Extended Validation Certificates Are Really Dead - <AUTHOR> https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ <comment><USER2> It's actually kind of unfortunate, as in some ways an organization's name is a much more meaningful expression of identity than a domain name is. When I visit the website for my bank, I don't really care that the entity I'm communicating with owns "mybank.com". What I, and I suspect most people, are really concerned with is that the entity they're communicating with is the same physical, real-world organization they opened a bank account with in the past.

The problem is that legal corporation names are much harder to verify than domain names, and even once verified they don't always match user expectations (as Ian Carroll so aptly demonstrated with his Stripe Inc. certificate). Furthermore, and perhaps partially as a result of the aforementioned issues, browsers don't treat EV certificates in a way which would allow any meaningful security guarantees to be built on top of them.

I wonder if there are ways this situation could be improved. Brand names, for example, are probably more likely to match user expectations than legal company names. Perhaps an alternative to EV could be built around that idea.

<comment><USER3> The names that people are familiar with come from branding and publicity - that is, advertising, news, social media, and so on. This affects the web pages that search engines crawl, what users search for, and also which websites rank higher. I'm not sure how someone would do better than search engines? Searching for the company you're looking for usually works.

You can imagine inventing a more systematic approach to assigning names, but it would be like using scientific names for animals instead of common names. Domain names serve this purpose already. What we really want is to document popular usage.

One systematic approach to tracking popular usage might be to treat this like creating a dictionary. However the dictionary compilers are always going to lag popular usage. This is why Yahoo's directory-based approach lost out to Google. The closest thing we have now is Wikipedia and Google gets that data via crawling.

I guess you could say that human languages are not entirely secure due to being a bit nebulous, but it's the best we have for humans referring to things they remember. If you want to be precise, you need to remember, record, or communicate the domain name.

<comment><USER4> .ac.uk is reserved only for education.

Simply having an e-mail on one of these domains implies access to e.g. free GitHub accounts.

We could have something akin to .bank.uk for banking purposes (you are only allowed go have one if you have a banking license).

<comment><USER5> I think the new gTld .bank is marketing itself for banks in that way, making sure only real banks get.bank

</comment></comment></comment></comment><comment><USER2> Direct link to explainer doc in the Chromium source: [https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s...](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/ev- to-page-info.md) (Permalink version [https://chromium.googlesource.com/chromium/src/+/bccea73462d...](https://chromium.googlesource.com/chromium/src/+/bccea73462da42b6366dd4d8dc391ee07c615312/docs/security/ev- to-page-info.md))

Chrome mailing list announcement: [https://groups.google.com/a/chromium.org/forum/#!topic/secur...](https://groups.google.com/a/chromium.org/forum/#!topic/security- dev/h1bTcoTpfeI)

Firefox mailing list announcement: [https://groups.google.com/forum/#!topic/firefox- dev/6wAg_Ppn...](https://groups.google.com/forum/#!topic/firefox- dev/6wAg_PpnlY4)

Firefox bugzilla issue: [https://bugzilla.mozilla.org/show_bug.cgi?id=1572936](https://bugzilla.mozilla.org/show_bug.cgi?id=1572936)

</comment><comment><USER6> The irritating thing is that EV is the closest thing to a useful thing PKI can provide[1]. And the only reason it's being pushed out is because Google doesn't like it and hence Chrome has been retiring it. Google's previously indicated it essentially wants to build it's own system[2] that is... effectively EV. So this is probably the death of a problematic but fixable open system which will be replaced by a proprietary Google-owned one.

Firefox, is, of course, following the monopoly lead.

[1]HTTPS encryption itself doesn't meaningfully require public key infrastructure, it's just that without PKI, you don't know who sent the encrypted traffic. Since domains are terrible "identities" and it's common for large organizations to use many of them that sound similar to scam domains, domain validation really doesn't tell anyone anything about whether or not they're talking to a trustworthy entity.

[2]Basically Google said it wants to "invent" EV certs here, late last year: [https://www.wired.com/story/google-wants-to-kill-the- url/](https://www.wired.com/story/google-wants-to-kill-the-url/)

<comment><USER7> > [1]HTTPS encryption itself doesn't meaningfully require public key > infrastructure, it's just that without PKI, you don't know who sent the > encrypted traffic. Since domains are terrible "identities" and it's common > for large organizations to use many of them that sound similar to scam > domains, domain validation really doesn't tell anyone anything about whether > or not they're talking to a trustworthy entity.

It is trivial to get an EV cert for a company that has the same name as a trustworthy entity[0]. There is nothing in the design of EV that prevents this, and name collisions between corporate entities are common and acceptable practice[1].

[0] [https://stripe.ian.sh/](https://stripe.ian.sh/)

[1] Trademarks are a different matter, but _getting_ an EV cert for a company that has the same incorporated name as a different company in a different state is completely legal.

<comment><USER8> > Trademarks are a different matter, but getting an EV cert for a company that > has the same incorporated name as a different company in a different state > is completely legal.

It is legal. But it's also much more easily traced (even through various shell companies as process agents want to get paid), which compared to the way most crime works on the internet is infinitely more risky for the perpetrator.

Also, companies like banks regular scour business records for similarly named businesses, which means the window for fraud is smaller. I'm not surprised that someone would find it easy to spoof Stripe, but let's see how long they manage to spoof PayPal or Bank of America. If they don't already, EV certificates should issue only after the named entity has existed for N months (or years).

<comment><USER9> >Also, companies like banks regular scour business records for similarly named businesses, which means the window for fraud is smaller

can't they also scour the certificate transparency logs as well? I'd imagine that's easier and more reliable than scouring the public records of hundreds or thousands of jurisdictions.

<comment><USER8> I'm sure they can and do. But it's not an either-or situation. Also, AFAIU, EV certs won't even _issue_ without heightened scrutiny regarding domain name ambiguity.

When SSL first came out there was a heavy focus on informing the public to check for the padlock; that if they were worried about fraud then checking for the padlock was a concrete step they could take to help reassure themselves. But there was never a similar campaign regarding EV certs. There were attempts, but they were short-lived and not nearly as aggressive. Partly that's because the messaging was more difficult, but it _could_ have been done.

Google _could_ have put more effort behind it. But they weren't interested, partly because as someone else mentioned they have their own ideas about how to move forward, ideas that just happen to fit in better with Google's commercial interests. Some of those ideas are reasonable, but again this isn't an either-or situation. They're making it either-or.

</comment></comment></comment></comment></comment><comment><USER10> I'm pretty disappointed by this. I definitely trust what I see a lot more when I see the legal entity name in the URL through an EV cert. I don't really understand why it's being removed. It's more difficult to get an EV cert because of the additional legal process, and it makes it clear to the user that the website is run by that entity, which is exactly what we want...

With Google removing [https://](https://) from the URL and EV being gone, I don't even know what to trust anymore.

<comment><USER11> I don't have any solutions to your last statement, but one of the problem is that legal name of the entity matching doesn't really mean its the same entiy you think it is - the example ( also in the original page): [https://stripe.ian.sh/](https://stripe.ian.sh/)

<comment><USER10> When I visit that page I don't see an EV banner in my Chrome, version 76.0.3809.100. It seems like I'm meant to according to the document?

Edit: I see, it says it was revoked. Well that makes sense:

> Edit (April 29th, 2018): This site no longer uses an EV certificate. Comodo > arbitrarily revoked — without any notice — the first certificate, saying > this site was made with the intent to mislead. GoDaddy issued us a new one > on 04/11/2018, but revoked it later that day, stating that the site was > fraudulent.

So OBVIOUSLY the CAs are trying (maybe not as hard as we'd hope) to make sure EV is used responsibly, so why kill EV? Why not just improve the process a little bit more to make it unlikely to give an EV cert that clearly intends to mislead?

> It is notable that neither company believes they mis-issued the certificate.

What? They clearly revoked both and specified the reason, so does that not make the mis-issuance implicit?

<comment><USER12> Comodo said the revocation was a mistake:

[https://sectigo.com/blog/on-comodo-cas-recent-revocation- of-...](https://sectigo.com/blog/on-comodo-cas-recent-revocation-of-an-ssl- certificate-for-kentucky-based-stripe-inc)

</comment></comment></comment></comment><comment><USER13> EV had one advantage: It allowed browser vendors to push for improved standards (like Certificate Transparency adoption) with minimal push-back. It's easy to complain about expensive security measures for run-of-the-mill certificates, it's much harder to argue about such measures for special extra- secure ones.

And since CAs wanted the EV cash cow, they implemented CT and other improvements, and once they had the code, they had little reason to object against applying the same requirement to regular certificates.

Another advantage is that when my bank requires me to enter a verified-by-visa password on lookslikephishingbutreallyismybank.com, I can actually verify (with a reasonable degree of certainty) who the site belongs to - even if they could, attackers generally won't go through the effort of getting a similar name. But that's a power user feature.

</comment><comment><USER14> Good riddance, IMO. They never meant much to begin with, the validation procedures were basically "can you pay the fee?", and they only added to user confusion.

</comment><comment><USER15> I don't understand the glee, _schadenfreude_ even. So because the UI side of things didn't work out, it is an improvement that now all certificates will go back to the "crusty Perl script fetching a side-channel secret from a webserver" method of "validation"?

On the contrary, we should just push for extended validation on all certificates. Whether they come with a fancy UI or not.

Because if we are on the topic of https UI effectiveness, then I'm pretty sure _everything we have right now_ is doing a horrible job and could be removed with much the same tenuous reasoning.

<comment><USER16> Why push for extended validation of there is no security benefits and the user experience is the same?

I remember that someone had successfully got an extended certificate for "Stripe, Inc".

Things like certificate transparency log monitoring seems better than EV to improve security.

<comment><USER15> Maybe EV isn't the answer. But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root.

That's before you get to the UI failures, where phishers can trivially get that lock for their microssoft.com domains.

<comment><USER17> > But there is opportunity for something else out there, because right now > https is not living up to the "authentication" promise when you have > Firefox, Chrome et al. kotau to company proxies and all kinds of dubious > state CAs in the trust root.

There's already a lot of things being done to improve the situation. Honest question: Are you aware of them? Do you know Certificate Transparency? Have you followed the intense discussion about Dark Matter? Do you know what the Baseline Requirements are? Do you know how Webauthn prevents Phishing?

</comment></comment></comment></comment><comment><USER18> I just replaced an EV certificate with a free AWS provided one on our website. We jumped through a lot of hoops a few years ago to get our EV certificate. This was a tedious process that involved form filling, credit cards, lots of waiting and poorly documented ways of handling the actual certificates. I actually had to append some text files to that were sent via email to get a valid thing that nginx actually understood, etc. I lost non trivial amounts of time with this. Because it was so tedious, we went for long lived certificates. When we switched to amazon we preserved our investment and uploaded the certificate to AWS and used it on an ALB.

Since then the market has changed a lot. E.g. Letsencrypt happened and several companies, including amazon, now offer very convenient ways of getting certificates. So, last week the process was as follows: 1) I created anew certificate in the region where I needed it. 2) after waiting for it to deploy, I selected it from a drop down on the ALB where it was needed. End of story. It will take care about renewal, adds no extra cost, and requires no fiddling with text files.

</comment><comment><USER19> seems like you are completely missing the use case, if you think EV certificates are for frequently visited website.

I, for one, always make sure my bank has EV before I enter the password. the fact that most people don't doesn't change the fact that it does provide additional trust for those who are aware. security isn't all or nothing.

the second use case is when you first visit a website, which potentially asks for credit card number or anything sensitive, it does improve your trust and reduces the friction with lesser known websites. of course PayPal, as a well known and trusted website doesn't need it - nobody is asking themselves if they should trust PayPal. again, it's probably not a security boundary, and it's probably not impossible to generate bogus ev certs, it's better than nothing.

<comment><USER20> Paypal is an interesting case [1]. Whether they served an EV-cert differed based on browser. If EV worked, that would mean people who switched browsers would refuse to use paypal.

And yet, there are no reports of people thinking their paypal is untrusted. Nor did paypal decide to roll out EV everywhere because they were losing users.

[1] [https://www.troyhunt.com/paypals-beautiful-demonstration- of-...](https://www.troyhunt.com/paypals-beautiful-demonstration-of-extended- validation-fud/)

edit: Claimed that EV differed based on location, but it was based on browser.

</comment></comment><comment><USER21> What about for Windows development? I just ordered one through my company in order to bypass 'untrusted app' dialogs that my non tech savvy users can't figure out.

<comment><USER22> Not all Code Signing certificates are Extended Validation. Non-EV Code Signing certificates bypass that warning (Authenticode). So it has no impact.

Code Signing will still be $175 too expensive and still work just as they have.

<comment><USER23> MS still requires that drivers be signed with an EV cert [https://docs.microsoft.com/en-us/windows- hardware/drivers/da...](https://docs.microsoft.com/en-us/windows- hardware/drivers/dashboard/get-a-code-signing-certificate) And it supposedly does help add some SmartScreen reputation, but that system is totally opaque and there is no way to quantify just what the EV cert adds.

<comment><USER24> New EV certificates don't just help with SmartScreen, they completely bypass it. Regular Windows code signing is the smartscreen booster.

</comment></comment></comment></comment><comment><USER25> Why do we need multiple CA now? Keep letsencrypt and distrust everyone else. Their business is dead anyway. Domain validation is an automated process and does not require much income to keep working. Just like DNS Roots works without competition.

<comment><USER2> Because then you'd be centralizing control of certificate validation in a single corporation, and creating a too-big-to-fail CA that _can 't_ be distrusted if it screws up for fear of breaking the entire internet.

<comment><USER25> We will have enough time to switch to the new CA if necessary. And ACME protocol is independent, so software just needs to update some configuration values.

Anyway letsencrypt already serves 80% of market. So it's already too big to fail, I don't see much difference between 80% and 100%. But dozens of random CA roots in my browser do bother me.

<comment><USER26> > _Anyway letsencrypt already serves 80% of market. So it 's already too big > to fail, I don't see much difference between 80% and 100%._

The difference is all the big websites still pay for certs, so if LE is distrusted then your bank will still work, google.com will still work, apple.com will still work, etc.

</comment></comment></comment></comment><comment><USER27> As someone with a direct interest in this (I run [https://certsimple.com](https://certsimple.com), a startup that focuses on steamlining the EV verification process), this is predictable but still hilarious:

> Through our own research as well as a survey of prior academic work, the > Chrome Security UX team has determined that the EV UI does not protect users > as intended (see Further Reading in the Chromium document). Users do not > appear to make secure choices (such as not entering password or credit card > information) when the UI is altered or removed, as would be necessary for EV > UI to provide meaningful protection.

Chrome has never tested a verification marker that resembles ANY of the common standards for verification used on Twitter, Whatsapp, Facebook, Apple's App Store or Google Play.

No research into better indicators has been done because Google do not wish to do research into better indicators. Decisions are:

\- made by one individual who believes users should be able to detect bad sites because they "don't look right"

\- supported by another person who thinks users can use DNS to decider whether sites are real. Ask a regular web user, or even an infosec expert to determine which out of "google.im", "google.co.uk" and "withgoogle.com" is actually controlled by Google.

\- and further supported by somebody else who thinks a study of IE7's UI:

        foo.com                            VeriSign [US]

is relevant research (see this article).

Yes UX designed in the mid-2000s, prior to modern verification standards, is sub optimal.

I've suggested Google's UX people investigate better alternatives for years. They're not interested.

The CAs aren't that much better either (being slow to realise how much the market is changing around them) but Google are absolutely not interested in finding out what would be possible with a modern verification UI, or making sure users know who they're connected to.

<comment><USER28> As the organisations that stand to benefit financially from selling these indicators, perhaps it's CAs that should invest in the research? CAs seem to constantly point at the browsers as the party responsible for doing that research, but I don't see why.

<comment><USER27> Totally agreed CAs dropped the ball on research too. It's not an either/or thing: browsers makers need to ensure their security UX helps people understand what they're connecting to and CAs need to do the same and additionally ensure their verification processes are robust.

<comment><USER28> But, didn't browser vendors do that and that's why the EV indicator is being moved to a less prominent location?..

<comment><USER27> No, browser vendors have not tested verification markers that are consistent with other platforms. See the top post in this thread.

<comment><USER28> That's not what I asked, that's a straw man.

Browser vendors have tested the efficacy of the current EV indicator, resulting in the current action.

If you feel that testing an alternative indicator consistent with other platforms is a good idea, then perhaps that's where the CAs should start their research.

<comment><USER27> >>>> browsers makers need to ensure their security UX helps people understand what they're connecting to

>>> But, didn't browser vendors do that

>> No, browser vendors have not tested verification markers that are consistent with other platforms.

> That's not what I asked, that's a straw man.

Doesn't seem like much of a straw man to me. Investigating whether browser security UX helps people understand what they're connecting to logically includes looking at designs other than the current one.

> then perhaps that's where the CAs should start their research.

Yes. And browsers too.</comment></comment></comment></comment></comment></comment></comment>


Hack cancer - <AUTHOR> http://unbouncepages.com/my-beat-cancer-report/

<comment><AUTHOR> A few months ago, my old college roommate's dad got cancer. That situation inspired me to start reading medical research on how to avoid cancer, or at least drastically reduce my risk for it.

I've learned a lot since then and have kept notes.

Now, I'm curious about whether there is interest for a report about what I've learned. If there is, I'll organize my notes and offer it for sale for a few bucks, just because I would have to take time away from my family to compose it.

If you would like me to create this report, please enter your email at the link above.

(This has also given me a chance to try out unbounce.com, which seems pretty cool so far!)</comment>


Show HN: Santa's Map to Christmas (Mobile App) - <AUTHOR> http://santasmap.com/ <comment><AUTHOR> Santa's Map to Christmas is an app for Android and iOS devices where I've been geocoding classic Christmas stories for the holiday season. I read through the stories, extract the contexts where places are mentioned and geocode those places so readers know where places like Bethlehem or Ebenezer Scrooge's offices are located. For places where I can find illustrations, I include images with the entries for a rich location-aware experience.

I hope HNers find some joy in this creation, and have a very happy holiday!</comment>


7 billion people on 1 page - <AUTHOR> http://www.7billionworld.com/

<comment><USER2> Reminds me of a (dumb) idea I had for a social networking site that was inspired by the million dollar homepage: show 1 million user accounts on one page, no scrolling. Every user can choose the color of their pixel. With zooming in or multiple pages, that could be extended to everyone, but I thought a million people would be pretty cool. Isn't quite as cool with the few dozen people that showed up though. <http://humbit.com/humbit.php>

<comment><USER3> I was playing around with Humbit and actually it is pretty cool =). But it is not that useful and gets boring after a few minutes. You could make it more dynamic or something to make users want to use it more.

<comment><USER2> That ship left a long time ago, but thanks!

</comment></comment></comment><comment><USER4> Soooo...... am I the only one who noticed Africa was annotated with a black coloured human, and Asia with a yellow one.

<comment><USER5> Is there a particular color Africans or Asians prefer to associate themselves with moreso than the colors chosen there? Just curious. I don't see how associating a certain continent with a certain color would be racist.

<comment><USER2> A lot of racial slurs are based on a caricature of people's skin colors. Selecting a color that has historically had that problem and then intentionally assigning it to the target of those caricatures seems, if not malicious, at least completely oblivious.

</comment></comment></comment><comment><USER6> Everyone could fit in a cube 1.1 miles on a side.

Let's say each person gets a 72 inch tall, 30 inch wide, 20 inch deep box. That's about 28 cubic feet per person. If you stacked all 7B of these next to each other in a cube, you'd have a cube with a side of just 1.1 miles.

<http://instacalc.com/11188>

<comment><USER7> A lot of people would not fit in boxes of that size (6'x2'6"x1'8"). But, if you where thinking of an average that might work.

<comment><USER8> They'd fit if you got creative. You could always put pieces of them in someone else's box. :)

<comment><USER9> 7 billion people in cramped boxes, some of them with limbs amputated and some of them with body parts in their box, with no ventilation, waste disposal or food supply. Sounds like a great xkcd what-if. That reminds me that you can fit 7 billion people on Rhode Island, but the geopolitical effects of that would be less than beneficial.

</comment></comment></comment></comment><comment><USER10> Would be cool if new people kept popping on top at the average rate people are born. also a good opportunity to stop such cruel segregation practices, and just mix up the folks at the rate they are born. The new generations should know no race.

<comment><USER11> To keep things squared, you'd have to cross out people at the rate they die as well.

And although the colors may suggest otherwise, the 5 continents division is not based on race but rather on location.

<comment><USER12> With addition of birth rate and death rate, the site may become a simulation application. Maybe also adding a text field to input those rate to check if we are increasing or decreasing.

</comment></comment></comment><comment><USER13> I just opened the page up in code inspector and deleted an element, am I going to jail?

<comment><USER14> Depends on the colour of the element you deleted...

<comment><USER15> But it didn't actually affect the original page, so...

</comment></comment></comment><comment><USER16> In Chrome, the scrollbar disappears after about 3/4 the way down. Interesting, anyone know why?

</comment><comment><USER17> I didn't scroll down far enough to "see everyone", but according to the legend, there are no people in Antarctica. Since it's neutral territory, I guess those people are naturally residents of one of the other continents, but it still seems sad in some way.

EDIT: I guess I would have also split north and south America into two continents ... sorry I didn't notice before!

EDIT2: I should also note that one of the goals on my bucket list was to travel to all 7 continents. I've found out that getting to Antarctica is hard without specific skills (and in some cases, specific employers ... who knew there were polar service companies: <http://rpsc.raytheon.com/>). I guess my best bet is to become wealthy enough to fund an expedition of my own ... but then I'd have a hard time justifying the cost.

<comment><USER18> national geographic has a trip there that's only 12k~ a person [http://www.nationalgeographicexpeditions.com/expeditions/ant...](http://www.nationalgeographicexpeditions.com/expeditions/antarctica- cruise/detail)

<comment><USER17> Wow ... thanks for the link (now bookmarked)!

</comment></comment></comment><comment><USER19> > _On this page you can see every single one of us. One by one._

If you want to count them _one by one_ at 1 per sec, you'll need ~220 years.

Edit: I just noted that it was already mentioned in the _counting all of us_ section...

</comment><comment><USER20> Some people might find blue europeans, red americans and green australians racist.

<comment><USER21> Hehe. You are right. Those are actually the official olympic colors of the continents, se they will get away with it.

</comment></comment><comment><USER22> Load time is impressive

<comment><USER23> The magic is repeating background images, I believe.

</comment></comment><comment><USER24> Very cool. It would be nice if the colours varied slightly so you had some reference point when scrolling. At the moment I scroll down and the page looks static.

</comment><comment><USER23> I would love it if (based on the estimated birth rate) I could put in the date, time and place of my birth and find myself.

That would be cool.

<comment><USER25> Iwas thinking that I would like to be able to click on a person and a popup asking for my details would arise. I could populate it with me.

(Just like: Name | DOB | Place of birth | Place of residence)

</comment></comment><comment><USER26> Awesome. I'm a sucker for a good visualization. What about adding a fixed nav to toggle the image size... sort of a zoom in/out effect?

</comment><comment><USER27> Just wondered how the population stats are measured? I.E. How do we actually know that there is this amount of people in the world?

Asia 4,221,013,428 Africa 1,056,035,237 Americas 947,209,798 Europe 738,356,924 Oceania 37,384,613

World 7,000,000,000

<comment><USER28> We don't, and even if we did, it changes on a minute-by-minute basis. This calls for a bit of suspension of disbelief.

</comment></comment><comment><USER29> It's interesting how they did it. I was assuming some javascript trick but it's really quite simple and elegant:

        #as1 {
          background-image: url('seven_asia.gif');
          height: 2110500px;
          width: 640000px;
        }

<comment><USER30> Thats how it loaded so dang fast.

</comment></comment><comment><USER31> i'm assuming i shouldn't try to print this at work?

<comment><USER32> Too late.

</comment></comment><comment><USER33> LIES! There's a link at the bottom of the first page that says "More..."

<comment><USER34> It's an indication to scroll to the right.

<comment><USER35> It's an indication to scroll to the right that masquerades as link to see more, then leaves you annoyed that it didn't work if you're actually foolish enough to try and click on a link to see more wee little people icons.

<comment><USER36> It's at this point that you realize you have better things to do with your life anyway.

<comment><USER9> Nah, I just scrolled to the right and forgot about any meaning or reason.

</comment></comment></comment></comment></comment><comment><USER37> "How big is this page?

Huge! The exact size depends on the screen resolution on your PC, but the page is almost 1 mile (1.6 Km) high and 800 feet (250 m) wide."

Wow - pretty crazy.

</comment><comment><USER38> 175,000 lines x 40,000 columns of a 16x20 pixel image.

That's a pretty impressive optimization in the browser, I'm fairly sure I don't have that much RAM.

</comment><comment><USER39> This idea could be improved by allowing people to "claim" their spot by logging into Facebook or Twitter, adding a face to an otherwise large number.

<comment><USER40> Charge them $2 each. That's worth a couple of millions at the very least.

</comment></comment><comment><USER41> This page makes my vertical scrollbar disappear when I go beyond ~70% of the page downwards. Chrome 24 on Windows 7, pretty common setup I'd say.

<comment><USER42> Me too, time for a chrome bug report.

</comment></comment><comment> martin-adams Sadly, I can't get them all to do the Harlem Shake.

</comment><comment><USER43> Who thought it was a good idea to color-code Asians with yellow?

<comment><USER44> ikr... and Africans are obviously colour-coded as black. They might as well have coloured Europeans in white (but I guess that wouldn't show up well on the already white background). I think there's a little bit of ethnicity generalization going on here which isn't really appropriate.

</comment></comment><comment><USER45> Anyone able to find me? I tried. It's really hard.

</comment><comment><USER46> reminds me of <http://www.theonemillioneuromap.com> ... in a way.

<comment><USER47> For the 1€ price tag per pin you think loading that website would take fewer than one million seconds.

</comment></comment><comment><USER48> Hmmm there's not a lotta people in Oceania

</comment><comment><USER49> Hey! I'm there! A little "blue" though.

</comment><comment><USER16> Tables! Gasp, my eyes!</comment>


Schumpeter's Ghost: Is Hypercompetition Making the Best of Times Shorter? - <AUTHOR> https://medium.com/pnr-paper/schumpeters-ghost-is-hypercompetition-making-the-best-of-times-shorter-e42c9c7e4769 <comment><AUTHOR> Hey i'm Antoine the author. Let me know if you have questions/comments. Happy to hear your thought since the format is a work in progress. Here's two good papers to follow up: 1- From MIT, Ricardo J. Caballero which covers the process of creative destruction in depth: [https://economics.mit.edu/files/1785](https://economics.mit.edu/files/1785) 2- From Yale, William D. Nordhaus: Schumpeterian Profits and the Alchemist Fallacy which states that most "profit" of new innovations go to consumer surplus: [http://economics.yale.edu/sites/default/files/files/Working-...](http://economics.yale.edu/sites/default/files/files/Working- Papers/wp000/ddp0006.pdf)</comment>


Covid-19 could kill the for-profit science publishing model - <AUTHOR> https://www.latimes.com/business/story/2020-03-03/covid-19-open-science <comment><USER2> Would anybody be upset about that? Well, apart from those that profit from such publishing models, I can't think or know of anybody else. But I'm open to input upon that as always.

<comment><USER3> Likely many older academics, just from the inertia.

</comment></comment><comment><USER4> Maybe it can also kill for-profit health care. A person can dream...

<comment><USER5> We share the same dream then :-)

</comment></comment><comment><USER6> _" Covid-19 could kill the for-profit science publishing model."_

If good things could come out of Covid-19 then this along with a ten to one- hundredfold speed up in the development of vaccines etc. ought to be among them.

That said, I've been around too long to know that a small percentage of the population are just too greedy to let that happen. Even if laws were rushed in to mandate that whilst it's fresh in everyone's mind, sooner or later they'll be usurped in the same way that late-19th Century anti-monopoly laws have been nuked these days.

Even though these old laws have already been on the statutes for over a century, these days no lawmaker or bureaucrat has the gumption or guts to enforce them against Big Tech.

If such a proposal were to ever get off the ground then tragically the same would happen all over again.

</comment><comment><USER7> > The data surrounding the biology, epidemiology and clinical characteristics > of the SARS-CoV-2 virus [the virus causing the current outbreak] have been > growing daily, with more than 400 articles listed in PubMed.

After reading dozens of media articles about this virus I still didn't find out what kills it reliably, except, maybe, alcohol. What about temperatures? What type of alcohol? Other disinfectants like chlorine? The media seems to be void of these details and mostly fuels worry and panic.

</comment><comment><USER8> Amen.

</comment><comment><USER5> At last

</comment><comment><USER9> Good!</comment>


Graphite Software Releases a New Android ROM for Nexus 5 - <AUTHOR> http://www.securespaces.com/WP2015/ <comment><AUTHOR> This also has Hidden Space Apps available from the Google Play store ... create a hidden virtual phone on your Nexus 5 [https://play.google.com/store/search?q=graphitesoftware&c=ap...](https://play.google.com/store/search?q=graphitesoftware&c=apps&hl=en)

</comment><comment><AUTHOR> Having a hidden Tor space on the device is one of the cool features of Secure Spaces but there are more things you can do as well. Check out the website for more details.

</comment><comment><USER2> Just flashed my Nexus.... test driving the Hidden Space now!

</comment><comment><USER2> Can I stay completely anonymous? Can I use one of these spaces for apps like Tor?

<comment><USER3> Check out the sample spaces link: [http://www.securespaces.com/WP2015/index.php/sample- spaces/](http://www.securespaces.com/WP2015/index.php/sample-spaces/)</comment></comment>


China Cuts Mobile Service of Xinjiang Residents Evading Internet Filters - <AUTHOR> http://www.nytimes.com/2015/11/24/business/international/china-cuts-mobile-service-of-xinjiang-residents-evading-internet-filters.html <comment><USER2> This is the kind of censorship and control that becomes very difficult to escape once activated. It seems imperative to me that anyone living in China who isn't already well off aught to consider having a backup plan in the event that communication with the outside world is completely disrupted.

This isn't the kind of move anyone should be taking lightly, more so for those directly in the country being cut off.

<comment><USER3> I have Satcom and HAM Radio as the backup, but I'm afraid they could be useless when law enforcements involved. A visa and plane ticket may be more realistic in the case.

<comment><USER4> >Satcom and HAM Radio

What is the punishment for being found owning/using that sort of equipment in China, if any?

<comment><USER5> I suspect that no one would care unless you do something evil (but nowadays people use the thing called internet). I found an active forum www.hellocq.net via a quick google search and there are >100 posts today.

</comment></comment></comment></comment><comment><USER6> The thing going on in Xinjiang that we're not supposed to know about is Tibet- style "internal colonisation" and almost certainly some "ethnic cleansing". However the censorship is good enough that it's hard to say accurately.

<comment><USER7> There has been two major attacks possibly related to Xinjiang lately. The 2014 Kunming attacks and the 2015 Bangkok bombings.

In Chinese perspective these are acts of international terrorism related to islamist jihad (ISIS, Al Queda etc.). And talk about Xinjiang seperation from China would be what we in the west call "hate speech" since it possibly would entail cleansing of Han-chinese from the region.

However this perspective is not shared by the west which is probably why the Chinese government cannot get the same services from Google and Facebook that countries like USA or France can when comes to censoring hate speech or get logs on suspected terrorist.

Hence they have to resort to more primitive ways.

<comment><USER8> Han Chinese were implanted in there to prevent Uyghur homogenity. So, why do "Anti-Terror" efforts involve force feeding muslims during the Islamic month of Ramadan? They have a Chinese flag affixed inside Masjids, and a lot more, but I'm sure you get the drift that not many of us are ignorant about the atrocities inflicted upon them.

<comment><USER9> "Force feeding muslims during the Islamic month of Ramadan" \--- Media Garbage. Only officers, teachers and students were disciplined, and I see no problems here. Religious practices are not allowed to paralyze public services. It's not new but had been a norm until extremists changed it.

Apparently, you're pro-Muslim and anti-Han. You may find a lot of brothers and sisters in Malaysia and Indonesia where the laws undisguisedly claim MALAY FIRST.

It's interesting that President Obama says nothing about this kind of extreme racist laws in his childhood residential country. Maybe he's pro-Muslim too?

You put a pair of quotes on "Anti-Terror" to show your anti-Han position given the facts that Han suffered most from the tension between the Government and Muslim Extremists. It's a clear sign that you're a media puppet.

China has a lot of "Affirmative Actions" against Han, including the birth control policy and Han people are furious about the situation.

Maybe some day, there will be a HAN FIRST government for you to criticize Han racists but not now.

<comment><USER8> I'm not anti-Han. I have family members who are Han. I'm only against oppression, be it in China, India or Pakistan.

I'm one of those that believes an individual should have the freedom to express themselves.

For what it matters, Han Chinese (urban) have historically been well-educated and get access to better jobs. If the Uyghurs (mostly rural) get decent education & opportunities, separatists' calls (and motivation) would die down.

</comment></comment></comment></comment></comment><comment><USER10> There's a part of me that can't believe that I live in an era where the authors of the article were directed to "the local cyberpolice" for questions. Sounds almost dystopian when I read it aloud.

<comment><USER11> [http://www.bj.cyberpolice.cn](http://www.bj.cyberpolice.cn) looks hilarious, I don't know why. Maybe the potted plants.

<comment><USER12> Or the identical cartoon police men and women!

</comment></comment></comment><comment><USER13> Xinjiang has been cut off from Internet for at least 11 months. It's seldom reported outside. Ppl even used dialups in landlines but soon get cut off again.

</comment><comment><USER14> Another day, another story of an Asian nation that deeply feers the personal expression and curiosity of its citizens. Thailand, Singapore, China... how privileged so many of us are, taking for granted that we grew up in a culture where that particular level of explicit distrust does not exist.

<comment><USER15> Except it's even worse, because in this particular case they're targeting an area full of ethnic minorities in a Han dominated china: [https://en.wikipedia.org/wiki/Xinjiang](https://en.wikipedia.org/wiki/Xinjiang)

The strong coercing the weak.

</comment></comment><comment><USER16> This is one area where China seems to be both the leader and trend setter. I wouldn't be surprised if this isn't being discussed in Western governments within the next 5 years unless trend changes drastically.

<comment><USER17> Generally these sorts of draconian measures seem to filter down from China, to the UK, then to Australia and New Zealand, Canada, and then the United States. From end to end it takes about 10 years.

<comment><USER18> curious of an example. Do you have one?

<comment><USER19> The list of blocked websites would be one such measure. It always starts with terrorists or some such and eventually filters down to local politics and whatnot.

<comment><USER20> Except there aren't blocklists in the US...

<comment><USER19> If you look at the progression, the US was listed after the rest. UK, Australia, etc. have all had big controversies over block lists and I think they're still working on implementing them in Canada.

<comment><USER17> Yep, the blocklist is just being implemented now in Australia.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> This isn't a new tactic. When visiting Beijing several years ago, I discovered that searches for sensitive terms would result in a dropped connection, with progressively longer reconnect delays for each additional action.

I imagine the permanent cutoff is a few steps up the scale of punishment.

</comment><comment><USER22> > The action also shows that despite spending billions of dollars to create > one of the world's most sophisticated Internet censorship and surveillance > systems, blind spots abound.

Does anyone here have a source that compares the reach of Chinese surveillance with the NSA and GCHQ?

<comment><USER23> Given how infamous US intelligence agencies are for being infiltrated by foreign agents, it's almost certainly a strict superset.

<comment><USER24> Infiltration gives you the ability to get to any bit of information you want. Not to all bits you need. Exfiltrating sizable amounts of data from US agencies is not so easy task, I would guess.

</comment></comment></comment><comment><USER25> What actions do I take as someone outside of China by a hemisphere or so?

Reading this just blows my mind. I've gotten my family and a few friends on Signal[0], but these types of things only help if you have basic access to the Internet.

What type of infrastructure future proofing can you do when it's such a centralized technology? I've been thinking about renewing my ham radio license again (no more Morse code!)

[0]: [https://whispersystems.org/](https://whispersystems.org/)

<comment><USER6> _What actions do I take as someone outside of China by a hemisphere or so?_

Absolutely none. But bear it in mind for the future.

<comment><USER25> If there is no action, then why even "bear it in mind"? Seems like you do think there is some preparatory action to take.

</comment></comment></comment><comment><USER3> The internet may be the least they worry about. Xinjiang is big hot dense mess since a few years ago, terrorists and extremists are not rare in Xinjiang. The current state is more likely in a war against terrorism.

<comment><USER8> Nice to term separatists as Terrorists. Uyghurs' have always wanted self- determination and are culturally different from the Han Chinese, hence the resettled Hans in Xinjiang to prevent ethnic homogenity in the region.

<comment><USER26> Aren't all "Terrorists" separatists. Like the terrorism is a means to an end (separation). I don't think there are any terrorists who exist soley to cause terror as their end goal.

Their are a fair few cultural differences in China (even just within the "han race" let alone the other "races"[0].

But I often play the thought experiment in my head: How would the US govt react to the Latinos or the African Americans wishing to create a seperate state within the US?

I don't really see it playing out that differently to what China are doing.

Is this just a case of "China has a problem that we (the US) don't, and look at them struggle with it!" kind of thing?

<comment><USER6> The US has quite a lot of practical political freedom at the state and even down to county level. Texas is politically different from California, Alabama different from New York. So pretty much the only remaining domestic terrorism is from white supremacists. The key question is "how would the US react to _white people_ trying to create a separate state within the US?

The US period of herding minorities into sub-states called "reservations" ended a long time ago.</comment></comment></comment></comment>


I built an OCR library in Ruby to help you win at Letterpress - <AUTHOR> http://wordhelper.net/contact

<comment><AUTHOR> I'd also like to point out mauricesvay's take on this: <https://github.com/mauricesvay/CheaterPress>. His implementation runs in the browser and is both simpler and faster than mine.</comment>


Evolution of Webdesign - <AUTHOR> http://fabianburghardt.de/webolution/ <comment><USER2> I really like Evolution of Webdesign. It captures the look of each year very accurately. As someone whose been making websites for 20 years it's delightfully nostalgic. A while ago I made a _really_ similar page - [http://time.ooer.com/](http://time.ooer.com/). The difference is that Evolution of Webdesign works by changing the HTML whereas mine uses the same HTML and only changes the CSS.</comment>


CERN migrates to open-source technologies - <AUTHOR> https://home.cern/news/news/computing/migrating-open-source-technologies <comment><USER2> Public funding of open source software is one of the most direct ways that government spending can grow the supply side of the economy. Taxpayers will directly benefit from the public domain technologies developed to replace the contracts CERN is moving away from. Software and science share an important economic trait, that once you produce them you can maximize their total impact by spreading them around as much as possible. That's an advantageous situation for public funding without IP restrictions, which is the model of academia.

<comment><USER3> Counter point: the more the government gets into funding OSS, they will essentially become a competitor to other software companies. Now the government both has the power and incentive to hinder private companies with rules and regulations.

I think that if the government needs OSS software for actual use by the government, then that's fine. Don't make the government become a competitor to private industry. Look how that turned out with Uber vs. Taxis.

OSS is just like anything in the free market. If people and companies want it that much, they will spend time and energy on it.

<comment><USER4> > Now the government both has the power and incentive to hinder private > companies with rules and regulations.

What incentive? In the scenario you describe, I don't see an obvious mechanism for the government to receive additional tax revenue as a result of funding OSS, and that's the usual mechanism for such an incentive.

I mean, I guess you could argue that tax revenues will tend to increase as the economy grows, but that seems like a case where the interests of the government are aligned with the interests of the nation(s) as a whole, which is generally considered a good thing.

</comment></comment></comment><comment><USER5> Disclaimer: I worked at CERN in IT for 5 years as staff.

CERN has never been a Microsoft organisation excepted in the head of management that was pushing for Microsoft solutions everywhere without success.

\- Scientific computation are done at CERN under Linux with the Root framework.

\- Most (all?) scientists uses OSx or Linux.

\- All computing clusters runs SC Linux or centos.

\- Most internal softwares: indico, EDH, landb, and other are running under Linux and are web based.

\- All DBs are OSS or oracle

\- All storages system are home made (EOS, Castor) or ceph based and run under Linux.

\- Data distribution is home made and based on a framework named xrootd under Linux.

\- Software distribution is also Linux based and run as a fuse module (cernVMFS)

\- Most systems services are UNIX C++ and Java for the control part.

\- CERN uses Openstack for virtualisation After the management pushed for Hyper-V and failed miserably.

\- Management pushed for SharePoint for years before the entire website switched to PHP and Drupal.

There si not real "Microsoft" at CERN excepted AD and phones. It is however a study case of bad management decisions in IT.

<comment><USER6> I'm not proud of it, but I worked on SharePoint at CERN IT. Some examples of how dysfunctional it was:

\- When asking about version control I was told that if I really wanted to use it I could have Visual SourceSafe 6.0 or something from way back in the nineties. It was basically CVS 0.1 alpha with a GUI, and I ended up learning Git instead.

\- I made sure all my changes worked on Firefox, because that's what I knew the physicists were using. My boss wanted me to support IE only, and after a heated discussion the quote which always haunted me was "We don't care about the physicists!"

\- A colleague lamented about having spent about a year developing some uber- flexible interface in SharePoint which would've been an order of magnitude simpler in other content management systems.

The rest of CERN is completely different, as indicated by cernguy.

I left a year into a two-year contract, and I'm happy to say I've not worked on a Microsoft platform ever since!

<comment><USER5> > The rest of CERN is completely different, as indicated by cernguy

Yes, that is also a thing at CERN.

Many other teams re-develop things internally (Linux based) because they could not trust or rely on IT management to do the right things.

That had a very perveted effect of internal duplication across teams and experiments.

</comment></comment></comment><comment><USER7> Since people don't read the article:

"The Microsoft Alternatives project (MAlt) started a year ago to mitigate anticipated software license fee increases. MAlt's objective is to put us back in control using open software."

"A prime example is that CERN has enjoyed special conditions for the use of Microsoft products for the last 20 years, by virtue of its status as an "academic institution". However, recently, the company has decided to revoke CERN's academic status, a measure that took effect at the end of the previous contract in March 2019, replaced by a new contract based on user numbers, increasing the license costs by more than a factor of ten. Although CERN has negotiated a ramp-up profile over ten years to give the necessary time to adapt, such costs are not sustainable."

<comment><USER8> Wow. Heads will surely roll once this reaches Satya's desk.

<comment><USER9> ...or the person gets promoted.

I previously worked for an enterprise analytics software provider whose success hinged on low-cost license agreements to schools and universities. Once the company became more successful commercially, it took the same tact-- substantially raising these fees in search of profitability. Today, the firm is under serious pressure from open source analytical libraries. The point being, what looks to be optimal in the short run may not be optimal in the long run, as future consequences could be anticipated but short term revenue growth was too tempting.

<comment><USER10> > same tact

"Tack", from sailing: changing direction lets you use the wind differently. Two boats on the same tack are using the same wind strategy.

My workplace currently teaches students several proprietary systems that are now old and clunky (and of course expensive). We want to switch to open source competitors, but the how and when are rather complicated to coordinate. It will happen eventually though.

<comment><USER11> he meant tact

</comment></comment></comment></comment></comment><comment><USER12> CERN had a major role in making kicad what it is today. they implemented tons of complex stuff that you normally only find in really expensive CAD tools.

Hope they can repeat that with a few more FOSS projects!

<comment><USER13> and you can donate to KiCad development via CERN: [https://cernandsocietyfoundation.cern/projects/kicad- develop...](https://cernandsocietyfoundation.cern/projects/kicad-development)

<comment><USER14> Aisler.net, a German boardhouse, makes a donation to kicad for every kicad designed pcb you order there and it's my favourite way to pay for open source.

They literally get paid the moment value is created from using their software. It's beautiful.

<comment><USER15> You aren't right! Aisler doesn't donate. The user can choose to donate.

From [http://www.kicad-pcb.org/about/kicad/](http://www.kicad- pcb.org/about/kicad/) "That is why AISLER allows its users to easily donate to the KiCad project during the ordering process."

<comment><USER14> True.

The donation is an item on the bill, they automatically set it and the user can change the amount.

</comment></comment></comment></comment></comment><comment><USER16> I worked support some hardware CERN used once. Fun guys to talk with / work with.

They call me up one day to note that one of their devices I supported had an accident and they were concerned they didn't know why. So they sent me photos.

This device had rows of modular cards installed in it. In the center of the device with two cards pulled out you could see that something had burred and even melted some of the surrounding cards. But it didn't look like any given card had failed as much as there was some sort of really hot fire ... that had been in the air between the cards or something. Now keep in mind this was just what a handful of photos looked like, so who really knows. Makes no sense that there was something floating in the air between the cards hot enough to do that thing ... but that is what it looked like.

Anyway it was like a good 100k+ in hardware burned up, possibly MUCH more as the full chassis held a lot more than that. So I promise them a new chassis and such and tell them to pack it up nicely and we will have a courier come and get it and send it to our QA team. The CERN guys promised not to expose the equipment to anymore micro black holes ;)

The process to send stuff to the QA team in strange situations like this was a painful series of steps. The QA team was BRUTAL about process (even if they never followed it themselves...). They also were a real pain to even email, but that was part of the process. Amusingly enough when I sent them the photos and explained it was CERN even the QA ultra dry guys cracked some good X-files references ;)

Still wonder what the hell happened to that equipment.

</comment><comment><USER17> It is awesome to see how CERN is supporting open source. They have been long time users of our open core GitLab with 12,000 users [https://about.gitlab.com/customers/cern/](https://about.gitlab.com/customers/cern/)

<comment><USER18> I visited CERN once in my role at GitLab. The scale of CERN and the level of people there is really impressive.

Many teams had implemented very complicated pipelines doing all sorts of things. Including using GitLab to design, validate and eventually produce hardware that was used in ATLAS.

</comment></comment><comment><USER19> I'm waiting for some of these documents being made public. I am working for a government institution that is making much of the same moves. Would be nice to see what an immense IT undertaking like this comes up with.

<comment><USER20> Are your org's documents public? I'd be excited to read about the practical effects of such deployment (from CERN too).

<comment><USER19> Ours is a more ad-hoc process than that. I work for Statistics Iceland. We are not changing OS or productivity suite (yet at least). Those that want Linux on their laptops get Ubuntu. We deploy Libreoffice alongside Office. Users using other statistical suites are encouraged to use R. On the infrastructure side we are making more use of Samba (one new DC, next up is migrating fileservers from old WServers over to Samba on Linux), just replaced Exchange with Kopano. We are an org of about 120-150 people/workstations.

<comment><USER21> How's the LibreOffice / MsOffice compatibility in practice?

Was thinking about this yesterday, and was curious how much functional coverage or issues there are with what people actually use it for.

<comment><USER22> Not the OP, but I tried to do a lot of work in Libreoffice Calc on XLSX files. I had a constant issue of Libreoffice not being able to handle >10000 rows, and actually crashing when trying to do something intense like vlookup.

<comment><USER23> I worked QA at a place that had huge CSV log files for a device. Sometimes the log files were slow to open in Excel, or just would not open at all.

I started using Jupyter and Pandas for my own work, just so I could get something done. I really liked it.

But the organization was moving even more in the MS direction, I'm sure any thought of Pandas died after I left.

Try something like that if you can.

</comment></comment></comment></comment></comment></comment><comment><USER24> >...increasing the license costs by more than a factor of ten

When I hear stories like that I always wonder what was the thought process of the sales people that managed that account. Probably something like that:

\- Hey, do you remember our old customer CERN, a world-famous scientific non- profit organization that pushes the boundaries of human knowledge about the universe?

\- Yeah, what about them?

\- Let's charge them 10 times more for our software licenses

\- Can't see anything wrong about it, go ahead

</comment><comment><USER25> I think this was posted at the time. It's worth saying that CERN have been massive open source users for decades

<comment><USER26> It's also worth noting that CERN has been running (not just using!) many open source projects since way back. Geant, madx, root and cling come to mind.

</comment></comment><comment><USER27> Also see the comments last time this was posted: [https://news.ycombinator.com/item?id=20166070](https://news.ycombinator.com/item?id=20166070)

and what I said last time:

I'm honestly pretty happy about this. I'm hoping that by aiming to replace the commercial products they use with opensource alternatives, the alternatives leave with a better polish and user experience. I also see CERN as an institution that is willing to hire the devs needed to maintain / support a project.

</comment><comment><USER28> Does this mean that no scientist at CERN can use applications like Mathematica? Or is this just focusing on essential foundation software like operating systems (moving away from Windows)

<comment><USER29> While some rely on Mathematica most at Cern uses ROOT for data science. The impact on the science program is more likely to come from ditching Oracle databases and LabView... That said, this is an IT department initiative, users also have access to software from their home institutes.

<comment><USER30> Is there any reliable and good opensource alternative of LabView ?

<comment><USER31> I would argue any dynamic programming language is a good alternative to labview. I'm a proponent on using python for labautomation (we run workshops at some major optics conferences, see [http://python4photonics.org](http://python4photonics.org) for an unfortunately somewhat out of date summary about some of what we do). In my experience labview is a mess, it's only momentum (in particular drivers provided by vendors, but that is changing) that keeps it going. I find labview code developed by amateurs is an unmaintainable mess. Grad students pass along code from on generation to the next without anyone daring to fix some of the glaring bugs. Really use anything but labview, even if it's the buggy matlab instrument toolbox.

<comment><USER32> Exactly. Labview is a mess anytime more than one person has to maintain a codebase. Source control tools are absolutely KEY to using any language for automation. Which mostly rules out Labview.

Do you have any more workshops/hackathons scheduled?

<comment><USER33> I know I'm late to the discussion, but I've worked on a very large LabVIEW program with ~10 active developers and source control was extremely important. But I'm talking about SVN with the option to lock files. If by source control you mean "distributed, file merge-based" source control like git, than I would agree there aren't good options for LabVIEW. But a central repo with file locking, small changes and LabVIEW graphical diff worked fine.

</comment></comment></comment></comment></comment></comment><comment><USER34> While this post is referring to desktop/server software, CERN are also using open source platforms in some of their experiments: they recently re-performed some of the 2012 analysis that led to the discovery of the Higgs boson, on top of Kubernetes.

Adam and I spoke to a computer scientist and two physicists from CERN for our podcast, and you might like to listen if you like physics or software.

[https://kubernetespodcast.com/episode/062-cern/](https://kubernetespodcast.com/episode/062-cern/)

</comment><comment><USER35> That's kind of ironic. I was doing paid contract work in 1994 (on Linux!) that involved customizing the open source CERN httpd server (before Apache existed, or loadable modules in a web server).

</comment><comment><USER36> Matrix would be a good fit for most research institutions, allowing cooperation trough federation. Heck, even Mastodon could be interesting, and ActivityPub as a transport layer for publications.

However, one issue is that small institutions cannot afford to self-host everything, or make the necessary adjustments themselves. I wonder if CERN and other big institutions could perform some heavy lifting (and maybe provide some shared services, hosting servers, etc.) without necessarily centralizing everything like it is done nowadays.

<comment><USER37> I'm a big Matrix fan but am curious about what options they have for integrating and managing it in a typical enterprise environment. For example:

-what happens for stuff like user management with Active Directory etc? -what happens for things like FOIA requirements considering it is e2e encrypted?

<comment><USER38> Matrix doesn't E2E encrypt everything, only certain rooms. It's not currently possible, but I suppose there's no technical roadblock to making a server prevent access to E2E encrypted rooms to meet FOIA requirements.

As for user management, synapse has identity servers and password providers to form a complete authentication solution. mxisd[0] is a service that uses both to offer LDAP authentication, although it seems dead with no real replacement.

[0] [https://github.com/kamax-matrix/mxisd](https://github.com/kamax- matrix/mxisd)

<comment><USER39> So Matrix has a bunch of enterprise integration support either in existence or in the making.

In terms of audit compliance for E2EE, there are three main options:

a) Turn it off (as per the parent post); there isn't a button for this in synapse but would be possible to add, albeit technically an abuse vector given it is effectively a downgrade attack.

b) Add an audit user to rooms which need to be 'on the record'. This is our preferred solution, as it makes it crystal clear to users as to which conversations are on the record (and whose record!) and which aren't. One could run such a user via a client like [https://github.com/matrix- org/pantalaimon](https://github.com/matrix-org/pantalaimon), and have the server autoinvite them into rooms which need to be recorded.

c) Add an audit (aka ghost) device to users who need to be 'on the record'. For instance, you could use pantalaimon to log in as a given user and record their messages. The audit device will appear in the E2E devices for the user, and once cross-signing lands, could be signed by the user (or their sysadmin) to be trusted. However, we're not keen on ghost devices in general - we've built all of Matrix's E2EE trust model to protect users against unexpected devices being present in their rooms, so we'd recommend audit users instead.

In terms of LDAP integration - there are more and more enterprise integration options appearing; for instance, ma1sd is a maintained fork of mxisd, and we're working on better LDAP bridging for Matrix in general. We want Matrix to work in an enterprise environment, so if people see stuff missing, please yell.

</comment></comment></comment></comment><comment> sh-run I'd like to see more done in the open networking space. Cumulus Linux was talked about a ton just a few years ago, but it seems like I haven't heard about it as much lately. Probably because Juniper and Cisco have (mostly) managed to catch up on the automation front.

I couldn't find anything concrete on the CERN website, but in their virtual DC tour I noticed HP Procurves as top-of-rack switches. I was really hoping to see whitebox switches.

</comment><comment><USER40> I came across a white paper years ago (2012/2013 ish) on how they used Icinga (An early but rapidly growing Nagios fork) and mod-gearman to monitor their ATLAS computing farm. At the time, as a newly appointed sysadmin, I was looking in to possible solutions that could scale well myself and their usage was very inspiring. Eventually deploying something similar where I'm still working now.

[https://cds.cern.ch/record/1455464/files/ATL-DAQ- PROC-2012-0...](https://cds.cern.ch/record/1455464/files/ATL-DAQ- PROC-2012-014.pdf)

</comment><comment><USER41> Good idea but

> Needless to say, isolated initiatives will waste effort and resources.

If the centralized procurement approach is what put everyone in the current mess, what indication is there that a centralized approach to open source won't produce the same issues?

I personally wonder why commit to open source in a centralized manner vs commit to interoperable standards (but not the specific tools used to speak to the standard).

<comment><USER42> jury probably still out, and no direct insight, but the overall incentives/philosphy driving acquisition for each could theoretically be drastically different (e.g. optimizing for openness, community, xyz instead of vendor size, ability to negotiate discounts, etc)

</comment></comment><comment><USER43> E-mail and ip telephone migration to start... doesn't seem like a big deal but they have been with Microsoft for 20 years.

<comment><USER29> When I worked there, they had 10k+ active user accounts and a wealth of systems integrated into Microsoft active directory. The nature of CERN also means that multiple institutes around the world will have to adapt their systems when CERN changes.

</comment></comment><comment><USER44> Is there a public-facing list of project activities?

</comment><comment><USER45> I suspect this is specifically targeting Windows. I think this would be a good idea for anyone really. I don't know whose or which decision brought MS into this mess, but this isn't a sustainable OS for the future.

Our company still relies on it, but any new piece of software has to be platform independent. Licensing income probably skyrocketed on MS end, but I don't think they made any friends with W10.

Maybe MS is correct that W10 will be the last Windows. But maybe not because of rolling releases.

Anyway, good news and the correct strategy in my opinion.

<comment><USER46> As long as schools use Windows, it won't die.

<comment><USER47> Businesses aren't using Windows because schools use it (I think Chromebooks and iPads are more popular among schools now than Windows machines because children can trash a PC easily). They use it because of a long tail of software applications that only run on Windows, they use it because of stuff like Group Policy and Active Directory, they use it because of a lot of things that Linux doesn't do as well.

<comment><USER48> Don't forget MS Office. That's microsoft's real crown jewel, and it only runs on windows, or much more expensive macs.

</comment></comment></comment></comment><comment><USER49> Are they using Linux instead of Windows already?

<comment><USER50> There's a mix of linux, windows and mac OS machines, depending on the use-case and/or user-preference. This won't change.

</comment></comment><comment><USER51> CERN is not a university and has no student, it's entirely justifiable for Microsoft to not give them a university discount.

Universities have thousands of students that do not generate any revenue. The standard licensing model per person or per computer totally breaks down in that case, asking for a huge bill based only on the sheer amount of users. Education discounts are adjusting for that, large user bases with no money to pay.

That being said. The CERN is a government entity. They should argue to be given government discount.

<comment><USER50> > Universities have thousands of students that do not generate any revenue. > The standard licensing model per person or per computer totally breaks down > in that case, asking for a huge bill based only on the sheer amount of > users.

There are thousands of students, postdocs and academics with CERN computing accounts (way outnumbering employees). It's not like they're generating revenue either.

> They should argue to be given government discount.

They did, IIRC, but their status as an IGO didn't cut it with Microsoft.

<comment><USER51> IGO: [https://en.wikipedia.org/wiki/Intergovernmental_organization](https://en.wikipedia.org/wiki/Intergovernmental_organization)

Honestly, it looks like the terms and licensing are being dictated by some dude(s) from Microsoft in the US, based on US norms. The way academy/university/research is organized and operated in Europe is fairly different. Bet Microsoft doesn't mind the added money either.

If the CERN were playing by US rules, they would be suing Microsoft to be recognized as a government or academic entity.

</comment></comment></comment><comment><USER52> That moment when left-pad creates a black hole on earth

</comment><comment><USER53> Wait. Why the fuck is there a cern TLD? Are ICANN naming TLDs after specific organizations now?

<comment><USER50> Basically yes: [https://icannwiki.org/Brand_TLD](https://icannwiki.org/Brand_TLD)

I agree with the move away from .ch, since it's an international organisation, but .int would have been the correct choice IMO

<comment><USER53> I expect nothing, and I'm still let down.

</comment></comment></comment><comment><USER54> My gut says this is related to forced updates and unwanted interface changes in current Microsoft products. It's been super annoying where I work, and staff are pretty upset.

<comment><USER47> I mean, they list a pretty compelling reason from their point of view: Microsoft changed their licensing terms from academic to business licenses, which are more expensive.

I suspect they will discover over time that the fully loaded costs of switching are higher than the costs of the licenses, unless this is just a way of trying to leverage MS into giving them academic licenses again.

<comment><USER55> They say that the licensing costs increased by "by more than a factor of ten".

Given that figure, do you really think that one-time project implementation and switching costs amortized over the next X years + ongoing support would really come to more than 10x? How do you make such a strong claim that easily, any prior examples?

Not saying you're obviously wrong or that CERN is obviously right, but this seems to be a much harder call (and intuitively feels right in fact), given the number.

<comment><USER47> There was a push in Germany to migrate to Linux, and they eventually gave up on that, so yeah, there are some prior examples.

[https://www.techrepublic.com/article/end-of-an-open- source-e...](https://www.techrepublic.com/article/end-of-an-open-source-era- linux-pioneer-munich-confirms-switch-to-windows-10/)

[https://www.theregister.co.uk/2018/07/27/lower_saxony_to_dum...](https://www.theregister.co.uk/2018/07/27/lower_saxony_to_dump_linux/)

<comment><USER56> Do you know why they gave up? Did Linux not work for them? Or were they persuaded by the MS sales team?

<comment><USER57> I guess it's a little bit of both. First mistake they made was that they tasked local contractors (think O(1) people) with forking their very own linux distro from Ubuntu. Then they put a lot of ressources into the KDE3-fork which was made to look like Windows NT (because they were migrating from that in 200x and you know the secretaries for life...). In the end they wondered why all their application software was old and buggy and I suppose from the whole project there was no significant contract work upstreamed (think LO performance patches...). Also being 1% of the market apparently does not entice any competition in the public software (think access-frontends in VB6@1000€s per place) market.

Given this, some years ago, the mayor changed, Accenture did a 'cost' study and MS moved its german HQ to the city.</comment></comment></comment></comment></comment></comment>