Alcohol Belts of Europe - <AUTHOR> https://en.wikipedia.org/wiki/Alcohol_belts_of_Europe <comment><USER2> I disagree with Hungary is in a Wine-Beer belt. Although Beer is in par with wine, the spirits (pálinka) is very significant. In the region I born, in every household that had some fruits had the argument whether jam or spirits should be made from the fruit. :)

[https://en.wikipedia.org/wiki/P%C3%A1linka](https://en.wikipedia.org/wiki/P%C3%A1linka) [https://welovebudapest.com/en/2015/02/20/19-signs-you- learne...](https://welovebudapest.com/en/2015/02/20/19-signs-you-learned-to- drink-in-hungary/)

<comment><USER3> Serbia is also not in Wine belt. The traditional drink is rakija - which is the same as pálinka in Hungary:

[https://en.wikipedia.org/wiki/Rakia](https://en.wikipedia.org/wiki/Rakia)

The "belts" seems like made up thing, bending the actual facts to fit someone's story.

<comment><USER4> > The "belts" seems like made up thing, bending the actual facts to fit > someone's story.

Agreed. As a Norwegian, I can attest Norway is known for its appreciation of fine spirits like scotch and cognac.

That said, we're clearly a beer-country. We make beer, we drink beer, we go out for a beer, and when people come over, we ask if they want a beer.

Vodka is only drunk by a smaller niche or Eastern European immigrants.

How we could ever be a "vodka nation" beats me. This looks like fiction.

Edit: I guess the illegal "moonshine" culture in the northern parts of the country could account for "vodkaism", but that's not really a striving culture these days, and definitely not mainstream.

<comment><USER5> "these days" is key. I think the map is trying to say that maybe 200 years ago, people mostly drank hard alcohol of some sort, not beer or wine. Do you know whether that is accurate?

And they've lumped by country borders, too. Could people grow hops in very southern Norway, perhaps?

<comment><USER6> They provide no sources for historical consumption. It looks fictional to me. I know there is a lot of fruit wines traditionally in lithuania, for example, but we have been lumped into the "vodka belt"...

</comment></comment></comment></comment></comment><comment><USER7> I don't know if it's because of the wine belt or the warmer climate, but there is definitely a difference in drinking styles between Northern and Southern Europe.

While living in the Northern countries, I've seen an emphasis on the alcohol content and getting as drunk as you can, just for the goal of getting drunk. In Southern countries instead, there is more of an appreciation of what are you actually drinking, its taste and history. People still get very drink, but it's a more mellow experience, as they enjoy this dionysian rite.

Did anybody else have the same experience?

<comment><USER8> Yes, generally speaking, the northern countries have had very strict restrictions on alcohol, which somehow developed an unhealthy attitude in that, once your job is over on friday, get as drunk as fast as possible, preferably until sunday.

But it's changing - now there's an appreciation of the taste of good wines, craft beers and liquors during the week, although still going hardcore during the weekend.

I don't know if it's for the better, but it's changing.

<comment><USER9> With craft beers it's usually still at the weekend and still mostly with the intention of getting the same level of drunk.

It just tastes better/different

</comment></comment></comment><comment><USER10> This makes the common mistake of taking country as the unit of analysis. Like just about everywhere on Earth, European countries are too regional to generalize. In Southern Austria, it's beer and schnapps, with a healthy dose of either white or red wine depending on what's best grown locally.

</comment><comment><USER11> A bit weird, the article refers to "traditional beverages of countries rather than what is most commonly drunk by the populace today", but then uses images compiled from modern consumption data. "consumption (in litres of pure alcohol) in 2010".

Traditional consumption largely follows from soil, and weather, affecting what grows. A less generalized article would be cool, showing cider regions in Germany, France and England as well as wine regions in Germany.

I don't think the generalization to whole countries suits the purported goal of traditional beverages well, nor does the classification of cider as a wine analogue.

</comment><comment><USER12> Many countries even have their own internal alcohol belts. Austria has many wine growing regions where Wine dominates alcohol consumption.

<comment><USER13> Austria's vineyards are concentrated in the eastern portion of the country, right? ([https://en.wikipedia.org/wiki/Austrian_wine#Wine_regions](https://en.wikipedia.org/wiki/Austrian_wine#Wine_regions)) That's wine production; is wine consumption also predominantly in the east, or do Austrians drink wine no matter where in the country they live?

</comment></comment><comment><USER14> Here is a light-hearted look at all the European belts, including the alcohol one.

[https://atlasofprejudice.com/tearing-europe- apart-10d01e876e...](https://atlasofprejudice.com/tearing-europe- apart-10d01e876eab)

<comment><USER6> I wouldn't be surprised if this was the source for the "historic" map, which to my eyes is entirely fictional and full of prejudice. In Lithuania, we historically have a culture of fruit (and berry) wines, but have been lumped into the "vodka belt".

<comment><USER15> And beer has historical presence too. Vodka wasn't a big thing till 19th century when Russian empire came.

</comment></comment></comment><comment><USER16> As said in the article, these are traditional belts.

Nordic countries would be in the beer belt today, for example.

<comment><USER17> Literally the next image shows that Nordic is not beer-belt today (well 2010) but instead split with Finland and Denmark being beer while Sweden and Norway is wine.

I wonder if there's any research as to why that is.

[https://en.m.wikipedia.org/wiki/File:Alcohol_belts_of_Europe...](https://en.m.wikipedia.org/wiki/File:Alcohol_belts_of_Europe_\(actual_consumption_in_2010\).svg)

<comment><USER18> > _Finland and Denmark being beer while Sweden and Norway is wine_

Finland and Norway are beer, Sweden and Denmark are wine.

</comment></comment></comment><comment> GuB-42 I have a feeling that beer is overtaking every other alcoholic beverage in popularity everywhere.

I live in southeastern France. Definitely wine country, lots of reasonably priced, good quality wine is produced here. And while wine is still very popular, a lot of younger people now drink beer. For taste, we have a lot of craft beer shops popping off. And on the opposite end of the spectrum, high alcohol beer is replacing red wine as a cheap way of getting drunk. It is a trend I trend to see everywhere I go.

Interestingly, in France, it looks like rosé wine is making a comeback with women.

</comment><comment><USER19> It's not clear what was the method to measure this. The article mentions "preferred alcohol," "drinking," "drinking pattern" and "production."

This can be misleading as many comments state below. For example, Romania is a big wine producer, it's most known for wine, but a lot of that wine goes for export.

For drinking, a one liter of vodka equals four liters of wine in terms of alcohol content. So a country that drinks 1.5x more wine in quantity over vodka isn't necessarily getting drunk on wine, because you may order a couple glasses of 2dl wine but hit 6 vodka shots of 0.5dl each so basically your main drink of the night was spirit even though quantity-wise you consumed more wine.

Often times, in central eastern Europe, you order beer which is half a liter but you get several shots with it.

For preferred alcohol, it's kind of like when you ask people if they prefer theatre to cinema, most will answer theatre even though they'll only go to cinema.

Or ask them if they prefer to read Economist or Buzzfeed. Nobody ever answers Buzzfeed, yet it is one of the most read media in the world.

So ask me if I prefer beer or wine, I'll say wine because I do. But when I go out I'll have a beer because it's cheaper allows me to sit in the pub much longer without getting drunk too fast and everyone else drinks it too.

This is hard to measure. But overall for main countries like Spain, UK, Germany, France, Italy, Russia etc. it's seems to be correct.

The correct way to measure this, in my opinion would be to measure which beverage delivers the most alcohol content for the said population for that will be its preferred alcoholic beverage.

</comment><comment><USER20> I'm a bit sad our vodka culture in Poland is dying. A lot of people just replace it with drinking beer, usually cheap and terrible.

That doesn't necessary mean that heavy drinkers suddenly drink less alcohol (as some vodka-opponents would claim). They just drink longer/faster to ingest the same amount of pure alcohol in the night.

</comment><comment><USER21> My take on this map is perhaps easier to judge by what is acceptable and common to have at lunch when at work or with family.

Would a glass of wine at lunch seem odd?

Would a beer with your lunchtime burger seem out of place?

Would a glass or two of vodka between colleagues be quite normal?

In that case, I suspect some countries would be more "prude belt"...

</comment><comment><USER22> Norwegian here:

Even though we have a long history of moonshine, especially in the rural areas, we are most def. a beer-drinking country.

If anything, our taste of alcohol is more diverse than ever before, simply because there are more options.

When I grew up, people either drank beer or moonshine, because that's the only things we had available in my small village. Then the (state owned) alcohol store arrived, and moonshine completely disappeared.

I remember the first time I visited Russia, in the 90s, and was set back by the sheer amount of Vodka the Russians drank. Went to a party, and couldn't find a single beer. They were all drinking straight vodka. But IIRC, they've now been "westernized" on that front, and drink much more beer.

</comment><comment><USER23> The article points out that Scotland actually falls into the spirit-drinking countries - typically whisky. Unsurprisingly this is almost entirely related to the climate of the countries and the crops that could traditionally be grown.

<comment><USER24> I'm not sure this is really reflected in reality, perhaps aside from the 65+ generation. I grew up in Scotland, and it was very much a beer drinking culture.

<comment><USER25> This is addressed in the beginning of the article,

>The alcohol belts refer to the traditional beverages of countries rather than what is most commonly drunk by the populace today, as in terms of drinking habits beer has become the most popular alcoholic drink in the whole world, including various parts of the wine and vodka belts.

</comment></comment></comment><comment><USER26> This made me wonder what alcoholic beverages the vodka belt countries drank before the arrival of the potato from South America in the late 1500's.

Seems it was mostly beer and mead:

[https://www.reddit.com/r/AskHistorians/comments/2e1rav/what_...](https://www.reddit.com/r/AskHistorians/comments/2e1rav/what_did_russians_drink_before_the_introduction/)

Interesting that the introduction of a single plant could have such an impact on cultural norms.

<comment><USER27> This is exactly the question that came to my mind (and that comes to my mind whenever I hear 'potatoes', 'tomatoes', or other New World imports mentioned as 'tradition' of some European country).

For example: I come from Italy. The number of times I've heard/read stuff about the supposed benefits of the "Mediterranean diet" being "recognised as far back as the Ancient Romans" and featuring some photograph of a platter involving fish and tomatoes... it just makes me want to flip.

When I saw sliced tomatoes on the table in the film _The Gladiator_ it made me want to walk out of the cinema.

</comment></comment><comment><USER28> Well, whoever wrote this doesn't know about whisky in Scotland. :D

</comment><comment><USER29> One of the things I have noticed among immigrants from Eastern Europe is that very few of them drink much, if at all. It seems to be some kind of class thing. So it's not surprising that in some of the wealthier Eastern European countries spirits are losing favor to beer

<comment><USER30> Really? I've never been as hung over as the day after I was drinking vodka with my polish counterpart software developers. Granted, they were still living in Poland, so not really immigrants, but they were probably amongst the 5-10% highest paid people in the country.

(Swede here.)

<comment><USER31> I can tell from experience that this may be due to them graduating from a technical university in Poland.

Young men[0] around here still bond via drinking lethal amounts of vodka. I know of at least one death caused by this.

[0] The gender imbalance in CS is so severe that I remember bragging to my friends how I was not only acquainted with _both_ of the female students in our year at the Warsaw University of Technology, but also _both_ of the ones that started studying CS in 2010 at the University of Warsaw.

</comment></comment></comment><comment><USER32> Beer is more common in Spain among the youth imo (own subjective experience), what's different to Germany is that young people pass litros (1l bottles) around like joints. Lips don't don't touch the bottle when you drink..

<comment><USER33> 1 liter beer bottles are more typically (informally) called litronas ;)

</comment></comment><comment><USER34> After searching for "Alcohol Belts of North America" unsuccessfully, I'm wondering if there really isn't a trend in North America (perhaps a bit of everything, everywhere?).

</comment><comment><USER35> The only country which for some reason got classified in two belts also happens to be one of the happiest countries in the world, Denmark.

<comment><USER36> Poland is in beer and vodka belts?

</comment></comment><comment><USER37> The two images at the top are quite dissimilar with no clear explanation why. Different years?

<comment><USER38> First map is aspirational. Second is actual.

<comment><USER31> I don't think many people in Poland nowadays - aside maybe from college students - aspire to be called "vodka country".

My family hails from Lesser Poland and I've never seen vodka on any of the family gatherings - including weddings.

It just doesn't appear to be part of the local culture.

Of course the situation is very different in the eastern and north-eastern regions.

<comment><USER39> Peculiar. I was born and still live in Lesser Poland, and throughout all my circles, beer and vodka are two staple alcoholic beverages. Especially when we talk weddings - vodka is _the_ one mandatory drink at a wedding. Everything else is optional, but there has to be wedding vodka, and besides providing an ample supply during the event, it's customary for the newlyweds to give a bottle to each guest couple as a parting gift.

<comment><USER31> Guess I extrapolated too much after all.

But then again both of my parents (almost) never drank vodka and they have wildly different backgrounds.

</comment></comment></comment></comment></comment><comment><USER40> As far as I know the most consumed alcohol in Spain is beer.

<comment><USER41> Is it because one can have a cold beer as a hydration and cooling vehicle, while wine cannot fill that role?

<comment><USER42> There is a tradition in Spain of cooling wine beverages in the warm months of the year: sangria where wine is mixed with fruit juice, and more recently calimocho where it is mixed with Coca-Cola.

</comment></comment></comment><comment> ur-whale Is there some sort of point to this classification ?

</comment><comment><USER43> Vodka is the aunt of wine.

</comment><comment><USER44> Reminds me of the Chumbawumba song "EU has a whiskey belt, EU has a vodka belt, EU has a wine belt"

EU never gonna keep me down?</comment>


How to get a developer job when you're blind - <AUTHOR> https://www.freecodecamp.org/news/blind-developer-sighted-team/ <comment><USER2> This is inspiring. As then author said, he gets tired of people making a big deal of it. I've heard this sentiment in other types of communities where people get tired of teaching others about their struggles and responding to other peoples curiosity. Sometimes, education is the best way to make people aware of your circumstances and I appreciate anyone that takes their own time and energy to do so.

Accessibility seems like a rare requirement in software projects. Probably because people don't think about it as often. Other times, the company might already be small and the person specifying the requirements might not know that accessibility is a thing that they can ask for. I'm beginning to think that it should be considered an integral part of the UI and not an extra requirement.</comment>


Adding Game Mechanics to a Non-Gaming Service - <AUTHOR> http://www.readwriteweb.com/start/2010/09/10-tips-for-adding-game-mechan.php

<comment><USER2> In case it wasn't clear, the original blog post came from - [http://www.vcdave.com/2010/09/14/top-10-ways-to-apply- game-m...](http://www.vcdave.com/2010/09/14/top-10-ways-to-apply-game- mechanics-to-non-game-services/)

The points shared were great, but it seems a lot of bloggers who cover these topics never emphasize how hard it can be to 'get it right', let alone actually develop the system. A lot of thought and work needs to go into making sure you're rewarding people for the right actions and for the right reasons. People will do exactly what you reward them to do.

Also, with achievements, points, leaderboards, etc comes the baggage of needing to manage it and report on it. That's one of the bigger points we try to make when talking about the services we offer at <http://www.IActionable.com>

You can't just say "we'll give an achievement when they click this button, done!" What happens when you want more complex requirements in order to earn that achievement? Most implementations today require a developer to be always available to alter the code/logic which drives the reward system.

Of course my perspective is different than most since I'm very passionate about this stuff and have a startup trying to solve these problems. :)

<comment><USER3> Have you seen any documented cases of websites moving real metrics using "game mechanics"? I'm not talking about Foursquare. I mean an established web property that added features like these and actually improved revenue or user acquisition.

I hate to be a skeptic, but I've seen a lot of bs around "game mechanics" ever since Foursquare hit, but I've yet to see real results.

<comment><USER4> You're half right: you may not actually be able to think of them like features. But "game mechanics" were "video games" and "psychology" a long time before they were distilled out, which means to take advantage of them properly, you really need to know a lot from both of those fields. Like anything else, you may have to design with them in mind from the get-go, and you'll probably get it wrong the first few times out, which means you'll need to practice (or have betas).

Instead of completely retooling your software, perhaps instead you can add a meta-game on top: Office Hero was a game added atop Microsoft Word by Lost Garden writer danc: <http://www.officelabs.com/ribbonhero> && [http://www.lostgarden.com/2010/01/ribbon-hero-turns- learning...](http://www.lostgarden.com/2010/01/ribbon-hero-turns-learning- office-into.html)

You'll never be able to "let's just add badges!" just like you can't "let's use gradients and glossy buttons!" to move the needle.

There's even the notion that video games and traditional UI interaction design are incompatible: IxD is about making things easy, but video games are about intentionally challenging the user. If your users aren't expecting a game, they may end up incredibly frustrated instead.

I did a workshop on adding game mechanics to an existing product (a calendar/dayplanner) and the results varied wildly. One group (Ray and Nicole) integrated social game mechanics into the application really well. Another group (Cecy and Brody) treated each mechanic as a feature, and by the end of the discussion I felt like it was "missing something." You can read the write- up of the workshop here: <http://vi.to/workshop/20100426/>

My notes include a lot of references, as well as images of the handouts and my own distillation of these principles: <http://vi.to/gmnotes>

</comment></comment></comment><comment><USER5> I have a hard time believing that if high-status users give free 'gifts' to low-status users, the low-status user will pay to reciprocate.

> Make the virtual real. Feinleib recommends adding sound and visual effects > to make the virtual experience more "real."

Also there's no way in hell I'm about to add sound effects to my website.

<comment><USER2> At our company we joke a lot about adding sound effects when users earn a reward.

And you're right, there is just something taboo and wrong about websites making unexpected noise.</comment></comment>


Ask HN: What is your favorite podcast in 2016? - <AUTHOR> Also please list out specific episodes if you can. How did it change your life and mindset? <comment><USER2> TrackChanges from Postlight: [https://trackchanges.postlight.com/](https://trackchanges.postlight.com/)

They sometimes refer to themselves as two old men reminiscing about the olden days of the internet. In reality, the quality of guests they have on and the sharpness of their insights is profound. It only makes it better that the whole show is a shameless plug for their product design studio in New York.

Paul Ford and Rich Ziade are genuinely interesting people, good story tellers, and credible builders.</comment>


Get Lamp - <AUTHOR> http://www.getlamp.com/jetlamp/ <comment><USER2> It wasn't initially obvious to me, but this is a documentary about text based adventure games: <http://www.getlamp.com/introduction.html></comment>


9 reasons to start a startup now - <AUTHOR> http://www.thestandard.com/news/2008/06/20/nine-reasons-why-you-should-start-startup

<comment> daniel-cussen "Melissa Chang of Pure Incubation recently listed five excellent reasons why a recession was a great time to start a company.

"But you don't have to wait for a recession. There has never been a better time to start a company than now..."

Recessions are bad for companies. Not good. Bad. Being 'forced' to 'be leaner' and such through numerous recessionary inconveniences is like environmental coercion.

There's a reason seedlings germinate when spring is coming.</comment>


Artificial intelligence accelerates discovery of metallic glass - <AUTHOR> https://news.northwestern.edu/stories/2018/april/artificial-intelligence-accelerates-discovery-of-metallic-glass/ <comment><USER2> This is random-forest supervised learning from a set of 4000 historical experiments

(Lots of feature engineering based on domain expertise. This is not end-to-end DL)

Do a smaller set of new experiments to explore a small subset of the solution space.

Retrain the model with these new experiments.

Perform another smaller set of experiments, this time over a more varied sample of the solution space.

Overall, a x10 improvement in predicting the glass property of an un-tested sample (although the entire process is biased toward positive samples)

Conclusion: classical ML still rocks.

I really dont see any reason why this could not have been done 10 or even 20 years ago.

<comment><USER3> > I really dont see any reason why this could not have been done 10 or even 20 > years ago.

The advancements in tooling, infrastructure and accessibility of ML in the last 3 years alone have made the difference. That's seems obvious.

Maybe your point is that the underlying techniques haven't changed, and thus it would have been possible to have made this discovery decades ago. But isn't that true of even the greatest inventions? Much of what's created or discovered is a function of the environment and conditions surrounding it.

In other words, it's not surprising to see a halo effect in other sectors as a result of tech investment in ML.

<comment><USER4> I agree that it is exactly this. New tooling has made machine learning easier to use. As a result, people with deep domain knowledge but less machine learning expertise are starting to apply ML to the problems they understand that best.

One of the biggest roadblocks to this happening more today is that people don't know how to perform feature engineering to prepare raw data for existing machine learning algorithms. If we could automate this step, it would be a lot easier for subject matter experts to use ML.

For example, I work on an open source python library called featuretools ([https://github.com/featuretools/featuretools/](https://github.com/featuretools/featuretools/)) that aims automated feature engineering for relational datasets. We've seen a lot of non-ml people use it make their first machine learning models. We also have demos for people interested in trying it themselves: [https://www.featuretools.com/demos](https://www.featuretools.com/demos).

I expect to see a lot more work in the automated feature engineering space going forward.

<comment><USER5> That's interesting! So could we see a gui based machine learning for non- programmers becoming a reality soon ?

And how close in performance this could get vs code based solutions ?

<comment><USER4> Yes, I think so. Featuretools is actually the core of my company's commercial product.

Performance is tricky thing to answer. If you care about machine learning performance such as AUC, RSME, F1, then I think the answer would be 80%-90% of coding. If you care about building a first solution, then I think the automation would be 5-10x better.

</comment></comment></comment></comment></comment><comment><USER6> As a researcher in this field I'll just add that in many cases, automating the mat sci workflows (the sample prep and the characterization) is a massive leap in and of itself, even without adding machine learning. The benefit of machine learning in many of these projects is to pick the automated runs optimally (choose he right neighborhood of composition space), which probably adds a 10-100x speedup on top of the already 100-1000x speedup gained from just not making and characterizing samples manually. It's truly a synergistic combination of advancements in both fields and has great potential for accelerated discovery. /shill

<comment><USER7> Long live the Singularity! (For which these types of exponentials bode well...)

</comment></comment><comment><USER8> Found the original article more informative: [https://www6.slac.stanford.edu/news/2018-04-13-scientists- us...](https://www6.slac.stanford.edu/news/2018-04-13-scientists-use-machine- learning-speed-discovery-metallic-glass.aspx)

And the actual publication: [http://advances.sciencemag.org/content/4/4/eaaq1566](http://advances.sciencemag.org/content/4/4/eaaq1566)

 _The paper is the first scientific result associated with a DOE-funded pilot project where SLAC is working with a Silicon Valley AI company, Citrine Informatics, to transform the way new materials are discovered and make the tools for doing that available to scientists everywhere._

[https://citrine.io](https://citrine.io)

</comment><comment><USER9> This field is ebullient! Bad joke, I know, but glorious times for materials scientists, expecially when not grant-constrained and free to go deep into domain applications. One recent state-of-the-art lit review is here [https://www.nature.com/articles/s41524-017-0056-5](https://www.nature.com/articles/s41524-017-0056-5) , outdated here and there already.

</comment><comment><USER10> Transparent aluminum?

<comment><AUTHOR> It's very hard to make a metal (where electrons can easily jump from atom to atom) transparent.

<comment><USER11> Transparency is a function of wavelength/photon energy as well as the underlying material. Glass (the silica version) is opaque to portions of the UV spectrum.

Generally you'll get absorption (opacity) when the photon energy exceeds an energy gap, allowing valence band electrons to be bumped into conduction bands, creating a corresponding hole in the valence. In the case of metals, there is effectively no gap at points in k-space, so there is absorption throughout the spectrum.

<comment><AUTHOR> I imagine a clever arrangement of atoms where non-metallic regions alternate with metallic ones could do the trick, as long as the transparent regions line up enough.

But anything this orderly doesn't look like a glass anymore.

</comment></comment></comment></comment><comment><USER12> I read about efforts to discover compounds using random methods back in the 90s, and have been trying to research it lately, to see if the "shake and bake" method is still a thing. Can anyone point me to relevant research? I was surprised by estimates given about the number of possible compounds, so many that there would not be enough time in the universe to make and test them all, even limiting the primary elements to a dozen or so. I guess there are a multitude of ways that the same atoms can fit together. I've tried to find research on computer simulations. Apparently, only rough predictions can be made. My searches have been pretty fruitless, though, and I'd welcome help.

</comment><comment><USER13> Bulk metallic glass based mainly on Fe is very interesting. It could likely be injection molded into very complex shapes.

</comment><comment><USER14> There's an old Kaggle competition[1] "Predicting Transparent Conductors" which had a similar objective.

There's a decent discussion of the 5th place entry[2]. Judging by a very quick read it looks like performance for methods like this could improve dramatically with larger amounts of data.

[1] [https://www.kaggle.com/c/nomad2018-predict-transparent- condu...](https://www.kaggle.com/c/nomad2018-predict-transparent-conductors)

[2] [https://www.kaggle.com/c/nomad2018-predict-transparent- condu...](https://www.kaggle.com/c/nomad2018-predict-transparent- conductors/discussion/49903)

</comment><comment><USER15> _The amorphous material's atoms are arranged every which way, much like the atoms of the glass in a window. Its glassy nature makes it stronger and lighter than today's best steel_

Why would this arrangement of atoms be stronger than a crystal lattice of steel?

<comment><USER6> From the actual paper: """ For example, the absence of deformation pathways based on gliding dislocations leads to exceptional yield strength and wear resistance """

Yield strength means "how much strain a material can handle before it fractures or otherwise breaks"

In crystalline metals, a crack that forms anywhere can propagate through the lattice quickly and lead to bulk fracture (see the southwest engine failure recently). In an amorphous material, the deformation caused by a local crack can be "absorbed" by the surrounding atoms because they're able to reposition more easily.

<comment><USER15> How come this does not make regular glass strong?

<comment><USER16> It does, check out its properties compared to other materials. The process of turning silica into glass makes it much stronger than other materials made of silica.

[https://en.wikipedia.org/wiki/Strength_of_glass](https://en.wikipedia.org/wiki/Strength_of_glass)

[https://en.wikipedia.org/wiki/Mohs_scale_of_mineral_hardness](https://en.wikipedia.org/wiki/Mohs_scale_of_mineral_hardness)

[https://en.wikipedia.org/wiki/Ultimate_tensile_strength](https://en.wikipedia.org/wiki/Ultimate_tensile_strength)

</comment></comment></comment></comment><comment><USER17> Maybe a dumb question, but speedier in reference to what? Design of Experiments?

</comment><comment><USER18> Wonder if the same thing could be done with high temperature superconductors.

<comment><USER6> definitely: [https://arxiv.org/abs/1709.02727](https://arxiv.org/abs/1709.02727)

I work kind of adjacent to two of the supervisors on this project at NIST, and the workflow for these types of projects usually goes:

(1) build predictive model of chemical composition -> superconductivity from past experiments or databases of simulations (2) Build and program automated sample prep (this is actually the hardest part, not the machine learning) (3) Build and program automated structural characterization and superconductivity measurement

The difficulty is finding a system whose design space can be explored with and measured with automated tools, otherwise the machine learning isn't used effectively. As others have noted the models are decades old in some cases, what's driving this is researchers who know how to automate traditional mat sci workflows and know enough about machine learning to pick the automated runs optimally

</comment></comment><comment><USER19> Every time I see "artificial intelligence" in a headline I mentally replace it with "a sleep deprived computer science grad student". The result is usually much more accurate.</comment>


Reactive GraphQL - <AUTHOR> http://info.meteor.com/blog/reactive-graphql <comment><USER2> Meteor is about the UX.

The ease of getting up and running, the ease of tools, and the ease of deployment. On no React stack can you (and in the future this will be more simple) run

      meteor create my-react-project
      npm init && npm install react

And start coding JSX, ES2015/2016 immediately. There is a non-trivial amount of boilerplate and configuration you need to do to get this working my hand, and while it can provide a greater level of control, it undoubtedly adds to the overall weight of code you need to maintain.

Then hypothetically after some time of development, do

      meteor add-platform ios
      meteor add-platform android
      meteor add-platform desktop (this is theoretical currently, but there exist packages which do exactly this)

And have Cordova iOS and Android builds, and an Electron desktop app. Then in a few weeks, do

      meteor deploy

and have a fully monitored application up and running on AWS with Meteor's monitoring and deployment tools. Meteor's play is in the ease of these tools. It is absolutely non-trivial the amount of glue and knowledge you need to create, understand, and maintain the current (and ever-rapidly expanding) Javascript toolchain.

This announcement touches on one of their most thorny issues of being tightly coupled to Mongo. Adding this abstraction layer allowing any UI and any data source is Meteor's ticket to the masses.

<comment><USER3> I think I get your point, and while I haven't done much with meteor since a few weeks after it was first announce, I recently started a couple react.js projects using jspm. I'm not sure, yet, if jspm is ready for prime-time, but getting started was as simple as:

        npm install [-g] jspm
        jspm init
        jspm install react

For es6/es7, adjust config.js babelOptions.

I've nothing to add in regards to ios / android / desktop, but for getting up- and-running, jspm seems to do the job quite well.

<comment><USER4> Can you use NPM packages with JSPM?

<comment><USER3> Yes you can. NPM and Github. [http://jspm.io/](http://jspm.io/)

(I have nothing to do with jspm, I've just been using it recently)

</comment></comment></comment></comment><comment><USER5> Each successive post of the recent set from meteor just seems to be bringing it further towards resembling the features of a GraphQL > Relay > React stack - in fact actually using React, and now it seems, GraphQL.

This is great because the promise of a stack like this is _very_ exciting, but I am left wondering what is meteor promising to bring that isn't just bundling some modules, and re-implementing Relay?

I can't see anything in the list of _what we are planning to build_ that isn't already offered by Relay, or on Relay's roadmap.

Not that a different implementation isn't a great thing, competition is always advantageous, but my understanding is that Meteor is a for-profit company whose product _is_ their framework - it seems quite odd therefore that their plan for that framework appears to be to just piece together and/or re- implement an already-existing, well-used and well-known stack of completely open-source libraries, that aren't at all difficult to piece together as it is. What's their strategy here?

<comment><USER6> To be "The Javascript App Platform", as displayed prominently on the Meteor homepage. If you build an app with Javascript, MDG want you to build it with Meteor. In order for you to do that you need to trust that you can use the tools you want to, and derive benefits from the fact that the stack is designed to work as a single platform. So if GraphQL is where it's at, it makes sense to design a place for it in Meteor.

<comment><USER5> Well yes, that's their general goal, but hasn't the developing React stack already won on that front?

It frankly seems they at least believe it has, as it appears their plan is to take it, bundle it together under one name and re-implement some parts.

The question is then, why would anyone on the React stack, which has become so popular, switch to Meteor? The stack of libraries Facebook has already put out there (not to mention third party libraries such as Redux) _are_ designed to work together, and do so easily and very well - people are familiar with them and already using them.

I suppose the only dimension on which they could coax people over from the existing React stack, Relay in particular, is by developing its feature set faster and better than Facebook can. For what it's worth I think it's a good thing, I just find it pretty intriguing if that's their play - going up against the popular tide and basically directly competing with Facebook on bundling together their own libraries. Will be great to watch their progress!

<comment><USER6> Has it won? Where can I go and write `react-stack create my-new-project` and get a guaranteed working integration of the various elements that make up the stack, including a working server environment, pre-installed and configured database, and all of the other inbetweens that come with Meteor (such as DDP, livequery, Tracker, Blaze, ReactiveVar, etc)?

The "React" stack has certainly been an up and coming potential competitor for Meteor, but until Facebook or someone else actually shows signs of preparing the kind of integrated development experience that Meteor ships with out of the box, I don't think it's really similar. So that's what they're doing: tying together the best of the Javascript ecosystem, which happens to currently include a couple of projects by Facebook, into one cohesive whole that "just works".

<comment><USER7> Is "react-stack create my-new-project" really preferable to something like "git clone email@example.com:react-stacks/react-firebase-template.git my-new- project" ?

I'm sold on the latter, since often enough I'll customize and publish my own tweaked templates as I become enamoured with different tech.

</comment></comment></comment></comment></comment><comment><USER8> Is Reactive GraphQL even specified? I thought that in the current state GraphQL only defines single queries (snapshots) of data, and not continuos update notifications. Forgive me if I have missed it - I have not followed GraphQL/Relay apart from a very basic look at it.

Without having an open specification Meteors implementation might end up completly different or incompatible to other (Reactive) GraphQL implementations.

Despite that, I think that implementing a reactive GraphQL backend will be very hard, and it would only work good if all of the sub-data-sources that you use in your backend support reactivity (subscriptions) as well. If they do, then you have to subscribe to all possible data sources that are mentioned in the query, and update the current state when one of these changes. If the update requires you to fetch an additional data source (e.g. you must fetch other indexes of data which are provided by another source), you must even dynamically subscribe/unsubscribe on updates of other sources.

And how can you provide traditional REST APIs (or even query-based GraphQL endpoints) as reactive endpoints? The best you can do is probably implement polling (rerunning) the query on the backend over and over.

<comment><USER7> The idea of changefeeds / subscription cursors has been around for a while now, especially in Meteor. I doubt it'll be that crazy to add reactivity to graphql queries when compared to what Meteor is already doing w/ subscriptions and DDP.

RethinkDB for example has changefeeds built in and is tackling this problem as well. See: [https://github.com/rethinkdb/rethinkdb/issues/3711](https://github.com/rethinkdb/rethinkdb/issues/3711)

Data as a stream is pretty interesting too: [https://www.youtube.com/watch?v=fU9hR3kiOK0](https://www.youtube.com/watch?v=fU9hR3kiOK0)

<comment><USER8> That doesn't really contradict my statement. I agree that the feature is already there in Meteor (only with another query language), and that it's also supportable by RethinkDB, Firebase or any other backend/db which supports subscriptions. By what I meant is that it requires support for subscriptions all along the chain, and this is not supported by legacy REST/GraphQL/etc. APIs. The lack of alternate DDP backends besides the MongoDB one (and of course the creation of custom subscriptions) seems to confirm this.

I am sure they could now update their query language to GraphQL instead of MongoDB queries by adapting and extending the existing system, but I don't know if thats currently the biggest problem for meteor adoption or only something that is nice to have for some GraphQl/Relay fans (which still might be using these directly anyway).

</comment></comment></comment><comment><USER9> I'd recommend rebranding and a big-bang launch. Enough people were put off by meteor that incremental improvements don't excite. Kind of the opposite of the boiling frog thing.

</comment><comment><USER10> What about offline support? This is one of the most tricky part.

<comment><USER11> Offline support is tricky because each app needs to implement what happens in the case of data conflict. Meteor already has the groundDB package that allows for offline support in local storage. I would imagine you could implement a read only option into local storage once they release reactive graphQL.

<comment><USER4> We have some thoughts about how the new invalidation system will make offline a lot more feasible. In pub/sub based Meteor apps you would need to reload all of the data if you took too long to reconnect, in the new system you will hopefully be able to get just the diff after a much longer reconnect gap, or possible indefinitely depending on implementation details. This is because the app server doesn't need a copy of all of the client's data anymore.

</comment></comment></comment><comment><USER12> Is anyone playing with GraphQL outside of js? Am interested in using it for a project at work and wondering what's it like in something lower like c/c++.

<comment><USER13> I've been playing with a scala implementation called sangria ([http://sangria- graphql.org/](http://sangria-graphql.org/)). The type safety of Scala has really been helpful for refactorings and creating the schema. I can't imagine the mess I'd have been in if I'd have used JS.

</comment></comment><comment><USER14> i would be interested why they decided against falcor style json graph instead of graphQL</comment>


AWS launches AWS Ground Station, a cloud service for satellite operators - <AUTHOR> https://www.geekwire.com/2018/amazon-web-services-launches-aws-ground-station-cloud-service-designed-satellite-operators/ <comment><USER2> Dupe

[https://news.ycombinator.com/item?id=18546272](https://news.ycombinator.com/item?id=18546272)</comment>


Facebook Patents News Feeds  - <AUTHOR> http://www.informationweek.com/news/software/open_source/showArticle.jhtml?articleID=223100843

<comment><USER2> Popular topic of the moment: <http://searchyc.com/submissions/facebook+patent?sort=by_date></comment>


Windows patch KB 3139929: When a security update is not a security update - <AUTHOR> http://www.infoworld.com/article/3042155/microsoft-windows/windows-patch-kb-3139929-when-a-security-update-is-not-a-security-update.html <comment><USER2> There's been a huge shitstorm on Reddit about Windows 7 / 8 forcing an automatic upgrade to Windows 10 [1] [2] [3] [4], with many accounts of people going away to do something and coming back to find their PCs had updated to Windows 10 without their permission. However I've not been able to find any stories on this from reliable sources. All I've found so far is a forum post on CNET and a submission on Slashdot [5] [6].

Does anyone know what's actually going on with this?

[1] [https://www.reddit.com/r/pcgaming/comments/4a5edx/psa_window...](https://www.reddit.com/r/pcgaming/comments/4a5edx/psa_windows_7_computers_are_being_reported_as/)

[2] [https://www.reddit.com/r/pcgaming/comments/4a7bkp/psa_micros...](https://www.reddit.com/r/pcgaming/comments/4a7bkp/psa_microsoft_refreshes_kb3035583_automatic/)

[3] [https://np.reddit.com/r/technology/comments/4a0asv/warning_w...](https://np.reddit.com/r/technology/comments/4a0asv/warning_windows_7_computers_are_being_reported_as/)

[4] [https://www.reddit.com/r/pcmasterrace/comments/4a59p4/psa_wi...](https://www.reddit.com/r/pcmasterrace/comments/4a59p4/psa_windows_7_computers_are_being_reported_as/)

[5] [http://www.cnet.com/forums/discussions/forced-to-upgrade- fro...](http://www.cnet.com/forums/discussions/forced-to-upgrade-from- windows-7-to-windows-10/)

[6] [https://news.slashdot.org/story/16/03/12/1634229/windows-10-...](https://news.slashdot.org/story/16/03/12/1634229/windows-10-upgrade- reportedly-starting-automatically-on-windows-7-pcs)

<comment><USER3> Whatever is going on, you can stop it from happening. Please get the word out about GWX Control Panel!

[http://ultimateoutsider.com/downloads/](http://ultimateoutsider.com/downloads/)

You can turn off all updates, delete the pre-downloaded update cache, kill the tray notifications, etc. - works wonderfully on several machines I tested!

<comment><USER4> There's no need to install any 3rd party software. Microsoft themselves provide the switch to disable upgrades to Windows 10:

[https://support.microsoft.com/en- us/kb/3080351](https://support.microsoft.com/en-us/kb/3080351)

(and you can also simply not install/uninstall KB3035583 aka GWX)

<comment><USER3> With all due respect to this official microsoft solution, it's a huge pain in the complicated _ass_ for casual users to follow. GWX Control panel is just _click, click, done_ \- something you can tell your grandma to do.

<comment><USER5> Unfortunately, it looks like that same tool could make it a bit too easy to disable Windows Updates altogether, which is not a good idea.

I'd rather endure some pain with going through the registry route, but apply a fix that addresses only one particular behavior.

</comment></comment></comment></comment></comment><comment><USER6> I spent about 3 hours this week doing tech support for my mom over the phone because of Windows 10's aggressive upgrading behaviour.

I told her to keep her the best way to keep safe security wise is to make sure the os/browser is up to date, and because Windows 10 keeps asking to upgrade, she went ahead and did so. After upgrading to Windows 10, all network access (wired and wifi) stopped working completely. The worst part of this is that if you can't get internet, you can't even download new drivers to try and debug the problem. We tried a few things, and eventually just did a system restore back to Windows 8, but unfortunately, the system restore didn't work completely and there was more mucking around to try and get the computer into a bootable state. Then, last night, she said the heard the fan making a lot of noise, and looked down to see that Windows had gone ahead and started installing Windows 10 again. Fortunately, wired network access works now, but wifi is still broken. Hopefully Windows will push an update that fixes the wifi access.

</comment><comment><USER7> Microsoft seems to be working hard to keep the forces of the universe balanced. Whatever good will is generated by their foray into oss must be immediately offset by ill will produced by windows 10.

<comment><USER8> It's just the second law of thermodynamics at work.

</comment></comment><comment><USER9> I find this behavior really curious on Microsoft's part. When I originally read that Windows 10 would be the last version of windows I thought it metaphor, but I think Microsoft is really serious, they are no longer interested in producing a standalone operating system for machines. It feels to me like they are dragging their customers into a ChromeOS type world where everything is on the network.

</comment><comment><USER10> Although force-upgrades are definitely too much, I wonder why such a strong opposition to upgrade t a much better OS in every way?

It certainly cannot be privacy, because you can turn off every piece of phone- home stuff. Also, almost every other OS has been doing the same thing for a long time now, so it seems a bit of an overreaction when Windows does it.

This sort of no-upgrades policy is what leads to IE6. And the entire world has to suffer because of a few obstinate sysadmins.

<comment><USER11> > It certainly cannot be privacy, because you can turn off every piece of > phone-home stuff.

No, you can't.

<comment><USER10> I definitely can! I have options for everything including Cortana to the automatic malware reporting.

<comment><USER11> Unless you have Enterprise their are still telemetry options that cannot be turned off entirely, and there is diagnostics and usage data not covered by any of the user settings that still leaks from the OS back to Microsoft.

If you want to block them as well you need to do it with a firewall rules (like a third party software firewall on whitelist mode).

</comment></comment></comment></comment><comment><USER12> Is this the garbage in the system tray that keeps putting up notices about windows 10? or is this something else?

<comment><USER4> This one shows an ad in IE.

</comment></comment><comment><USER13> "I spent most of the night trying to replicate this behavior -- a blue banner on new tabs in IE11 with "Microsoft recommends upgrading to Windows 10" \-- and couldn't get it to trigger. If you can, I'd appreciate your shooting an email with a screenshot to firstname.lastname@example.com."

<comment><USER14> weird, I just opened IE up and got it immediately:

[https://imgur.com/o69rzTG](https://imgur.com/o69rzTG)

<comment><USER15> I get that same ad on a Windows 2012 R2 RDS server. It's interesting having a user in a remote desktop environment log a ticket about a required upgrade to Windows 10.

</comment></comment></comment><comment><USER16> This is great. Nagging people might actually get them to upgrade to a supported, secure browser. I literally see nothing wrong with this.

<comment><USER17> But IE 11 is still supported and "secure" after latest updates.</comment></comment>


Complexity of FreeBSD VFS using ZFS as an example - <AUTHOR> http://www.hybridcluster.com/blog/complexity-freebsd-vfs-using-zfs-example-part-1-2/

<comment><USER2> Happy to take any questions :-)

<comment><USER3> I'm also a very happy ZFS user on FreeBSD. I've tried to use it in a lot of crazy ways. At the moment I'm researching if ZFS and a virtual machine running Microsoft SQL Server can improve query performance(with LZ4/GZIP compression) and improve the backup speed.

Though I'm wondering about if there are any plans to add XZ compression? Or faster hashing with Siphash24 for data checksums?

<comment><USER4> LZMA compression (used in the xz format) is much slower than the disk interface and uses a lot of memory, so it would reduce performance.

</comment></comment></comment><comment><USER5> Interesting to see some technical details of FreeBSD's VFS layer, I've never delved too deeply into it myself but I have looked at Linux's so it's not completely unfamiliar to me.

<comment><USER6> I haven't had a chance yet to examine Linux VFS in details, so at the moment I can only talk about Solaris and FreeBSD ones.

</comment></comment><comment><USER7> This was very interesting, thanks. Sorta-OT, I wonder if there's a modern equivalent of Vahalia's _Unix Internals: The New Frontiers_ [1]?

[1] [http://www.goodreads.com/book/show/337378.UNIX_Internals](http://www.goodreads.com/book/show/337378.UNIX_Internals)

<comment><USER6> Not exactly the same thing but I found the following books quite useful for understanding how a lot of kernle code works: \- The Design and Implementation of the FreeBSD Operating System \- Solaris Internals: Solaris 10 and OpenSolaris Kernel Architecture

Still, nothing beats reading the source code :-)

</comment></comment><comment><USER8> The article mentions illumos--has anybody got any experiences to share with using that instead of _BSD or_ nix?

<comment><USER9> Illumos is nix. Per wikipedia, "Illumos is a free and open-source Unix operating system. It derives from OpenSolaris, which in turn derives from UNIX System V R4 and Berkeley Software Distribution. "

When Oracle killed off OpenSolaris, Illumos came about.</comment></comment>


CNET iPad 3 heating test - <AUTHOR> http://news.cnet.com/8301-13579_3-57401047-37/confirmed-new-ipads-heat-a-non-issue/

<comment><AUTHOR> I do wish that they would have included data on the exact measurement setup. IR thermometers are affected by surface material characteristics and can be affected by orientation and distance to the DUT. Thermocouples would provide the most reliable measurements. Barring that, we've always resorted to applying black non-reflective masking tape to the spot to be measured in order to eliminate surface effects. The next step is to ensure that the thermometer is normal to the surface and that all measurements are taken from the same distance.

It is likely that some of the extra heating is coming from the display. This post covers it:

<http://news.ycombinator.com/item?id=3740270>

There's probably nothing seriously wrong with it new iPad though. People probably aren't used to having a processor that gets hotter with usage so close to their hands. I have multiple laptops that get to hot to be on your lap. This is nothing new.</comment>


Project Phoenix - Kickstarter JRPG with many experienced game developers. - <AUTHOR> http://www.kickstarter.com/projects/1300298569/project-phoenix-japans-indie-rpg-feat-aaa-talent

<comment><AUTHOR> I am pretty excited about this project because the music will be composed by game music legend Nobuo Uematsu - a true composing genius!</comment>


London's Tulip tower 'could confuse air traffic control systems' - <AUTHOR> https://www.theguardian.com/artanddesign/2018/nov/28/london-tulip-tower-norman-foster-air-traffic-control-systems <comment><USER2> The sad thing is that with London's urban planning committees having apparently taken all leave of their aesthetic senses, this will almost certainly be approved to become another hideous blight on the skyline just like its taller neighbour across the river.</comment>


Tile Puzzle - <AUTHOR> https://play.google.com/store/apps/details?id=games.negup.tilepuzzle <comment><AUTHOR> Negup Picture Tile puzzle is a really cool tile puzzle game with a ton of features. You'll love it! A good mixture of scenes is another good thing.</comment>


Ask HN: Do you double tap or pinch to zoom images on mobile websites? - <AUTHOR> I'm trying to understand what is the most common user behaviour when zooming images on a mobile web page. Do you double tap or pinch to zoom images on mobile websites? Are you using Android or iOS? <comment><USER2> I pinch, index and middle fingers, double tapping on a phone bugs me.

I run both os's, and a few others. It seems the more reliable behavior across devices ihmo.

</comment><comment><USER3> I always double tap first. Then usually the image will become bigger than I want, I pinch zoom it down.

</comment><comment><USER4> Pinch to Zoom but it's quite a rare behavior. Both platforms.

</comment><comment><USER5> Almost always pinch to zoom, using iOS

</comment><comment><USER6> yes i have done via iphone</comment>


Show HN: Featureflags.io – microsite for feature flag best practices, libraries - <AUTHOR> https://featureflags.io <comment><AUTHOR> I'm Justin and I work at LaunchDarkly. We built this microsite to collect content on feature flagging best practices and put it into one place. We also have suggestions for feature flag implementation, SDKs, open-source libraries. Whether you are looking to build from an open source library or buy a solution, it is important to understand the fundamentals of feature flag- driven development. We're also looking for any feedback about other best practices/guides/tutorials around feature flagging that we can include in the future. We welcome contributions to the microsite on GitHub: [https://github.com/launchdarkly/featureflags](https://github.com/launchdarkly/featureflags).

Feature flagging/toggling is a method by which developers wrap a new feature in a conditional to gain more control over its release. By wrapping a feature with a toggle, it's possible to isolate its effect on the system and to turn that toggle on or off independent from a deployment. This effectively separates feature rollout from code deployment. Feature toggling is a core component of continuous delivery that empowers software organizations to release quickly and reliably.</comment>


How Scandinavian design took over the world - <AUTHOR> http://www.curbed.com/2016/3/23/11286010/scandinavian-design-arne-jacobsen-alvar-aalto-muuto-artek <comment><USER2> The association to the welfare state is complete bogus. Every last item of furniture in that article is from before the welfare state started its expansion in Scandinavia. Sweden and Denmark had lower taxes than the US until about 1960.

What Scandinavian designers offered at the time was something entirely different: International modernism in its purest form. The architects of the time, most notably Arne Jakobsen, were heavily inspired by German and American modernists. They were just better at it.

Jakobsen designed most of his chairs for a skyskraper in Copenhagen that's essentially a copy of Lever House on Park Avenue in NYC, and his mania for designing every last item in the skyskraper mirrored that of Mies van der Rohe, a German-American. At the time, it was considered "American" by Danes.

If there's anything special about Scandinavian design, and I believe there is, it's the constant search for purity.

There's not a single period in Scandinavian art history since the Protestant reformations of the 16th century that isn't dominated by the search for purity. Even baroque art from Scandinavia is strangely cool. It just happens to in vogue today, and since we practiced for centuries and it's engrained in our culture, we're very, very good at it.

Culture is much deeper than whatever political currents dominate a country at one partical point in time.

<comment><USER3> I don't think the welfare state is just about taxes. National maternity leave in Norway e.g. was introduced in early 1900s, something which still doesn't exist at a national level in the US. The problem is that people conflate welfare states with socialism. Nordic countries have been very pro market and free trade focuses from early on, but that has always been combined with more active government policies towards the ills of society than what has been found in the anglo-saxon world.

Even back in the 1500s Scandinavian countries were markedly milder towards criminals than e.g. Britain which always had a much harder stance towards crime. So just like design, the philosophies that underly the welfare state has been there a long time.

It is just that in later years, especially in e.g. Norway with its oil wealth, the welfare state system has become a lot more visible, due to the amount of money available to expand it.

<comment><USER4> Please compare US states to EU states. If we're going to compare US vs. EU or Norway versus Montana, the EU and Scandinavia don't stack up so nicely. Constitutional differences make sociopolitical and cultural comparisons difficult enough.

While it's true that paid maternity leave doesn't exist at the US level, it does exist at the state level. California, population 39 million (versus 26 million for all EU and non-EU Nordic states) offers maternity & paternity leave since circa 2002.

And yes, states with criminal jury trials have traditionally been much harder on crime than Scandinavia. The US population growth rate has been incomparable to Scandinavia's, and the immigrants have by and large not been homogeneous in culture nor orderly. And when you're judged by such peers (as versus the king's nepotistic and political appointments, as in Scandinavia), the judgement can be quite harsh.

<comment><USER5> I don't want to be rude and I didn't post it. I'm just posting this here so you can get a reply.

Your comment was placed on /r/shitamericanssay

> > [https://www.reddit.com/r/ShitAmericansSay/comments/4c6xpr/ha...](https://www.reddit.com/r/ShitAmericansSay/comments/4c6xpr/hackernews_please_compare_us_states_to_eu_states/)

<comment><USER4> Is the discussion in English?

But on a serious note, that my comments make it onto what I assume would be an anti-US (anti-"American") subreddit is ... meh. This is the Internet. It is to be expected.

</comment></comment></comment></comment></comment><comment><USER6> 15 years ago, when I was in my mid-20s, I didn't understand why people where so excited about IKEA. Then I went to a normal American furniture store. The traditional American store was terrible. The furniture was ugly and expensive with none of the clean lines of IKEA. That's when I understood for the first time the genius of Scandinavian design.

<comment><USER7> I think people are excited about IKEA because it's inexpensive, comes in a flat box, and can be taken home right now. Furthermore, I bet IKEA has clean lines not for the sake of clean lines but rather because clean lines can be made inexpensively and packed into a flat box.

<comment><USER8> A furniture store near me went into administration recently. Some of its sofas cost north of £10,000.

They looked a lot like IKEA sofas, and the rumour was they were sourced from the same factories and made from similar materials, but offered in a wider range with a hint of extra trim - mostly nicer looking feet.

<comment><USER9> > They looked a lot like IKEA sofas, and the rumour was they were sourced from > the same factories and made from similar material

I was always under the impression that Ikea designed and sold all of its own designs. Is it really a place that sells mostly desirable private-label goods from 3rd parties, a-la Trader Joe's?

> but offered in a wider range with a hint of extra trim - mostly nicer > looking feet.

My bother was telling me last weekend about [http://www.prettypegs.com/us/](http://www.prettypegs.com/us/). Apparently there's an ecosystem developing around Ikea furniture to provide that.

Also, to completely change the subject. I recently learned that all the Philips-looking screws on Ikea furniture are "Posidriv" screws _not Philips_ and you need special driver for them, because a Philips driver will likely ruin them.

[https://en.wikipedia.org/wiki/List_of_screw_drives](https://en.wikipedia.org/wiki/List_of_screw_drives)

<comment><USER10> Why don't they just include the correct screwdriver with the furniture? It's only going to cost them like one or two dollars and will likely increase customer satisfaction.

<comment><USER11> "Every" screwdriver kit you can buy in Sweden is very likely to have both PZ and PH included.

<comment><USER12> And many American sets will come with Pozidrive now. I believe including the $9.99 "FIXA" tool kit you can get at IKEA checkouts.

</comment></comment></comment></comment></comment></comment></comment><comment> chestnut-tree Somewhat related: if you're in the UK, the BBC is currently airing a three- part documentary series called Art of Scandinavia. The series focuses on Norway, Denmark and Sweden.

It's available to watch on iPlayer (for UK residents only)

[http://www.bbc.co.uk/programmes/b0745j6m/episodes/guide](http://www.bbc.co.uk/programmes/b0745j6m/episodes/guide)

</comment><comment><USER13> Two answers:

1\. Cheap.

2\. After two devastating World Wars, people wanted to discard the past. Clean functionality inspired by aircraft represented a modern, better future.

</comment><comment><USER14> Someone was desperate to put that pun into print</comment>


Ask HN: Does the demo video of my startup suck? - <AUTHOR> http://tagmask.com/video

<comment><USER2> I think the video does a fine job (music is a bit jarring, perhaps).

But I actually think the video is the least of your concerns. Right now, when I visit your site, I get no impression of what your site actually is -- a news aggregation site.

As it is, on the homepage all I see is "Tune your feed" and a lot of explanation copy. This all makes it look like an app or service.

Same thing on the video page -- after watching through the video, I had no firm grasp of what exactly you were offering because you never planted the simple fact at the outset that this is a news aggregation site.

Once I figured this out, it made a lot more sense. Advice: Before you do anything, make sure they realize what on earth your site is at its core -- a news aggregator. Then tell them why it's special.

<comment><AUTHOR> Thanks for the feedback. However, I didn't understand about the homepage. Did you mean that all texts there just explain how to configure the feed? And contains no information what Tagmask really is? Initial headline was "Flexible place for programmers to share and discuss technical stuff" but I thought that the current headline is better.

<comment><USER2> Yes, that is what I mean. But I think this is less a text/copy problem than a design/layout problem. You should probably make the articles the front page, like Hacker News/Reddit/Digg. There's a reason that's the standard. Burying the articles section of a social news site just doesn't work.

You will have to be clever about how to make it clear that there is something different about how your news site works. A big "How It Works" link at the top, or embedding your explanation video in the corner next to articles might work.

<comment><AUTHOR> The main feature of Hacker News/Reddit/Digg is that such site provides "front- page articles" which was upvoted by the community, so put it on the homepage makes sense.

Tagmask idea is to provide personalized feed for each user. So, that's why its structure much like Twitter/Quora, they also didn't display any posts on the homepage.

</comment></comment></comment></comment><comment><USER3> the video was informative, but sound on background is a bit annoying. over all i like the idea :) good luck

<comment><AUTHOR> Thanks for the comment! Actually, I am little bit confused about the music. Some people like it, some people say that it is really annoying. For now, I cannot make the right decision about it.</comment></comment>


Even the LastPass Will Be Stolen - <AUTHOR> https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it <comment><USER2> It seems dubious that there is a real vulnerability here.

The authors talk a lot about how you can get everything if you compromise the client machine, but of course if you compromise the client you can compromise everything.

Just install a keylogger to get all typed passwords, send the decrypted hard drive image over the network and run it in a VM proxying network traffic via the compromised machine, no need for any targeted attack.

The fact that they focus on that rather than on an actual interesting attack makes me believe that there is no real vulnerability whatsoever.

"We also found how it is possible to abuse account recovery to ultimately obtain the encryption key for the vault" is really scary, but if it were accurate they would be talking solely about that, so maybe it's just a phishing attack.

<comment><USER3> The fact that it is still a central point of failure that contains the keys to the kingdom is worth noting.

It occurs to me as I write this that for most people compromising an email account would be just as disastrous, given how many services rely on a simple email for password recovery/resets.

<comment> rkuykendall-com > The fact that it is still a central point of failure that contains the keys > to the kingdom is worth noting.

I think the difference between someone who uses a password-manager user, and the vast majority of people who don't, is that those who don't have HUNDREDS of points of failure that contain the keys to the kingdom, some completely insecure.

<comment><USER4> Hardly. "Keys to the kingdom" seems to imply that access to the key opens up a large number of other doors. That's the case for email (via password recovery) and password manager (via its function), but not for much else. E.g. while access to online banking is a catastrophe in its own right, it doesn't unlock many other accounts.

<comment><USER5> No, the point is, people without a password manager tend to use the same password for every account. So you steal the bank password, and it opens your email, facebook, and everything else. Hundreds of failure points. With a password manager, there is just one.

<comment><USER6> Human nature being what it is, a large fraction of password-manager users probably also reuse passwords, or nearly reuse them, which is nearly as bad. With the password manager being there for cases where some BOFH admin required two relatively-prime numbers, plus three non-adjacent capital letters, plus at least one special character that's not a star, plus a final character that's not a lower case letter, plus uniqueness with respect to your previous 100 passwords, plus a length of at least 12 characters, plus a change every 14 days.

</comment></comment></comment></comment></comment></comment><comment><USER7> Full Disclosure. I am a former LastPass employee.

This guy's research, and most research regarding password managers is way overblown. Every lp product has a big popup that says "WHAT YOU ARE DOING IS INSECURE" when you click "Remember Password". Having secure defaults are something they are very mindful of.

All password managers are toast if you have someone else on your box. It's baked in to the threat model.

<comment><USER8> Doesn't LastPass encourage you to install their browser plugin though?

[https://www.dropbox.com/s/pzmdqex81tsicyk/Screenshot%202015-...](https://www.dropbox.com/s/pzmdqex81tsicyk/Screenshot%202015-09-14%2016.45.31.png?dl=0)

<comment><USER9> And this is the popup that plugin gives you when you click the button to save the master password: [http://i.imgur.com/s0FgRhI.jpg](http://i.imgur.com/s0FgRhI.jpg)

<comment><USER10> Sadly (?), it may be reasonable for password managers to not even offer that option because of technically-invalid PR fiascos like this one -- people are just going to stop using password managers otherwise.

<comment><USER11> An user moving to LastPass (or any password manager) is exponentially safer than before, even if they choose to save the master password on their local computer. If there's a subset of users who would drop LastPass if the password couldn't be saved, that would be a shame, as they're much better off this way.

</comment></comment></comment></comment></comment><comment><USER12> It's probably worth noting, this exploit requires the user to save their master password locally.

While it's not obvious from the blackhat blurb, it's stated by the author in their more detailed blog post [1]

Additionally, this behavior is something that LastPass advises against:

 _" Are you sure you want to have LastPass remember your password? This will significantly decrease the security of your LastPass account!"_

[1] [http://www.martinvigo.com/a-look-into- lastpass/](http://www.martinvigo.com/a-look-into-lastpass/)

</comment><comment><USER13> Sounds rather dicey, considering that the attack apparently depends on both the user using the "store master password" option, and the attacker having admin/root access to the user's computer. At that point, you might as well just install a keylogger, browser snooper, etc.

I don't think this makes any progress on any of the real nightmare scenarios, like a bulk breach of LastPass servers plus some critical mistake allowing the master passwords to be cracked en-mass in less than a multi-decade timespan, or even a vulnerability allowing somebody capable of intercepting the traffic between a device and the LastPass server to get master password or cleartext vault data.

<comment><USER14> Hmmm, I agree, based on what they claim, the above is not an "exploit", it is more like "I forgot my master password, and I am admin, how do I get my password back"

Like this: [https://apple.stackexchange.com/questions/56130/how-to- retri...](https://apple.stackexchange.com/questions/56130/how-to-retrieve-the- wi-fi-password-of-a-connected-network-on-a-mac)

So yes, if you gain root access on someone's machine, you can do nasty stuff. That is not really news.

</comment></comment><comment><USER15> Blog post about the sploit here from the authors: [https://news.ycombinator.com/item?id=10217551](https://news.ycombinator.com/item?id=10217551)

<comment><USER16> From above link: "Our attack only covers users that click the "Store my password" option though so, don't store your master password!"

That seems a rather important detail. Thanks for the link.

<comment><USER17> This has me breathing a sigh of relief. That said, why is this even an option??

<comment><USER18> Can this be a problem on mobile?

I have a long master passphrase - too long to type on a touchscreen keyboard in any convenient amount of time and where there's a non-trivial risk that somebody peering over my shoulder (think - using it on the bus) could spy it. So in that case I resort to using the fingerprint-unlock feature (which I assume is the security equivalent of 'save master passphrase' or at least token).

I am aware that this might open me up to other attacks - an adversary dusting my fingerprints off my tablet, etc. Curious though as to whether this is an attack vector for the same or a similar type of process to what the authors are describing (haven't read their blog post, just the Black Hat description).

<comment><USER19> Fingerprint unlock on iOS puts something equivalent to the master password in the iOS keychain for 1password. Only when your fingerprint is verified does the 1password app get it.

So at the very least you still have your passwords kept in a relatively secure keychain manager and not inside the app stored in plain text of some sort.

<comment><USER20> About iOS fingerprint- while a judge can not compel you to type in a password, I have heard that they _can_ compel you to swipe your fingerprint. Something to consider when deciding whether to enable fingerprint access to your smart phone login or other sensitive credentials (e.g. Password manager keychain credentials).

[http://jolt.law.harvard.edu/digest/telecommunications/court-...](http://jolt.law.harvard.edu/digest/telecommunications/court- rules-police-may-compel-suspects-to-unlock-fingerprint-protected-smartphones)

(Fwiw - I use LP, no master password saved, no iOS finger print access)

<comment><USER16> I wish there was a way to combine a simple 4-6 digit pin with fingerprint, it'd certainly make an attack on a physical device more cumbersome, especially if the rejection happened after the TouchID so the error was obfuscated on what failed.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> I use 1Password. To my non-security-expert eyes, the two weakest spots in how I use 1Password are: (a) The plugin I use on the browser, (b) The fact that I use Dropbox to sync the password keychain.

I can maybe move the keychain to an encfs encrypted folder in Dropbox. Then, I won't be able to use 1Password mobile app. And for the plugin, perhaps I can disable the plugin and copy-paste the password directly from the app.

Would love to get others' feedback. UPDATE: It appears I can combine sync through encfs folder and manual sync through phone to achieve sync on all devices.

<comment><USER22> The 1password keychain is of course encrypted[1] (I think[3] that dropbox syncing uses the older agile keychain format?). I personally sync my 1password keychain with icloud. Apple claims[2] that iCloud data is encrypted during transfer, as well as encrypted at rest. If I was more concerned about that aspect of it, I would probably just sync with wifi.

I do not use the browser plugin (personal preference).

[1]: [https://support.1password.com/opvault- overview/](https://support.1password.com/opvault-overview/)

[2]: [https://support.apple.com/en-us/HT202303](https://support.apple.com/en- us/HT202303)

[3]: [https://support.1password.com/switch-to- opvault/](https://support.1password.com/switch-to-opvault/)

<comment><USER21> Yeah, the keychain is obviously encrypted, but I still feel uneasy about it being naked on Dropbox. The reason I'm leaning towards using encfs + Dropbox vs iCloud is that although I definitely trust Apple more with my data (compared to Dropbox), I feel that an encryption controlled by me at client side will be safer.

<comment><USER23> The 1password keychain is encrypted locally before being transferred to Dropbox.

</comment></comment></comment></comment><comment><USER24> This attack appears to require compromise of the client machine running LastPass. If the target were not using a password manager, it would be relatively simple to use the same vector to deliver a keystroke logger, so it's unclear that there is an actual security disadvantage here.

<comment><USER25> I'd say mainly that you don't have to wait around for the user to go to the sites you are interested and look for passwords in a long string of keys.

<comment><USER24> True, but this is sort of academic when we're talking about protecting secrets on an already compromised machine.

I don't think this is a reason to not use LastPass.

<comment><USER26> There are some scenarios in which compromising a machine once is much easier. A lost device is one example. Installing a keylogger won't provide any value there, but if this exploit can recover the Lastpass master password and disable 2FA authentication (if enabled), then they will have access to the entire vault.

</comment></comment></comment></comment><comment><USER27> Any popular password manager, especially an online one, is likely to be compromised. Security has to make a successful attack more expensive than the target is worth. How much is all data in all accounts of an online password manager worth? That is a very attractive target, and generally in IT it is much cheaper to attack than to deend.

I doubt any password manager vendor has the resources necessary to truly protect their users. At least, if you are not paying top dollar for security, don't expect much.

</comment><comment><USER28> My biggest issue with LastPass is that they force you to have the _same_ password for your online account and as the master password for your vault.

To have a secure master password, you do not want to be using it to login to their website, because now you are blindly hoping they aren't having it logged somewhere or retained in memory that can be dumped.

</comment><comment><USER29> I used to just let Chrome remember everything, but then jumped on the LastPass bandwagon after Heartbleed last year.

I've been happy with it. The mobile app works well and it is very convenient. I just can't help but to have this nagging feeling since all their salts were exposed, I am really no (or not very much) "safer" than if I let Chrome remember them. If someone gets on my machine and knows what they're doing it is probably all over anyway, right? (And no, I dont let LastPass remember master PW, and I do use a system-level password so you cant easily see them in chrome://settings/passwords unless you have that to...) So the question is who do you trust more to protect the credentials that are synced to the cloud: Google or Lastpass? I don't know the best answer, all things considered (local and on the network). I would guess Google is a much harder target than LastPass.

<comment><USER30> I trust LastPass for 3 reasons:

1) LastPass has a history of taking ownership of vulnerabilities and taking appropriate measures. They do this publicly and provide a level of detail that demonstrates their expertise[1].

2) They're working under the same constraints as Google with the same caliber of engineering strength.

3) Most importantly, their business depends on delivering a secure product. It's in their best interest to continue providing a secure product.

[1] [https://blog.lastpass.com/2015/06/lastpass-security- notice.h...](https://blog.lastpass.com/2015/06/lastpass-security-notice.html/)

<comment><USER29> It isn't that I don't trust LastPass the company. It is that I'm no longer sure if the entire model of the product/service offers enough additional (or comparable) security over what Chrome offers, wrt to the syncing of encrypted credentials to the cloud.

If your're only considering vulnerabilities that pertain to that, I would think native Chrome has an inherent security advantage over a Chrome plugin. I am happy to be wrong about this, though.

Edit/Addition: While I give them props for the full disclosure about the salts being exposed, we don't have any evidence that this has ever happened to Google, so setting everything else aside, we already know for certain LastPass has been exploited in a way we don't have any evidence that Google has. That's not intended to be a slight on LastPass or praise for Google, just that, "it is what it is."

</comment></comment></comment><comment><USER31> I use [http://www.passwordstore.org/](http://www.passwordstore.org/) without any plugins. I imagine this has to be pretty rock solid.

<comment><USER32> I wish it offered using symmetric crypto - so I won't have to find ways to secure a GPG key...

</comment></comment><comment><USER33> I posted this last week [0] but got no traction. Nothing to worry about, but it is the same exact URL and I thought HN was deduplicating entries. Isn't that the case?

[0] [https://news.ycombinator.com/item?id=10202196](https://news.ycombinator.com/item?id=10202196)

Edit: added link

<comment><USER33> Update: Solved [https://news.ycombinator.com/item?id=10216280](https://news.ycombinator.com/item?id=10216280)

</comment></comment><comment><USER34> One thing I found out (well, actually, just asked them) last year is this[0].

Basically, even though they are claiming not to send your password to the server, if you open their security check:

> Once the master password is entered on the security check page, it decrypts > your data (login and passwords) and send the length and character to our > server for analysis then send you the result.

So, practically, they're not sending your passwords per se, but they are sending the length and characters used?

[0] [https://lastpass.com/my.php?token=T1KUZTUH78P7&lpnorefresh=1](https://lastpass.com/my.php?token=T1KUZTUH78P7&lpnorefresh=1)

<comment><USER35> Only when you perform a security check about the passwords you storesñ

</comment></comment><comment><USER36> Well, that sounds bad.

At least they apparently need access to a local machine. Would be a lot more concerned if a random hacker on the internet could break into anyone's vault. Still obviously not great though!

<comment><USER37> > At least they apparently need access to a local machine.

In addition to _everyone in the building_ , the individuals in your IT department have access to your work machine, and can install key loggers easily. It may even be SOP at some places.

<comment><USER36> I am my IT department, and the only other individuals in my building are my family. ;) But in general I agree: local-only exploits are still a significant concern. (Just not as bad as remote ones.)

</comment></comment></comment><comment><USER38> After reviewing this service for password sharing among coworkers (yes it it still necessary for a few parts on a server) I have big doubt in security of Lastpass. Turning on 2FA did not worked most of the times and user experience without their browser plugin is very bad. So I analyzed their page sourcecode and saw everywhere PHP which was also failing sometimes (see the 2FA). Sorry but I will never give trust to a password manager written in PHP (no offense against PHP, but please not for my 100% secure passwords!)

<comment><USER39> Full Disclosure: I work at LastPass.

> "Turning on 2FA did not worked most of the times"

If you have a security issue here we'd appreciate a report at [https://lastpass.com/security/](https://lastpass.com/security/) that said every report of this has always been a case of someone not reading the manual or FAQs so please checkout [https://lastpass.com/support.php?cmd=showfaq&id=2775](https://lastpass.com/support.php?cmd=showfaq&id=2775) first.

> "Sorry but I will never give trust to a password manager written in PHP"

The password manager is actually written in C++,Objective-C,Java,C# and JavaScript -- depending on platform. You seem to be focused on our website however (which only handles encrypted data with a key never get) which is written in Hack: [http://hacklang.org/](http://hacklang.org/) actually, not PHP.

Regarding the user experience being less without extensions installed -- yes, that's true, we highly encourage installing those -- the extension-less access should really be used for emergencies only -- it's safer to login to the extensions since it's not relying on JavaScript you just downloaded, it's always preferred.

<comment><USER38> Big thanks for clarifying! But it seems I'm not the main target audience because I do not want to use Lastpass for all my passwords (personal preference) and I also do not want to force coworkers to use browser plugins just for exchanging passwords once in a while.

<comment><USER39> Understood -- you may want to consider a combination open source command line version + mobile + mac apps:

[https://github.com/LastPass/lastpass- cli](https://github.com/LastPass/lastpass-cli)

If your coworkers aren't using something they're likely reusing company passwords, which is one of the key reasons to force using the extensions.

</comment></comment></comment></comment><comment><USER40> Sooooo... what's a good recommendation for an "offline" password manager (ie: one that connects via USB and requires physical input to "paste" the password)

<comment><USER41> I use "pass": [http://www.passwordstore.org/](http://www.passwordstore.org/)

Everything in GPG-encrypted files, in a git repo that I sync with my server. The GPG key is kept unlocked for an hour or so with gpg-agent, meaning I only type my key password a few times a day.

All passwords copied and pasted from the shell, though I use Conkeror so there's no reason I couldn't write a little bit of integration to have the passwords pasted directly into the web forms.

<comment><USER42> I do the same here, though I have not pushed my keys to anywhere external just yet and I do not have my gpg kept unlocked for very long.

<comment><USER41> I keep the repo sync'd between two computers, and have even cloned it to my Android phone, but I haven't yet summoned the guts to actually put my PGP key on my phone so I can access my passwords there.

</comment></comment></comment></comment><comment><USER43> There is always a security cost for convenience.

Personally, I use a password manager that doesn't directly integrate with any browsers or plugins. While the crypto protecting most vault files is imperfect, there are mitigations that can lower that risk. I can't mitigate risks from third party plugins.

<comment><USER44> Some of what 1password provides is a synergy of security _and_ convenience.

1password's browser integration can save you from phishing, because it can tell g00gle.com from google.com every time and not offer to fill in your google.com login, whereas if you're used to just copying from your password manager, you have to make sure not to mess that up.

Lack of convenience means manual work, which means chance for error. This is the same reason we recommend coding using trustworthy high-level crypto constructs instead of implementing it yourself; it's more convenient _and_ harder to mess up.

</comment></comment><comment><USER45> LastPass offers 2 options in the Chrome extension to help mitigate the issue if you enable remember your master password:

1) Automatically Log out when all browsers are closed and Chrome has been closed for (mins)

2) Automatically Log out after idle (mins)

</comment><comment><USER46> I literally switched to using LastPass for everything over the past four hours after meaning to do so for years. I can't believe this.

<comment><USER47> Well on the bright side I think you can export your lastpass account to something better, like 1pass.

<comment><USER48> I used 1password before, but several times I lost access to all my passwords after upgrading the software. On the bright side, I was always able to restore access to it by manually downloading 1password and reinstalling 1password. Besides, 1password does not officially support Linux. That's why I wanted to try Lastpass. I also find the yubikey support interesting.

Well, I guess, it's time to reinstall keepass2 again.

<comment><USER49> A really cool feature I love about 1Password is that you can open up the `agilekeychain` file in a web browser and unlock it to view your passwords right there without the application. [0]

One of the few unique passwords I remember myself is that of Dropbox, so I'm always able to access my passwords this way from anywhere that has a web browser.

I don't know if this would have helped your particular situation (not sure if you can export from this stripped down interface), but it gives me peace of mind that if the software itself ceased to function, my passwords would still be accessible.

[0] [https://support.1password.com/guides/mac/1passwordanywhere.h...](https://support.1password.com/guides/mac/1passwordanywhere.html)

</comment></comment></comment></comment><comment><USER50> A password manager would be the perfect application for a smartwatch.

</comment><comment><USER51> What I try to do is use LastPass for unimportant passwords and just remember unique but memorable passwords for important sites, like my bank's.

But nowadays this is pretty tough in general.

</comment><comment><USER52> We're going to be actively encouraging our enterprise clients to use Logrr ([http://logrr.com/](http://logrr.com/)) to eliminate their password completely in favor of on device cryptography. It's the only way to avoid the vulnerability of password's entirely that I've seen.

<comment><USER53> The How does it work section of their website doesn't explain how it works and the FAQs are empty. How did you get enough information about their technology?

<comment><USER52> Met them in person - I'm sure they'll update the website at some point, they're working hand in hand with their customers right now so I think marketing materials are probably falling a bit to the wayside. It's really quite something.

</comment></comment></comment><comment><USER54> Why don't people use KeePass ?

<comment><USER55> I do. It's less convenient, but I feel more secure.

</comment></comment><comment><USER56> black page with white text...WHY?? *headache

<comment><USER57> javascript:(%28function%28%29%7Bwindow.baseUrl%3D%27 https%3A//www.readability.com%27%3Bwindow.readabilityToken %3D%27%27%3Bvar s%3Ddocument.createElement%28%27script %27%29%3Bs.setAttribute%28%27type%27%2C%27text/javascript %27%29%3Bs.setAttribute%28%27charset%27%2C%27UTF-8 %27%29%3Bs.setAttribute%28%27src%27%2CbaseUrl%2B %27/bookmarklet/read.js%27%29%3B document.documentElement.appendChild%28s%29%3B%7D%29%28%29)

Make a bookmark out of that (all on one line, newlines added to not kill page formatting), toss it in your browser's bookmarks bar, and click to convert. It's crazy awesome.

<comment><USER58> You need to drop the space after the 'script' element up there, but otherwise this is a great little tool. Thanks!

</comment></comment></comment><comment><USER15> Is this vulnerability in 1Password too?

</comment><comment> guard-of-terra That's why your passwords root should lie somewhere in the basement in the form of printed QR-code. In hopes that it will never be needed.

</comment><comment><USER59> well then...

</comment><comment><USER60> Well that sucks.

</comment><comment><USER61> That is really big news, it also allows me to go find my friend and claim my $20 from our bet that his password manager of choice would succumb to an attack within 5 years that renders it more dangerous than not having it...

 _> We also found how it is possible to abuse account recovery to ultimately obtain the encryption key for the vault._

If a 3rd party can help recover your information, your information is not secure because account recovery can typically be bypassed by social engineering.

E:

Someone posted the blog outlying more details:

 _> With all this information, we where finally able to obtain master passwords in cleartext. Woo hoo! Our attack only covers users that click the "Store my password" option though so, don't store your master password!_

So it's hackable, but only if you're an idiot who stores your master password or sets your password reminder to contain your password.

Seems my bet with my friend wages on. I'll probably be out $20 by the years' end.

<comment><USER62> > renders it more dangerous than not having it

If I were your friend, I would tell you that this is still dubious owing to the fact that without it, many people might use very weak passwords that never change. You gotta weigh that and the vulnerability it presents for large-scale remote attacks/leaks, against the likelihood of these guys getting local access to your machine (i think?) for this exploit.

<comment><USER61> Please allow me to elaborate a bit.

Storing multiple passwords within a single master password means your security is only ever as strong as your master password is safe. Literally "putting all your eggs into one basket". Same with centralized email. One should separate accounts by email such that if a single email is compromised - not every account is compromised.

My argument (and practice) is to have individual emails for individual accounts. Using a dice selection method [0] they'll be as secure as any individual master password. The issue is burden of memory.

The argument in favor of password managers is that they relieve the user of burden of memory by exchanging a small chunk of security for a large chunk of convenience. Which is why I use a password manager.

The actual _bet_ however is that somewhere in the implementation of password managers there will be found something that is so insecure it allows someone to "seize the basket" and more or less make the trade-off go from a "small chunk of security" to "all security". Specifically, any PM that doesn't require the device being _compromised_ ; though physical access is fine. (Physical access allows memory attacks but the device itself is not yet compromised.)

I hope that helped give my position some more nuance.

[0] [http://world.std.com/~reinhold/diceware.html](http://world.std.com/~reinhold/diceware.html)</comment></comment></comment>


A View of ISIS's Evolution in New Details of Paris Attacks - <AUTHOR> http://www.nytimes.com/2016/03/20/world/europe/a-view-of-isiss-evolution-in-new-details-of-paris-attacks.html <comment><AUTHOR> "One of the terrorists pulled out a laptop, propping it open against the wall, said the 40-year-old woman. When the laptop powered on, she saw a line of gibberish across the screen: "It was bizarre — he was looking at a bunch of lines, like lines of code. There was no image, no Internet," she said. Her description matches the look of certain encryption software, which ISIS claims to have used during the Paris attacks."

This is incoherent to me. Any idea what they're referring to?

"According to the police report and interviews with officials, none of the attackers' emails or other electronic communications have been found, prompting the authorities to conclude that the group used encryption. What kind of encryption remains unknown, and is among the details that Mr. Abdeslam's capture could help reveal."

The absence of evidence is not the evidence of absence. They seem to be referring to steganography more than encryption here, anyway.

<comment><USER2> The code might have been a foreign language they communicate in. Not encryption or source code.

Unlesz they are using Kali Linux or some Linux distro that hides IP adresses and makes things private.</comment></comment>


Moved by Fire: History's Promethean Moment (2014) - <AUTHOR> http://theappendix.net/issues/2014/10/moved-by-fire-historys-promethean-moment <comment><USER2> This is the article I was looking for. But there is still so little evidence for climate-changing fire in prehistory..</comment>