Evaluating the Search Phase of Neural Architecture Search - <AUTHOR> https://arxiv.org/abs/1902.08142 <comment><USER2> This is a really nice paper which asks some critical questions for the future of NAS research.

However, it's important to note that this paper doesn't show that NAS algorithms as originally designed, with completely independent training of each proposed architecture, are equivalent to random search. Rather, it shows that weight sharing, a technique introduced by ENAS [1] which tries to minimize necessary compute by training multiple models simultaneously with shared weights, doesn't outperform random baselines. Intuitively, this makes sense: weight sharing dramatically reduces the number of independent evaluations, and thereby leads to far less signal for the controller, which proposes architectures.

The paper itself makes this fairly clear, but I think it's easy to misinterpret this distinction from the abstract.

[1] ] H. Pham, M. Y. Guan, B. Zoph, Q. V. Le, and J. Dean. Efficient neural architecture search via parameter sharing. ICML, 2018.

<comment><USER3> Thank you for pointing that out! I did misinterpret that part of the abstract!

On a perhaps related note, it seem a bit surprising to me because when I first started with neural networks about a year ago, I tried to shortcut hyperparameter search by reusing weights and noticed that independently trained models with the same hyperparameters would produce model with different performance. I naively assumed that such correlation is something I don't want and it was something that everyone knows about so I just moved on.

Edit: typo (pointed --> pointing)

<comment><USER4> I've noticed this too. I've got a paper coming up on the arxiv soon that discusses this phenomenon, and structured random architecture search, in the context of semantic segmentation networks.

</comment></comment></comment><comment><USER5> > On average, the random policy outperforms state-of-the-art NAS algorithms.

Ouch... I guess random policy _is_ the state-of-the-art then, no?

</comment><comment><USER6> The problem with neural architecture search is that we don't know what to optimize on. We need some kind of topological understanding of the data to help build algorithms that can optimize performance. Clearly passing in error rates is not doing the trick

<comment><USER7> I agree, I've been thinking about this too. Do you want to work together on this?

</comment></comment><comment><USER8> Should this be a cause to correct affected papers? If not corrected, maybe even retract?

I understand that there is still clear value in these papers (defining search space, achieving state of the art).

But it does seem, there is some partially broken science there (not evaluating against baselines, algorithm that performs same as a random baseline).

</comment><comment><USER9> I wish they wrote more about how the search space is created. There is appendix A that talks a little bit about search space representation, but doesn't give any details about how the search space is created in the first place. Is it choosing the architecture from a set of given manually created architectures or is it actually creating them at random?

There are some references to other papers so perhaps the details are those papers.

</comment><comment><USER10> Yo dog, we heard you like neural architecture search, so we wrote a NAS for your NAS so you can optimize your hyperhyperparameters while you optimize your hyperparameters.</comment>


Steve Jobs' Plans to Disrupt the Textbook Industry - <AUTHOR> http://www.hackeducation.com/2011/11/07/steve-jobs-plans-to-disrupt-the-textbook-industry/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+HackEducation+%28Hack+Education%29 <comment><USER2> >Why spend $149.99 on a Biology textbook that only has 3 chapters you need?

Unfortunately, that's not how textbooks are written. Unlike music albums, where an artist invent 1, 2 or even 3 good songs, and then must fill the album with lesser songs, most chapters in a textbook are needed.

Further, chapters of a textbook are often related or dependent on each other; it's doesn't make much sense to buy selected chapters from textbooks.

<comment><USER3> Not true in the slightest. Many chapters in textbooks used post-secondary education institutes are either regurgitating things you already knew from pre-req classes or things you don't need (i.e. not part of the course curriculum).

While in theory you're right, in practice I find that I rarely use more than half of any textbook in a single given class (less, if multiple textbooks are assigned).</comment></comment>


Ask HN: What color do you recommend for a physical product? - <AUTHOR>

One of our businesses is a hookah shop, where we manufacture a portable style hookah (http://hobohookah.com).  Our first one was silver, the second one black and now we want to add 1 or 2 new colors.
What are your favorite product colors?  Couple of rules: 1) I need a Pantone Code, if at all possible. 2) Extra points if the color was implemented on anodized aluminum.
Our product uses the same aluminum anodizing process to add color as Apple does for its iPods.  If anyone has the Pantone Codes for Apple's current product lines, those would be helpful!
Thanks! <comment><USER2> The most popular color for Dell laptops after they added the custom case color option was pink, by far.</comment>


Rai Stones - <AUTHOR> https://en.wikipedia.org/wiki/Rai_stones <comment><USER2> > The monetary system of Yap relies on an oral history of ownership. In the > case of stones that are too large to move, buying an item with one simply > involves agreeing that the ownership has changed. As long as the transaction > is recorded in the oral history, it will now be owned by the person to whom > it is passed

> The extrinsic (perceived) value of a specific stone is based on not only its > size and craftsmanship, but also its history. If many people—or no one at > all—died when the specific stone was transported, or a famous sailor brought > it in, the value of the rai stone increases by reason of its anecdotal heft.

So, it's Bitcoin.

<comment><USER3> Its a ledger but that's about it. Its not distributed, decentralized or permissionless.

<comment><USER2> The "oral history" part makes me think the "ledger" exists in the collective memory of a community. Plus, the value is purely defined on how hard the artifact was to get, not on any kind of intrinsic utility.

<comment><USER4> So not a million miles away from Gold then

<comment><USER2> Gold has some intrinsic utility. Even before electronics, it was useful as a visible display of wealth and power, which did have very tangible value.

<comment><USER5> And the whole malleability thing

</comment></comment></comment></comment></comment></comment><comment><USER6> Keep this in mind when people claim that money is a modern invention, that it dates from the Copper Age or later, or that it's dependent on the existence of states.

<comment><USER7> ....it's really a stretch to call these stones "money."

Yes, they represent value, but other than that they practically immobile, non- portable, non-fungible, and work entirely via word of mouth and rely on human honesty...perhaps it's more appropriate to call it proto-money.

<comment><USER8> It's proto-banking, eh? They skipped the earlier phases of finance.

It reminds me of the aliens in Douglas Adams' who, having fifty arms, are the only species to invent under-arm deodorant before the wheel.

<comment><USER6> Probably hard currencies started out as debt and title systems like the rai stones.

If you look at a pidgin English dialect like Nigerian pidgin, and compare it to British English or for that matter Nigerian non-pidgin English, you might assume that pidgin English was the original form, since it's simpler, and that British English evolved from it. But in fact the truth is the opposite: pidgin English is a simplified version of English developed as a _lingua franca_ for international communication.

The same seems to be true of hard currency and especially barter. Hard currency is pidgin banking; barter is pidgin hard currency. Rai stones show us the complexity of social arrangements surrounding money that in a homogeneous culture within a generation or two, but which are only legible to someone who grew up in the culture to which that money belongs. In Yap this heritage has been preserved, although diminished in importance; elsewhere it has been mostly lost.

Hard currency is sufficiently simple to bridge cultural gaps and even gaps between ages, like pidgin English or Glosa.

[https://en.wikipedia.org/wiki/Debt:_The_First_5000_Years](https://en.wikipedia.org/wiki/Debt:_The_First_5000_Years)

<comment><USER8> That book is on my list to read.

One of the most interesting things I've heard about money is what Giordano Bruno (1548 – 1600) supposedly said: "Whatever has the greatest value and the least cost of storage becomes money."

<comment><USER9> it's a good book, but the earlier chapters regarding tribal economics and the valued currency being tribal women themselves is questionable from a truth standpoint.

Tribes traded people for goods and services, sometimes temporarily. It was mostly a sex and politics thing, but the book views it as a form of currency bartering and trade; I think there is more nuance there.

</comment></comment></comment></comment></comment></comment><comment><USER10> Nano (the cryptocurrency) was originally named Raiblocks after these.

<comment><USER11> And I can see why "In one instance, a large rai being transported by canoe and outrigger was accidentally dropped and sank to the sea floor. Although it was never seen again, everyone agreed that the rai must still be there, so it continued to be transacted as genuine currency".

<comment><USER12> Interestingly this is the reason why the first Raiblocks wallet was named canoe. [1]

[1] [https://getcanoe.io/](https://getcanoe.io/)

</comment></comment></comment><comment><USER13> I find these stones fascinating. You might be interested in this NPR article: [https://www.npr.org/sections/money/2011/02/15/131934618/the-...](https://www.npr.org/sections/money/2011/02/15/131934618/the- island-of-stone-money)

<comment><USER14> It's a good read with a little more color than the Wikipedia piece.

</comment></comment><comment><USER14> Humans are wonderfully crazy at times. This really tickled me.

Excerpt (one of the details that delighted me):

 _The extrinsic (perceived) value of a specific stone is based on not only its size and craftsmanship, but also its history. If many people—or no one at all—died when the specific stone was transported, or a famous sailor brought it in, the value of the rai stone increases by reason of its anecdotal heft._

<comment><USER15> Well, there's the stock market.

<comment><USER14> Not the kind of reply I expected and utterly fails to be a setup for the joke I wanted to make about not being human myself and just being here on your planet to do the field study portion of my degree in _Human Studies._

</comment></comment></comment><comment><USER16> I believe the Disappointment Islands have one of these [1], in a community of ~40 inhabitants.

[1] [http://www.bbc.com/travel/story/20190319-a-journey-to-the- di...](http://www.bbc.com/travel/story/20190319-a-journey-to-the- disappointment-islands)

</comment><comment><USER17> Money Mischief: Episodes in Monetary History by Milton Friedman is a great read about this and similar topics.

[https://www.goodreads.com/book/show/97822.Money_Mischief](https://www.goodreads.com/book/show/97822.Money_Mischief)

</comment><comment><USER18> "Economist Milton Friedman has compared the monetary role of the stone money to the reserves of gold held in Fort Knox for foreign governments"

</comment><comment> ur-whale Very few people actually understand money (what it is, how it works), and the Yap stones are a perfect reminder of that fact.

And unfortunately, the few that do use that knowledge in a profoundly irresponsible way (e.g. QE)</comment>


My int is too big - <AUTHOR> http://www.tedunangst.com/flak/post/my-int-is-too-big <comment><USER2> Some of this comes about from the choice of LP64 (32 bit ints on 64 bit platforms[0]). There seems no sensible reason why ints are 32 bit on a 64 bit platform, it only introduces inefficiency[1] and these kinds of problems.

The one argument I've seen is there would be no 32 bit type (since the next smallest integer, ie. short, would be 16 bit), but a compiler could easily have a __builtin_int32 mapped to C99 standard int32_t etc.

In C code that we write, we have a rule that every use of plain 'int' must be justified - it's a "code smell". Most places where 'int' is used should be replaced with 'size_t' (if used as an index to an array), or a C99 int32_t etc.

[0] [https://en.wikipedia.org/wiki/64-bit_computing#64-bit_data_m...](https://en.wikipedia.org/wiki/64-bit_computing#64-bit_data_models)

[1] [https://gist.github.com/rygorous/e0f055bfb74e3d5f0af20690759...](https://gist.github.com/rygorous/e0f055bfb74e3d5f0af20690759de5a7)

<comment><USER3> _In C code that we write, we have a rule that every use of plain 'int' must be justified - it's a "code smell". Most places where 'int' is used should be replaced with 'size_t' (if used as an index to an array), or a C99 int32_t etc._

I completely disagree (except with the size_t bit - I agree with that). In my view, it's usages of int32_t and similar that should be justified: why you do you need _exactly_ 32 bits and 2s complement representation - why does _at least_ 32 bits and unspecific representation not suffice?

<comment><USER4> > why does at least 32 bits and unspecific representation not suffice?

Because that doesn't help you. Static reasoning becomes harder. Dynamic checks (pretending the exact size is unknown) are possible but .. the exact size _is_ statically known (just not to the programmer). It is a waste.

The sentiment is right, but the solution is metaprogramming, not unhelpfully underspecified types.

</comment></comment></comment><comment><USER5> Whenever I get back into Clojure and use type hinting, I usually forget that Clojure doesn't allow ints, only longs. Kind of a strange choice given the JVM supports signed variants of the common word lengths. But then I read articles like this.

I'm a pretty high-level language user (read: I don't do C, et al), so when I read stuff like this it always makes me cringe and be happy Hickey decided to keep it simple. 64 bits, everywhere! (God save us when things go to 128)

<comment><USER6> > God save us when things go to 128

That will take a while. And even then, people will likely keep using 64 bits for most things.

<comment><USER7> I doubt we'll ever have more than 2^64 bytes of RAM, so that will probably never happen.

(Please don't make the obvious reply.)

<comment><USER6> Even if we have more than 2^64 bytes (that's 16 EB, not really an astronomical amount) of RAM, it's not obvious that the optimum way to use them will be by placing everything at the same address space.

<comment><USER8> Yea i'd fully expect something like PAE to be more useful and common. Even if something is using more than 16EB of ram, i can't imagine it'll be a single process and instead it'll be larger distributed system instead, leaving each process smaller than that. Just filling up 16 EB of ram right now would take:

        < simcop2387> farnsworth: eta[16 EiB, 19200 MiB/s] - #now# -> "years"
        < farnsworth> simcop2387:  2177.63532452879 years

based on marketing info on DDR4. So at the very least it's going to take a while before we even have to worry about a max of 16EiB in address space.

</comment></comment></comment></comment></comment><comment><USER9> i actually realized that the original fix to the int overflow was UB, not tim.

as usual, tim gets all the credit ;)

(i mean, he did send the email)

</comment><comment><USER10> I have to say this article is writing about topics leagues ahead of the average computer user but in a way they could (well...most of them.) understand.</comment>


How to make the Smart Home less "stupid" - <AUTHOR> https://eengenious.com/how-to-make-the-smart-home-less-stupid/ <comment><USER2> My solution: Transceivers that can be reconfigured – automatically, under firmware control -- to respond to the detected wireless standard integrated with these wireless microcontrollers (see [http://goo.gl/8K3hdM](http://goo.gl/8K3hdM)), would solve the interoperability problem.

</comment><comment><USER3> Original: [http://www.digikey.com/en/articles/techzone/2015/oct/wireles...](http://www.digikey.com/en/articles/techzone/2015/oct/wireless- microcontrollers-enable-the-smart-home)

</comment><comment><USER4> besides interoperability, there are security and reliability issues</comment>


Password security in Deus Ex - <AUTHOR> http://qntm.org/smashthestate <comment><USER2> Excellent analysis of truth in fiction.</comment>


Microsoft Sales Decline 6% from a Year Ago - <AUTHOR> http://techcombo.com/microsoft-sales-decline-6-from-a-year-ago

<comment><USER2> Interesting, the GDP also shrank by 6%. Is MS's monopoly a good economic index? It's probably a lagging indicator, but interesting never the less.</comment>


ZeroMQ 4.2.0 - <AUTHOR> https://github.com/zeromq/libzmq/releases/tag/v4.2.0 <comment><USER2> I'm confused. I thought 0MQ had essentially been superceded by nanomsg [0]. What's the deal?

On a related note, using nnpy [1] and mangos [0] have been a real pleasure.

And lastly, a bit of info on how 0MQ and nanomsg differ [3].

[0] [http://nanomsg.org/](http://nanomsg.org/) [1] [https://github.com/nanomsg/nnpy](https://github.com/nanomsg/nnpy) [2] [https://github.com/go-mangos/mangos](https://github.com/go-mangos/mangos) [3] [http://nanomsg.org/documentation- zeromq.html](http://nanomsg.org/documentation-zeromq.html)

<comment><USER3> A postmortem on nanomsg begs to differ: [http://sealedabstract.com/rants/nanomsg-postmortem-and- other...](http://sealedabstract.com/rants/nanomsg-postmortem-and-other- stories/)

<comment><USER4> After that, Garrett D'Amore eventually returned on condition he be BDFL. See [https://github.com/nanomsg/nanomsg/issues/619](https://github.com/nanomsg/nanomsg/issues/619)

Since then the project looks to be fairly healthy.

<comment><USER2> Oh good! This is the guy behind mangos, too.

</comment></comment></comment></comment><comment><USER5> I've been seeing the occasional post from his blog about the choice to die but didn't connect them to ZMQ until I saw this.

ZMQ, as a library, is a work of art and Code Connected is by and far one of the best programming books I have had the pleasure to read. That, coupled with the deep and interesting posts on his blog show we have lost a truly great mind.

</comment><comment><USER6> "Tell them I was a writer.

A maker of software.

A humanist. A father.

And many things.

But above all, a writer.

Thank You. :)"

\- Pieter Hintjens [http://hintjens.com/](http://hintjens.com/)

<comment><USER7> If you're just learning about ZeroMQ (or just reading this post) - I suggest taking some time to read or listen to some of Pieter Hintjens blogs/book/talks.

It's a wonderful experience and he seemed like a great/genuine dude.

<comment><USER6> I think I will use PC3[0] in my next project. Seems like an easy and sane way to structure repos.

[0] [http://hintjens.com/blog:23](http://hintjens.com/blog:23)

<comment><USER8> How would you review PC3 versus C4? It seems like C4 ([https://rfc.zeromq.org/spec:42/C4](https://rfc.zeromq.org/spec:42/C4)) is the latest evolution of this design. It seems to embrace optimistic merging even more than PC3 and does away with reviewers.

<comment><USER6> Hm, like he wrote it, it seems to be the other way around

"The Pedantic Code Construction Contract (PC3) is an evolution of the GitHub Fork + Pull Model, and the ZeroMQ C4 process..."

<comment><USER8> That's a good point. I was basing it on dates I could find and what I've been reading in Social Architecture. Perhaps the latest C4 is later and PC3 is smack in the middle

</comment></comment></comment></comment></comment></comment><comment><USER9> I haven't used zeromq in forever, but did they ever fix the problem with request/reply sockets where the server socket could get into an indeterminate state after a client socket drops at just the wrong time?

<comment><USER10> Nope. The reality is that ZeroMQ is useful for a variety of tasks but doesn't really excel at the tasks for its specific socket types anymore. He offers a heart-beating pattern to get around this issue for Req/Rep sockets though.

For pub/sub Aeron is now _much_ better (way more throughput and doesn't crash at multi-gigabit rates like OpenPGM). For REQ/REP HTTP/2 and other QUIC-based approaches are reigning supreme (if you need high performance across a WAN then you can repurpose something like FIXT 1.1 from the FIX protocol).

<comment><USER11> > For REQ/REP HTTP/2 and other QUIC-based approaches are reigning supreme

Oh? I implemented something recently using req/rep using pyzmq and then ported it to grpc. grpc was an order of magnitude slower. Then I updated the zeromq code to do pipelining via router/dealer and that was even faster.. by sending pipelined batches of 100 items it can do 160k lookups/second. grpc+batching I think maxed out around 20k.

Could have been protobuf that was the cause of the performance hit though.

<comment><USER12> gRPC is and certainly will never be the fastest protocol for small request/reply messages. The reason is the stream multiplexing layer that is required for it. You almost certainly need to copy data from the connections receive buffer into a streams receive buffer into the application and the opposite for the sending side.

If you don't have the stream multiplexing and just write complete request or response packets to a connection (similar to Thrift) you save quite a lot of overhead.

However this multiplexing feature is also the biggest upside and achievement of gRPC, since it enables you to stream big requests or responses and not only small packets. And it enables multiple big streams (file uploads, etc.) in parallel over a single connection without one blocking another. And of course it enables flow-controlled bidirectional streaming IPC, which can not be found in other systems.

<comment><USER11> Well the underlying thing I am doing is small request/reply messages - I'm doing metadata lookup for ip addresses. The way I sped things up with zeromq was first by batching requests. Essentially, if I have 10k lookups to do, instead of sending 1 at a time, I group them into blocks of 100 and send

        ' '.join(block)

Then I do all the lookups on the server and send a block of responses back. This turns what would be 10k queries into only 100 rpc calls.

That got me to about 60k lookups a second locally, but over a wan link that dropped down to 10k. I fixed that by implementing pipelining using a method similar to the described under [http://zguide.zeromq.org/page%3Aall#Transferring- Files](http://zguide.zeromq.org/page%3Aall#Transferring-Files) where I keep the socket buffers busy by having 10 chunks in flight all the time.

That got things to 160k/s locally and 100k+/sec even over a slow link.

I'll have to mess with grpc a bit more. Looking at my grpc branch it looks like I tried using the request_iterator method first, then I tried a regular function that used batching, but I didn't try using request_iterator with batching. I think the biggest difference would be if request_iterator uses a pipeline, or if it still only does one req/reply behind the scenes.

I'm sure one thing that doesn't help is that

      message LookupRequest {
        string address = 1;
      }
      message LookupRequestBatch {
        repeated LookupRequest requests = 1;
      }

Ends up as a lot more overhead than doing ' '.join(batch)

</comment></comment></comment></comment></comment><comment><USER13> Who took over zmq after Hintjens' untimely death?</comment>


Windows has fallen behind Apple iOS and Google Android - <AUTHOR> http://www.zdnet.com/windows-has-fallen-behind-apple-ios-and-google-android-7000008699/

<comment><USER2> So, if "computing operating systems" is what we're measuring now, no one should complain about Microsoft's monopoly advantage anymore, right?

The most frustrating thing about reading pop-journalism about Microsoft these days is watching people complain that Microsoft is abusing their monopoly to promote services like SkyDrive/Bing or not allowing Store apps to implement dynamic code generation, while still claiming that Microsoft is no longer relevant because we're in a post PC world now. Which is it?

<comment><USER3> Both. (I'll play devil's advocate, if that's ok.)

What matters most? "Computing operating systems" or "desktop market share"?

I believe both are vital to the long-term success of any competitor, Microsoft, Google, Apple, or "other."

If Google or Apple did not deliver a good UX on Windows Desktops, the resulting lost opportunities would severely curb their success in "computing operating systems."

Meanwhile, Microsoft owns the platform they deliver on. Can Microsoft use that to their advantage? Logically they can, but the ethics of their actions may result in US DOJ antitrust action.

If Microsoft does not deliver a good UX in mobile, tablet, and ultrabook markets, their future relevance on the desktop is threatened. This is where I think you and I disconnect: I believe Microsoft is now waging a two-front war and is being squeezed by the resulting pincer attack. Microsoft has to simultaneously innovate in new, fast-moving markets like mobile and tablet, while acting like a benevolent 800-lb gorilla in the desktop OS market.

It's not impossible to do, but it requires a combination of finesse and balls that Microsoft seems to be lacking, based solely on the stock price history for the 2002-2012 timespan.

</comment></comment><comment><USER4> I'm not sure i follow that graph. What happened in 2004-2005 that caused 29% of "Other"? And what's responsible for the simultaneous large jump with apple? The iPhone wasn't released until mid-2007.

<comment><USER5> Can't be Symbian, can't be Linux/Ubuntu, as those never picked up a large chunk of market share.... Possibly Blackberry?

Large jump with Apple might be Tiger?

The data does seem highly dubious though....</comment></comment>


Revolutionary Semaphore: High-Speed Communications in 18th-Century France - <AUTHOR> https://99percentinvisible.org/article/the-revolutionary-semaphore-high-speed-communications-in-18th-century-france/ <comment><USER2> > connecting major cities with Paris as a central node.

Some things never change, all network in France are still organized that way. The most visible is the rail network: if you want to travel between any two city (excluding Paris) by train, most of the time it will be shorter to go through Paris.</comment>


C++ – From goto to std::transform - <AUTHOR> https://github.com/Dobiasd/articles/blob/master/from_goto_to_std-transform.md <comment><USER2> What I find painful about writing pseudo-functional C++ using <algorithm> and other tricks is that you have to allocate storage for intermediate values. This makes C++ algorithms a lot less composable than similar things in other languages.

So if I wanted to do something like (in Haskell):

        sumOfOddSquares xs = sum . map (^2) . filter odd $ xs

In C++, I would need to allocate temporary storage for the intermediate values.

        std::vector odd_numbers;
        std::copy_if(xs.begin(), xs.end(), back_inserter(odd_numbers), isOdd);
        std::transform(odd_numbers.begin(), odd_numbers.end(), odd_numbers.begin(), square);
        std::accumulate(odd_numbers.begin(), odd_numbers.end(), 0, plus);

This becomes quite painful very quickly. You can use solutions like boost::filter_iterator, but soon you're knee deep in C++ templates and the long compile times and awful error messages that follow.

The example above is a bit contrived since it can be easily be done with a single accumulate, but you get the idea...

        std::accumulate(xs.begin(), xs.end(), 0,
            [](int sum, int i) { return sum + ((i&1) ? i*i : 0); });

So while you can have lots of fun with <algorithm>, it's quite limited in what it can do.

<comment><USER3> On the other hand, C++ has more flexibility. Since C++ allows you to specify your allocation scheme, you can guarantee a piece of code will never trigger an allocation, allocate in a special way to ensure cache coherence, etc.

For example, you could have written equivalent logic that allocates odd_numbers on the stack or from a special memory pool.

Sure, application developers shouldn't care about that kind of fine-grained control. However, they should care about having fast, small, safe, and high- quality libraries available. For library authors and developers in special domains (high-performance, safety-critical, etc.), these tools are essential.

<comment><USER2> > On the other hand, C++ has more flexibility. Since C++ allows you to specify > your allocation scheme, you can guarantee a piece of code will never trigger > an allocation, allocate in a special way to ensure cache coherence, etc.

This is true but the way C++ standard containers work with allocators is rather clumsy. So clumsy that often when custom allocation logic is required, standard containers are not used at all and custom containers are built instead. For example, EA has used a custom STL-esque container library to avoid memory allocation pressure in console and PC games.

> For example, you could have written equivalent logic that allocates > odd_numbers on the stack or from a special memory pool.

But this example does not require any allocation space at all. But there's no way of doing this with standard C++ algorithms without allocating additional space.

<comment><USER3> > But this example does not require any allocation space at all.

That's not possible if you're comparing algorithms apples-to-apples. If you have an intermediate collection, it's in memory somewhere, even if the language does the allocation for you transparently.

<comment><USER2> > If you have an intermediate collection, it's in memory somewhere, even if > the language does the allocation for you transparently.

This toy example algorithm, and many practical algorithms, do not need an intermediate collection to be stored in memory.

Using some kind of laziness, you only need exactly one temporary element, not the whole collection. You can make this happen not only in Haskell but also using Python generators, Clojure lazy sequences or even in C++ using Folly.

The lack of means of composition, the inability to pipe the output of one algorithm as the input of another, is in my opinion the greatest shortcoming of C++ <algorithm>.

</comment></comment></comment></comment></comment><comment><USER4> <algorithm> is so 90s. In C++14 you'll be able to do this:

        auto square_copy = [](auto v) {
           for (auto& e: v) { e *= e; }
           return v;
        };

Another option:

        auto square = [](auto& v) { v *= v; };

        auto map = [](auto range, auto fun) {
            transform (begin(range), end(range), fun);
            return range;
        };

        vector<int> vec = {1,2,3,4,5,6};
        auto squared = map (vec, square);

Note that, in both of these cases, if you use std::move() to gift a container to these functions, they will not actually allocate any memory and will effectively operate in-place.

<comment><USER5> Am I missing something? I don't see anything beyond C++11 in here.

<comment><USER4> Parameters can't be auto in C++11. Polymorphic lambdas are a C++14 feature.

Incidentally, are you Stormhawk on Freenodes #C++ ?

<comment><USER5> Ah right. I have to admit I was so astounded this was omitted in C++11 (with some really dumb rationale, iirc) that I keep forgetting it wasn't.

And nope, that's not me. I go by stormbrew on freenode as well and haven't been in a C++ focused channel since the late 90s on efnet. :)

<comment><USER4> Not quite as astounding as omitting make_unique :P No matter, C++14 is going to be here _very_ soon. Both of the open source compilers are almost there, and I've read the standard will be final once the Ts are crossed.

</comment></comment></comment></comment></comment><comment><USER6> Using Facebook's `folly::gen` library [1], you can get it down to:

        vector<int> squareVec3(const vector<int>& v) {
          return from(v) | mapped([](int i){ return i * i; }) | as<vector>();
        }

which is pretty slick. There are a bunch of the usual LINQ/functional operators in `folly::gen` that are quite nice. As an example, to filter out the odd elements of `v`, you can do

        vector<int> squareVecFiltered(const vector<int>& v) {
          return from(v)
               | filter([](int i){ return i % 2 == 0; })
               | mapped([](int i){ return i * i; })
               | as<vector>();
        }

[https://github.com/facebook/folly/tree/master/folly/gen](https://github.com/facebook/folly/tree/master/folly/gen)

<comment><USER3> That's cool, but I'd rather not bitwise-or my functional operators together. Something like this would be better:

        vector<int> squareVecFiltered(const vector<int>& v) {
          return from(v
               filter([](int i){ return i % 2 == 0; }),
               mapped([](int i){ return i * i; }),
               as<vector>());
        }

<comment><USER5> That is actually really nice.

</comment></comment></comment><comment><USER5> C++ is evolving at a kind of breakneck pace lately, and it's already a lot different from the language it used to be. Auto, range loops, and lambdas are making it much more pleasant to work in while still maintaining a lot of performance advantages.

I know it's pretty popular to hate on C++, but I'm pretty excited about where it's going, personally.

<comment><USER7> I've recently started working in C++ (I've had some prior knowledge, but mostly basics) and whenever I try to Google stuff up, a few of the results are _Don 't use C++ because of X_

I read a few of them out of curiosity, and realised that they are mostly religious reasons to hate C++, hardly any of them are proper, factual, or empirical reasons. So, my hypothesis is the following: They were unable to learn C++, and because of immaturity, decided it was stupid[0][1].

[0]: I'm no saint to this. I said on numerous occasions Erlang is shit because I couldn't wrap my head around the syntax.

[1]: I believe it's a phenomenon associated with _Psychological Projection_ , but I might've confused it with something else.

<comment><USER8> C++ isn't the easiest language to work with, but what I find truly bizarre are all the internet people who apparently hate C++ while also praising C as wonderful and "elegant". I'm convinced that the vast majority of them have never written anything significant in C, which is a painful experience tolerated only by systems programmers who actually need something that's one step above a portable assembly language.

C++ only fails if you try to write it like C, and don't take advantage of all the lovely new tools it gives you. It's always been a more useful language for nontrivial projects, and C++11 elevates it so much further.

<comment><USER9> I'm a 20 year C programmer finally making the transition to C++ and as far as I can tell the main advantages C has left are: * Faster compilation * Comprehensible error messages * No cout

<comment><USER5> I have more issue with the poor performance of iostreams than with the interface, personally. Typesafe and type deducting string formatting is a pretty nice thing to have.

<comment><USER10> Maybe because iostreams are synchronized with stdio by default? It's possible to disable that for a big speed boost.

There's also the issue that iostreams might be implemented on top of stdio for simplicity. Hard to make it faster in that case!

<comment><USER5> Even then, it's pretty much the only place in the stdlib that extensively uses virtual calls, via std::locale. It's very complicated implementation-wise (I was actually working on an implementation of it once and it's not fun at all) and hard to find places to optimize it.

It's not that it's too heavy for a console app's output, really, but for things like converting numbers to strings and vice-versa (a-la boost::format) it is definitely a lot slower than atoi/sprintf.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm not really sure why references are being used here, if you're just making a copy straight-away.

        vector<int> square(vector<int> vcopy)
        {
            for (int &i : vcopy)
                i *= i;
            return vcopy;
        }

is shorter, (IMO) much more readable, and on my tests, measurably faster than the reference version. If you really want the std::accumulate version,

        vector<int> square(vector<int> vcopy)
        {
            accumulate(begin(vcopy), end(vcopy), begin(vcopy),
                       [](int i) { return i * i; });
            return vcopy;
        }

works just as well.

Still, I guess it's beside the point.

<comment><USER12> Awesome! It is more readable and makes it faster. Thank you very much. I changed my article accordingly.

</comment></comment><comment><USER13> After coding in languages in like Scala/Python for a while, it took me a while to parse this. Scala equivalent: `def square(a: List[Int]) = a map {i => i*i}`

<comment><USER14> After in coding in languages like C/C++/ObjC for a while, it took me a while to parse your Scale equivalent.

Personally I find the C++ much clearer – I don't see either as that much better/worse.

</comment></comment><comment><USER15> Convenience overloads for common use cases (iterating over the full vector, accumulating on a default-constructed accumulator, etc) would be great to have as standard. Are there and I have missed them? If not, what's the rationale? (this goes for the STL in general, not specifically these high order algos)

<comment><USER16> Here is a blog post on this very issue:

[http://herbsutter.com/2011/10/07/why-no-container-based- algo...](http://herbsutter.com/2011/10/07/why-no-container-based-algorithms/)

<comment><USER3> That's a valid technical reason why there isn't a std::sort that takes containers. It's not a valid reason why there can't be a std::range_sort or std::range::sort that takes container arguments.

<comment><USER15> If I was doing heavy C++11 today, that kind of range namespace would be the second thing I'd write; the first being a bunch of string functions for the operations I actually want to do with strings (as opposed to the low level "character buffer manipulation primitives" the STL offers).

I was ok with that low level, low semantics design in the STL until I heard that stuff about integrating a graphics library. Now I'm just confused. :)

</comment></comment></comment></comment><comment><USER17> Readability improved from squareVec1 to squareVec4, then went downhill. Hiding loops behind new names doesn't make programming better.

<comment><USER4> At Going Native last year Sean Parent, from Adobe, gave a superb talk called 'C++ Seasoning' where his number one pro-tip for C++ was: no raw loops.

He made a good case that anywhere you have a non-trivial loop in C++, you're almost always going to be better off folding the problem in to a composition of algorithms. The code got more readable, more performant, and redundant code can often be removed.

Please take an hour to watch it here in glorious high quality:

[http://channel9.msdn.com/Events/GoingNative/2013/Cpp- Seasoni...](http://channel9.msdn.com/Events/GoingNative/2013/Cpp-Seasoning)

<comment><USER18> And if someone has nothing better to do, may I suggest to watch anything by Sean Parent. Some old adobe talks might be in low-res, but they were still very interesting, on the abstraction side of things.

<comment><USER4> Where can we find these old talks?

<comment><USER18> Here's one :

A Possible Future of Software Development : www.youtube.com/watch?v=4moyKUHApq4

</comment></comment></comment></comment></comment><comment><USER19> Just as a side note: if you're looking to write a convenience wrapper like the author's transformVec, do not have it take the function as `const function<T(T)>&`. Instead, do something like:

        template <typename T, typename F>
        vector<T> transformVec(const vector<T>& v, F op)

Using std::function in a case where you just want something callable just makes the optimizer's job a lot harder. Using std::function is a good idea if you actually need type erasure (for example if you want to pass something callable to a function that is _not_ a template).

<comment><USER12> Wow, awesome tip, thanks. This makes the wrapped version as fast as the others. I updated my article accordingly.

</comment></comment><comment><USER20> The author probably thinks that all versions are equally fast, but in fact they are just equally slow. Neither gcc 4.8 nor icc 14 can use vectorization for this loop (likely because of aliasing).

<comment><USER21> It's not because of aliasing, it's because of the push_back call inside the inner loop, which may potentially have to allocate (in this case we know it doesn't, but the compiler does not). If you replace squareVec6 with

        vector<int> squareVec6(const vector<int>& v)
        {
            vector<int> result(v.size()); // preallocate
            // result.reserve(v.size());
            transform(begin(v), end(v), begin(result), [](int i)
            {
                return i*i;
            });
            return result;
        }

the compiler will be happy to vectorize the loop.

</comment></comment><comment><USER22>
      def square(vector)
        vector.collect { |i| i**2 }
      end

<comment><USER23> I like the Python version of:

      def square(vector):
        return [v**2 for v in vector]

<comment><USER24> Haskell:

      let square = map (^ 2)

_Real_ partial application and currying is something I'm longing for in other languages; it's easy to fall for the beauty of the Point Free Style.

<comment><USER25> Well, in Python that would be:

      from functools import partial
      square = partial(map, lambda i: i**2)

EDIT: I guess it's still not the same, since the lambda isn't a partial application. But I don't think we can just set the exponent in pow(), we need to create a function that takes the arguments in the reverse order. Maybe:

      from functools import wraps, partial
      def flip(func):
          'Create a new function from the original with the arguments reversed'
          @wraps(func)
          def newfunc(*args):
              return func(*args[::-1])
          return newfunc

      _pow = flip(pow) #Take Y, then X

      # Then the equivalent would be
      square = partial(map, partial(_pow, 2)

Of course, flip is rather long-winded because it's a generic function, one could just do:

      _pow = lambda y, x: pow(x, y)

</comment></comment></comment></comment><comment><USER26> `result = [i * i for i in v]` looks much more readable to me.

What if you need to square every other element? copy_if and transform then don't look so pretty anymore. `result = [i * i for i in v if i % 2 == 0]` is still more readable.

What if you need to do something else and you don't know if there is a transform like function for it?

<comment><USER27> > What if you need to do something else and you don't know if there is a > transform like function for it?

What about the same thing in python? As far as I know the two examples you gave exhausted list comprehensions' functionality.

</comment></comment><comment><USER28> It seems like it's the loop itself that is redundant. Why couldn't I just do:

        squaredVec = vec * vec

or

        squaredVec = vec ^ 2

<comment><USER29> You can, but not with vector. Use valarray if you need to perform those kinds of computations.

</comment></comment><comment><USER30> The example is too trivial. you could have 100 ways to write "hello world", but it does not matter.

</comment><comment><USER9> Why were all the examples using iterators, and not square bracket indexing?

</comment><comment><USER31> am i the only one who thinks the std::transform version is LESS readable than the for loop?

</comment><comment><USER32>
      but you still have to read the whole line

Oh the pain!</comment>


Golden Gate Ruby Conference Live Stream (starts at 9:30AM PST Friday 17th & Saturday 18th) - <AUTHOR> http://pivotallabs.com/gogaruco/

<comment><AUTHOR> Here's the Schedule too: <http://gogaruco.com/schedule/>

</comment><comment><AUTHOR> The stream was down for a while, it's up and working now, but the audio is kinda muffled. sounds like they're working on it.

</comment><comment><AUTHOR> Oh! and people are chilling in #gogaruco on freenode. :) Looks like there are gonna be some interesting talks

</comment><comment><USER2> doesn't seem to work...

<comment><USER3> It's working for me. If you can give me some more details of what isn't working for you, I'll see what I can do to fix it.</comment></comment>


1 in 4 Americans 25-54 Not Working - <AUTHOR> http://www.weeklystandard.com/blogs/1-4-americans-25-54-not-working_806178.html

<comment><USER2> I don't understand the whole "so discouraged that they left the labor force entirely" bit. If you have that luxury should you even be counted?

<comment><USER3> Looks like the usual 'Millennial hate' to me.

<comment><USER2> I'm confused, I've never heard this term before. I was commenting on how adults require income to survive. If you are wealthy enough to support yourself without work I wouldn't call you unemployed. I mean, it's technically true but messes up the data.

<comment><USER4> > If you are wealthy enough to support yourself without work I wouldn't call > you unemployed.

If you're neither working nor contributing to the Social Security system, the SSA regards you as unemployed. If you're neither working nor seeking work, many states regard you as unemployed regardless of your income from other sources.

> I mean, it's technically true but messes up the data.

Not at all. It depends on the uses to which the data are put. If someone wants to know how many people are going to be driving to work, then why someone isn't working is irrelevant.

As far as I am concerned, the data should be as rich as possible without breaking privacy requirements, and the database's users should figure out what the data actually mean.

<comment><USER2> I stand corrected, for the purposes I was attempting to use the data for (The number of people likely going to bed hungry because they don't have any work) it messes up the data.

</comment></comment></comment></comment></comment><comment><USER5> Does this count stay at home parents in the 1 in 4 figure?</comment>


Strengthening 2-Step Verification with Security Key - <AUTHOR> http://googleonlinesecurity.blogspot.com/2014/10/strengthening-2-step-verification-with.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+GoogleOnlineSecurityBlog+%28Google+Online+Security+Blog%29 <comment><USER2> No one has mentioned the coolest feature of U2F/Fido auth: TLS Channel IDs.

Via an internal Chrome extension ("cryptotoken"), authentication state & the handshake can be bound to a specific TLS session -- preventing cookie theft. Incredibly cool: [http://www.browserauth.net/channel-bound- cookies](http://www.browserauth.net/channel-bound-cookies)

<comment><USER3> This is indeed a cool feature. I hadn't been aware of it until now. I see that Dirk Balfanz from Google published a IETF draft a couple years ago.

I need to digest the security implications, but it seems like a nice mitigation to session theft.

<comment><USER4> until tls session resumption gets more common and someone comes up with a "tls session resumption is not in fact secure" :(

there were some talks in 2013 about this in various sec conferences

</comment></comment></comment><comment><USER5> Interesting. I've hacked something together for my personal usage with my OpenGPG smartcard for use on my Windows desktop and developer-mode chromebook. In the end I had to work with "chrome native messaging" which basically calls native binaries on the host OS and is a nightmare to set up.

This doesn't look like they're planning to start supporting existing smartcards, but hopefully it's a first step?

My idea was to create a login page that requires the user to sign a secret with their private key which can be completed manually, but also automatically with the click of a button if the extension is installed. The key could live securely on a smartcard or in the user's gpg keyring, it doesn't matter as that part is deferred to gpg.

In case anyone happens to be interested, my un-documented prototype sits at [https://github.com/r04r/GPGThing](https://github.com/r04r/GPGThing). It consists of a chrome extension, a golang application do some juggling between json input/output (which is a limitation by chrome native message passing) and gpg, and apache configs to set it up as an authentication method.

There's some more hacks necessary to get it working on chromebook, including a crouton installation with gpg.

<comment><USER6> Is there more info on GPG smart cards? I use a SafeNet eToken and highly reccomend it but it does X.509 certificates instead of GPG.

<comment><USER5> I've found [https://wiki.debian.org/Smartcards/OpenPGP](https://wiki.debian.org/Smartcards/OpenPGP) a really good resource with plenty of links. There's also [https://www.gnupg.org/howtos/card-howto/en/smartcard- howto-s...](https://www.gnupg.org/howtos/card-howto/en/smartcard-howto- single.html) & [http://www.narf.ssji.net/~shtrom/wiki/tips/openpgpsmartcard](http://www.narf.ssji.net/~shtrom/wiki/tips/openpgpsmartcard) which I've found helpful. Once they're set up they behave just as if the key was part of your local keyring encrypted with the smartcard's passphrase, but is of course only usable when the card is plugged in.

It actually seems like the Yubikey Neo also supports GPG, so that is quite nice. I own [http://shop.kernelconcepts.de/product_info.php?products_id=4...](http://shop.kernelconcepts.de/product_info.php?products_id=42) & [http://shop.kernelconcepts.de/product_info.php?products_id=1...](http://shop.kernelconcepts.de/product_info.php?products_id=119)

</comment></comment></comment><comment><USER2> EDIT: Looks like this is now working! Looks like there is a tiny UI bug -- make sure your account is correctly selected on the Security Token page if you have multiple accounts signed in. #userError

Ouch, looks like a serious downside is that a given key can only be used with one Google account.

Trying to add a U2F-compatible token to more than one Google account results in errors: "This Security Key is already registered. Use a key that is not registered yet and try again."

<comment><USER7> I just looked at the specification for this, it looks like a Google-specific limitation. There's no reason why a single site couldn't support the same U2F for multiple accounts.

In fact in Google's presentation they advertise a husband and wife using the same exact token for both of their accounts [0].

[0] [https://sites.google.com/site/oauthgoog/gnubby](https://sites.google.com/site/oauthgoog/gnubby)

<comment><USER2> Ah, it looks like their FAQ also says this is supported:

       Can I use the same Security Key with multiple Google Accounts?
       Yes. You can register the same Security Key with multiple Google Accounts.

[https://support.google.com/accounts/answer/6103543?hl=en](https://support.google.com/accounts/answer/6103543?hl=en)

</comment></comment></comment><comment><USER8> How does the challenge get from the web browser out to the USB device? I've spent some time looking for a specification, but haven't managed to find the answer to this question.

<comment><USER9> The device probably registers as a USB keyboard, and it "types out" the 2-factor code when you tap it.

<comment><USER8> Right, but how does the challenge get to the device?

"Security Key is a physical USB second factor that only works after verifying the login site is truly a Google website, not a fake site pretending to be Google."

The specs say that a challenge is involved. The device must receive the challenge. "Typing out" keys isn't sufficient unless that typing can go the other way. And in the OS, there has to be support for Chrome to send data to such a device. Normal keyboard input is not sufficient for this. This is what I'm looking for clarity on.

</comment></comment></comment><comment><USER10>
        Security Key does not work on browsers other than Chrome.

Well that's a bummer.

Doesn't mean it can't be useful in some settings, though.

<comment><USER11> Also this though:

> Security Key and Chrome incorporate the open Universal 2nd Factor (U2F) > protocol from the FIDO Alliance, so other websites with account login > systems can get FIDO U2F working in Chrome today. _It's our hope that other > browsers will add FIDO U2F support, too._

<comment><USER12> If you share the same FIDO U2F key between services, does that mean that one service could spoof tokens for a different service?

e.g. foo gets compromised, so attackers can generate codes for google apps.

<comment><USER13> No. There are no shared secrets. This is real asymmetric crypto.

</comment></comment></comment></comment><comment><USER14> So, we recently had a bunch of articles coming out on "the fundamental insecurity of USB" [1]. How does that jive with a USB-based security key? Can't this be "flashed" like any other USB device?

[1]: [https://www.schneier.com/blog/archives/2014/07/the_fundament...](https://www.schneier.com/blog/archives/2014/07/the_fundamental.html)

<comment><USER15> The insecurity relates the problem with allowing random usb devices to be plugged into a computer. Specifically, it points out that, even if you wipe an usb stick, you still can't trust that it's safe.

The devices that Google is referring to should be inherently safe. If you don't trust the supplier of these devices then yes, that's an issue. But, in theory, you receive these from a trusted source. As long as the device doesn't leave your possession, you're ok.

Edit: I should add that I didn't quite summarize the vulnerability correctly. If you plug a trusted USB device into an untrusted computer, you also have the potential for attack. If the USB device can be made writable, the computer can infect the USB device, propagating malware forward. I _assume_ that these security keys are made read-only before they leave factory, but vulnerabilities can be found in the darnedest of places!

<comment><USER16> I have a Yubikey and it isn't read only. You can customize how it works with software they provide.

<comment><USER17> Setting parameters in the device is different than replacing the firmware. The attack requires replacing the firmware. As far as I know yubikeys have never been able to update firmware after they've left the factory. In the forums you will see yubico people offering to swap devices because of problems related to outdated firmware.

There was also a blog post by yubico confirming that the badusb attack is irrelevant on yubikeys. [https://www.yubico.com/2014/08/yubikey- badusb/](https://www.yubico.com/2014/08/yubikey-badusb/)

I think the take away is that all the devices are read only except the Neo and the Device Firmware Upgrade (DFU) implementation on the Neo "requires the new firmware image to be signed by [yubico]. Yubico does not endorse nor support use of DFU for users"

The Neo also has javacard capability that lets you load applets. In the latest devices unless you purchase the developer editions, the javacard apps cannot be updated.* Older Neo's allowed you to build and load your own javacard apps.

* I'm not entirely sure about whether in the latest Neos the javacard apps can be updated to new official signed yubikey versions or whether the javacard apps cannot be updated at all...

</comment></comment></comment></comment><comment><USER18> Some comments are pointing out how awkward this might be,

> I don't see a point in plugging my entire keychain (the physical keychain, > with my car keys) into my laptop every time I want to log in

> I'm not sure about having to plug it in every time

I'll share my experience. I use two of these on a laptop and desktop and I have never unplugged them; there's no reason to. They sit very flush in the USB slot. I suppose if I ever needed the extra USB slot for something else I might unplug it.

<comment><USER19> > I use two of these on a laptop and desktop and I have never unplugged them; > there's no reason to.

I use a Yubikey for ${WORK} and we are required to remove such tokens as soon as they have fulfilled their purpose. On pain of disciplinary action, as it is considered on par with leaving a password on a Post-it.

Otherwise there's no point in them as an additional security step in the event that the laptop is lost or stolen.

<comment><USER20> If laptop is stolen you can revoke it, and your password shouldn't be compromised at this point. And hacking through phishing is way more likely in any case (security keys protect against it while regular 2fa doesn't).

<comment><USER21> Additionally, if somebody removes the token, dumps a bunch of OTPs and then puts it back, as soon as you use the token once, it will invalidate all previous ones so their dump will be reasonably useless. I leave my key in my computer _when I 'm at my desk_ but have it attached to my keychain so that I take it with me if I leave my desk.

<comment><USER20> FYI the nice thing with security keys, is that you can't actually do that (dump a bunch of OTPs to use later).

</comment></comment></comment></comment></comment><comment><USER22> This is very interesting. Is this Yubikey-compatible?

[http://www.amazon.com/Plug-up- International-U2F-SK-01-FIDO-S...](http://www.amazon.com/Plug-up- International-U2F-SK-01-FIDO- Security/dp/B00OGPO3ZS/ref=sr_1_1?ie=UTF8&qid=1413900231&sr=8-1&keywords=FIDO+U2F+Security+Key)

Can I buy one of these to use with SSH auth/password programs/Chrome?

<comment><USER23> It should be:

[https://fidoalliance.org/adoption/video/yubico-fido- alliance...](https://fidoalliance.org/adoption/video/yubico-fido-alliance- universal-2nd-factor-u2f-demonstration)

[https://www.yubico.com/products/yubikey- hardware/fido-u2f-se...](https://www.yubico.com/products/yubikey- hardware/fido-u2f-security-key/)

<comment><USER6> Blog post: [https://www.yubico.com/2014/10/google-releases-support- fido-...](https://www.yubico.com/2014/10/google-releases-support- fido-u2f-security-key/)

</comment></comment></comment><comment><USER24> This seems to me to be a bit of a narrow market. At the upper end of secure machines, USB ports will be physically disabled. And if you're not hyper security conscious, you're not going to bother with a physical key.

So with this, you need to be somewhat paranoid, but not totally paranoid.

<comment><USER25> > _At the upper end of secure machines, USB ports will be physically > disabled._

Those same organizations would likely be looking at PKI-based smart cards that they issue themselves over something like this, though.

<comment><USER26> Yes, and that's exactly OP's point — it's a narrow market.

<comment><USER27> A narrow market that includes all domestic Chrome users who use Google services.

</comment></comment></comment></comment><comment><USER28> Cool, but I will continue using the Google Authenticator app. Google is not the only thing that requires 2FA, so do numerous other sites, and GA app is the most widely supported and the least pain in the behind. I don't see a point in plugging my entire keychain (the physical keychain, with my car keys) into my laptop every time I want to log into GMail, much less carrying around 10+ different USB tokens.

Now, a NFC-based token where I don't have to type anything in, or an iWatch/FitBit/whatever type wearable as a token would be pretty cool. Or even better: a universal library/service that abstracts which token I use. That way I can have multiple tokens for different situations.

<comment><USER29> IMHO the Authy app is nicer than Google Authenticator.

[https://play.google.com/store/apps/details?id=com.authy.auth...](https://play.google.com/store/apps/details?id=com.authy.authy&hl=en)

[http://itunes.apple.com/us/app/authy/id494168017?mt=8](http://itunes.apple.com/us/app/authy/id494168017?mt=8)

<comment><USER30> Maybe the UI is nicer, but the permissions on Android are unnecessarily intrusive, which—to me—is a dealbreaker with a _2FA manager_.

      Device & app history
          read sensitive log data

      Identity
          find accounts on the device

      Camera/Microphone
          take pictures and videos

      Wi-Fi connection information
          view Wi-Fi connections

      Other
          receive data from Internet
          access Bluetooth settings
          pair with Bluetooth devices
          full network access
          view network connections
          control vibration
          prevent device from sleeping
          send sticky broadcast

Contrast this with Google Authenticator:

      Identity
          find accounts on the device

      Other
          control vibration
          full network access
          use accounts on the device
          create accounts and set passwords
          close other apps

[https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2)

<comment><USER31> Well, each of those permissions they request ties to a very obvious and useful feature.

Camera/Photo for QR code-based 2FA, Bluetooth permissions and Internet Data to handle local connection to trusted machines and callbacks from sites like Coinbase (when I log into coinbase, I get a handy 2fa notification from authy that leads me right to the code)

Log data is the most questionable, but it really makes debugging so much easier when you can see what's going on, and is a pattern/permission they share with Evernote, foursquare, fring, Netflix, Rdio, Dolphin Browser, AccuWeather.com, Hotmail, doubleTwist Player, MOG, Handcent SMS, Bump, TweetCaster, etc.

<comment><USER32> Wait, Google Authenticator lets you provision accounts by scanning a barcode, how does it not list "take pictures and videos" in its permissions manifest ?

<comment><USER33> IIRC Google Authenticator uses a third-party barcode scanner via an intent.

</comment></comment></comment></comment></comment></comment><comment><USER7> Shame I have to pick EITHER 2-step or Security Key.

My ideal would be to use Security Key to bypass 2-step on devices that supported it and then use 2-step elsewhere.

For example, some public computers have the USB port literally glued shut, therefore Security Key won't work. In those cases I'll still have my phone with me and could bypass it via 2-step.

Essentially I want to use the Security Key as a way to save me typing in my 2-step code because I'm lazy, rather than to "add" security.

Google's current 2-step "remember-device" doesn't really work for me as it utilises cookies which get cleared. I could add it to a white-list of preserved cookies but they use obscure often changing sub-domains.

<comment><USER34> You _don 't_ have to pick one or the other. According to the FAQ [0] (linked from the blog post):

"In general, you'll still be able to use a verification code the way you normally do on any device that doesn't support Security Key."

[0] [https://support.google.com/accounts/answer/6103523](https://support.google.com/accounts/answer/6103523)

</comment></comment><comment><USER35> To me, USB seems more and more like a security problem in general. Operating systems trust USB devices implicitly, despite the fact that every single one is a little computer of its own that can be compromised.

2-factor auth via a mobile device airgaps the devices from one another, which seems like a great idea for security. If both factors are directly connected by a trust-by-default data channel, it seems at least possible that one exploit could affect both factors.

</comment><comment><USER36> My worry about using my phone as the second factor is that my phone is attractive to thieves. I would personally prefer to carry around a keyring with many fobs on it.

<comment><USER37> It seems a bit cheesy, but I just put a lock screen on my phone. I figure if anyone steals it, they're unlikely to have the chops to bypass it without wiping the phone (I assume that's possible with adb at least). That combined with Google's remote wipe functionality and I'm pretty comfortable with the theft scenario.

</comment></comment><comment><USER23> Could we instead use smartwatch Bluetooth or NFC (probably better, I don't like the long range of Bluetooth for something like this) to unlock sites instead of these USB keys? Does the FIDO Alliance support such a protocol? I know Android 5.0 supports that but it's only for unlocking the phones (and Chromebooks I believe). But what about sites? Or is that too risky compared to an USB key?

<comment><USER38> FIDO U2F strives to support Bluetooth and NFC, see [https://fidoalliance.org/specs/fido-u2f-overview-v1.0-rd-201...](https://fidoalliance.org/specs/fido-u2f-overview-v1.0-rd-20141008.pdf)

</comment></comment><comment><USER39> I like the idea of a physical key distinct from the phone, but I'm not sure about having to plug it in every time and/or restricting it to Chrome devices.

Is there some way that it could instead be made compatible with a device like the RSA SecurID tokens? That way it remains separate from the devices I'm trying to get into and doesn't require a USB slot.

<comment><USER40> Unfortunately, the FIDO Alliance seems to have forgotten to specify CCID bindings for U2F (i.e. they left out the trivial part of the protocol that would describe how to talk to one of these tokens in a smart card slot or over NFC). The specs describe USB HID bindings.

[https://fidoalliance.org/specifications/download](https://fidoalliance.org/specifications/download)

</comment></comment><comment> chris-at Sounds like an interesting idea but isn't it a bit limited? I can only use it on a computer, not on mobile devices.

<comment><USER41> Yubikey Neo should provide FIDO U2F over NFC.

<comment><USER42> So the mobile version of this would be /less/ secure than standard 2FA?

<comment><USER43> Why? Even if you can eavesdrop on the NFC communication, how does intercepting the challenge/response help you?

<comment><USER42> I'm just asking, because I have no idea how this works. I figured an assailant could more easily make use of an NFC signal than they could see the code on the front of the device in the short time it takes you to memorize or copy/paste the code.

<comment><USER44> it uses an OTP so even if they intercepted it, it wouldn't be useful

</comment></comment></comment></comment></comment></comment><comment><USER45> Would be good if next gen chromebooks have a bay on the bottom with a USB socket so you can leave one of these attached without it dangling off the side (and maybe permanently glued in by paranoid IT). Another trick might be NFC in the palmrests that can detect your watch . . .

Looks like a solid step in the right direction though.

<comment><USER46> Yubikey's first offering that is U2F compatible is that bright blue USB key, but they have previously offered a USB key that is almost flush with the port, and the conductive contact is on the edge of it. I suspect they'll be updating that product to offer U2F soon, and it should be a better fit for what you are asking.

<comment><USER47> They already have with the neo-n:

[https://www.yubico.com/products/yubikey- hardware/](https://www.yubico.com/products/yubikey-hardware/)

It does cost a bit more than the U2F-only version, however.

</comment></comment></comment><comment><USER48> Super cool; this a great win on the path to U2F acceptance. I ordered a key to try it out; I've been meaning to anyway. I want to try out the using U2F via NFC on Android and see if I can hack something together using Apple's private NFC framework. Wish the tokens had BTLE compatibility though.

</comment><comment><USER49> ISTM that a nice feature for HN would be to strip out the

      ?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Google...

crap that gets stuck in URLs occasionally when people use RSS readers. In this case it doesn't seem to include any PII but I think sometimes it does?

</comment><comment> bjelkeman-again With more interaction online moving to smartphones and tablets, what do we do instead of USB hardware keys like these?

<comment><USER50> Probably a similar device but with some sort of low-power NFC transponder rather than a physical connection.

<comment><USER51> I've never used it but, [https://www.yubico.com/products/yubikey- hardware/yubikey-neo...](https://www.yubico.com/products/yubikey- hardware/yubikey-neo/) seems to fit the bill.

<comment><USER52> I have one. It is pretty cool but it hasn't been real useful up until now. I haven't found many apps that support it.

I ended up just grabbing the clipboard app that yubikey puts out.

I tried using the static password feature by using it as part of my master password in 1password but the newer versions of 1password block using the clipboard in android (with good reason). It would be pretty awesome if password-managers added support for it.

<comment><USER53> LastPass supports Yubikey natively, including on mobile.

</comment></comment></comment></comment></comment><comment><USER54> I don't get this, what about malware pretending to be a browser? Is there a protection against this in protocol

<comment><USER33> Yes, I think the protocol protects against MITM and replay attacks. [http://fidoalliance.org/specs/fido-security- ref-v1.0-rd-2014...](http://fidoalliance.org/specs/fido-security- ref-v1.0-rd-20140209.pdf)

<comment><USER55> No, not really - if you're a MITM, you control what the user sees, as well as what gets sent to the device, and nothing prevents those 2 things being different. You might _SEE_ that you're sending $100 to Grandma, but when you tap the key, you're authenticating your entire bank balance to some place in the Bahamas.

</comment></comment></comment><comment><USER56> Not much of an improvement over 2FA using my phone because the times when I really need it to be easy is when I'm browsing on my phone. Since this is USB I can't use it on my phone. When I'm on my laptop I just pull out my phone and type in a short code and be done with it.

<comment><USER57> Not sure how it will interact with this, but at least one of the compatible Yubikey devices that was mentioned also supports NFC specifically for use on mobile devices that lack USB ports.

<comment><USER57> As an addendum to this, after looking over the spec, it appears that the FIDO-U2F protocol currently _only_ supports USB, but that support for NFC and bluetooth is planned in later versions of the specification. Presumably a firmware update sometime down the line would be sufficient to bring the Yubikey device up to date with the NFC standard and allow it to work over NFC in addition to the currently supported USB version of U2F.

<comment><USER40> Yubico doesn't allow firmware updates. They do, however, support the GlobalPlatform standard for uploading new JavaCard applets, and, if the NFC bindings were designed such that a JavaCard applet could implement it, then a U2F applet could be uploaded to an existing YKNeo.

</comment></comment></comment></comment><comment><USER58> is this the result of the partnership with yubikey?

<comment><USER23> Google is supporting the FIDO U2F standard just like Yubikey now.

<comment><USER55> They pay upwards of $100k+ per year to have a seat on the board and direct the "standard" to suit their products.

<comment><USER59> Your comment reads as if you believe that having an authentication standard that suits the products of the largest webmail provider is somehow bad. I'm having trouble understanding this. Better suiting the use-case of things like gmail seems like unequivocally a good thing. (As does the consortium being better funded by $100k+ a year, for that matter.)</comment></comment></comment></comment>


MLB buys Rawlings, the company that makes its baseballs - <AUTHOR> https://www.axios.com/major-league-baseball-buys-rawlings-1528302413-93888fee-f07c-4bf5-93f1-c7889e213e7e.html <comment><USER2> Thats how home run rate keeps going up!</comment>


Any SaaS founders here who have sold their future revenue? - <AUTHOR> Was recently made an offer to sell future revenue of my SaaS product. Has anyone ever done this / have experience on either side of the coin? <comment><USER2> I'm afraid I have no advice, but I'm just curious about the structure of the deal. Is it $X for Y% in perpetuity or for Z time period?

You may want to consider a Working Capital loan instead, if you haven't already.

<comment><AUTHOR> Yeah $X for Y% for one year, it's a very small amount.

How does one go get working capital loans?

<comment><USER3> Super curious about this. There must be some way that the loaner knows what to expect for the next year. If that's true is the loaner paying based on your expected revenue with the upside being that you might grow further?

<comment><USER2> From my experience with PayPal Working Capital, you get loaned $X based on a percentage of your expected annual sales, and must pay back Y% up to a maximum of $Z.

There's no additional upside for PayPal beyond the lofty rates they charge for the service.

The fee is also "fixed" and is based on an APR calculated at the time of application. You never accrue interest.</comment></comment></comment></comment>


Ask HN: Have you replaced your phone with an iPod Touch? - <AUTHOR>

My contract iPhone is expiring soon, and instead of renewing for another 2 years, I'm considering just using an iPod Touch to talk and text over Wifi.<p>Anyone have experience with this? I'd also get a cheap pay-as-you-go phone for emergencies. But I like the idea of not always being "on", as well as the obvious lack of monthly charges. <comment><USER2> I'm on tmobile (android phone). The wifi calling feature doesn't work very well. You have to have a really strong signal, and even then the connection can be flaky. And for some reason, the feature doesn't work at all with some wifi hotspots.

So while it's a nice idea, in practice it doesn't work very well for voice. Texting seems to be OK.

<comment><USER3> I think it doesn't work because you have to open your browser and accept the terms before they let you out of their intranet. That's how it works at Starbucks anyways.

<comment><USER2> Right, I'm talking about after any browser-based authorization has happened.

</comment></comment></comment><comment><USER4> Why not use the iphone with a pay as you go sim (or as a ipod without a sim)?

I have been using my iphone with skype as the phone and just a data sim, it works okay but IP telephony is not as reliable as normal cellular telephony but I can live with it.

In my country (denmark) there are no real options for SMS texting without a normal SIM card (no ip based receiving of sms messages) so unfortunately that made the thing a no go for me.

</comment><comment><USER5> Use an Android phone without service on wifi. Install any of the these apps: GrooveIP, Spare Phone, or Talkatone; and you can use Google Voice for texting and unlimited minutes for free.

</comment><comment><USER6> Have you heard of [http://republicwireless.com/](http://republicwireless.com/)? Might accomplish what you're looking for.

</comment><comment><USER7> Have you heard about Ting.com? Pretty cheap mobile service.</comment>


ACLU and EFF Sue Over Warrantless Phone and Laptop Searches at U.S. Border - <AUTHOR> https://www.aclu.org/news/aclu-eff-sue-over-warrantless-phone-and-laptop-searches-us-border <comment><USER2> I hope this one goes to the Supreme Court, as that's the only place this will be resolved. Otherwise, U.S. Criminal Law is clear: searches and seizures at the border are exempt from requirements for warrants or probable cause.

Multiple circuit courts have upheld the Government's right to do this, and that this right extends to electronic files and information. Only the Ninth has disagreed ( _United States v. Cotterman_ ).

<comment><USER3> Problem is "at the border" isn't always interpreted as "crossing the border". 200 million people live in border-zones (within 100 miles of a border), and a lot of courts have given border patrol even wider jurisdiction.

<comment><USER2> True, but a secondary issue, unrelated to the matter at hand, and frankly much less egregious. While Federal law allows certain agencies to conduct search and seizure operations within 100 miles of the border, the Supreme Court has been clear on multiple occasions that _warrantless_ actions only apply at the border itself (including points of entry like airports).

</comment></comment></comment><comment><USER4> Totally tangential: It'd be nice if the _[dupe]_ tag took you to the HN original discussion.

<comment><AUTHOR> The other discussion (id=15240781) is actually a dupe of this one (id=15240700). HN marked the wrong dupe!

I tried to warn people before the other article got any comments, but they just downvoted me. [https://news.ycombinator.com/item?id=15240973](https://news.ycombinator.com/item?id=15240973)</comment></comment>


iOS8 to support WebGL – is this the end for matrix3d frameworks like famo.us? - t-plane

There's been a lot of hype lately about famo.us, a javascript framework that claims to have solved performance issues in HTMl5. Famo.us gets its performance by heavily using "matrix3d" CSS property to allow positioning, rotation and alignment of elements by means of applying a 16 cell transformation matrix array onto these elements. Matrix3d is also one of the few CSS properties that reliably invoke GPU acceleration in the browser. You can see some demos of the framework @ http://periodic.famo.us and http://famo.us/demos/.
But there are alot of things that famo.us cannot do - one of them is rendering real 3d models. Reason for that is that famo.us relies on divs as its core building block, and divs are, by design, rectangular. To create a 3d mesh with famo.us, you'd need to create tons of tiny divs, positioned to create an illusion of a 3d object. Each one of these divs would need to have a matrix3d transformation applied to it. That quickly becomes extremely hard for a browser to render.
There is, however, a web technology that can do it much better. Its called WebGL, and it's been around for a few years now. WebGL operates completely differently from the way famo.us does. It, instead, relies on HTML5's canvas tag and its also GPU accelerated. Because it uses canvas, which is basically a pixel based drawing board, it's much more flexible in regards to what it can display. Downside is that you can't use any of html elements we are so used to. For example, if you want to create a text input, you'd have to create (or use) a class that actually creates one my means of canvas. You can check out some examples of WebGL @ http://threejs.org/examples/.
And now, Apple has made and announcement that webGL is coming to the iPhone near you. What do you think that means for things like matrix3d and famo.us? Would this prompt more developers to use webGL? Or would the two technologies compliment each other? <comment><AUTHOR> Hey t-plane. Famo.us offers a bit more than just matrix 3d transforms, in fact one of the best ways to think about how famo.us handles dom is more of a transport layer. There is no reason that famo.us could not use the same entity pattern and tree to render to webgl, we just have not been focusing on it (yet).

Disclaimer I work at Famo.us

<comment> t-plane I hear you, man. But, as we know it, famo.us, is all about matrix3d. And I haven't seen a webGL renderer for it yet. On the other hand, three.js added css3d renderer and it works pretty well with their already established webGL approach.

<comment><AUTHOR> Keep your eyes peeled for the stuff we are going to announce next Wednesday :D

<comment> t-plane hey - so, I checked out the meeting. Didn't really hear anything new - did I miss something?

</comment></comment></comment></comment><comment><USER2> The answer is yes. Using other html/css framework plus WebGL, you can do pretty much anything to match. Also it's faster and easier since most people are more familiar with those frameworks (i.e. bootstrap, angular, ionic framework, zurb...)

</comment><comment><USER3> I think they compliment each other whether or not they work together. More options for anything increases interest in that whole subject and interest causes the options to be improved.

</comment><comment><USER4> Lol Unity3D is the way to go

<comment> t-plane sure is, but it doesn't work in a mobile browser, though!</comment></comment>


Top Programming Languages Survey – Coding Infinite Poll - <AUTHOR> https://codinginfinite.com/top-programming-languages-survey-poll/ <comment><USER2> This survey asks for the "best" programming language.

Best for what? No one language is best for everything.

Is this more of a popularity contest?</comment>


Caesar AEAD Crypto Competition Final Portafolio - <AUTHOR> https://competitions.cr.yp.to/caesar-call.html <comment><AUTHOR> CAESAR AEAD crypto competition final portafolio.

After 8 years since the initial announcement and 5 years of the initial papers submission, the CAESAR committee selects the most robust AEAD crypto implementations that offer better security and performance than AES-GCM. The portfolio groups in three categories: lightweight application, high performance and nonce misuse resistance.</comment>


No Deleterious Effects of Increased Atmospheric Carbon Dioxide - 31,000 Scientists sign Petition - <AUTHOR> http://www.oism.org/pproject/s33p36.htm <comment><USER2> More information on this prestigious institute:

[http://en.wikipedia.org/wiki/Oregon_Institute_of_Science_and...](http://en.wikipedia.org/wiki/Oregon_Institute_of_Science_and_Medicine)

Cave Junction is a _beautiful_ area, and I'd highly recommend a detour if you get the chance (say, go down the coast route instead of taking I5 south), but it's pretty much in the middle of nowhere:

[http://maps.google.com/maps?ll=42.166779,-123.646999&spn...](http://maps.google.com/maps?ll=42.166779,-123.646999&spn=0.1,0.1&t=p&q=42.166779,-123.646999)

that, combined with their "nuclear war survival guide" stuff, makes me think "survivalists!".

I would vote "not hacker news".

<comment><USER3> The Wikipedia article links to an even more informative piece on SourceWatch:

[http://www.sourcewatch.org/wiki.phtml?title=Oregon_Institute...](http://www.sourcewatch.org/wiki.phtml?title=Oregon_Institute_of_Science_and_Medicine#Case_Study:_The_Oregon_Petition)

<comment><USER4> Here is how modern anti-science propaganda works. Just read edit history of linked wiki page on SourceWatch.

Arthur B. Robinson, head of Oregon Institute is labeled there "an eccentric scientist who has a long history of controversial entanglements with figures on the fringe of accepted research".

One science historian, author of a well-researched and well-reviewed book on Amazon, objects and tries to edit the entry: "he is a thoroughly reputable scientist... he does not have a 'long history' of controversial engagements...".

His words are erased by some Diane Farsetta, who sits on the board of SourceWatch and writes for AlterNet. She has not written a book on the subject. But she has time and she has an agenda.

So the entry is back to personal slander and innuendo. Enjoy the 'facts'.

<comment><USER2> Uh... everyone in this debate has an 'agenda', not least of whom, the organization in question.

</comment></comment></comment></comment><comment><USER5> Hey guys, shut up. You aren't supposed to show all those graphs. Only the hockey stick! The Scientific Consensus is settled. No questions, please.

More seriously, I'm not confident of everything they discuss here, and I think they are cherrypicking.

Upvoted because some of it is useful, however. For instance, hurricane number/intensity vs time (Katrina wasn't caused by global warming folks) and computer model uncertainty (they are crap). It's well worth a skeptical read.

<comment><USER6> _Katrina wasn't caused by global warming_

It's not a good idea to make statements like this. Weather systems are very complex, and we don't know if Katrina was caused by global warming or not. We just don't know what an increase in atmospheric CO2 will do - that's what's so scary about it.

<comment><USER7> Exactly _what_ is scary about not knowing? The post makes a point that no matter what the mechanism is, none of the variables involved is out of the "normal" range for the last 3000 years. Excuse me if I don't "act now!" about every thing that looks normal but is unexplained.

<comment><USER6> _Exactly _what_ is scary about not knowing?_

That if the ocean currents suddenly change, hundreds of millions of people could die.

 _none of the variables involved is out of the "normal" range for the last 3000 years_

That's a lie. Probably justifiable by a really bad definition of "normal". Would you say we are at a "normal" range of CO2, historically?

<http://en.wikipedia.org/wiki/Image:Carbon_Dioxide_400kyr.png>

</comment></comment></comment></comment><comment><USER8> Did you seriously read the last paragraph?

"Human activities are producing part of the rise in CO2 in the atmosphere. Mankind is moving the carbon in coal, oil, and natural gas from below ground to the atmosphere, where it is available for conversion into living things. We are living in an increasingly lush environment of plants and animals as a result of this CO2 increase. Our children will therefore enjoy an Earth with far more plant and animal life than that with which we now are blessed."

This is industry propaganda. See: [http://www.climatesciencewatch.org/index.php/csw/details/rea...](http://www.climatesciencewatch.org/index.php/csw/details/realclimate_wiki/) <http://fm4.orf.at/chris/215162/main>

</comment><comment><USER9> One of those 31,000 'scientists' is none other than climate researcher-turned- Spice Girl Geri Halliwell or "Dr. Halliwell" as her friends call her.

<comment><USER4> No, you are lying.

Signers "H": <http://www.oism.org/pproject/s33p342.htm>

There are 452 PhDs on that page alone. Each of them actually risks something by signing the petition, so this is no joke.

<comment><USER9> I have no doubt once Geri's name was found (and made public) they removed it from the list as it was obviously fake or just plain wrong.

My point was mostly humor, but my underlying point was that there is simply no verification as to the qualifications of any scientist, phd or spice girl on this list.

<comment><USER4> _Ad hominem ad nauseam_...

The signatures are results of a nation-wide mail survey first undertaken in 1998. The respondents were selected based on their scientific credentials of publicly accepted quality. All the signatures are done in writing and are available for inspection on your request at the institute.

Since you've just attempted a mass character assassination, do you mind sharing the results of your inquest into the validity of the signatures/qualifications with us?

<comment><USER10> _argumentum ad verecundiam_

An appeal to authority or argument by authority also known as argument from authority. If you say 50 or 5 billion scientists provide wieght to your argument your already falling under a logical falicy. Responding with an _Ad hominem ad nauseam_ seems reasonable when at least one person that made the list had zero credibility.

PS: I see a lot of hand waving and use of vary specific data when more general studies have been done but I don't see any real theory. What model are they using to base their assumptions on and how well tested is it and or what specific flaws have they uncovered in existing research or thery?

</comment></comment></comment></comment></comment><comment><USER4> Wow, those scientists have balls to stand up against 'big warming' special interests...

</comment><comment><USER11> Show those hippies who's boss!

I didn't read the entire article, but this seems to be a great example of how you can take an assumption and manipulate data to fit that mold. Good example here: [http://scienceblogs.com/goodmath/2008/05/selective_data_and_...](http://scienceblogs.com/goodmath/2008/05/selective_data_and_global_warm.php)

Crichton has a book about how this happens all the time in environmental science. If you haven't read State of Fear, I strongly suggest it.

I think that the data is a non-issue. This is a rare occurence when interests are aligned from two sides of the spectrum. Reducing carbon emissions through less consumption is no longer some flower-child's dream; it has to do with US national security, global stability, and economic security. It may seem like alliterative nonsense, but it's what I believe.

</comment><comment><USER12> From M-W:

 _deleterious: harmful often in a subtle or unexpected way <deleterious effects> <deleterious to health>_

Just in case I wasn't the only one ;-)

<comment><USER13> If deleterious means harmful in an _unexpected_ way, wouldn't it be meaningless to sign a petition saying no _unexpected_ problems are _expected_.

</comment></comment><comment><USER14> Does it matter whether or not global warming is man-made?

In case anyone has forgotten, there are plenty of other benefits we get along with the switch to cleaner sources of energy.

<comment><USER15> benefits that include rapidly rising food prices because of all the farming resources being shifted towards producing biofuels.

<comment><USER16> The current approach with biofuels is a debacle -- algae is clearly the way to go. That said, biofuels are not the only thing that comprises "green energy". Solar, wind, geothermal all have their place.

Let's also not forget increasing energy efficiency and otherwise reducing waste that have direct economic benefits...

<comment><USER17> >Let's also not forget increasing energy efficiency and otherwise reducing waste that have direct economic benefits...

Then it should be profitable to do so without $billions of subsidies and draconian regulations.

<comment><USER16> Agreed. Those billion$ in subsidies going to coal, oil and nuclear don't make for much of a level playing field, do they?

</comment></comment></comment></comment></comment><comment><USER17> >"A review of the research literature concerning the environmental consequences of increased levels of atmospheric carbon dioxide leads to the conclusion that increases during the 20th and early 21st centuries have produced no deleterious effects upon Earth's weather and climate. Increased carbon dioxide has, however, markedly increased plant growth. Predictions of harmful climatic effects due to future increases in hydrocarbon use and minor greenhouse gases like CO2 do not conform to current experimental knowledge."

I'm pretty sure this is non-controversial. Most of the dangers of Global Warming are _predicted_ based on _computer models_ of the future. They are not, strictly speaking, empirical.

</comment><comment> patrickg-zill It seems to me that someone expert in the fields of either a) probability or b) statistics could rather easily review the current climate models and determine whether they respectively cover a) enough possibilities or b) determine a confidence factor for the collected data, in order to determine how useful the current climate models are.

My understanding of current climate models is that they are not sophisticated enough to model even the actions of the Gulf Stream in combination with what is happening on land, much less handle the Pacific High and whatever goes on in the Indian Ocean.

</comment><comment><USER18> How did this pile of crap make it to the front page of HN?

To make it more hacker friendly, check out the Open Source Debunking of the paper and petition from October 2007: [http://www.realclimate.org/index.php/archives/2007/10/oregon...](http://www.realclimate.org/index.php/archives/2007/10/oregon- institute-of-science-and-malarkey)

Now, that's real science: Peer reviewed, transparent, and, shockingly, based on evidence interpreted by people who understand it.</comment>