site to be really helpful [https://dataengweekly.substack.com/](https://dataengweekly.substack.com/)</comment>


To apply, solve the following... are you kidding? - <AUTHOR>

This is about the 4th job I've looked at that requires some kind of boring but time sucking piece of code to be written just to apply...
http://www.codeeval.com/public_sc/12/
What the heck?  Do these companies only want people to apply who are not busy or are desperate for jobs? <comment><USER2> This problem is too easy to weed out the good hackers from the bad. Solving it doesn't show that the coder is willing to go the extra mile for your company nor does it show that the coder is any good. It's just a waste of everyone's time.

This company probably thought that since other companies have these types of hoops in place, they need to also have them in order to look legit.

</comment><comment><USER3> Good and Bad?

This problem is very basic and might attempt to demonstrate the candidate's competency around basic algorithms, data structures, and performance (although nothing was specified about efficiency and this is very basic). I feel like good programmers code all the time and love to solve problems with code. So it seems like the average coder would not have much aversion to something like this.

The biggest issue is that it may not even reflect the domain that the candidate would normally work in. What if this was a javascript job? Would this be a good filter?

As developers, we have access to so much information on so many topics around computer science. I think they are important to know, but they can also be referenced and learned. It seems like an invaluable skill set (at early stage startups) is to be able to "figure stuff out".

For me, the ideal hiring process is to do a quick phone screen and filter by existing code sample, then "hiring" a candidate for the day, have them come in, work on a small project alone for half the day, then spend the other half pairing and refactoring the project. This may seem like a lot, but you learn important things, like if someone can quickly work on something on their own, how they work with other team members, an example of their personality with team and in office, etc.

At the end of the day, I am looking to hire people that "fit" personality-wise and can get sh*t done, groking what they need to and overcoming any obstacles in the way.

</comment><comment><USER4>
      corpus = """

      yellow

      tooth

      """

      for line in corpus.splitlines():

        for letter in line:

          if line.count(letter) == 1:

            print letter

            break

<comment><USER5> My first pass (assumes input file is an arg):

        import sys

        def first_unique(word):
            if len(word) == 0:
                return "EOF"
            for i in range(0, len(word)-1):
                return word[i] if word[i] != word[i+1]
            return "NA"

        def main():
            with open(sys.argv[1],'r') as f:
                print first_unique(f.readline())

</comment></comment><comment><USER6> Maybe the companies want those people to apply that a) have the patience to b) actually complete a piece of code that c) gives the company an idea of how good the prospective employee is?

</comment><comment><USER7> Personally, I wouldn't mind if it was somewhere I wanted to work. Heck, I spend longer than that on the cover letter. When I'm job hunting I'm pretty selective so I spend a lot of time on just a few job applications (research + cover letter). Requiring code makes makes it more time consuming for less focused job searchers but maybe that is the point?

</comment><comment><USER8> I'll tell you why it's fair.

A job application shouldn't be a fishing game. The ideal person I want to hire is the person that also wants to work for my company. Maybe there are a few other companies that he likes, but my company isn't competing for mindshare with the myriad of other companies advertising their positions on Monster.

I want hire someone who is competent enough to complete a "20 minute" code evaluation, or even one who can take the time research half a day and figure out how to do something he might not have known the answer to when he first saw the quiz.

I want to hire someone who isn't turned off by a 20 minute code evaluation for the chance of working with me, for me, or at my company.

I also want to hire people I can get along with, who perhaps share my vision, who want to go in directions I expect the company will go, who will be a good fit with the rest of my team, who won't be a pain to work with, and who is competent, capable, eager and motivated to learn, do better, try to kick ass, and always care about the work they're doing and the team they're doing it for.

I want the things in that last paragraph, but there's not really a code eval I can give online that will judge them, so I give you a 20 minute code evaluation to make sure you're even worth talking to so that I can figure out whether or not you are my ideal candidate.

I want YOU to enjoy the job as much as I enjoy employing you, and I don't personally think that someone who is too uppity to fill out a 20 minute quiz before applying is the kind of person I want to hire.

<comment><USER9> The economics of the situation are such that hoops are rarely worth tolerating during the initial submission.

If you're not Google, I don't have much time for you until you clearly signal to me that there is actually a real job opening, with funding, which you intend to hire someone for in the immediate future, which you have determined that I might be a fit for based on the information I sent you. I don't mind jumping through a few reasonable hoops after I know it's not a waste of my time. If you don't value my time enough to spend a few seconds skimming my letter of interest and affirming to me that you have a real position open, there are plenty of other openings for developers.

<comment><USER8> Fair and appropriate. I'm clearly not Google, but I am looking to hire people who value my company the way you seem to value Google. If that isn't you, I think we'll both agree that it's best that you don't complete the code eval.

You might be the best programmer in the world, but I'd rather hire a 'really good' programmer that gives a damn about what we do than a 'super awesome amazing rockstar' programmer that doesn't.

That said, since somebody called and asked... No, I am not hiring.

<comment><USER10> How do you tell the difference between caring about your company and being desperate?

</comment></comment></comment></comment><comment><USER11> err 20 min? It's about a 60 second problem.

<?php $lines = explode("\n", strtolower(file_get_contents("input.txt"))); foreach ($lines as $ln) { for ($i = 0; $i < strlen($ln); $i++) { $char = $ln[$i]; $first_pos = strpos($ln, $char); $second_pos = strpos($ln, $char, $first_pos+1); $is_repeating = $second_pos !== false; if (!$is_repeating) { echo $char."\n"; break; } } }

?>

<comment><AUTHOR> Also, this solution isn't the most efficient because again you're searching the whole string potentially every iteration of your inner loop. So you've got an O(n^2) algorithm when it could be an O(n) algorithm. If we're dealing with just a short string, fine, but if the string were tens of thousands of characters long and we had thousands of lines, this might star to become significant. Sure, we're not likely to be given that. Maybe I read too much into these problems, but if they're going to give this as a test I assume they actually want to test something like efficiency, readability, etc.

</comment></comment><comment><USER12> This type of hiring approach strikes me as test for submissiveness, rather than programming ability. The hiring company wants someone who will do as they're told.

</comment><comment><USER13> I can't relate. I love little programming problems like these, and I want to hire other people that do as well.

</comment><comment><USER14> Maybe they're junior positions.

</comment><comment><USER15> solve all of them copy paste to other companies

sux-but-work

ps: bonus, you can even just google for the solutions and paste that.

</comment><comment> saiko-chriskun time sucking? are you being serious?

<comment><AUTHOR> Even if it's just 20 minutes, 20 minutes every time I want to file an app?

<comment><USER16> The one I see there "first non-repeated character" does not look like a 20 minute deal.

<comment><AUTHOR> It's 20 minutes because it's for an application. I want to look through it before I submit it, not just slap something down. I actually ended up doing this one just because it was so trivial.

<comment><USER17> If I were applying I would send them my 1-minute solution, because I wouldn't want them to think it took me 20 minutes to solve.</comment></comment></comment></comment></comment>


A definitive case against the Electoral College - <AUTHOR> https://www.vox.com/21142223/electoral-college-2020-election-jesse-wegman <comment><USER2> A tangential issue is the limitation of Congressional seats to 435 (since 1911), which affects the number of electors each state gets and distorts the value of each elector and representative in terms of how many people each represents.</comment>


Gorgeous Time-Lapse Video Of The Milky Way (video) - <AUTHOR> http://vimeo.com/8918647

<comment><USER2> If you like that you will probably like this too: [http://vimeo.com/4505537?pg=embed&sec=&hd=1](http://vimeo.com/4505537?pg=embed&sec=&hd=1) (gets good around 00:20)</comment>


Show HN: My newest Android app, Resume Builder Pro - <AUTHOR> https://play.google.com/store/apps/details?id=com.twansoftware.resumebuilderpro

<comment><USER2> It would be nice to see one output example in the app screenshots gallery

</comment><comment><USER3> Uhm I think that I would prefer to handle something important like my resume on my PC, still might be a good way to put down some notes. Also, +1 for all the Breaking Bad references.</comment>


Free – Jira Software - <AUTHOR> https://www.atlassian.com/software/jira/free <comment><USER2> Too late. Switched to clubhouse.io

</comment><comment><USER3> An ad?</comment>


App Used 23AndMes DNA Database to Block People from Sites Based on Race and Gender - <AUTHOR> http://www.fastcompany.com/3048980/fast-feed/app-used-23andmes-dna-database-to-block-people-from-sites-based-on-race-and-gender <comment><USER2> Well ... since the only thing good the DNA for is discrimination - not a single surprise here.

After outside of legitimate research you can use a DNA DB to find:

data about people that are something data about people that are not something

And I am not sure if it is illegal for a non commercial service to require its members to be something.

</comment><comment><USER3> The problem is not with the database or with the fact that 23&Me collected the data or that 23&me made it available. The problem is that there are people who want to discriminate and would use DNA (and any other available information) for that purpose.</comment>


Ask HN: Review my friends website: plushcuffs.com - <AUTHOR>

My friend built a website to sell a new kind of travel pillow she's been making.  I thought I could be more helpful in this endeavor, but I realized I know very little about online businesses that sell real, physical stuff.  Anyone have any experience with this?  How effective is SEO/SEM/other marketing methods?  How important is AB testing pricing/branding/positioning?  Thanks! <comment><USER2> Looks like a cool product. SEO is VERY effective, if done right. Completely ineffective if done wrong. As far as AB testing goes. I believe you have to have enough traffic to make it worth while.

I would probably suggest starting with a design template which has a good call to action, or get a designer who has experience in driving sales.</comment>


How Do You Enjoy Internet TV? - <AUTHOR> http://www.youtube.com/watch?v=l-IryK4wsUM Since I found the joys of ShareReactor and Edonkey (now Hulu/etc) I have connected my PCs to TVs.  Have not had cable for a long while.
With a sour economy I have seen a lot of articles on Cnet and elsewhere promoting what is seen in the video.  Though everyone is different and maybe enjoying Internet TV in their own fashion (Boxee, Windows Media Center, laptop connected to TV projector).
Thought I'd post this to see if others here too enjoying all their content through the web? If so, how? <comment><AUTHOR> Since I found the joys of ShareReactor and Edonkey (now Hulu/etc) I have connected my PCs to TVs. Have not had cable for a long while.

With a sour economy I have seen a lot of articles on Cnet and elsewhere promoting what is seen in the video. Though everyone is different and maybe enjoying Internet TV in their own fashion (Boxee, Windows Media Center, laptop connected to TV projector).

Thought I'd post this to see if others here too enjoying all their content through the web? If so, how?</comment>


Ask HN: How do you switch between projects simply, quickly and efficiently? - <AUTHOR> I work on multiple projects at once, mainly saas / web apps. I do everything: sketching, designing, developing, writing, marketing, etc.
For each project I need to launch multiple apps and documents: a few terminals (let's say task runner and server), at least 1 browser window, an IDE like Sublime, and maybe Sketch, or a spreadsheet, or some evernotes, etc.
Because I'm working on 2 to 3 different projects in the same day, switching a lot between them, I prefer to keep ALL the apps and documents open for all those projects. All. At the same time.
Which is, if you ask my laptop (more specifically, its RAM), a bad idea.
Now I have 2 (unsatisfying) solutions:
1. close all apps and documents for projects which I'm not actively working on. Then, few minutes or hours later, spend multiple real minutes opening all the apps and documents related to that project, so I can pick up work where I left it (hoping I didn't forget what I was doing, but that's another issue).
2. be a lot more organized and focus on 1 single project per day. Heck, that would still mean I have to switch apps every day. So let's say I need to focus on 1 project per week. I'm not sure I can do that. I know, context-switching is bad, etc. but I can't see myself working on 1 single thing per day.
Am I simply bad at organizing my work? Should I try sticking to 1 single project per day? Does anyone else have the same issues, and need to do a dozen different things every day, on different projects?
What solutions do you have to switch between projects simply, quickly and efficiently? <comment><AUTHOR> What I've tried so far:

\- setting up shortcuts / shell scripts to quickly open my terminals + apps. That's cool for the first few days, then scripts are obsolete because no, I don't need to open Sketch anymore, and the command to run the server has changed again, and... ok, I'll just launch everything by hand.

\- same solution but a bit more elegant with [https://github.com/TomAnthony/itermocil/](https://github.com/TomAnthony/itermocil/). Same issue.

\- this one is definitely a win: I set up different tab sessions, ready to be opened in 1 click, with this Chrome extension: [https://chrome.google.com/webstore/detail/edacconmaakjimmfgn...](https://chrome.google.com/webstore/detail/edacconmaakjimmfgnblocblbcdcpbko). This answers only a small part of the problem though.

\- use multiple desktops (macOS): all apps related to the same project are grouped on the same workspace. I like this a lot, making it really easy to "switch context" between different projects. But that doesn't solve at all the performance issue.</comment>


Why UK Brexit Talk Baffles Germany - <AUTHOR> http://www.bbc.com/news/uk-politics-37799805 <comment><USER3> Germany has the concept of a non-refusal in order to not impose and just show politeness as well. There is no massive cultural difference here.

Sometimes though you just say no, this is one of these times. As a German I'm not baffled at all by the U.K. Brexit talk. Politicians in the U.K. have simply created a mess they don't quite know how to get out of, this is how they placate the electorate while they're trying to figure it out.

It seems to me what's really baffling to some people is how Germany thinks of the EU. It seems to me that not many people realize just how highly the EU is valued in Germany across the political spectrum. People seem to severely underestimate what sacrifices Germany is willing to make in the context of Brexit to benefit the EU.

Among politicians in Germany I think the consensus is that having a hard Brexit, a crash of Britain and the effects on other countries in the EU including Germany would be unfortunate. Further damage to the EU however would be considered catastrophic. At least some people in Berlin have essentially already written off the U.K. in their minds.

If article 50 is invoked in march and the clock starts ticking, it will be fascinating to see the horror of the people coming to realize this.

<comment><USER4> > It seems to me that not many people realize just how highly the EU is valued > in Germany across the political spectrum. People seem to severely > underestimate what sacrifices Germany is willing to make in the context of > Brexit to benefit the EU.

The perception of the EU as a German project — or experiment, if you will — was one of the factors leading people to vote for Brexit.

<comment><USER5> I believe a lot of countries will show no mercy to UK, not just germany. No one wants to see a lopsided deal struck at the expense of their own.

<comment><USER6> Isn't that quite scary for you? I don't think I'd every want to be part of a multinational organization that has unelected rulers, is attempting to build a military, and will give anyone leaving it a hard time.

That's an absurd state to be in and it's already a parody of itself.

<comment><USER5> The EU is not giving UK hard time. It is simply no longer willing to go above and beyond to appease them nor should it do so. If UK does not want to take part in responsibilities but would like to keep the benefits EU is not able to allow that. It is a simple fact that there are no satisfactory ways for UK to leave EU and it is not EU fault.

Most of EU rulers are democratically elected, at least no less than in most country-level governments.

I support federalisation of EU. Most of the issues with EU stem from not enough integration and overly nationalistic nonsense countries do to the detriment of everybody. Euro needs a reform that will introduce transfers to less wealthy states, UK blocking much needed finance reform to keep its criminal City afloat, different countries throwing everyone under the bus so they can protect their own reelection.

Any talk of "sovereignity" is goddamn laughable in this day and age, between the banks and trade agreemens and megacorps

Together the EU is the biggest economy, outside of it you are just a shitty country that is hungover on glory long past

<comment><USER6> >Most of EU rulers are democratically elected, at least no less than in most country-level governments.

"Most", need I say more?

> Most of the issues with EU stem from not enough integration and overly > nationalistic nonsense countries do to the detriment of everybody

"Ok so what we're doing isn't working out but if you give us more money and power I swear it'll work guys! Just trust me and give up your currency, boarders, militaries, and legislative branches and don't worry this isn't sketchy at all"

> Euro needs a reform that will introduce transfers to less wealthy states

Ah so the EU is now a charity/Robin Hood organization. Not a government? Most government's aren't so selfless. I'd go so far as to say that no government can be as selfless.

> UK blocking much needed finance reform to keep its criminal City afloat

Criminal City?

> different countries throwing everyone under the bus so they can protect > their own reelection.

That's what happens with all governments. It's not about the public, it's about maintaining power.

> Any talk of "sovereignity" is goddamn laughable in this day and age, between > the banks and trade agreemens and megacorps

Would you have found it better for black people living in America during segregation to say "Any talk of "equality" is goddamn laughable in this day and age, between the government and the kkk and the racist people" or do you think it was right for them to fight to reverse the encroachment of their basic human rights?

I see Brexit as a means of fighting back against a relentless ruling class that has grown out of an apathy of the working class.

> Together the EU is the biggest economy, outside of it you are just a shitty > country that is hungover on glory long past

I can't see a single economist predicting a good future for the EU. It all looks doom and gloom from here on out. I'd say that the countries that are the worst off would benifit the most from less trade regulations. Look at what China and India have become. "Super power by 2020" would be a great thing to hear about the eastern block but that will never be the case under EU's thumbs

<comment><USER5> >I see Brexit as a means of fighting back against a relentless ruling class that has grown out of an apathy of the working class.

What you did is you submitted yourself to whackjobs like May or Johnson who apparently think that advisory referendum made them supreme rulers that can just sidestep the parliament

Wonder why UK is talking about leaving EHRC if you want your human rights protected

Criminal City as in main export goods of UK: LIBOR fixing, tax evasion, money laundering, etc. After 2008 there were genuine attempts at reform, all succesfully cockblocked and watered down by UK

Everywhere there is doom and gloom, not just EU - the current financial system will collapse under the unbearable debt that is created ever quicker.

And the rise of China and India is exactly why small countries are irrelevant. Sure, you get to feel all important for a while, but since you don't really have much to offer to a giant they can just steamroll over you.

Thats what I don't get. You bitch and moan about how EU is evil and trying to destroy UK, for taking EU perks away and then you turn around and argue how evil and bad the EU is because it has nothing to offer...

<comment><USER6> > What you did is you submitted yourself to whackjobs like May or Johnson who > apparently think that advisory referendum made them supreme rulers that can > just sidestep the parliament

I'm not British so I've done nothing but what I see as an outsider is a parliament that feels it can entirely sidestep the wills of the public.

> Wonder why UK is talking about leaving EHRC if you want your human rights > protected

We'll I'd assume it's to avoid foreign control over their domestic affairs. I don't think any country should be subject to the moral judgement of other nations and I would like to point out that the UK offers some of the best humanitarian protection to it's people. I'd call this point a bit of a non sequitur.

For instance, let's say I'm rich and I'm investing in a set of manufacturing companies. If I want to pull all of my money out of foreign markets and I state by pulling money from my off-shore cookie factories does this mean I hate cookies as a product? I don't necessarily feel that is the case especially if I still have investments in, or have future plans to invest in, domestic cookie production.

> Criminal City as in main export goods of UK: LIBOR fixing, tax evasion, > money laundering, etc. After 2008 there were genuine attempts at reform, all > succesfully cockblocked and watered down by UK

I've never head of this but I'd chalk this up as a job for Interpol if it's a set of people engaging in money laundering and tax evasion. This is again a non sequitur as every country has this. Switzerland, France, and other EU countries are if anything more guilty of this then the UK.

(Yes I know Switzerland isn't technically an EU country but it was a founding member of the EFTA so I'm counting it as they are still subject to trade sanctions that have never been levied from my understanding)

> And the rise of China and India is exactly why small countries are > irrelevant. Sure, you get to feel all important for a while, but since you > don't really have much to offer to a giant they can just steamroll over you.

You have a lot to offer. You're main point of attraction is different cultural backgrounds and different legal precedents. Many eastern block countries have the perfect storm of intelligent people, good universities, and a strong set of natural resource that they could turn from shabby to economic powerhouses overnight if they where allowed to engage in some practices that haven't been monopolized by the EU. One such example was the British fishing industry. [0]

> Thats what I don't get. You bitch and moan about how EU is evil and trying > to destroy UK, for taking EU perks away and then you turn around and argue > how evil and bad the EU is because it has nothing to offer...

I don't feel that I'm bitching and moaning. I feel that I'm presenting my opinions on the topic. I'm going to have to pick this apart bit by bit because there's a lot crammed into this one section.

> You bitch and moan about how EU is evil

I don't think it's evil. I've never said that and I don't think I ever will say that. It's the same way I've never said the Mafia was evil. I don't agree with a lot of the things that both the Mafia and the EU engage in but can see exactly why they have done these actions and their arguments for why these things are acceptable.

One such example is intimidation of people leaving the group -- the topic that started this discussion You made it a point to say:

> taking EU perks away and then you turn around and argue how evil and bad the > EU is because it has nothing to offer

I find it very odd, and would never want to participate in a group, that would feel the need to intimidate people leaving it. For instance here in the States if one of these United States didn't want to be part of the union anymore I'd feel perfectly fine with putting it up to a vote for the people in that state. That's perfectly fine for me. I'd also be against any state attempting to "get back at them" or "teach them a lesson for going against the group". That's just bullying and I wouldn't expect it from anyone of polite company; that is behavior of children at play in an elementary school.

The Mafia also made attempts to intimidate people who left their ranks. Now I understand it from a Mafia perspective as a Mafia is meant to be run as a corporation. It's not for the benefit of the public but for the benefit of Mafia's stake holders. For them, intimidation is a form of self-preservation in an attempt of it's members to do the best for themselves, not to go against the will of the public.

What shocks me the most is that people are okay with hostile intimidation from the EU [1] but not from the Mafia when I feel it is more justified for a Mafia to do this then a government.

A government is meant to services as a way for regulating the people. If the people aren't being regulated fairly then the government should either change to shape themselves in the image of the public's morals or be removed from their place as the model of governance for the public. Now I've never seen this happen without violent kicking and screaming, as we are seeing here with the EU.

I don't support what the EU because it is a vengeful organization that want's it's fingers in all of the pies around the world. Not for the benefit of humanity, but instead for the benefit of a well segregated ruling class that looks down at many of you as mere peons.

[0] - [https://en.wikipedia.org/wiki/Common_Fisheries_Policy](https://en.wikipedia.org/wiki/Common_Fisheries_Policy) [1] - [https://www.theguardian.com/commentisfree/2016/oct/07/europe...](https://www.theguardian.com/commentisfree/2016/oct/07/europe- hard-brexit-hurt-british-trade-deal)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm guessing the ambassadors on both sides are hyper-aware of cultural nuances like this. A non-story.

<comment><USER8> No. Just the opposite.

Having lived in Europe ... I was absolutely shocked at the dissonance between their elite and their plebes. It's laughably crazy.

It's so much, it's almost unbelievable.

Euros come from a historical situation wherein they hyper-powerful nobility ruled all.

They overthrew that - but the condescension still very much exists. Now - <USER2> you go to Oxobridge or a 'Grande Ecole' you're party of the elite, they go off and give each other the plumb jobs, protect each others careers and act like rulers.

Because even on the other side of the fence - the socialists - are led by intellectuals, not so much by 'the people' (i.e. labour) - both sides of the aisle are utterly out of touch.

Brexit itself should be a shock to no one who has the pulse of Europe.

It's only shocking to the disconnected chattering classes.

They consider anything anti-EU to be 'fringe' and 'far right' \- when in fact about 1/2 of Europeans would dump the EU if given a chance. Even in Germany 48% don't like the EU - not to say they would dump it but they don't like it.

<comment><USER3> Socialism and Communism has always been led by intellectuals. Marx was hardly a member of the proletariat for example.

Additionally this is overall hardly a European phenomenon. People tend to associate mostly with people similar to themselves, especially when it comes to education which correlates to income and jobs.

The education system reinforces this strongly in most countries. In the US this begins as early as starting school based on which school (district) the parents can afford. In Germany you have Students being separated by education level after primary school (4th grade). If you go to university you might almost never interact with people with a different education level, apart from family or the people you buy stuff from.

I'd also wonder just how many of those 48% that don't like the EU, would miss what the EU offers. I'd wager most not just don't know what it offers but don't even really know what exactly is bad about it.

<comment><USER4> > I'd wager most not just don't know what it offers but don't even really know > what exactly is bad about it.

This is a good reason why the EU should fail, and why people voted for Brexit, which will hopefully go some way to making that happen.

To the average citizen, the EU is a gargantuan bureaucracy, burning through enormous sums of money, whose main concern seems to be churning out reams of incomprehensible regulations. It also has some courts that overrule our national governments from time to time.

I like the _concept_ of a more integrated Europe, but the EU is just the first attempt at it.

<comment><USER3> To the average citizen the majority of regulation is incomprehensible because it deals with things they never have to deal with. I care that the food I buy is safe not precisely how regulation and standardization makes it so or that I personally understand it. The entire point of representative democracy is that I don't have to.

The vast amount of "regulation" is simply standardization to simplify trade in the single market. The industries affected themselves tend to want it even while people make fun of it in the media.

The amount of money invested in the EU is really not all that enormous, besides it's not like it disappears in a black hole. It seems like any significant infrastructure project in the EU gets at least some EU funding. Especially Eastern Europe has benefitted greatly from that and we all benefit as the East catches up with the rest of Europe.

In any case you can't just scrap the EU and start fresh and instantly come up with the perfect solution. This is not how politics and policy works or has ever worked. Any non-trivial system is built iteratively through incremental improvement, especially large systems. A more integrated Europe is achieved by improving the EU not by replacing it with some fantasy that will never come to fruition.

</comment></comment></comment></comment></comment><comment><USER9> I don't think this is the case at all. The UK has a rather rosy view of its history and current worth. To many it was inconceivable that the EU wouldn't do anything to keep us in the club, despite that necessarily weakening its position when dealing with other countries. Others thought the UK was being held back by the EU and that we are so great people would be bending over backwards to deal with us.

Offering a biscuit from a tray and keeping a poker face during negotiations are two very different things, nobody mixed them up.</comment>


A Great JavaScript Side Project Is Your Most Important Asset - <AUTHOR> http://thefullstack.xyz/javascript-side-project/ <comment><USER2> > The average developer spends more than 7 hours per week coding on the side.

I don't believe for a second that most developers spend an hour a day on side projects. I'd believe many, but not most. There just isn't that kind of time available for many full-time developers with a family and responsibilities outside of coding.

I know I spend quite a bit of time coding for fun, but I know many people who do "not so cool" development at their day job who want nothing to do with code in the evenings.

<comment><USER3> > > The average developer spends more than 7 hours per week coding on the > side.

> I don't believe for a second that most developers spend an hour a day on > side projects.

"Average" here quite likely means arithmetic mean, not median, and the distribution of side-coding-time among developers is probably not normal, so its quite possible for the average to be more than 7 hours and most to do significantly less than that.

<comment><USER4> In that case, the statement is misleading.

</comment></comment></comment><comment><USER5> Or.... Side-projects could be your most important asset. I'd even argue that intentionally non-JS projects are going to help you much more than JS ones.

<comment><USER6> The site is about isomorphic JavaScript development (JS on the client and server). So they advocate JavaScript

<comment><USER5> Ah, interesting. Especially since the url is thefullstack...

</comment></comment></comment><comment><USER7> "Full stack"? Check. Hipster tld? Check. Argument based on scientifically obvious weak correlation? Check.

Well obviously this guy is going to think JavaScript is the most important thing in the universe. That's probably the only programming language he knows.

What a poor world that must be.

Obviously hobby projects are nice to have. But you should have them because you care, not because you need an "asset".

There's just so much to learn out there, so much fun! Why oh why limit yourself to the same old JavaScript?

<comment><USER8> A lot of people make a good living building great apps that you use every day in javascript and a lot of people are trying to break into that line of work. For those people this article is both relevant and a decent guide. I hire Javascipt developers and guess what? If you are junior and trying to bust in and you show me a badass side project, you have a shot, so this guy isn't wrong at all.

[edited: less snarkiness]

<comment><USER9> > _I 'm sorry you have a giant squirming bug up your ass_

Please don't respond to a snarky comment by posting something even worse. That's exactly the wrong direction to take.</comment></comment></comment>


Chisel – free public and private Fossil repository hosting - <AUTHOR> http://chiselapp.com/ <comment><USER2> I currently operate this service, let me know if there's any questions about it!</comment>


Hovercards for facebook prototype - <AUTHOR> http://start.hover.in/koimoi

<comment><AUTHOR> btw, am wondering about opening this up as an app.

does whitelabel hovercards for your platform/app/api make sense? write to me @bosky101 or kode at hover dot in,

also see <http://start.hover.in/stocktwits> <http://start.hover.in/collecta>

~B</comment>


Show HN: Ladder, the new and easy way to autoscale - <AUTHOR> https://github.com/themotion/ladder <comment><USER2> Needs a much better explanation of what it is, probably some examples, because I have no idea and this is meaningless:

> Ladder is a simple and small program that is used to autoscale things, when > we mean things we are talking about any kind of stuff that can increase or > decrease, for example, docker containers, AWS instances, simple binnary > processes, files…

<comment><USER3> Hi! thanks for the feedback :) I've updated the readme:

[https://github.com/themotion/ladder](https://github.com/themotion/ladder)

Let me know if it's easyer to understand.

<comment><USER2> That's much better :)</comment></comment></comment>


The New Way Your Computer Can Be Attacked - <AUTHOR> https://www.theatlantic.com/technology/archive/2018/01/spectre-meltdown-cybersecurity/551147?single_page=true <comment><AUTHOR> _Both Spectre and Meltdown break that isolation, deep down at the microprocessor level, by exploiting performance optimizations that have been implemented for the past decade or so. Basically, microprocessors have become so fast that they spend a lot of time waiting for data to move in and out of memory. To increase performance, these processors guess what data they're going to receive and execute instructions based on that. If the guess turns out to be correct, it's a performance win. If it's wrong, the microprocessors throw away what they've done without losing any time. This feature is called speculative execution._</comment>


Brute forcing JSON Web Tokens in C - <AUTHOR> https://github.com/brendan-rius/c-jwt-cracker <comment><USER2> This software attempts to determine the private key for the HMAC-SHA256 (HS256) signature algorithm.

The example provided has a private key length of 32 bits which is far too short to be secure. Based on the JSON Web Algorithms (RFC 7518) the key length must be at least the length of the output hash (256 bits) to be used in accordance with the standard.

> A key of the same size as the hash output (for instance, 256 bits for > "HS256") or larger MUST be used with this algorithm.

[https://tools.ietf.org/html/rfc7518](https://tools.ietf.org/html/rfc7518)

<comment><AUTHOR> If only people respected RFCs

<comment><USER3> I'm not aware of any common libraries that don't. Where did you get the token cracked in your example code?

<comment><USER4> Let's suppose I search for 'jwt' and end up at 'jwt.io' (run by Auth0), which talks about what JWT is and lists a bunch of libraries. Let's say I want to use python.

One library checks for key lengths [1] and throws exceptions, another one doesn't [2] -- in fact it uses a quickstart example that should obviously fail.

[1] [https://github.com/latchset/jwcrypto/](https://github.com/latchset/jwcrypto/) [2] [https://github.com/mpdavis/python- jose](https://github.com/mpdavis/python-jose)

</comment></comment></comment></comment><comment><USER5> Nice! For a threaded Rust implementation, see [https://github.com/ojensen5115/jwtcrack](https://github.com/ojensen5115/jwtcrack)

<comment><AUTHOR> Nice work, thanks for sharing

</comment></comment><comment><USER6> A good reminder to use long HMAC secrets or sign your JWT with RSA.

<comment><USER7> I am curious why more folks don't use rsa keys anyways? Seems like that makes signature validation even easier (publish the location of the public key for validation). Then your endpoints don't need to exchange secrets at all?

<comment><USER6> It makes rotating the secret a hell of a lot easier as well.

<comment><USER8> I'm not sure I follow. You still need to communicate the public key securely.

</comment></comment></comment></comment><comment><USER9> This doesn't seem to work. Compiled from source on macOS Sierra 10.12.2. I tried a valid JWT and it reports back instantly that the key is 'e'. Also does the same with invalid JWT.

<comment><AUTHOR> That is definitely strange, if it is not sensitive data, would you mind sharing the JWT and the original secret? or try to find another example where it behaves like this?

Thanks

<comment><USER9> It is sensitive data so I can't share the payload for a (possibly unfounded) fear of brute-forcing the correct key used. I can tell you that the key is not an ASCII string (it is a random sequence of bits). The jwt.io debugger verified the signature when I gave it the proper key and failed to verify with the key "e" that this tool reported.

</comment></comment></comment><comment><USER10> 'Brute forcing JSON Web Tokens tokens in C'

<comment><AUTHOR> It's clearer, I fixed it :)

</comment></comment><comment><USER11> I'm curious. How long could it take to bruteforce a JWT with an average latest generation i7 processor?

<comment><USER12> Since brute forcing the HMAC is pretty much the same as brute forcing the underlying hash function, you would probably want to use a GPU instead of your i7.

Using [1] as a reference for a specialised system in a price range affordable to hobbyists, assuming HMAC-SHA256, a 48bit secret would take about three hours to brute force (48bit is about 10 letters all lowercase), while a 64bit secret would already hold 25 years (assuming no upgrades etc).

With sufficient volume you can probably build such a system for about $5000-$7000. Let's assume $5000, because that number is rounder. If you spend $1,000,000 on your setup (so certainly professional level now), your 64bit secret only holds 44 days.

If the NSA would spend 10% of a single year's budget on GPUs, the resulting machine could crack a 64 bit secret in one hour, but a 84bit secret would take 100 years to crack (84 bits is about 17 lowercase letters, or 14 mixed-case, or 10.5 bytes if you use the entire range of the byte).

Of course that ignores some scaling effects (if you spend $1billion you get much more bang for the buck by designing custom ASICs), but it should give a sense of what's secure against whom. By using proper 256bit secrets you should be secure against everyone until the end-of-life of your application.

1: [https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...](https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40)

<comment><USER11> Wow. Thanks, I learned a lot from this.

</comment></comment></comment><comment><USER13> "... with 32 bit keys."

The whole thing is editorialized to make it sound like the problem is with JWTs. It's not, this is just plain old improper use of perfectly good crypto.

Brute-forcing 32 bit HMAC keys isn't exactly newsworthy.

<comment><AUTHOR> From the readme: "If you are very lucky or have a huge computing power"

Also the title "Brute forcing JWT in C" could not be clearer. This is not "0day found in JWT", or just "breaking JWT". This is brute force & nothing more

This is actually editorialized to make it sound the way it really is

</comment></comment><comment><USER14> I ran it against some JWTs produced by one of my systems and it reported success. The secret it gave was about 5 characters in length. The secret we actually use is 64 characters in length.

<comment><AUTHOR> If it is not sensitive information, I would be curious to know the JWT you tested with, the key used, and the key that program found

<comment><USER14> Sent you an email on this. Sorry for slow response.</comment></comment></comment>


Google To Spend $500 Million To Market Moto X Phone - <AUTHOR> http://www.forbes.com/sites/roberthof/2013/07/11/in-one-big-nudge-google-to-spend-500-million-to-market-moto-x-phone-report/

<comment><USER2> Don't really see the point in getting another Motorola phone. I paid a premium for my Photon, and it really annoys me every single day with how long it takes to wake up and actually do something, and how often it crashes. That might be due to the fact that I have no choice but to still run Gingerbread, because Motorola decided to lock the Photon to that version.

<comment><USER3> Because, you know, once a company makes one bad move, its impossible to change. We should only support companies who have never made bad choices or aggravated us personally. Especially those companies whose leadership, product vision and circumstances in general have changed dramatically since the offense.

<comment><USER4> The Photon came out around a year ago. That's a really short time in terms of corporate lifetimes.

<comment><USER3> It was closer to two years, according to Wikipedia.

<comment><USER4> You're right. I seem to have forgotten which year it was. :(

</comment></comment></comment></comment></comment><comment><USER5> <rumor> I have a guess about the motoX phone: It will have a modular hardware component. Probably something similar to the jolla phone , which is build from two different parts stuck togheter by magnets. One part if your phone , and the other one is a replaceable hardware card.

This also fits the motoX ad saying "design your own phone".

The replaceable part could be designed by anyone, and it opens a lot of places for innovation: think of a microscope, or a fingerprint scanner, or nose on a chip, or high quality audio interfaces ,or unique sensors or any number of niche hardware.

Anyway , i really hope that's the case. If will be really fun to play and design with such phones.

</rumor>

<comment><USER6> All the current rumors on the phone point to boring superficial changes like color and customized wallpapers (for real). They're not spending $500mil advertising a phone for hardware geeks.

<comment><USER5> But if they designed it with 5/10 optional popular hardware modules , and marketing about future modules that will come from community, this could really appeal to early adopters , and people with specific niches that need to be filled.

And technically , if this is the right way to build more innovative phones, it has a good chance to win in the general population.

</comment></comment></comment><comment> wes-exp I look forward to being annoyed with a Moto X ad every time I use a Google service.

</comment><comment><USER7> or maybe they're realizing that samsung Is starting to compete with google on the OS so they need to compete with samsung on the hardware. This ways samsung will never be in a position to impose its new OS.

</comment><comment><USER8> From what I've read, the main feature is a low power, always on, sensor array. My guess is that this phone will break new ground with comprehensive and novel Google Now integration, and push further towards the goal of a device that actively assists its user. Think of it as a robotic system that is integrated into the growing AI/expert system service that is Google.

</comment><comment><USER9> Slowly, Google is transforming into Apple faster than Apple can transform into Google.

</comment><comment><USER10> Sponsored by the NSA? Some of the weird tech acquisitions start making sense when the NSA is factored in; Motorola, Skype, anything else? It's completely possible in this time and age to have back-doored hardware in Motorola phones, so I think everyone should advice against buying those.

<comment><USER11> If I recall correctly Skype was working with the NSA before it was acquired by anyone.

<comment><USER10> Microsoft changed Skype's architecture drastically, which helps making wiretapping easier. See HN discussion: [https://news.ycombinator.com/item?id=4254925](https://news.ycombinator.com/item?id=4254925)

<comment><USER12> Wiretapping was possible even before MS has re-engineered Skype. The main reason behind using central servers is to increase reliability and decrease power usage on mobile devices (as they do not need to serve as supernodes anymore).

<comment><USER13> >Wiretapping was possible even before MS has re-engineered Skype.

Wrong. Skype was bullet proof, completely end-to-end encrypted, before the MS takeover.

<comment><USER14> This is not completely true. Even back then, certain computers running skype could become "super nodes" that handled incoming connections to devices e.g. behind NAT. All you needed to do to wiretap was become one of these nodes, which wasn't hard to do.

But yes, if you made sure neither computer had NAT and used no super nodes it was possible to be pretty protected (except for the problem that PRISM is tied to the network hardware and can read anything anywhere on the internet).

</comment></comment></comment></comment></comment></comment><comment><USER15> This should've been called the Google X Phone not the Moto X Phone.

</comment><comment><USER16> This could be a good win for Google if they do it properly.

</comment><comment><USER17> I hope they compete on price. $600 phones are ridiculous.

<comment><USER18> I'd gladly pay 1k for decent battery (2 days actual use) and a keyboard. No &$@#+=! Soft touch "buttons" for back, etc.

<comment><USER15> I like my Nexus 4's soft touch buttons, thanks. It really depends upon personal taste.

<comment><USER19> Nexus 4 doesn't have any soft keys, it has the onscreen UI

</comment></comment></comment></comment><comment><USER20> U think they will be able to position themselves on a satisfied market like this? I don't think they will make it!</comment>