Space Tourism Isn't Frivolous, or Impossible - <AUTHOR> http://www.nytimes.com/2014/11/04/opinion/space-tourism-isnt-frivolous-or-impossible.html?ref=opinion <comment><USER3> Aerospace Engineering major here. People may be quick to dismiss space travel, and overall innovations and advancements in space technology due to its high cost and (seemingly) dangerous tests that companies do to test new technologies. Take the very recent Antares launch failure and Virgin Galactic's tragic crash. But don't dismiss it too soon. There are an astounding amount of safety checks, safety factors, test runs, check runs, and more safety checks before an actual launch or test flight is performed.

But these tragedies and tests were experienced in the early stages of within- the-atmosphere flight. While we are still learning about creating a safer and more efficient airliner, we had some bumps and tragedies we had to overcome in the past to get it to where it is now. Take for example the De Havilland Comet aircraft. It was the very first production jet airliner, but within a year of its commercial service, it had tragic accidents that led to 13 crashes with about 440 deaths total. We later learned that the stress in the edges of the square windows compromised the structural integrity of the fuselage which led to catastrophic failure.

This is why the windows on your 737, 747, etc are now rounded.

But through these tragedies and innovation, we not only gained knowledge on how to build a better aircraft, ticket prices also decreased substantially in price.

Space travel right now is right where the air travel industry used to be when it was just starting out: we are still working out the kinks, and to quote Sir Branson, "Space flight is hard, but worth it".

<comment><USER4> >This is why the windows on your 737, 747, etc are now rounded.

This always sounded apocryphal to me, considering ships have had round windows for ages before planes even existed.

<comment><USER5> It's already been noted but:

> A year after entering commercial service the Comets began suffering > problems, with three of them breaking up during mid-flight in well- > publicised accidents. This was later found to be due to catastrophic metal > fatigue in the airframes, not well understood at the time. The Comet was > withdrawn from service and extensively tested to discover the cause; the > first incident had been incorrectly blamed on adverse weather. Design flaws, > including dangerous stresses at the corners of the square windows and > installation methodology, were ultimately identified. As a result, the Comet > was extensively redesigned with oval windows, structural reinforcement and > other changes. Rival manufacturers meanwhile heeded the lessons learned from > the Comet while developing their own aircraft. > [[http://en.wikipedia.org/wiki/De_Havilland_Comet](http://en.wikipedia.org/wiki/De_Havilland_Comet)]

Perhaps (nautical) ships had round windows, but it was for an entirely different reason, and clearly _some_ planes used square windows and found out a good reason _not_ to use square windows.

</comment></comment></comment><comment><USER6> Except what Virgin is doing isn't "spaceships" or "space tourism".

It's just a high flying plane.

Its max altitude is still within the outer limits of the earth's atmosphere for pete's sake.

It can only hit 100km (62 miles):

 _International law defines the lower boundary of space as the lowest perigee attainable by an orbiting space vehicle ..._

 _Due to atmospheric drag, the lowest altitude at which an object in a circular orbit can complete at least one full revolution without propulsion is approximately 150 km_

<comment><USER7> Sure it is. It's a company selling a trip to "space". If they succeed they can reinvest the revenue into R&D to build better "spaceships", and so on. Additionally, other people will see a profitable company and try to enter the market.

There's a whole snowball effect. Tesla is doing the same thing with the electric car.

By the way, outer space does begin at 100 kilometers.

[http://en.m.wikipedia.org/wiki/Kármán_line](http://en.m.wikipedia.org/wiki/Kármán_line)

<comment><USER6> What part of "atmosphere up to 150km" makes 100km space?

At 100km it is dark and cold but there is atmosphere.

That's not "space" in my book.

<comment><USER8> The International Space Station, orbiting at around 420km is dragged down by atmosphere[1], so I'm going to call that 150km limit an arbitrary one. Also, the Wikipedia article on the subject[2] doesn't appear to consider it worthy of even mentioning.

You are, of course, entitled to define "space" however you want in your own book, but be adviced that a lot of people will disagree with your definition.

[1] [https://en.wikipedia.org/wiki/Night_Glider_mode](https://en.wikipedia.org/wiki/Night_Glider_mode) [2] [https://en.wikipedia.org/wiki/Atmosphere_of_Earth](https://en.wikipedia.org/wiki/Atmosphere_of_Earth)

</comment></comment></comment></comment><comment><USER9> It isn't frivolous, or impossible, but it _is_ not ready to take customers. Rocket launch failure rate is about 5%.

[http://marginalrevolution.com/marginalrevolution/2014/11/spa...](http://marginalrevolution.com/marginalrevolution/2014/11/space- tourism-still-not-ready-for-flight.html)

<comment><USER10> Its wholly frivolous at the current time, there is no destination other than up. How more frivolous can you get.

Once there are orbital and lunar destinations where you can stay more than a few days with a reasonable number of other people then it might get past frivolous.

<comment><USER11> The destination isn't the point. Yes, some rich folks go to go to almost space, and that's awesome for them. But what's awesome for the rest of us is the rich folks are subsidizing research into spaceplanes, and some day stepping into a spaceplanebto go to the Lunar colony will be just like stepping onto a 747 to go to London is today.

<comment><USER12> Pretty much exactly what I came to say.

Also, as well as ponying up the cash, they will also be risking their skins. We need human guinea pigs, and the super-rich are volunteering.

</comment></comment></comment></comment><comment><USER13> Whether space tourism is frivolous or not is question of personal taste and values.

But this opinion piece is definitely very frivolous indeed, in that it misses (by light years) the main argument against space tourism -- the amount of energy and resources needed (both in flight, and in on-ground support), is far greater than that of land-based travel, and will necessarily always be so (whatever improvements may be seen in terms of industrial efficiency, a gravitational well is still a gravitational well).

The article doesn't even _mention_ carbon footprint, in fact. As if the author is unaware of the fact that even regular air travel is seen by many experts as an essentially unsustainable industry, in terms of carbon impact (on the scale that it exists, and in the unrestricted, no-penalties sense as we know it today).

<comment><USER14> Can't space tourism be seen as an investment? Sure, the carbon footprint is huge, but the money spent on space tourism is going towards the space industry, which could result in cleaner sources of energy. (Imagine huge solar collectors beaming power down to surface collectors in the desert. Doesn't get much cleaner than that, after everything is manufactured and launched - <USER2> I'm grossly underestimating the maintenance.)

<comment><USER13> Yeah, one can imagine various piggybacking effects or other tradeoffs by which luxury space travel might be more feasible. But what got me was the the opinion piece didn't consider environmental impact _at all_. It was just "C'mon, it's the human spirit! Ya gotta believe!"

</comment></comment></comment><comment><USER15> Well, tourism is "frivolous" in itself, so...

</comment><comment><USER16> How much carbon emission does one trip to space generate (I have no idea)?

<comment><USER17> In a hydrogen-burning rocket, zero (at least directly).

(SpaceX has some sort of plastic-fuelled hybrid rocket though).

<comment><USER18> Virgin uses the plastic hybrid, not SpaceX.

</comment></comment></comment><comment><USER19> Recent tweet from Hans Rosling on space tourism: "Thoughts from Liberia: Space tourism is like Ebola; it's lethal, it's costly and the world is better without it!" ([https://twitter.com/HansRosling/status/528308903873089538](https://twitter.com/HansRosling/status/528308903873089538))

Personally I'm all for space exploration, but space tourism seems like a non- needed luxury.

<comment><USER20> Luxury? This isn't government funded, and it's no more of a luxury than private jets, or a supercar or whatever else you spend hundreds of thousands of dollars on.

Most of the first world live their lives based on non-needed luxury and it just seems mad to try and suddenly impose "need" as a requirement of a product.

<comment><USER21> Time and again, the luxury of one era becomes a basic need of the next. Legal protection, education, electricity, health care...

<comment><USER22> And time and time again they don't: Having your own tiger petting zoo, milk baths, private chef... So now we know that luxuries may or may not turn out to be considered basic needs.

<comment><USER23> Not disagreeing with the overall point of your comment, but:

> private chef

I can purchase a pre-prepared meal and heat it up in my microwave by pressing two buttons. That's pretty close!

<comment><USER22> Agreed, and a similar point can be made regarding private zoos (first world citizens have access to zoos) and milk baths (most of us could afford it but we have even better hygiene products).

Some past luxuries were just fads and go out of fashion, others address a lasting need but fail to scale up and remain extravagant luxuries only available to the ultra rich, others still also address a lasting need and are transformed into something that works on a societal level.

</comment></comment></comment></comment></comment></comment><comment><USER24> Edit: Seems people don't like being faced with reality. Screw it. Let's burn this mother down, we only have one, right. YOLO \----

It may not be impossible, albeit debatably frivolous, but it sure as hell is dangerous as it will increase exponentially more damaging pollution and degradation of the upper atmosphere. I don't think people quite appreciate the risk with which we really are frivolously toying. Understand, there is no fall-back, no fail-safe, no do-overs, no mulligans. Once the atmosphere is damaged, once the already engaged process of global climate change is exasperated by millionaires and billionaires who want to fly into space simply to take a looksie at the planet from high up because of their narcissistic impulse for exclusivity and domination is blind and self-destructive; there is a point of no return, where the system of a human habitable ecosystem starts collapsing. There will be no god to save us, no god to fix anything. Once it's done, it's done. Finished, Fin, Ende, Finito.... Game Over... no lives left.

Some people claim, well, we'll just populate other planets. Again, a psychopathic and narcissistic mentality. So billionaires will ruin this planet and then jet off to another planet, leaving this one do wither and die along with the billions of people who you will surely also belong to? Is that the plan?

I hate to be the bearer of bad news that pops your fantasy dream bubble. Reality is that this whole idea of space tourism and inter-planetary travel and terra-forming is really the equivalent of a cat hoarder living in a squalid shit and trash smeared shack venturing out to figure out how to take on a predatory loan to buy a nice new car. The priorities are so delusional and screwed up, it's incomprehensible to anyone with any bit of a level head.

<comment><USER25> Their problem may not be with what you said, but how you said it.

I fear the particular "brand" of space tourism offered by Virgin is probably frivolous in that it's at a level not too far removed from the "Vomit Comet" that astronauts, and paying customers, frequently use.

Space tourism that does reach Low Earth Orbit is probably a play-thing for the rich as well, but I see that as a stepping stone to a greater voyage in our solar system and beyond.

We're getting better at recycling our waste products and there is already a ton of research coming from the ISS on long-duration living in space. These alone have already contributed immensely to our understanding of the world around us and have lead to new technologies that are already in use or are about to enter the market soon. Likewise, space tourism will bring its share of productive advances.

Let's not forget that it took millennia after the invention of sailing to get to flight. Although it only took decades from flight to space travel, it's unrealistic to expect such exponential advances in the next phase of our exploration. I doubt we'll have humans landing on Mars in my lifetime, but I wouldn't put it past the lifetime of the next generation.</comment></comment>


Show HN: DraftJS Plugins: Slack-Like Emojis, FB-Like Mentions and Stickers (Web) - nik-graf https://github.com/draft-js-plugins/draft-js-plugins <comment><AUTHOR> This is really cool. Would love to use it in a project

</comment><comment><USER2> Good job Nik!</comment>


Smog in our brains - <AUTHOR> http://www.apa.org/monitor/2012/07-08/smog.aspx <comment><USER2> You should be worried about IAQ - indoor air quality.

This is because you spend 90% of your time indoors.

It is also because IAQ is far worse than outdoor air quality. The kitchens of most homes would be closed down by inspectors if they were commercial.

Correctly ventilating a home with a ERV/HRV, bathroom ventilation and oven hood (harder than it sounds because many designs are snake oil) solves the problem. Few people have gone to such lengths, not even the wealthy.

The "Building Performance Podcast" has more information if anybody's interested. There's a lot of good information online from US government websites.

Most American homes share a leaky wall with their garage. A garage with shelves of highly toxic substances that offgas through the wall when the weather gets hotter.

I intend to design my home so it does not contain these drawbacks.

<comment><USER3> Is there an easy way to measure your indoor air quality?

<comment><USER4> I live in Beijing and we use the air purifiers from Xiaomi to measure indoor air quality (and clean it up). It's true that eg frying bacon really makes the air quality index spike up a lot.

<comment><USER5> Off topic but I have a ton of questions about air in Beijing - I can hardly believe what I've heard. It's kind of off-topic but if you'd have a minute, could you shoot me an email (see my profile here) or reply with yours? Thanks.

</comment></comment></comment></comment><comment><USER6> I wouldn't be surprised if some future historians are able to look back at modern cities the same way that we look at granny pictures of a soot-streaked city of the industrial revolution.

"Yes, some of them thought that it was bad to have all that stuff around, but most thought it wasn't too serious compared to the immediate economic benefit it brought."

<comment><USER7> "Yes, the planet got destroyed. But for a beautiful moment in time we created a lot of value for shareholders."

[http://www.newyorker.com/cartoon/a16995](http://www.newyorker.com/cartoon/a16995)

<comment><USER8> Nonsense. This has nothing to do with the planet being destroyed, but minor health effects of air pollution. Which in first world countries, is vastly less than it used to be. And could be eliminated entirely in a few years with technology like solar power and electric cars. Possibly it could have been seriously cut back decades ago, if environmentalists hadn't fought so hard against nuclear.

<comment><USER9> Yea. The real problem was fightng against a technology that is more expensive yhan cleaner options, has massive NIMBY problems that are not yet resolved, gets more expensive as time goes on, has led to massive cpncentrated disasters and still is unable to find a solution to its long term problems.

A technology whose proponents's best answer even today is "wait until the next breakthrough".

Nuclear: The one trick the evil environmentalists won't tell you about that will solve all your energy problems.

<comment><USER8> If we had adopted nuclear power decades ago, none of that would be an issue. Solar power is only just now catching up to cost effectiveness with nuclear. And only on sunny days, the storage problem is very far away from being solved. Maybe coal is cheaper, but only if you exclude externalities. The amount of radiation released by nuclear is tiny compared to coal. Not to mention mercury, carbon dioxide, etc.

<comment><USER10> >If we had adopted nuclear power decades ago, none of that would be an issue.

Then we would have even more problems with final disposal than we already have, that's the topic none of the pro-nuclear people ever want to touch on because they fully realize it's quite an issue.

As is, it's already bad enough how plant operators socialize these long-term costs while keeping all the profits private, which is the only way these operations can turn a short-term profit. Case in point: [http://www.dw.com/en/german-government-does-nuclear-waste- de...](http://www.dw.com/en/german-government-does-nuclear-waste-deal-with- energy-companies/a-36089376)

It's even more infuriating to see that quote of Sigmar Gabrial boasting that "society alone doesn't have to bear the costs". How generous of them to pay a little bit into a fund for the disposal of their own waste, while the German taxpayer will end up picking the brunt of the bill when, as always, everything ends up going way over the estimated costs.

Just take a look at Fukushima: TEPCO has a book equity of $US20 billion, total cleanup costs are estimated at $US250 billion, who's paying for that? Right, the Japanese government aka the tax payer.

<comment><USER8> Even despite that, it's still better than coal. The costs are just more concentrated, and therefore more apparent. But the fact it's concentrated also make it at least _possible_ to contain and cleanup. No one would even _attempt_ to cleanup the environmental damage caused by coal, and it would cost vastly more than hundreds of billions. The estimated deaths are much larger than from nuclear accidents.

If we had invested more in Nuclear it would be less of an issue. We've invented much safer reactors, and more efficient ones that produce much less waste. Probably much more would have been developed if the investment was there.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Can anyone recommend an air quality detector for personal use. My second floor office is in downtown Oakland by a busy road. The windows are closed and an air filter is always running. Perhaps the air filter is providing a false sense of security and not trapping any sub 2.5 micron particles.

My last air quality detector seemed questionable. I could leave the windows open during rush hour it would always just say the quality was good. Meanwhile there is soot on my window sill.

<comment> semi-extrinsic There are sufficiently many aspects of air quality (NOX, PM2.5, PM10, O3, SO2, CO, CO2, VOCs, humidity) that a basic trustworthy monitoring station would set you back at least $500. I'd say get a trustworthy temp/humidity/CO2 sensor, since those are the only ones you really emit yourself, and get the remaining data from your local environmental info agency - check e.g. aqicn.org .

Edit: is your air filter a HEPA unit? (Does it look like a big car engine air filter?) Do you change the filter every 6 months? Those should help.

</comment></comment><comment><USER12> Clean diesel is the biggest industry scam since smoking. Thousands die every year from small particle emission from vehicles. Smog damages baby brain development.

Most diesel cars emitt up to ten times small particles like pm2.5 than car regulation and it's really bad for human health.

<comment><USER13> Always a bit of a sucker for conspiracies and woo, reading this left a long term impression on me:

" _Are Diesels More Dangerous than Cigarettes as a Cause of Lung Cancer?_ " \- [http://www.second-opinions.co.uk/diesel_lung_cancer.html](http://www.second- opinions.co.uk/diesel_lung_cancer.html)

</comment></comment><comment><USER14> They didn't mention whether the effect remained constant regardless of population density.

I'm a big proponent of "you probably shouldn't be inhaling more than you need to of any sort of particle" but I wouldn't be surprised if the small amounts of extra stress of day to day life in a more densely populated area isn't good for you.

<comment><USER15> > I wouldn't be surprised if the small amounts of extra stress of day to day > life in a more densely populated area isn't good for you.

Extra psychological stress is always detrimental. They did mention other variables, including noise and other gasses, were not controlled for.

However, the mouse study removed those variables:

> He exposed mice to high levels of fine particulate air pollution five times > a week, eight hours a day, to mimic the exposure a human commuter might > receive if he or she lived in the suburbs and worked in a smoggy city > (Molecular Psychiatry, 2011). After 10 months, they found that the mice that > had been exposed to polluted air took longer to learn a maze task and made > more mistakes than mice that had not breathed in the pollution. > > Nelson > also found that the pollutant-exposed mice showed signs of the rodent > equivalent of depression. Mice said to express depressive-like symptoms give > up swimming more quickly in a forced swim test and stop sipping sugar water > that they normally find attractive. Both behaviors can be reversed with > antidepressants. Nelson found that mice exposed to the polluted air scored > higher on tests of depressive-like responses.

I suggest reading the article. There were other disturbing changes that strongly suggest pollution may be the modern analogue to the Roman Empire's lead paint. It's definitely worth significant and rapid research investment.

</comment></comment><comment><USER16> How can it be that there are not decades of thorough, prioritized studies on the connection between air pollution and cognitive impairment?

<comment><USER17> $

</comment></comment><comment><USER18> This doesn't prove that smog is the cause. Perhaps the people in smoggier districts had lower education levels and didn't stay as mentally active in old age? There are too many other variables that could be at fault.</comment>


Does HP + Palm = Facepalm? - <AUTHOR> http://www.computerworlduk.com/community/blogs/index.cfm?blogid=14&entryid=2938 <comment><USER2> I am not a financial whiz or even moderately edumicated, so do not buy or sell stock based on what I write here. Clarification sand corrections eagerly solicited!

> I'd be grateful if some financial wizard could explain to me why it has $33 > _billion_ of goodwill on its books when Apple, by contrast, has only $480 > million

One source of what accountants call goodwill is free spending on companies. When HP buys Palm for $1.2 billion, it will add up all of Palm's cash and assets and put those on its books. If all that adds up to less than B$1.2, the rest is marked as "goodwill."

Later on, HP can decide that they really didn't get B$1.2 out of Palm and adjust the amount of goodwill to reflect overpaying. This is called "writing it down." It's very embarrassing but it's also prudent, as having too much goodwill on your books makes you look like a financial pufferfish. A writedown trades one-time embarrassment for long-term attractiveness.

B$33 is a lot, it probably reflects HP having done a lot of M&A while not writing the goodwill down.

<comment><USER3> Ordinarily I wouldn't, but since you eagerly solicited...

s/Clarification sand corrections/Clarifications and corrections/

</comment></comment><comment><USER4> I stopped reading when I got to the part where the author expressed an apathetic ignorance about the concept of "goodwill". If the author can't be arsed to research an article, I can't be bothered to read it.

That said, the article did motivate me to do 10 minutes of research into United States GAAP and conclude that the $33 billion is probably a result of the Compaq merger.

Edit:

The Inquirer says HP valued the goodwill from the Compaq acquisition at $14.5 billion: [http://www.theinquirer.net/inquirer/news/1019181/when-hp- bou...](http://www.theinquirer.net/inquirer/news/1019181/when-hp-bought- compaq-crock)

That leaves another $18.5 billion that is probably explained by this list: [http://en.wikipedia.org/wiki/List_of_acquisitions_by_Hewlett...](http://en.wikipedia.org/wiki/List_of_acquisitions_by_Hewlett- Packard)

<comment><USER5> It's somehow interesting that their previous acquisition was 3com. It's as if Palm returned to a previous home but in a different city.

</comment></comment><comment><USER6> The Android handset market seems to heavily saturated at this point. I think HP was probably wise to go in a different direction and do something unique with potential for a bigger splash in the market than just another Android handset with an HP logo on it would.

</comment><comment><USER7> Off-topic, but wow, that site is a promo for AdBlock if there ever was one. I wonder how frequently authors of cogent, well-written content (like this article) feel frustrated that they have to

[!!!!!!!ADVERTISEMENT!!!!!!!]

compete for their readers' attention with scads of distracting ads, some of which are placed smack-dab in the middle of their content.

<comment><USER8> Not often, I'd say, as those ads are where their paycheck comes from.

</comment></comment><comment><USER9> No facebook + palm = facepalm

<comment><USER10> /facepalm</comment></comment>


*.atlassian.com SSL certificate expired - <AUTHOR> https://status.atlassian.com <comment><AUTHOR> Detailed status: [https://www.ssllabs.com/ssltest/analyze.html?d=aui%2dcdn.atl...](https://www.ssllabs.com/ssltest/analyze.html?d=aui%2dcdn.atlassian.com)

</comment><comment><AUTHOR> The Status page only says "some customers" and "CDN is impacted", but it seems that the .atlassian.com wildcard cert is simply expired at 15:00 today.</comment>


A Curious Case of Disregarded Robots.txt - <AUTHOR> https://mike.pub/20170425-disregarded-robots-txt <comment><USER2> Robots.txt doesn't confer copyright.

What about domains that have been sharked ? Does controlling robots.txt now give me the right to suppress all content ever originating from that domain, for as long as I control robots.txt?

Internet archive is right to spider the site, but defer showing. Collection != dissemenation.

The IA isn't synthesizing, selling, cross referencing or afaict doing anything nefarious with the data.

You are literally picking on the last org on the internet that needs to get picked on.

<comment><USER3> > You are literally picking on the last org on the internet that needs to get > picked on.

True but at the same time I do understand those who generally want others to abide by their Robots.txt. INAL, but ideally I would love to see the IA having the right to ignore Robots.txt (however, if some one wants to opt out of the IA they should be given the option) while others shouldn't be allowed to do so.

</comment></comment><comment><USER4> Meh. I'm pretty ambivalent about voluntary restrictions like robots.txt. As far as I'm concerned it's mostly useful as a way for site operators to document endless dynamic content or requests that are prohibitively expensive (but not so much that they restrict access).

I figure if it's on the web and a human can read it, my computer ought to be able to read it too.

<comment><AUTHOR> Yes, but should your computer also be allowed to disseminate that content without the original author's permission?

<comment><USER5> Well yes, the whole point of robots.txt is that it's impolite to refuse to follow it, and doing so and getting caught might get you banned from the site.

<comment><USER6> That's a really good point. I'm not a fan of Internet Archive ignoring robots.txt, but if I'm really unhappy about it I can block their robot in Apache using .htaccess rules (as long as they continue using archive.org_bot as their user agent).</comment></comment></comment></comment>


How Microsoft computer scientists and researchers are working to 'solve' cancer - <AUTHOR> https://news.microsoft.com/stories/computingcancer/ <comment><AUTHOR> Research in progress at Microsoft Research at Cambridge, UK.

This has been picked up by the media (how I heard about it) - but with the usual hyperbole, e.g.,

\- Microsoft will 'solve' cancer within 10 years by 'reprogramming' diseased cells: [http://www.telegraph.co.uk/science/2016/09/20/microsoft- will...](http://www.telegraph.co.uk/science/2016/09/20/microsoft-will-solve- cancer-within-10-years-by-reprogramming-dis/)

\- Microsoft is reprogramming cancer: [http://www.pcauthority.com.au/News/437929,microsoft-is- repro...](http://www.pcauthority.com.au/News/437929,microsoft-is- reprogramming-cancer.aspx)

<comment><USER2> \- Microsoft, in a Flash of Genius, Will Soon Devise "Grand Unified Theory"

\- Microsoft Shortly to Invent Electric Car, and Probably Outsell Tesla by a Factor of 3

\- Microsoft Only Two Years Away from Composing a Song So Beautiful it Revolutionizes Music Industry

<comment><USER3> And a few days ago on HN:

\- Oracle launches cloud service, predicts Amazon's demise

</comment></comment></comment><comment><USER4> It's great that we have all these research teams tackling the cancer problem from a machine-learning/genomics/personalised-medicine angle...

But do they have a common/open standard for technologies (ML, CV, etc), sharing datasets and findings, trials, etc? IMO something like HL7 [0] but for cancer research would be a game-changer.

I see a lot of promising approaches but not so good coordination, with everybody working in silos and developing their own framework... or maybe it's what I see on the surface.

[0] [http://www.hl7.org/](http://www.hl7.org/)

<comment><USER5> There are. Data types are pretty much standardized on the basic level (eg. fastq, bam, bed, vcf etc.). Else, most is done by the big science consortia like TCGA, ICGC & PanCancer. And obviously the big databases from NCBI and EBI-EMBL. Trials are standardized by EMA and FDA.

<comment><USER6> FASTQ, BAM, BED, VCF, etc are all standardized in terms of file format, but the semantics of the content are not. Harmonizing data across multiple semantics is still a very challenging problem that few people take seriously.

<comment><USER5> Like the good old "chr1" == "1" problem? Well, yeah that's true. But still I think we have those consortia in place, why do we need another authority. They just have to set (and somewhat enforce) the rules.

<comment><USER6> It goes far beyond "chr1" = "1". There are many other fields with next-to- impossible to interpret data. The consortia have, at best, advisory roles, they cannot enforce any rules. And given an extensible file format, third parties are going to extend it with poorly defined/standardized data. Then the consumers have to harmonize the data. Data harmonization (or cleaning) it typically one of the bottleneck steps in applying machine learning at scale.

</comment></comment></comment></comment></comment><comment><USER5> For those not that deeply involved into this: There is the whole field of bioinformatics that is involved in this kind of research, creating data in the range of multiple peta-bytes, using some of the biggest computing clusters around. That a big enterprise like Microsoft wants their part of the cake is obvious, especially as this is going to be a billion dollar market. But there is no reason to especially belief in Microsoft, they are just doing what everyone else is doing (and only with more money and/or expertise if they spent more than a few billion dollar on it, else this is mere marketing, nothing really note worthy). Maybe its a nice touch for the field that now even Microsoft has noticed it.

<comment><USER7> Indeed there's a whole field, and I think Microsoft has a strong potential to radically improve it.

Most bioinformaticians I know are poor developers, have limited knowledge of existing algorithms, and/or have critically limited bio knowledge. As a result you get buggy, slow and unmaintainable software (see: all the MRI analysis software posts recently), reinvention of classical algorithms (anything from basic statistical tests to full on clustering methods) or tools lacking the full scope required to actually be useful.

I think MS could change this by having strong CS/SWEs with longer tenures than you see in academia, backed by more money and essentially unlimited computing resources, with a high profile name to win them collaborators who can share good datasets. (Compared with Google, they're not trying to generate data in- house as far as I've heard.) Some of the most notable advances in bioinformatics have come from applying decades-old algorithms that never made it to bio before then. Even if MS just accelerates this by applying people who know about these algorithms, that would be very helpful.

<comment><USER8> Cancer cannot only be solved with algorithms and machine learning. Remember that it's biology, not informatics. A lot of smart people have been working on cancer for decades. It's unlikely MS will 'solve' cancer.

</comment></comment></comment><comment><USER6> Stop saying you're going to "solve" or "cure" cancer. that doesn't even make sense. Show some humility.

<comment><USER9> Independent of any overly-optimistic time-frames, why does this not make sense?

I take it to mean that we will understand cancer so completely that we can render it a minor disease.

Oh man, I had to call in sick last week 'cause I had a nasty cancer, but I'm feeling fine now.

<comment><USER6> I strongly suggest reading "The Biology of Cancer" by Weinberg to get a better understanding of why we will likely not understand cancer so completely we can render it a minor disease.

</comment></comment></comment><comment><USER10> The last two projects mentioned in the article (Literome and better interpretation of medical images) sound like they may be useful. The projects that are described as cell-debugging and cell-reprogramming sound like the sort of hubristic projects that someone with a good computing background but less than an undergraduate knowledge of cell biology might propose (at least as the projects are described in the article).

About a decade ago I was involved with a US Department of Energy effort to model radiation damage to DNA in silico, and more peripherally involved with a proteomics effort working out of the same institution. They didn't work very well. The number one problem was that we didn't have good baseline data from experiments to work with. IMO, you'd get better mileage out of automating in vitro experiments and ensuring that the data is reproducible before you start trying to leverage the latest in computer science. How much can you machine- learn from garbage inputs? Biology experiments even at the isolated cell level are notoriously fiddly. Let _the biologists_ (or at least people who have worked with them) explain the problems that need solving in biology, and then bring in CS people as required. Starting with a computing-oriented perspective is just begging to misunderstand what biological research needs.

</comment><comment><USER11> Hats off to the new Microsoft for a worthy endeavour.

I just hope that the eventual solution is cheap for those that need it and that the tools and techniques are readily available to the hacker community (i.e. open sourced).. otherwise I'll put my hat back on.

</comment><comment><USER12> [http://xkcd.com/1736/](http://xkcd.com/1736/)

<comment><USER13> This one is also relevant: [https://xkcd.com/793/](https://xkcd.com/793/)

</comment></comment><comment><USER14> I look at their publications list: [https://www.microsoft.com/en- us/research/research-area/medic...](https://www.microsoft.com/en- us/research/research-area/medical-health-genomics/?q&content- type=publications)

With all due respects, the claim of the article is overblown. Those are the kind of articles a very good department would publish, nothing special or game changing.

</comment><comment><USER15> There is a very interesting dynamic at work in medical research strategy where the scientific urge to completely map our biochemistry meets the engineering urge to make tangible progress in repairing things when they go wrong.

The truth of the matter is that most of the mapping of molecular biochemistry being done in this age of enormous datasets and genetics is of very little immediate application. Meanwhile paths that can use what we already know to generate enormous impact on disease get little attention. This is an age of personalized medicine as the mainstream, but really the overwhelming majority of serious disease mechanisms, those that are age-related or infectious, are exactly the same for everyone. Personalized medicine is a wondrous machine for making money by the look of it, but won't deliver on its promises.

For example in cancer the best path forward is to turn off telomerase and ALT, preventing telomere lengthening. That will work for all cancers, one type of treatment for every cancer type, and will cost no more to bring to fruition than any one of the recent examples of cancer therapies brought to market. But that gets a fraction of the attention that goes towards mapping every last part of the genetics and cellular biochemistry of cancer. The efforts to create therapies that spin off from that type of mapping work are largely very limited, in that they involve targeting a mechanism or marker very specific to only one or a few of the hundreds of types of cancer, and even those types are capable of evolving away from that marker or mechanism when it is successfully targeted.

Cancer is hard because the research and development community largely follows a terrible high level strategy for implementation of therapies, even though in the long term the mapping strategy is exactly what scientists should be doing.

<comment><USER16> Are you claiming you know how to solve cancer?

<comment><USER17> I think he is talking about this: [http://www.bu.edu/research/articles/a-new- tactic-for-fightin...](http://www.bu.edu/research/articles/a-new-tactic-for- fighting-cancer/)

It's actually pretty interesting.

</comment></comment></comment><comment><USER18> Cancer is just a name to group a lot of different diseases under; there can't be an universal cure...

<comment><USER19> If you had a general purpose way to selectively kill specific cell types then there could theoretically be a universal cure ?

<comment><USER6> No, because cancer always evolves. If you don't kill 100% of cancer cells, the remaining cells are likely resistant to whatever you used to kill the specific cell type, and they will grow up and continue causing problems.

What you would need is something that recognized cancer cells and only cancer cells with 100% specificity/100% selectivity, and killed all of them. This is near impossible for something that can evolve.

<comment><USER20> It's an arms race, but we can in principle stay mostly ahead in it. Evolution is not a perfect solution finder, and in the future, we may be able to constrain it by reducing the probability of a mutation we can't handle to arbitrarily low values. We know how the optimization process works here, what we lack today is enough control over the problem space to screw that process up.

<comment><USER6> Arms races are a great way to bankrupt yourself. as for "Evolution is not a perfect solution finder, and in the future, we may be able to constrain it by reducing the probability of a mutation we can't handle to arbitrarily low values", that's a nice speculation, however, it's just a speculation, and not one well-founded in fact.

<comment><USER20> It's a one race we can't avoid - biology will not cooperate to stop evolving pathogens if we collectively agree to abandon medical research.

As for the speculation part, it kind of follows from the math of things. Evolution is very dumb compared to us, it just has the numbers advantage.

<comment><USER6> I heartily encourage you to look at the current state of antibiotics and appreciate that while evolution may not be "smart", it has more advantages that just numbers.

As for cancer, it's not clear that more effective cancer will evolve in the near term if we don't apply selection pressure to it- cancer has existed in humans with little to no change for millions of years and in mammals for far longer than that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Well good for them and I wish them success. But I'll believe it when I see it.

</comment><comment><USER22> Why would you post marketing material and then have a problem with it being marketing?

Google X is this kind of thing 1000x.

</comment><comment><USER23> \- Microsoft Cure For Cancer To Ship With Windows 10 Whether You Like It Or Not

(joke)

</comment><comment><USER24> Notwithstanding the grandiose statements, I love this direction: cure cancer by somehow telling the cancerous cells to become normal cells.

</comment><comment><USER9> We should harness cancer to engineer intentional structures. Is it brain cancer, or is it a neural lace?

</comment><comment><USER25> [http://blogs.sciencemag.org/pipeline/archives/2016/09/21/bet...](http://blogs.sciencemag.org/pipeline/archives/2016/09/21/better- faster-more-comprehensive-manure-distribution)

Derek Lowe's take, as usual, is a good counterpoint and a giant "Take With Lump Of Salt" NB.

>I have beaten on this theme many times on the blog, so for those who haven't heard me rant on the subject, let me refer you to this post and the links in it. Put shortly – and these sorts of stories tend to put actual oncology researchers in a pretty short mood – the cell/computer analogy is too facile to be useful. And that goes, with chocolate sprinkles on it, for all the subsidiary analogies, such as DNA/source code, disease/bug, etc. One one level, these things do sort of fit, but it's not a level that you can get much use out of. DNA is much, much messier than any usable code ever written, and it's messier on several different levels and in a lot of different ways. These (which include the complications of transcriptional regulation, post- transcriptional modification, epigenetic factors, repair mechanisms and mutation rates, and much, much, more), have no good analogies (especially when taken together) in coding. And these DNA-level concerns are only the beginning! That's where you start working on an actual therapy; that's what we call "Target ID", and it's way, way back in the process of finding a drug. So many complications await you after that – you can easily spend your entire working life on them, and many of us have.

And that's why many of us who have actually been working on diseases like cancer get a little testy when we see folks from computer science coming in with this "Gosh darn it fellows, do I have to do everything myself?" attitude. Years of working with (human-designed) hardware running (human-written) code have given many people in that field what I think is an exaggerated idea of human capabilities (at least as they are right now). When you can write code that gets used by hundreds of millions of people in their daily lives, it's understandable to think that you're able to just reach in and change reality by sheer braininess and force of will. Unfortunately the world of code and computational hardware, as important, useful, and lucrative as it is, is just a sandbox compared to the real physical universe, of which living creatures are just a tiny little part. But biology has no debugging programs, no annotations, no manuals. It wasn't written by humans – in fact, as far as we know, it wasn't written by anyone at all, it "just grew" in a process that has no good counterpart to the ways that humans generally get things done. ....

>If you remove the hubris from the Microsoft announcement, though, which takes sandblasters and water cannons, you get to something that could be interesting. It's another machine learning approach to biology, from what I can make out, and I'm not opposed in principle to that sort of thing at all. It has to be approached with caution, though, because any application of machine learning to the biology literature has to take into account that a good percentage of that literature is crap, and that negative results (which have great value for these systems) are grievously underrepresented in it as well. I think that machine approaches to understanding biological pathways will, in the end, probably be the way to go, because it's too complex for us to keep it all straight in our minds (not human!) But we're not there. There are many, many important things that we simply don't understand very well, and many others, I'm sure, that we just flat-out don't even know exist yet. Debug that.

So if Microsoft wants to apply machine learning to cancer biology, I'm all for it. But they should just go and try it and report back when something interesting comes out of it, rather than beginning by making a big noise in the newspapers. You want to cure cancer? Go do it; don't sit around giving interviews about how you're going to cure cancer real soon now. I'm sure that someone at the company imagines this as a big blazing publicity sendoff, fireworks and balloons and all the rest of it. But to anyone who works in the field, it's more like a grenade going off inside a manure pile.

<comment> lloyd-christmas _"We're in a revolution with respect to cancer treatment"_

Reading this quote from the original article make me nauseous. We're in a revolution with respect to cancer RESEARCH. PEOPLE are the ones being treated. You can't only focus on a math equation. You also need to focus both on palliative care and explainable research. The article seemed to save that acknowledgement for the last two sentences.

My father has been an oncology physician/researcher for 35 years. He regularly has to tell to some of his non-physician researchers that their work needs to be explainable to both his patients and those who will continue funding the research, yet they consistently show up with black box neural networks saying "we found it!"... found what exactly? He has to be able to convince his master-of-the-universe patients that he knows more than WebMD or their favorite holistic blog, see: Steve Jobs. It's incredibly more common than one would hope, see: anti-vax.

Just to clarify, there is nothing wrong with ML research into cancer. However, research isn't treatment. Oncology is depressing. Fewer and fewer doctors are interested in specializing in it. The overall suicide rate of physicians is double the general population, and that's not even oncology-specific. There's a revolution with respect to cancer treatment, and it's a pretty scary downward spiral.

Announcements such as these can end up taking money AWAY from cancer treatment. The government sees this stuff and jumps on the bandwagon. "Why fund humans when computers can do it?" Government research grants pay my father's salary along with all of his physician-researchers and students. Without that funding, people just get to read about the upcoming research while they wait to die.

</comment></comment><comment><USER26> That's Cancer with a big C, not the operating system also known as Linux</comment>


Ask HN: How to do freelance work that is reclaimable? - <AUTHOR> Most of the projects I see, their coding depends on the outsourced company it started. I would like go into consultancy business but when things go side ways and it comes time to leave my customer, I would want them to remain happy.
Here, I wonder if how other companies are willing to take over the existing code? What should I do best to make transition easier for the project itself for encouragement of new team taking over?
Thank you for thoughts. <comment><USER2> Write clean, simple code. Don't over-engineer. Use version control. Document design decisions, dependencies that aren't obvious, and installation/build instructions, and keep those current. Did I mention USE VERSION CONTROL?

My freelance business is taking over legacy software when the original developers quit, get fired, stop answering emails.

<comment><AUTHOR> I like your points, I assume I will do all. "Document design decisions" is new for me, I will look for standards for that.

</comment></comment><comment><USER3> I think to some degree you have to accept the disposable nature of consulting. If you want to be responsible for satisfaction years down the road, you could do a product-consulting hybrid, where you do quite a lot of customer-specific dev upfront but as part of a bigger product.

Otherwise you really need to make sure the customer cares about it as much as you do. And many simply don't.</comment>


Scalable Web Architecture and Distributed Systems - <AUTHOR> http://www.aosabook.org/en/distsys.html#

<comment><USER2> A chapter from _The Architecture of Open Source Applications_. The complete text of which is available from here:

<http://www.aosabook.org/en/index.html>

Looks interesting. No I haven't read it.

<comment><USER3> I've read a few bits and they're all great one way or the other, primarily because chapters on specific projects are written by their primary authors. A couple of good ones

Nginx: <http://www.aosabook.org/en/nginx.html> LLVM: <http://www.aosabook.org/en/llvm.html> Sendmail: <http://www.aosabook.org/en/sendmail.html>

Although this means there's no consistent style across chapters, it's really something else to hear about the architectural and design decisions that the author made, and how they look back at those decisions now (esp. in the Sendmail article).

</comment></comment><comment><USER4> I have been finding more and more interesting eBooks for purchase online. But I don't buy them for a few reasons.

First, without ratings by people with good reputation I have no idea whether the book is good or bad. In this case, Grady Booch gave it a thumbs up, but I would still like to see more endorsements / reviews. I know Amazon can be rigged, but for certain genres I've found individuals I trust.

Second, my experience with self published books is that they are often pretty poor in terms of eBook production, even by good authors. I have books by good authors who have gone the traditional route and then tried self publishing; the difference is often night and day.

Last, when I purchase an eBook, I like that it is stored permanently in some place online, so I can refresh it at will. When new formats become available, I want the option to download it for free. I'm not paying for separate PDFs and ePubs. Both OReilly and Informit allow this, and when new formats become available, its easy to get them.

</comment><comment><USER5> Section 1.1 starts out by listing some "principles": availability, reliability, cost, etc. None of these are principles.

At a higher level, the main point of the book, a Service Oriented Architecture composed of independent, separable, small components, doesn't really make sense: many of the critical concerns in distributed systems are cross-cutting. E.g. if you're using Mongo as a storage component, you will be doomed to the morass of eventual consistency throughout your application. Cross cutting concerns require end-to-end thinking.

Now, SOA is a meaningless term and one can redefine it to mean anything, so don't defend the book by redefining critical terms. I am not arguing that componentized designs don't make sense. I am arguing that you cannot componentize in the manner described in the book, without constant concern for the whole. Yes, you can bolt crap together into a bigger pile (of crap), but it'll stink as badly as the weakest, stinkiest component.

<comment><USER6> Can you recommend other resources for learning the right way to construct SOA?

</comment></comment><comment><USER7> Please support AOSA by buying a copy... Money goes to charity, but it shows these books are appreciated. I bought pdfs lastvyear and the epubs last month as my yearly new year's charity.

This chapter surely is a good one, but the books contain a lot of good suggestions.</comment>


Google Is Already Late to China's AI Revolution - <AUTHOR> https://www.wired.com/2017/06/ai-revolution-bigger-google-facebook-microsoft/ <comment><USER2> It's not so much they were late to the party; they weren't invited.</comment>


Ask HN: Why do ATMs run on Windows? - <AUTHOR>

Seems like a lousy choice for a machine that needs to be highly secured. <comment><USER2> Well, if your bank's internal systems/offices already run Windows, then it is better to use the same platforms for your ATMs too - you can reuse code between the two systems, and you only need one developer team instead of two.

Also, ATM development started way before Linux was a major player and people basically only had MS-DOS or OS/2 as choices - and as banking software develops at the same speed as a glacier moves (and those ATMs tend to grow OLD), you're stuck in a lock-in effect.

</comment><comment><USER3> For the same reason everyone writes other financial systems for Windows. It's a popular platform with rich frameworks and a large developer base.

The current versions (>= Windows 7) of Windows are pretty secure. Even the last patched up version of XP isn't awful. That said, my experience with ATMs has been that nobody does a good job of hardening ATMs.

</comment><comment><USER4> Why wouldn't they run windows? I don't get all this drama with ATM's and XP. They are (should be) physically secure, meaning no usb ports available, cd- rom, no public network. THey are completely locked down. Many of them are still running windows95 and they seem to work pretty well.

What would you recommend then? Mac? Linux?

</comment><comment><USER5> Atm's, from what I know, are generally not connected to wifi. Most are directly wired to either DSL or to a modem making it the end users issue(aka the person who owns the property which the ATM is on).</comment>


EFF Urges Court to Reconsider Decision That Harms Internet Users - <AUTHOR> https://www.eff.org/deeplinks/2019/11/eff-urges-court-reconsider-decision-harms-internet-users-ability-protect <comment><USER2> Woaaah, this is really ridiculous. The Ninth Circuit thinks that not only are there "anti-competitive" exceptions to Section 230 (there aren't), but that Section 230 applies to _actions that a user-installed software takes on that users own computer_?!

How do I file a brief with the court too, to tell them how horribly wrong they are? This seems like a ham-fisted attempt to weaken Section 230 in any way that they can.

This ruling opens the door for advertisers to sue authors of adblockers for blocking their ads, because it's "anti-competitive." Terrible, terrible, ruling.

<comment><USER3> > but that Section 230 applies to actions that a user-installed software takes > on that users own computer?!

Malwarebytes was the one trying to invoke Section 230's "safe harbor" for filtering software because it would immunize Malwarebytes even if its conduct was illegal under New York competition law. (And it would allow dismissing the case at an early stage, without resolving whether Malwarebytes' conduct was in fact legal.)

If you're correct that Section 230 doesn't apply at all, then the result is the same as what the Ninth Circuit held: the claims against Malwarebytes can go forward.

</comment></comment><comment><USER4> Why does it seem like it's the Ninth Circuit that wants to contradict / ignore / destroy the legal environment around online technology in general?

Location? Especially clueless judges? Failure of due diligence in research? Malicious hijacking by business interests?

<comment><USER5> What I hear from my lawyer friends is that the Ninth Circuit is the oddball on basically any topic.

<comment><USER6> I've heard it called the "Ninth Circus".

</comment></comment></comment><comment><USER7> So if a company can block access to URLs/sites that host competitive content, wouldn't that authorize Google to block damn near everything on the internet? There are very few areas in which they aren't competing with someone... maybe Amazon's online grocery delivery -- except that's powered by AWS which competes with GCP.

Maybe Google _would_ be able to legally block everything if you installed software from them on your computer.

</comment><comment><USER3> The framing of this as an "antitrust exception" to section 230 is probably not the most correct one. Here is the statutory provision in question:

> (2) Civil liability

> No provider or user of an interactive computer service shall be held liable > on account of— > (A) any action voluntarily taken in good faith to restrict > access to or availability of material that the provider or user considers to > be obscene, lewd, lascivious, filthy, excessively violent, harassing, or > _otherwise objectionable_ , whether or not such material is constitutionally > protected;

The question is: what is "otherwise objectionable?"

The Ninth Circuit's _Zongo_ case held that "providers of computer security software can benefit from § 230 immunity, and that such providers have discretion to identify what online content is considered 'objectionable.'"

Of the bat, the Ninth Circuit is dealing with a self-created problem. Under ordinary principles of statutory construction, "otherwise objectionable" must be interpreted consistently with the preceding elements of the list, which relate to pornography or violence. Maybe Nazi material would qualify, but Congress probably didn't intend the statute to cover malware or spyware. Had the Ninth Circuit limited "otherwise objectionable" to such content, the antitrust issue would never have arisen, because _other filtering tools_ wouldn't fall within the scope of "otherwise objectionable" content.

Regardless, Ninth Circuit precedent is what it is. But that still doesn't support calling this an antitrust exception. As the Court itself says, it's about the scope of the "discretion" to define what is "otherwise objectionable" content. It's about whether the safe harbor applies at all, not carving out an exception for the safe harbor when it would otherwise clearly apply.

<comment><USER8> I see no reason that whether material is objectionable only applies to pornography. However typically when someone tries to call something _not_ pornography objectionable whatever the case is about is thrown out, eventually, on first amendment concerns.

> Regardless, Ninth Circuit precedent is what it is.

Careful. Bad precedent should not stand just because it is precedent.

<comment><USER3> The statute creates a safe harbor for filtering "material" that is "obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable." One of the rules of interpreting statutes is that you interpret the scope of catch-all terms in a list consistently with the preceding elements. The preceding elements refer to pornographic or violent content. That would suggest that you shouldn't interpret "otherwise objectionable" to include things like adware or spyware.

<comment><USER8> 4 of the 6 explicit criteria given are not inherently sexual in nature, and only 2 of those 4 are in any way related to violence (but even harassing is not necessarily violent, so it may be 1). Like I said, the only case law that exists relates to pornographic material as it is the most unpopular. That wording was ripped from other anti-obscenity laws that have had a hard time in court but have not yet been entirely struck down.</comment></comment></comment></comment>


Why don't most web 2.0 startups use sophisticated algorithms? - <AUTHOR>

Lack of knowledge/ability?  To avoid infringing patents (even accidentally)?  Most users won't care?  Not important in the problem domain? <comment><USER2> I don't get the question? I know a lot of startups using all kinds of algorithms. Xobni(email analysis algorithms/bayesian analysis, statistical analysis), Topix (classification algorithm), Reddit (recommendation algorithm), automattic (spam detection/classification algorithm), krugle(ranking algorithm),joost(distributed system alogrithms) and the list goes on.

<comment><AUTHOR> How about something that would be publishable in a 1st tier conference?

<comment><USER3> Most of the things published in 1st tier conferences are useless outside of academia. In my current field (computer graphics) this is glaringly obvious.

</comment></comment></comment><comment><USER4> Why do you think they don't?

<comment><AUTHOR> Because the vast majority of users won't appreciate them. Also users like predictability, particularly in social sites. Clever heuristics are not predictable.

<comment><USER5> Actually, I think pg was asking "on what do you base the theory that they don't use sophisticated algorithms?" rather than "why do YOU think that startups aren't using sophisticated algorithms?", but depending on the emphasis, it could go either way.

<comment><AUTHOR> If they are using sophisticated algorithms, then they are using them behind the scenes. For example, such a startup might use sophisticated spam detection or a clever algorithm to get a performance boost.

This is different from a startup such as Google where PageRank is major breakthrough that is made obvious to everyone. We don't see many startups like Google in web 2.0. It seems that web 2.0 is more about harvesting people power and less about sophisticated algorithms.

<comment><USER6> I bet most people aren't thinking about eigenvectors when they are looking at Google's search results. The user does not (and should not be made to) care about sophisticated algorithms; only utility counts (in business, of course, not in research.)

<comment><AUTHOR> One can still ask the question though: of the startups acquired by major companies, how many of them use sophisticated algorithms?

<comment><USER5> "One can still ask the question though: of the startups acquired by major companies, how many of them use sophisticated algorithms?"

Yes, one could. Though it isn't the question you originally asked, and so you shouldn't be surprised when you don't get an answer to that question. The question you asked was "why aren't startups using sophisticated algorithms?" ;-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> We use some pretty sophisticated algorithms in our startup.

</comment><comment><USER8> merge sort ftw.</comment>


U2F Support in OpenSSH Head - <AUTHOR> https://marc.info/?l=openssh-unix-dev&m=157259802529972&w=2 <comment><USER2> This is awesome, I can now have hardware backed SSH keys without any PKCS#11 or gpg-agent in the mix. A blue security key is enough.

</comment><comment><USER3> You can use U2F with SSH today by making U2F a pam authentication requirement... though this normally requires some copy and paste of the u2f challenge and response since your terminal doesn't know to do that and the ssh client software itself doesn't recognize the U2F challenge.

Making it easier would be really nice.

The linked post really unclear to me about the security properties provided. This document ( [https://github.com/openssh/openssh- portable/commit/57ecc1062...](https://github.com/openssh/openssh- portable/commit/57ecc10628b04c384cbba2fbc87d38b74cd1199d) ) is a least a little more clear about what its doing, though it doesn't make an explicit statement about the intended security properties. (So I can't tell if what I'm about to describe is a security break or just simply an attack outside of the security model.)

The language of the post implies, or at least is likely to be read as claiming, that an attacker has to possess the id_ecdsa_sk private key and that a compromised token wouldn't be enough to break your security. This is not the case.

Lets imagine that your U2F device maker is totally malicious or at least the manufacture of your device compromised (e.g. by substituting it in the post)-- under this assumption they know all the secrets in the device and have tampered with its signing procedure.

Given my understanding of the protocol, under that threat model this form of ssh auth is totally insecure: the device can exfiltrate the key-handle (or just the derived private key itself) via the ECDSA nonce.

For example, the token knows some attacker pubkey Q, It takes its current secret x and does ECDH with that and Q, hashes the result with the message being signed and uses that as k. The attacker can observe a single signature, compute the same k then just calculate the user's x which is enough for them to authenticate as the user using ecdsa-sa.

A simple variation of this allows the device to leak 32-bits of data per signature: use the shared secret to index into an error correcting code over the data-to-be-leaked, and grab 32-bits and add it to k. The leak would allow the attacker to get the key-handle of a third party site without ever having to observe an authenticating signature to that site. N bits of additional secret can be learned by the attacker after observing N/32 signatures.

I'm a little unclear about how the enrollment procedure works, but I think nothing about it actually certifies that the public key returned by the device was generated based on the transmitted key handle... If, as I suspect, it doesn't a malicious device doesn't need to bother with any of the above nonce sidechannel stuff, it can simply return a static pubkey regardless of the key handle and simplify the process and the attacker can simply guess your usename and then look up the key in their database to login as you.

As such, I don't believe users should consider use of "ecdsa-sk" to be two- factor... and for ones where their threat model includes attackers that could tamper with the hardware manufacture or shipment (e.g. certainly any major state attackers), they should probably not use this authentication mechanism without an additional effort to use strong two factor auth of some kind. (and it would be kind of unfortunate if it reduced their security to just a crappy user-provided password...)

I think this is really unfortunate missed opportunity, and potentially an unprecedented increase in exposure of boring ssh installs to state attackers. Use of a HW token is a _massive_ security increase against less cosmic attackers, but users shouldn't have to choose between security against weak attackers and powerful ones.

The authentication procedure could have simply included a second ec point in the pubkey (or made the "pubkey" a hash for two ec points which are provided in the signature) and the authentication could have included an additional signature made with an ordinary private key stored in the key file and never presented to the U2F device. This way a malicious U2F device alone wouldn't be enough to compromise the user security, an attacker would also need to steal the key file. This security improvement wouldn't hurt the usability of the system at all, because honest use also still requires the key file. [Super- extra-paranoids-bonus: the second key could be a better trusted curve, or even a PQ safe cryptosystem like SPHINCS]

If the goal wasn't to require the key file-- why store the key handle there at all and not just derive it from data sent by the server as in a more typical U2F application? The only other advantage I see is potentially limiting some cros-domain attacks (e.g. where server A provides server B's key handle).

<comment><USER4> > If the goal wasn't to require the key file-- why store the key handle there > at all and not just derive it from data sent by the server as in a more > typical U2F application? The only other advantage I see is potentially > limiting some cros-domain attacks (e.g. where server A provides server B's > key handle).

I was also a little surprised this isn't used as a second factor, like Universal 2nd Factor is meant to be used. But maybe it's not so surprising given there are at this moment probably more U2F keys than FIDO2 keys in users' hands and the author chose to went with the option that has a bigger installed base.

FIDO2 offers resident keys[0] where a unique key is generated and stored on the authenticator. The server does not need to present the key handle to the authenticator so it can decrypt it and initialize its internal state. The server gets back the userHandle[1] that was set during registration as well.

Protecting the resident credential(s) can be done via a PIN or fingerprint scan, depending on the capabilities of the authenticator and user preference.

[0]: a. [https://auth0.com/blog/a-look-at-webauthn-resident- credentia...](https://auth0.com/blog/a-look-at-webauthn-resident-credentials/) b. [https://www.w3.org/TR/2019/REC- webauthn-1-20190304/#resident...](https://www.w3.org/TR/2019/REC- webauthn-1-20190304/#resident-credential)

[1]: [https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#user- han...](https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#user-handle)

<comment><USER5> You can use it as a second factor by configuring the server to require both password & key with the "AuthenticationMethods" directive

You can also configure it to require public key + U2F by specifying pubkey auth twice which will require two different pub keys but I suppose that would depend on the user having only 1 regular pubkey and one U2F pubkey in their authorized_keys file

[https://man.openbsd.org/sshd_config#AuthenticationMethods](https://man.openbsd.org/sshd_config#AuthenticationMethods)

</comment></comment></comment><comment> m-p-3 Anything that makes SSH authentication secure and easy to use is a win for me and many others!

Just wondering, is there an NFC-based U2F key out there? Would really like being able to use that with my phone as well if an app can support it.

<comment><USER6> The Yubikey 5 NFC [0] has NFC and works in Android.

[0] [https://www.yubico.com/product/yubikey-5-nfc](https://www.yubico.com/product/yubikey-5-nfc)

</comment></comment><comment><USER7> Theoretically you could probably hack the U2F device protocol to _be_ your ssh key.

I've switched to using GPG and GPG-Agent as my SSH identity however. I keep my PGP key on a Nitrokey and keep it with me.

<comment><USER8> > Theoretically you could probably hack the U2F device protocol to _be_ your > ssh key.

That's exactly what this is.

<comment><USER7> I see this now. When I first glanced at it, I thought it was another PAM module

</comment></comment></comment><comment><USER9> Is the Nitrokey supported? I didn't see it.

<comment><USER10> Nitrokey start works with openssh and the pkcs11 lib from (IIRC) opensc.

<comment><USER11> Yes, this works since ages. Here are details: [https://www.nitrokey.com/solutions/sichere-administration- vo...](https://www.nitrokey.com/solutions/sichere-administration-von-servern- und-iot-mit-ssh)</comment></comment></comment>


"Perl" in the name "Perl 6" is confusing and irritating - <AUTHOR> https://github.com/perl6/problem-solving/issues/81 <comment><AUTHOR> context: Elizabeth Mattijsen is part of the Perl 6 Core Development team. ([https://perlcon.eu/user/elizabeth](https://perlcon.eu/user/elizabeth))</comment>