Privacy Absolutism - <AUTHOR> http://avc.com/2016/03/privacy-absolutism/ <comment><USER2> "Privacy absolutism" is the direct consequence of the Snowden revelations. If the government had not created such a massive apparatus spying on everyone, there'd be room for compromise (if technically feasible).

By creating secret courts, secret warrants or warrantless spying, the gov itself destroyed all faith in the possibility of a compromise that allows access where necessary while safeguarding meaningful privacy.

The NSA now has a profile of my porn preferences. Congratulation! I hope it was worth it – I've since enabled SSL on every domain I control, taught classes on the use of PGP and am one of thousands of non-Americans willing & able to create strong encryption messaging services it Silicon Valley bends to the Gov's demands. The NSA helpfully create a market and at this point any moral qualms I might have once had evaporated.

Reflecting back on the last decade, I feel like a case study in 'unwanted side effects'. I never was (and never will be) an Ayn Rand-style libertarian or one of those conspiracy-peddling bitcoin enthusiast. I've defended the primacy of the law as the only legitimate outlet of power in the face of hands-of-the- internet techno-anarchism. As I'm European, it should also be mentioned that I despise the Anti-american undercurrent so prevalent here, being able to recite most of The West Wing from memory. Hey, my major claim-to-fame is actually a widely-copied photo of Obama at his Berlin rally in summer '08.

But I've apparently made much of same journey as Apple has, which probably never foresaw that it would end it such an open confrontation with the US government (it must be bad for business to take sides in the culture wars).

In fact it seems possible that Apple or I actually never changed. Lesson: if you shift the Overton-window until the moderates become extremists, don't be surprised if they start behaving as such.

<comment><USER3> People say this a lot, but I'm not sure what it's supposed to mean. Ok, Snowden demonstrated that giving the USG centralized access to communications is dangerous. People don't trust the government. Now what? What's the effective policy response to this?

Crypto advocates (I am one of those) eventually need to stop pretending that there isn't a meaningful tradeoff here. In 10-20 years, everything is going to be encrypted: every phone call, every hard drive, every email, every photograph. That is going to pose real problems for the kinds of law enforcement cases that _everyone_ cares about.

That doesn't mean key escrow is a good idea, or that we should prohibit encryption. But saying "that's not going to be a problem" is just not an argument. You have to do better.

<comment><USER4> > _That is going to pose real problems for the kinds of law enforcement cases > that everyone cares about._

Those problems have existing solutions: Place a room bug where the evildoers meet. Use real-world physical surveillance. Track their movements.

The only thing you can't do with existing solutions is to scale them up to pushbutton mass-surveillance numbers. And that's only a problem if you want to use surveillance as a tool to suppress political/social movements, and our beneficent government would never do that.

<comment><USER3> I agree with you. That's something that frustrates me about the "Going Dark" debate. Crypto can pose real problems for justice and safety, and the answer _still_ probably isn't to suppress crypto. Maybe we should just do a better job of funding investigatory work?

<comment><USER5> > _Crypto can pose real problems for justice and safety_

Exactly like the worries of "shouting fire in a crowded theater".

If communication leads to an action that has _real world consequences_ , then criminalize and investigate the actual action. Don't take the lazy way and attempt to police communication.

<comment><USER3> I'm sorry, but I don't understand how this sentiment is responsive to anything I wrote.

<comment><USER5> "Safety and justice" are abstract concepts. Referencing them without discussing specific situations can only lead one to the conclusion that more is better.

I brought things closer to specifics, while needing to stay general, by asserting that any _real crime_ must have real-world physical involvement, which can always be investigated and policed.

It's always been possible to execute the "perfect murder", although few manage to accomplish it. I don't see how that could possibly change with the addition of bicycles for the mind, unless they lead to psionic powers.

What we're actually "debating" here is law enforcement getting a temporary boost due to criminals' misunderstanding of technology, and now fighting tooth and nail to hold onto the transient. Nobody was breaking out of jail and then posting about it on facialbook in 1950, so in 2050 when someone breaks out of jail and posts on e2e socialnet, police will simply have to use the same classic investigative techniques they've always had.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> And what happens when that capability is not given to those you trust but instead to your enemies or state actors with vast human rights abuses?

Not mentioned in this article is the cost of those we do not trust having the same keys in the locks, and the power that it would give them, simply saying that this new position is "absolutist" when in fact it is exactly the same as before.

The TSA key and the elevator key were recently leaked and no one can put that genie back in the bottle without replacing all the locks in the city/luggage.

If you design your locks with a fail-safe built in then it will only take someone with specific knowledge of that fail-safe to use it; saying we should just back down and that this is just Silicon Valley misinterpreting existing thought is a complete mischaracterization of the facts and vast new authority the government wants granted.

<comment><USER7> The point is that society has already figured out and agreed on these issues. This is not about a dragnet but specific situations where there is a warrant.

I think we've all been so scared by all the dragnet activity the NSA/FBI have been conducting that we want to throw the baby out with the bathwater.

<comment><USER8> The problem is that the existing societal solutions have a pretty hard bottleneck: It requires a physical person to show up at your door with a warrant to "rifle through your underwear drawer" as the president put it. It's relatively hard for someone else to take advantage of this (though, put on a fake police uniform and bring a fake warrant and you can probably get into most people's houses while risking some really nasty charges).

With encryption, any solution I've seen suggested has the risk of mass use by the government in addition to allowing other people besides the government to use it.

<comment><USER9> This is an incredibly important point.

It is arguably baked into the nature of policing that such institutions will over-reach their authority and attempt to consolidate it. Usually for all the right motivations, but they have systematic blinders to the unintended consequences and risks. For this reason, there _must_ be effective counterbalances, and demonstrably court and board oversight is insufficient.

Hence it is important that for some actions that police are legally enabled to do, they remain too expensive (in time, manpower, money, whatever) to do habitually or without thought and prioritization.

Pretty much any technological advantage that facilitates parallel construction should probably be resisted for this reason.

</comment></comment></comment></comment><comment><USER10> I appreciated the President's thoughtfulness on this issue, but this post doesn't add anything beyond a "Me, too!" to what Obama said.

He links to this article:

[http://continuations.com/post/139510663785/key-based- device-...](http://continuations.com/post/139510663785/key-based-device- unlocking-questionidea-re-apple)

Which ends:

"I would love to hear from folks who really understand security if such a scheme would work or not (and/or point me to people who have thought about this)."

So again, very little added to the conversation. This really is one of those cases where a lot of technical expertise is required to usefully comment, and I appreciate Obama conceding as much at SXSW. But there seems to be many others just throwing out magical solutions without understanding whether or not they would actually work in practice.

<comment><USER11> yup. that is all i wanted to say. i agree with the president.

</comment></comment><comment><USER12> No, it isn't. You are wrong.

You're comparing apples and oranges. The correct comparison is getting a warrant to search someone's house and finding a piece of paper with a strong cryptogram on it. They plead the fifth, and the story ends.

The secret that unlocks the cryptogram belongs to the owner, not to Apple or anybody else. It lives in their mind. You can get a warrant to search someone's house, but you cannot compel someone to share a secret. That has been true from day one, but you're trying to weasel your way around this fact because you're afraid of terrorists and you trust the police.

Sorry, but it just doesn't work that way.

<comment><USER3> Are you a lawyer, or have you studied 5A jurisprudence? My impression is that it's not as simple as you're making it out to be. The 5A doesn't prevent a bunch of other compelled incriminating actions, and compelled production of passwords may eventually survive 5A scrutiny at SCOTUS as well.

Prohibitions on compelled self-incrimination predate the bill of rights, and were intended as a measure to limit torture, not as a general privilege of the accused to conceal evidence.

<comment><USER12> No, I'm not a lawyer, and I'm deliberately simplifying my example to make an argument.

However, I have looked into 5a jurisprudence, and fully agree that there are some scenarios that are not so simple, e.g. if they really did have certain other evidence against you that specifically suggests what is in the cryptogram, and/or that it is pertinent, then you could very well end up in jail indefinitely for contempt of court.

In this instance, I strongly suspect that my simplification is justified because in the San Bernardino case and the myriad others that are on the FBI's short list, they are fishing in order to gain a general precedent that they do not currently have. They want to be able to compel you to release a password even when they don't have any evidence suggesting what is in the cryptogram, arguments for why it is pertinent, etc.

<comment><USER3> I personally think people should prepare themselves for a future in which compelled production of passwords (or, at least, compelled unlocking of devices and documents) is the norm. The 5A argument about crypto seems really flimsy, and allowing compelled unlocking seems constitutionally more straightforward than a ban on strong cryptography.

<comment><USER13> Doesn't this simply lead to the development of better deniable encryption products?

<comment><USER3> There is less organic pressure for deniable encryption than there is for end- to-end encryption, because the latter is helpful for general-purpose security, and the former is not.

<comment><USER13> I dunno, it's a weak argument, but bad guys can't put effort into attacking that which they don't know exists either.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Commenter @charlieok on that site had a great point:

"...If we were to invent a technology to read peoples thoughts should the state demand the absolute right to access our thoughts because after all the bad minds can not be allowed to go dark? This decision is that decision. ..."

</comment><comment><USER15> People keep talking about an elegant solution, but from what I understand, there can't be. Either I'm the only one with a key to my home, or some third party also has a key. And we've see recently that there is no third party that can be completely trusted. Well, maybe with the exception of my Mom. Everyone's mother gets their encryption keys? :)

<comment><USER4> What's the difference between the two sides of this debate?

One side can point to a viable, proven, secure implementation around which there is a consensus of experts.

The other side is begging, threatening, and otherwise haranguing those same experts to implement their wishful thinking.

</comment></comment><comment><USER16> > I am saddened by the tech sector's absolutist approach to this issue

Is this guy living in the same universe as the rest of us? Keeling over on this would just be a final act of surrender regarding any semblance of privacy defenses.

<comment><USER17> _Keeling over on this would just be a final act of surrender regarding any semblance of privacy defenses._

If warranted government access represents a _final_ surrender and not the _first_ surrender, we've already lost privacy defenses ages ago.

In a world where consumer privacy is invaded by hardware vendors, software vendors and service providers with data to sell. All without a second thought whenever there is a whiff of profitability, what are we even holding on to? When I don't have and can't get root on my own devices, do we even have privacy defenses in computing to begin with?

Never installing software or ever visiting a website isn't a defense. It's a cop-out to pretend like the existence of that option somehow means we're not all already fucked.

</comment></comment><comment><USER3> I guess it's sort of brave for him to come out and say this, since Wilson's livelihood depends in part on his relationship with the tech industry, which is on this issue as he describes it.

But it's just not enough to point out that the people are entitled to every person's evidence. For that principle to have any sound control over engineering, we need a means for evidence to be produced in court cases but not coughed up to extralegal procedures by the DoD or other countries. Nobody knows how to do that right now.

I'm unlike virtually all of HN in that I think both Obama and Wilson are raising a valid point, as are the "Going Dark" campaigners. But just because the argument is valid doesn't mean that we should build weaker security. We may have to live with real, meaningful challenges to law enforcement for years or decades while we work out a response to the problem.

<comment><USER18> The problem with their point is that it it's a fair-weather argument. It sounds perfectly reasonable in a world of good-faith actors, and a checked and regulated law enforcement, filled with upstanding moral officers.

And even if you trust the current government, how can you trust a future government to continue acting in the best interest? Maybe abuse won't happen today, but what are your guarantees that it won't happen in the future?

Also, we live in a world where there are still plenty of totalitarian regimes. If, for example, Apple develops this capability and give it to US law enforcement, every single totalitarian regime out there is going to demand access to the same thing for their law enforcement, and then we know they are going to abuse it.

</comment></comment><comment><USER19> This article signals that big VCs have officially become a part of the establishment (lobbying, hosting Obama dinners, etc), and Fred Wilson is volunteering to plead compliance to the powers above.

<comment><USER20> That was my reading too. This isn't a post for public consumption; this is a coded communication to the U.S. national security apparatus that Mr. Wilson is willing to play ball.

Of course, he could have just emailed anybody with the same message, and they would have gotten it...

</comment></comment><comment><USER21> Unbreakable encryption exists. Trying to legislate it away is like trying to stuff the genie back in the bottle.

There is no way to prevent "bad guys" from writing encryption software and installing it on programmable devices; you can find the code for AES in under one minute, written for any language you desire. It takes an undergrad level of programming ability to create a functioning app that does basic AES encryption. So ISIS just needs one programmer with this ability -- and somehow I doubt that person is going to give a copy of the master private key to law enforcement.

To the extent that governments prevent unfettered use of encryption in mainstream devices, "bad guys" will just use rasbperry pi's, custom ASICs they get fabricated, etc. Programmable devices capable of running strong ciphers and communicating over the internet are absurdly cheap now.

Limiting the use of cryptography would therefore only harm stupid and non- resourceful criminals, and regular people with something to hide. Which is everyone, kind of.

<comment><USER22> I think this is the operative point. Even if we agreed on some key escrow system and mandated its use on common devices, that would just make strong crypto somewhat harder to get. You can bet a thriving black market would spring up in no time to serve the need.

The choice is not between a world where bad actors can communicate securely and one where they can't. The choice is between a world where everyone can communicate securely and one where _only_ criminals can do so. "If strong crypto is outlawed, only outlaws will have strong crypto", one might say.

</comment></comment><comment><USER18> The problem isn't with ways for law enforcement to access all your communication with a warrant, for probable cause, on the suspicion of wrongdoing, by upstanding law enforcement officers, and fair trials.

The problem is the potential for abuse. When your secrets get leaked, when they're used unlawfully, when they get in the wrong hands, when the humans who have access to it do the wrong things, if the wrong people get elected, if the wrong laws get enacted that enable more abuse, if another McCarthy comes along and sweeps people up in hysteria.

And that is why we must support strong encryption without backdoors, for everyone, upstanding citizens and criminals alike. The positives simply don't outweigh the negatives.

</comment><comment><USER23> First, I love it when the language in a debate evolves. Everyone for secure communication is now am absolutist. It's like what was attempted with pro- life. Oh, so you're anti-life?

What a horrible argument though. We should ban a readily available technology so the average consumer's communications are no longer secure? Anyone who has half a brain is going to just download non backdoored technology (or write it themselves) when they need to communicate securely. Most criminals committing major crimes are smart enough to be this careful.

Also, saying the tech sector is libertarian? I'd give up the majority of my income to taxes if it meant no one went hungry. I still believe in a right to privacy and secure communication. My mom would never send personal information (credit card mainly) over text when I was younger. I thought she was nuts. Now I see how right she was when learning about stingrays and other cell site simulators.

You can call me a privacy extremist if you want, and paint me in there next to all the other extremists. If you ever start looking into how broken our communication systems currently are, and how easy it is for criminals to eavesdrop, you'll likely become an extremist too. Political movements can also change rapidly. Backdoored communication means to can be targeted politically, for your race, religion, sexual orientation, and opinions. I'm not willing to gamble on the government's good nature now nor in the future.

</comment><comment><USER24> "Absolutist Reality Distortion Field" or "I Want to Believe"...

Nothing new here, just another VC who apparently doesn't understand core concepts and repercussions of his favourite "industry".

</comment><comment><USER25> What this misses is let's take say me as an 8yr in the eighties and an eight year old today...there was no way to subpoena conversations with ones parents, the comics you read, music you listened to, etc. none of that was recorded...

</comment><comment><USER4> Freedom and police power has evolved over history. It is highly tendentious to claim that proliferating strong encryption would overturn any particularly strong legal tradition. It would simply make _some forms_ of electronic surveillance less useful. Encryption had been used long before mass telecommunications with no negative impact on law enforcement. Law enforcement will adapt to the lack of useful wiretapping if it needs to, and the means to adapt are in use today: placing bugs, physical surveillance, etc.

</comment><comment><USER26> I think the only way the house search warrant vs. phone search warrant comparison would work is if there was a way to know that someone used a warrant to sift through your data. You can know the police has searched your home because doing so requires physical access to the house. If there is a way to use a private key to access your data, anyone could use that key to access your data and you will never know about it. And that is really scary!

<comment><USER27> That's not necessarily true RE physical search warrants: [https://en.wikipedia.org/wiki/Sneak_and_peek_warrant](https://en.wikipedia.org/wiki/Sneak_and_peek_warrant)

<comment><USER26> But still, nothing prevents you from having cameras hidden throughout your house. There still needs to be physical access to the house. Where encrypted data can be distributed anywhere and decrypted without trace, there is only one copy of a house and it is yours.

</comment></comment></comment><comment><USER28> So, when they get everything they want ("no absolutism" implemented by US companies), will we finally be able to explain to them it was all for nothing (except making the public less secure) when the next big attack uses open source non-backdoored encryption, maybe even routed through companies not under the US's jurisdiction?

</comment><comment><USER29> I can understand where Fred is coming from, and I think Obama's statements on the matter were actually pretty thoughtful. But writing this article without mentioning the fact that the "warrants" that are being granted to law enforcement have grown more dubious by the year is incredibly insincere.

</comment><comment><USER30> No, the proper analogy to locking down a computer is locking secrets away in your mind and as of this writing, that's still mostly protected by both the 4th and 5th Amendments of the Constitution. I cannot be compelled to testify against myself and neither should my electronic devices which are no more than an extension of my mind. Of course idiots like the author of this article want to literally create something that's impossible, the have your cake and eat it too approach to security that has never worked and cannot possibly work. Yes, it's these kind of idiots we should be looking for advice from, people who don't even understand the basics of computing, mathematics, or even their own reality, people who defer to our technologically handicapped president as an authority on technology.

</comment><comment><USER31> > if there is probable cause to think that you have abducted a child or you > are engaging in a terrorist plot or you are guilty of some serious crime, > law enforcement can appear at your doorstep and say we have a warrant to > search your home,

How exactly is this supposed to work? Are we pretending that real criminals are suddenly going to stop using safe encryption just because it's illegal? That just doesn't make sense to me.

I mean the software is out there, how are you going to stop people from using it? Or are we going to decrypt ALL the traffic, all the time just to make sure everybody still uses our weak crypto? That seems just as "absolutist" as perfect encryption.

I just can't see any middle ground here.

</comment><comment><USER32> So, let's say the U.S. tech sector compromises. Who outside of the U.S. is ever going to use software, hardware or services developed by the U.S. again?

Second, I completely agree with others that, well, the government has brought this on itself.

</comment><comment><USER33> If American technology is generally back-doored for access by US government agencies, nobody elsewhere on the planet will want to touch it.

Heck, the contract cancellation-zilla that already started with the Snowden affair will just start snowballing.

With technology pretty much permeating everything, it means that it may no longer be possible to export almost anything to other countries. Get used to widespread rampant poverty now already, when international trade will be mostly gone.

The FBI say that all they want is to protect the United States, and indeed that will become much easier to do when there will be pretty much nothing left to protect! ;-)

</comment><comment><USER34> Sometimes when I read the news these days I shudder with the fear that we are rapidly approaching the dystopian nightmare many of us who grew up in the Cold War era came to fear. We were taught that a favorite saying by the Soviet "subjects" was "The walls have ears."

I read a story in elementary school about a child (my age at the time) preparing for a State exam. His father was answering questions (quotes are approximate):

"Dad, why are the leaves green?"

"Nobody knows."

"How far away is the sun?"

"1000 miles."

The father was concerned that his kid might get too many questions correct on the exam. Kids who were too smart disappeared,

Hopefully Mr. Wilson would agree that if this goes through then we need a serious fucking discussion about these "warrants" that are "required" to get private information.

One of problems we have now is that the warrants are too easy to get. And they can be kept secret. There is no harm in trying, so the feds might as well keep trying. The FISA court contains judges that are hand-picked by the Chief Justice of the Supreme Court [1], which can leave the FISA court dangerously single-minded. Perhaps new laws compelling law enforcement to be open and transparent about what it is trying to acquire would be enough, but I am suspicious.

A second problem centers on the legal justification for the validity of the National Security Letter- the letter that the FBI can write to get information from things like libraries. The (legal) legitimacy of the process for aquiring an NSL (which does not require judicial oversight) rests on the idea that the target has no expectation of privacy to the information being obtained. If they put in a back-door to our private communications, then it could be argued that we now have no expectation of privacy for our phones (etc.). So I'm afraid that lowering the technological barrier may coincidentally lower the legal barrier.

[1] [http://www.fisc.uscourts.gov/about-foreign-intelligence- surv...](http://www.fisc.uscourts.gov/about-foreign-intelligence-surveillance- court)

</comment><comment><USER35> We don't have to abandon the framework at all. The framework never guaranteed law enforcement would have a resource to access. It just says we have to obey the warrant. So, if only I can unlock the device, I can be ordered by a court to unlock it for a search. If I don't, I can be put in jail. So, Congress would just need to pass laws strengthening that principle to achieve what FBI claims to want.

Far as what Fred asks for, the best minds in cryptography (and breaking it) looked at the past of industry and present of CompSci to see if that was feasible. The consensus is that it was impossible to design a backdoor for FBI that wouldn't be used by foreign intelligence services or breached by hackers. The write-up of that is here:

[https://www.schneier.com/cryptography/paperfiles/paper- keys-...](https://www.schneier.com/cryptography/paperfiles/paper-keys-under- doormats-CSAIL.pdf)

My own background is high-assurance security: the kind of rigorous engineering designed to stop nation-states. I have an idea of what works and doesn't. I disagree with the authors that we can't make a backdoor for selective access. We do it all the time under banner of remote administration, VPN's, etc. Crypto in general, damnit! My concerns were hackers accessing all data, FBI reading more than allowed, and FBI/hackers having write access that allows forgery. My attempt at a read-only, high-assurance mechanism for law enforcement is here:

[https://www.schneier.com/blog/archives/2014/09/fake_cell_pho...](https://www.schneier.com/blog/archives/2014/09/fake_cell_phone.html#c6679179)

Note: That post reads like I'm in favor of surveillance or something. The context is a situation where courts or Congress forces L.E. into systems. My L.E. scheme is insurance policy against broader ones.

The design lets Feds and courts get what they need while restricting access, esp write access. Such designs can be made arbitrarily difficult for attackers without access. Consumer devices and anything cost-sensitive will have limits. The hardware levels can be hit, esp with emanation attacks. U.S., U.K., Israel, and Russia have that tech. So, there's residual risk of attack that has to be mitigated.

However, the bigger problem is key management. The Fed's original proposal was escrowing the keys to them. The FBI, DEA, and NSA have a long history of poor security leading to leaks, infiltration by foreign intelligence, corruption, and occasionally targeting Americans. I question giving them any full L.E. power to begin with but they certainly shouldn't hold the keys if one is mandated. That means companies will hold the keys themselves protecting them with recommended means (esp HSM's). HSM's themselves have same security issues, esp w.r.t. intelligence agencies, but we'll ignore that for now. ;)

So, the problem then changes from protecting ephemeral communication (like spoken words) to protecting keys to records that will be kept for years. If not initially, government will pass laws to mandate it like they've done here to a degree and in other countries. You have to realize, though, that a product as popular with elites and government as an Apple or Android phone will lead to tons of people's secrets consolidated into hands of a few companies. That's incredible power for them to wield. Let's say we trust them, though.

This leads to the biggest counterpoint I heard in my exploration of lawful intercept. Dirk Praet, well-versed in IT and military INFOSEC, put it something like this: "Nick, let's say you deploy high-assurance L.E. in devices and every security method you can to protect escrowed keys. Once secrets pile up in one place, you must realize that _every intelligence agency, hacker, and organized crime group on Earth_ will be coming for it. You might be smart enough to stop many of them. Will you bet you're smarter than all of them combined?"

I'm confident in myself but not dumb enough to place that bet. My L.E. design might be implemented for remote administration, etc for voluntary use in companies. Yet, after thorough exploration, I strongly recommend against any escrow or backdoor mechanism because it puts us at risk against people who otherwise had limited potential to harm us. It also piles up the risk, too, once laws show up mandating retention of communications. Instead, we should focus on penalizing refusal to allow a search and implement methods to ensure the search is honest.

<comment><USER36> > I disagree with the authors that we can't make a backdoor for selective > access. ... However, the bigger problem is key management.

That right there is _why_ we can't make a backdoor for _selective_ access. The Bad Guys _will_ get the credentials to access the door, (or they'll be inside the Good Guys' organization) and they'll walk right through the door.

Past experience has taught us that law enforcement and government _both_ want backdoors to be quick and rather hassle-free to use. This -obviously- is at odds with a paranoid credential management scheme.

> ...I strongly recommend against any escrow or backdoor mechanism... Instead, > we should focus on penalizing refusal to allow a search and implement > methods to ensure the search is honest.

1) Heh.

2) If a manufacturer ships a crypto system that _cannot_ produce plaintext on demand (and cannot be modified and field-upgraded to do so) and _requires_ physical access and sophisticated hardware tampering to defeat, will this be considered a "refusal to allow a search"?

<comment><USER35> Here you go. Two useful essays on this topic:

Operating an online service with resistance to U.S. TLA's [https://www.schneier.com/blog/archives/2013/10/a_court_order...](https://www.schneier.com/blog/archives/2013/10/a_court_order_i.html#c1945655)

Related work on securing a service like Tor against NSA-level attacker [https://www.schneier.com/blog/archives/2014/09/identifying_d...](https://www.schneier.com/blog/archives/2014/09/identifying_dre.html#c6678915)

<comment><USER36> > Operating an online service with resistance to U.S. TLA's > [https://www.schneier.com/blog/archives/2013/10/a_court_order...](https://www.schneier.com/blog/archives/2013/10/a_court_order..).

The second half of this is largely hand-wavy technobabble. The first half or so of it doesn't apply to the system we're describing.

> Related work on securing a service like Tor against NSA-level attacker > [https://www.schneier.com/blog/archives/2014/09/identifying_d...](https://www.schneier.com/blog/archives/2014/09/identifying_d..).

Similar song to the first one: _Oh_ so much of that is completely unrelated to the topic at hand (which is -to wit- design of a high-volume (think hundreds of signatures per day), _very_ low-friction, audited code signing system that creates images signed with what is -for all intents and purposes- the same key that's used to sign the official, aboveboard builds of the software).

I also notice that you didn't answer my question.

<comment><USER35> "The second half of this is largely hand-wavy technobabble. The first half or so of it doesn't apply to the system we're describing." "Similar song to the first one: Oh so much of that is completely unrelated to the topic at hand "

You got a talent for dismissing without reading. If you did, you'd have guessed that I implemented the second scheme in _something_. That actually included signed messaging and code operating at 10Mbps wirespeed. Besides, if an 8-bit CPU can do ECC/RSA ops in 0.x-3sec, then why would you think GHz CPU's w/ HW acceleration couldn't do a few hundred signatures a day? You running your infrastructure on 4-bit CPU's handwired with TTL chips or something?

"high-volume (think hundreds of signatures per day), very low-friction, audited code signing system that creates images signed with what is -for all intents and purposes- the same key that's used to sign the official, aboveboard builds of the software)."

You said low-friction, high-speed, no "techno-babble," and implied it shows resistance to NSA/FBI scheming. That's impossible to answer given your constraints.

"I also notice that you didn't answer my question."

A non-technical, low-friction answer to that is possible. Let's revisit it.

"If a manufacturer ships a crypto system that cannot_ produce plaintext on demand (and cannot be modified and field-upgraded to do so) and requires physical access and sophisticated hardware tampering to defeat, will this be considered a "refusal to allow a search"?"

No law says it's illegal for private party to buy intercept proof equipment unless it's radio. There's foreign countries that don't restrict crypto. So, buying one from a foreign country is legal if it passes import approval. Using it is legal. When hit with court, one must show reason other than dodging the law that the information can't be produced to dodge obvious prosecutor argument. My prior scheme on that is resistance to attacks on personnel by organized crime or foreign spies via extortion, kidnapping, torture, etc. Easier to resist them compromising everything in permanent, stealth fashion if that's impossible at manufacturing time. So, legal to buy, a justifiable reason for it, and finally great lawyers for presentation. There you go.

No guarantees, though. Our laws are subject to court interpretation. That can be good or bad for the accused.

</comment></comment></comment></comment></comment><comment><USER34> Wow- this think tanked quickly off of the front page. With 35 points submitted 4 hours ago, it is on page 7- below a story submitted one day ago that only has 6 points. Is this an intervention of the mods?

</comment><comment><USER37> The problem is that surrendering encryption would not restore the old pre- encryption status quo. It would give government and state-linked actors absolutely unprecedented ability to observe, surveil, and monitor our activities now (and in real time) and in the past. These are not old abilities. They are abilities that have never existed.

When the government gets a search warrant to go and rifle through your sock drawer, they do not gain access to:

\- A complete history of every physical movement you've made in the past several years to an accuracy of 1-4 meters.

\- Every private correspondence you've made in the past several years.

\- The history of every home automation device in your home and how it was used.

\- Personal health and body monitoring data for years (if you use personal health monitors, etc.).

... and so on. As this technology advances the amount of information things can passively collect is going to keep growing exponentially.

Modern Internet-connected device-embedded computing devices log, collect, and can reveal more information than has ever been available in all of human history. Without encryption we're living in glass houses -- a true panopticon.

Encryption is critical if we are to have _any_ hope of implementing a "smart" automated future without surrendering _absolutely all_ privacy forever.

In the further-future (maybe not as far as we think) I can imagine things with direct neural interface to the human brain. That's where we might be going. Surrendering encryption and strong security as we head into that kind of world is a recipe for insane dystopian scenarios.

The old world is gone. The old status quo is dead. There is no "balance" that can be legislated that will restore it. The new world is a qualitatively different place where completely different rules and balances apply. In the new world we face a binary choice between absolute panopticon and total surveillance or an unparalleled level of individual privacy. There is no middle ground -- because _math_ says so. Information is either encrypted or it is not. In security systems are either secure or they are broken. It's binary.

I actually think most of the people in this debate -- on both sides -- fail to realize just how dramatic this shift is. This is literally the end of an age of human history, and the relationship between individuals and governments (and "society") is about to be radically redefined in ways that _many_ people (liberal, conservative, even libertarian) are not going to like. I know there are aspects of it that I don't like, like the strangely intimate relationship that is emerging between software and "cloud" vendors and human beings, but I don't see these things changing and I think the best reaction is try to work through the implications and figure out how to deal with them than to dig in and resist time.

Edit:

But "it can't happen here!"

Donald Trump is a credible presidential candidate, and has said things like "maybe he should have been roughed up" about protestors. Any power we give to Obama will be passed along to the next administration, and the next, and the next, and the fact that someone like Trump can even be _considered_ should be a reminder that we cannot bet on future leadership being any better than present leadership. If you're right-of-center, replace Donald Trump with Hillary Clinton or Bernie Sanders. They are also credible candidates, and they too would inherit the panopticon we're building. Every power you grant to the current government will be possessed by _all future governments_ \-- including many you don't like -- and once granted a power is very hard to revoke.

 _No society_ can bet on its future leadership being perfect. That's an impossible pipe dream. Any society that lasts for any length of time is going to weather periodic episodes of fanaticism or corruption.

The way you stop it from "happening here" is by _limiting government_ so as to prevent moral hazard. That way you can weather an awful leadership without descending into tyranny or collapse. The reason we don't live in a corruption- ridden hellhole or a totalitarian dictatorship is because we have laws, procedures, and customs that limit government. Those limits allow criminals to get away with crimes, but that's one of the costs of preserving a nominally free and open society. The alternative is to load up on moral hazard and then wait for the first corrupt or fanatical government to trip over it.

<comment><USER25> The idea of "going dark" is laughable if one extends the time line previous to say the late 90's,

</comment></comment><comment><USER38> I have two words to counterpoint:

President Trump

<comment><USER39> What polls show Trump winning against any Democrat?

</comment></comment><comment><USER40> This article links to another blog post where someone yet again proposes not just one master key, but a unique master key for every device manufactured (which would then presumably be protected by a master master key ... it is, as they say, turtles all the way down). But once again, someone will get a hold of that super-master key and it's game over.

Personally, I'm more afraid of the government/law enforcement (and by that I mean not just the US, but every country's government and law enforcement) having access to this. So maybe the US isn't looking at my data - after all they said they'd only look if they have a warrant[1] - but what's to stop the rest of the world? I'm not a citizen anywhere else, so there isn't any legal framework protecting my privacy there.

And besides, the LEA argument that having encryption they can break being no different than having houses, safes, safety deposit boxes, etc. accessible with a warrant is complete bollocks. If the technology existed which let a burglar break into every house in the world with a particular sort of lock, simultaneously and undetectablely and get away with the _entire_ contents of said house, these same agencies would be demanding better locks for everyone (well, actually they'd probably be demanding regulations on who can have access to the "be everywhere at once" tech and insisting that they needed it to fight terrorists and pedophiles). But make no mistake, that's what having an "encryption master key" means. It doesn't mean "great I have this super key, now when I burglarize houses I don't need to smash the door in", it means "great, now I can break into every house and no one will even notice until all their stuff is on eBay".

I don't believe that government/law enforcement should have this capability and I certainly don't believe that investigating a couple of _dead_ terrorists (or live ones for that matter) is worth giving up our privacy, but if this sort of tech is going to be required, at the very minimum using it must require physical access to and irreversible modification of the target device. For example, this mythical magic decoder ring device should have to work like so:

If I understand correctly how the security on iPhones works, your passcode is used to unlock a private key which is then used to decrypt your data. If a copy of that private key is also encrypted with an asymmetric cypher and different, per-device keypair and the private half of that keypair is stored in a special chip (which I describe below), then this should be pretty safe.

1\. Get a warrant to take physical possession of the target device 2\. Dismantle said device and remove the chip with the encryption keys 3\. Insert the chip into the decoder machine 4\. The decoder machine burns out one-time fuses (via pins which are left physically disconnected in the target device) in the encryption chip which enables access to aforementioned second private key (which is unique _per-device_) and prevents the device from working should the encryption chip (or a replacement) be reinstalled[2] 5\. Data is decrypted using this copy of the private key 6\. Now it is very obvious that this has been done, it isn't feasible to do it on a large scale and _no one_ is doing it remotely.

If you're still concerned that there may exist a remote exploit (and those fears are justified, even though as far as I can tell it should be impossible because the hardware to blow the fuses doesn't even exist in the target device), add an additional constraint that blowing those fuses also removes power from the radio baseband chipset, physically and permanently disconnecting the device from all networks. The obvious issue here is the potential for extreme mayhem if someone figures out this exploit, instantly bricking 100's of millions of mobile devices.

I'm not saying that this is a good idea or that we should back down from a pro-encryption stance, but if it comes down to some stupid law requiring such a thing, acting upon it must be _at least_ as difficult, time consuming, and apparent as my proposal above.

[1] I don't believe them, but that's not actually relevant [2] This is probably the most hand-wavy part, but technically feasible I think

</comment><comment><USER41> Okay. You first.

</comment><comment><USER42> No its not, anyone who thinks so does not understand the relationship between the state and its subjects

</comment><comment><USER43> I disagree with him, but even if tech companies were to compromise on this issue they should get something in return. Like tell the government to stop writing idiotic laws about the internet for example.</comment>


Thoughts on the American Airlines rebranding — and aircraft design in general - <AUTHOR> http://nquo.tumblr.com/post/40779163271/american-airlines

<comment><USER2> >Still undecided about in-flight wi-fi though — it's one of the very few chunks of time we have left where we can truly disconnect and go offline nowadays.

Wow, this guy and I have very different flying experiences. I have yet to have anything close to a zen like experience with the child behind me kicking my seat, the baby in front crying, and the fat guy next to me sweating profusely.

The first airline that offers adults only (weight limit apply) on select flights will get ALL my business.</comment>


Free SSD based web hosting - <AUTHOR> https://haydenjames.io/free-ssd-based-web-hosting/ <comment><USER2> you keep posting links to essentially the same website...</comment>


Hacker News News Feed for the Mac Touch Bar - <AUTHOR> https://github.com/mrmekon/toucHNews <comment><USER2> It's written in…Rust? That's interesting. How is it interacting with Cocoa?

EDIT: It looks like it's using the rubrail package, which links with the private DFRFoundation framework. rubrail itself is using the objc package. I think this code snippet from the README[1] is enough:

      let cls = Class::get("NSObject").unwrap();
      let obj: *mut Object = msg_send![cls, new];
      let hash: usize = msg_send![obj, hash];
      let is_kind: BOOL = msg_send![obj, isKindOfClass:cls];
      // Even void methods must have their return type annotated
      let _: () = msg_send![obj, release];

Ugh. Why?

[1][https://github.com/SSheldon/rust-objc](https://github.com/SSheldon/rust- objc)

<comment><USER3> It should be still rewritten in rust.

<comment><USER2> What? Cocoa, or toucHNews?

<comment><USER3> It was just a meta joke :) I hope it can be tolerated.

</comment></comment></comment></comment><comment><USER4> This is definitely interesting and well excuted, but there are two problems which prevent me from using this regularly. These are, of course, just my opinions and I completely understand that others may disagree:

Firstly, the interaction paradigm doesn't really make sense. Swiping should advance / go back, not open or hide, and tapping on the headline should open the link in the browser. The headlines should automatically cycle through with a customisable delay, or work like a scrolling ticker system.

Secondly, there's no way to view the HN comments on any given article, since swiping takes you directly to the article. If I read an article linked on HN while I'm browsing here, I am invariably more interested in the discussion surrounding it than the article itself. Ideally, tapping the headline would open the comments on HN, and I could then open the link to the article myself if I choose to. Alternatively, a short press could open the article, and a long press could open the comments, or something like that.

Overall, I really like the concept, and I especially like the fact that it turns the Touch Bar into something actually useful for a change, but I can't see myself using this app without the above changes.

EDIT: I don't seem to be able to quit the app, either. I had to kill the process since tapping on the "x" button didn't do anything.

</comment><comment><USER5> I love my MBP, I think its the best yet.

But the touch bar is pretty pointless, I would rather have just paid less money or gotten better hardware.

Maybe if I use an app that uses it effectively my opinion will change.

<comment><USER6> Apparently there's touch bar support in the Mac emacs branch

<comment><USER7> Interesting! Got a link for this? I haven't been able to find anything yet. Edit: don't tell me I missed the sarcasm!

<comment><USER6> It was just a tweet I saw. The port of Emacs in question is this one: [https://bitbucket.org/mituharu/emacs- mac/overview](https://bitbucket.org/mituharu/emacs-mac/overview)

</comment></comment></comment></comment><comment><USER8> If they wanted the top row to be flexible, I would have prefered individual keys with an eink-style surface that could change, but would look completely normal otherwise.

<comment><USER9> It would be nice if it were like the Optimus keyboard [1], but I understand why they didn't do it. I would remove a lot of flexibility for sliders and variable size keys.

[1] [http://www.artlebedev.com/optimus/](http://www.artlebedev.com/optimus/)

<comment><USER10> It would also cost a lot more.

</comment></comment></comment><comment><USER11> I don't actually have a touch bar to try this out, but the UI controls seem a little non-intuitive to me. Wouldn't it make more sense to tap to open and swipe to advance to next item? Those are pretty standard interactions.

</comment><comment><USER12> Without auto scrolling through the headlines, this is kind of useless in my opinion.

And clicking the X on the right doesn't quit 0.3.1 for me, I installed the prebuilt package, had to SIGKILL the thing.

TouchBar Piano retains the crown as basically the only good TouchBar app. Which says all you really need to know about the TouchBar.

<comment><USER13> Is there any touchbar app that just shows configurable buttons that you can use for performing certain functions?

</comment></comment><comment><USER14> Anyone who has the new model w/ Touch Bar can comment on the usefulness of it, now that it's been out for a while? Do you ever used it / still use it daily?

<comment><USER15> I got a MBP this last refresh. I'm a programmer.

Touch Bar is a nice incremental advance. Not having a physical ESC key is not as bothersome as I expected. In fact, I don't notice it at all. Disclaimer: I don't use vi.

I like the media control modes, and am looking forward to content creation apps (ex: Ableton) making use of it.

I'd be sad if it were taken away, but it wouldn't prevent me from getting work done. It's a nice-to-have extra.

Also, the new keyboard is _fantastic_. I love the keys, and my external keyboard is now a buzzkill and I can't wait for Apple to refresh the Magic Keyboard with the new switches.

I have never accidentally hit the touch bar.

<comment><USER16> Are you able to use the arrow keys? From what I've heard, most people have a problem with them.

I think I could get used the keyboard overall, but the arrow keys (with full- height left/right keys) were a complete no-go. There's so little space between each key I found it impossible to position my hand over the arrows properly.

I was completely ready to buy a new MBP but those arrow keys put an immediate end to that thought.

<comment><USER17> I've been using it for a month and I often hit the up arrow when I want to press down. It's strange as I have used SP3 keyboard for a while now before where the up and down arrow keys are half sized without issues. I think I'll get used to it and don't think it's a deal breaker

</comment></comment></comment></comment><comment><USER18> The best I can say about the Touch Bar is that I'm able to customize what the function keys can do in whatever placement I want. Overall its OK, but I don't use it the way Apple intended. I do wish the ESC was a hardware key.

[http://imgur.com/a/no8MQ](http://imgur.com/a/no8MQ)

<comment><USER19> I remapped my Caps to Esc, and recommend doing the same; as a vim user it's great.

<comment><USER20> I tried that configuration, but I found it's too easy to accidentally flick it with my finger and pop myself out of insert mode, and ended up going back to the default (with CapsLock completely disabled). I think Esc's placement far from the home row is intentional.

</comment></comment></comment><comment><USER21> I'm on the market for a new laptop. Not a fan of the touchbar, and Surface only goes to 512gb.

And turns out those two are the only professional-ish laptops you can actually see in stores. At least here in Vancouver, the only things stocked at Best Buy etc are Mega Gigatron Gaming Ultra XXXL-sized laptops, underpowered $299 laptops for your mom, and super svelte Macbook Air copies.

I know for a fact there's product lines such as the Dell XPS , the HP Elitebook, i7 ultrabooks from Toshiba, Samsung etc, but nobody wants to sell them.

Well, except Amazon, but buying a laptop from the internet feels as wrong as buying shoes from the internet. What if the ergonomics are all wrong for me?

<comment><USER22> I have the same fear. I'm leaning towards the xps but I'm not gonna buy one unless I can try one out first physically.

</comment></comment><comment><USER23> If they allow web type content into the touch bar, does that mean it could include pornography? I guess if it wasn't allowed in the app store it could exist, but wouldn't get very far.

</comment><comment><USER24> Still waiting for a hack that adds a physical ESC key.

</comment><comment><USER25> Mac Touch Bar is useless. Does anyone actually use it? Would you rather have the touch bar or your escape key back?

<comment><USER26> I'm using a machine with a touch bar right now and I have an escape key in the upper-left corner of the touch bar where it always was. I don't understand this complaint.

<comment><USER8> Unfortunately it's not quite where it was though. It's about one key's width in from the left. Presumably for the sheer sake of symmetry with the touch sensor the other end.

<comment><USER27> The touchable area is actually bigger than it appears. It does in fact extend much farther left. Try it.

This is probably for aesthetics as you mention.

<comment><USER8> I've read that a couple of times, but it's only a little bit. About half way between the far edge and the edge of the touchbar display.

<comment><USER27> But still considerably wider than the physical escape button it replaced.

</comment></comment></comment></comment></comment></comment><comment><USER28> The Touch Bar has revolutionized the way I accidentally invoke Siri once per 30 minute period.

<comment><USER29> You can remove Siri from the touch bar in the touchbar settings. While in the settings you can tap the bar to open the different configurations and remove her anywhere

<comment><USER30> I replaced Siri with the Sleep button since the keyboard shortcut to lock/sleep your MBP doesn't work anymore. :) (If anyone is interested: Finder > View (press Option key) > Customize Control Strip)

<comment><USER31> Wow! I've had this laptop also for about 6 months and never knew you could do that!

<comment><USER32> To me, this is a GUI anti-pattern. Why do we have to go to Finder to customise the Touchbar? I looked for this option in System Preferences for days before I stumbled across this .. and then to have to hold down the magic Option key.

Honestly, these sorts of anti-patterns are what makes me think Apple has seriously lost the plot.

<comment><USER29> In system preferences, keyboard settings there is a button to configure the strip. I didn't know about the finder thing

</comment></comment></comment></comment></comment></comment><comment><USER33> Apple is basically dead to me now. I have no interest in this "touch bar", and it just increases the cost of an already pricey laptop for no gain.

When my current MBPR dies, a SurfaceBook is replacing it.

<comment><USER34> Cool story.

<comment><USER35> Please don't? Even if a comment is bad, replying like this only makes the thread worse.

</comment></comment></comment><comment><USER36> Interesting proof of concept, but the Touch Bar is still nothing I want any part of.

Apple needs to make the Touch Bar a build-to-order option so that the rest of us can get a hardware Escape key and function keys back again.

<comment><USER37> Non-touchbar are the first models offered on the MacBook pro page.

<comment><USER38> At almost 1ghz slower, 2 less usb-c ports, no gpu, 1600mhz vs 2133mhz ram and only available in silver. They've gimped the non touchbar version on purpose so those of us that want a top spec MacBook have no choice but to go with it.

</comment></comment></comment><comment><USER39> Oh, the Touch Bar that is preventing me from getting a new laptop, because I am professional.

ThinkPad is actually solid replacement.

<comment><USER40> Oh, the Touch Bar that I'm really looking forward to having when I upgrade my laptop, because I am a professional.

<comment><USER41> "I went to stock market today. I did a business" :)</comment></comment></comment>


PostHeads Social Media Ecosystem is now LIVE - <AUTHOR> http://postheads.com

<comment><AUTHOR> Social media ecosystem, PostHeads, has finally released its demo accounts for those who believe in efficiency and the potential of digital media. But what the heck in PostHeads anyway? This should help: \- <http://vimeo.com/62110339></comment>


MHacks - "The Most Epic Hackathon Ever" - <AUTHOR> http://mhacks.org

<comment><USER2> This is sensationalist flotsam- how can you call a hackathon that hasn't even happened yet "the biggest" and "most epic"?

<comment><USER3> Word is there's gonna be Red Bull girls there :D

<comment><USER4> Yea damn dude that's why my girlfriend won't let me come.

<comment><USER5> no way!?

</comment></comment></comment></comment><comment><USER6> Should be interesting to see how this goes considering this is only the second hackathon ever held at Michigan.

<comment><USER5> Inaugural MHacks!

<comment><USER7> Nope. Definitely the second MHacks. <https://www.facebook.com/events/430667410314875>

<comment><USER5> that was a different event

<comment><USER7> With the same name, same logo, same sponsoring parent organization, held at the same university? I also distinctly recall a meeting where the executive director from the last hackathon, who is now running this one, informed the members former team that you would be joining on for this semester's MHacks.

Please, do explain how this MHacks is inaugural or different.

<comment><USER8> Exactly lol

</comment></comment></comment></comment></comment></comment><comment><USER9> I can't wait. This is going to be huge.

</comment><comment><USER10> I'm a student at Michigan, can't wait!

</comment><comment><USER11> oh what basis can they claim that they are the most epic?

<comment><USER12> It's Michigan For god sakes!

<comment><USER5> THE BIG HOUSE!

</comment></comment></comment><comment><USER5> damn this site is sexy</comment>


Why we should only work 15 hours a week - <AUTHOR> http://www.smh.com.au/nsw/worklife-balance-why-we-should-only-work-15-hours-a-week-20170817-gxyfk2.html <comment><USER2> In some regards the economist's predictions were correct as many people really only work 15 hours or less a week right now. The rest is meetings, chit chat, calls, emails, looking busy. But don't go home early or you'll look like you aren't dedicated.

It is kind of messed up situation and probably will eventually resolve towards efficiency.

<comment><USER3> Communication is necessary if you work in large groups towards common goals (row in the same direction).

That is currently done by emails, meetings and calls and are a necessary cost of business (obviously to a certain extent).

My managers currently target 25 hours of individual work with the rest being taken up by the aforementioned topics which I find a reasonable/maybe a little high balance.

15 hours of individual work per week is pretty low though.

</comment></comment><comment><USER4> A former boss once told me that he expected to realistically get about 3 hours of "real, productive" work from a person in a given day. The rest would be task switching, administration, and other overhead (including water cooler type socializing).

So that's about 15 hours a week, in a 5-day workweek. Problem is that a lot of that that overhead sort of has to happen to make the three hours possible.

</comment><comment><USER5> Bucky Fuller calculated that we would be able to "make the World work / for 100% of Humanity / In the shortest possible time / Through spontaneous cooperation / Without ecological offense / Or the disadvantage of anyone." by some time in the 1970's...</comment>


Honda's Dancing Humanoid Robot - <AUTHOR> http://www.wired.com/2014/04/honda-asimo/ <comment><USER2> Hacker News is turning out to be the RSS feed for Wired's stupid articles and their link bait titles. I've even seen mods change the titles they're so "Upworthy" like. There hasn't been a day there haven't been one or two Wired articles on the front page and I think if they're not gaming it, something I wouldn't put past someone writing obnoxious titles like this, well then maybe we just need a weight against these "Astounding!" Wired articles.

Please just go to [http://www.wired.com/](http://www.wired.com/) and see one gross and manipulative title after another:

"The Coolest Spaceships Ever Built, Compared by Size" Well I'll only read it if they're the coolest EVER!

"Americans Aren't Ready for the Future Google and Amazon Want to Build" I'm sure they used a scientific poll.

"Why the Console Wars Won't Be Anything Like You Expect" Right, you knew just what I was expecting.

"The Craziest, Coolest Mustangs That Never Were" So crazy, so cool, who would have known?

"Free iPhone 5s Deal Proves Apple Isn't So Special" See there you go, proof Apple isn't special.

Seriously, Wired is shit content. It's a cesspool. Yet every day it's on the HN home page. One obnoxious article after another. Usually HN is a bellwether for what will end up on techmeme or the general tech press the next day, but you think you're going to see these shit articles from Wired on techmeme or the tech page of the New York Times? How often is tptacek leaving amazing comments on these stupid Wired posts. Like never.

<comment><USER3> Yes, this was a stupid title (I just edited it), and yes, a lot of Wired posts are fluff and inappropriate for HN. We sometimes penalize sites (without banning them) when they're responsible for too much fluff. But doing so increases the risk of missing any substantial articles.

The last three from wired.com that got significant attention on HN were:

      https://news.ycombinator.com/item?id=7590644
      https://news.ycombinator.com/item?id=7610452
      https://news.ycombinator.com/item?id=7599422

Not the most substantial ever, but not bad.

If anyone wants to throw out some things we might try to address this problem—specifically, the problem of tech press websites that put out substantive pieces but also a stream of dreck—we're interested in addressing this. It's a significant impediment to the quality of HN.

<comment><USER2> That's a tough problem. Outside of human moderation I don't have any idea. I'm glad you're aware of the problem though and are working on it. You guys work hard and we pay you nothing!

<comment><USER3> Thanks. I may write some code to show moderators a view like /newest but only from sites marked lightweight. Then we can rescue any solid articles from the penalty. If we can save most of the solid articles, it would free us to mark more borderline sites as lightweight. An experiment worth trying, anyway.

</comment></comment></comment></comment><comment><USER4> It was such a strange mistake for Toyota to abandon their little QRIO robots. Even at their small size, they always seemed to be head and shoulders above ASIMO, and frankly, they still do: [http://www.youtube.com/watch?v=fGtxPmcsXfg](http://www.youtube.com/watch?v=fGtxPmcsXfg)

(This is an old video. They cancelled their robotics line in 2006.)

<comment><USER5> They were Sony robots weren't they?

<comment><USER4> Oops! You're most definitely right about that. Toyota is still making robots. Sony isn't.

</comment></comment></comment><comment><USER6> Whenever I watch advanced robotics stuff, particularly humanoid stuff, I'm always struck by feelings that are equal parts awe and mild anxiety.

<comment><USER7> This is normal. If you think about it, at no point in the history of our species has another bipedal, humanoid creature shared our space (excluding perhaps early humans and Neanderthals). We're used to seeing that we're the only things that look like us.

</comment></comment><comment><USER8> Honda should think about using some 'deploy then code' philosophy with ASIMO. I know ASIMO works hard in theme parks and in the lab, however, ASIMO really needs to be in a movie to reach a large appreciative audience. The things ASIMO can't quite do now could be CGI'd in or there could be some (stunted) stunt doubles dressed in a suit.

From what I understand the target audience is elderly care. I have done a fair bit of this myself on a neighbourly basis and I have witnessed how professional care workers can work - they can fill in lots of forms and somehow avoid any actual care. Imagine how dystopian things could get if elderly people had ASIMO and instead of care workers visiting them they just had an engineer to care for the ASIMO. Then imagine the Alzheimer's disease kicking in. ASIMO could be sent off doing the same thing three thousand times a day, with a feedback loop formed, making matters worse.

Clearly the distant relatives would interface with ASIMO rather than their grandma/grandpa. The senile yet devious grandma/pa would do things to outwit ASIMO like regurgitate their pills or eat the bag of sugar instead of their microwave meal. So situations could develop without relatives knowing what was going on. Obviously at things like family weddings the elderly person would not actually go, instead ASIMO would do the duties including standing in the pictures, front-row due to height reasons. You would also have the problem that we have with cars - most houses have lots of them. So some people could end up with more ASIMO than occupants.

So, I look forward to 'ASIMO the movie', where the basic premise is basic care work - as intentioned - and how it works out in practice, ideas fully worked through on the assumption that the code can be written, e.g. to do things like change bandages. Using this 'deploy then code' we could determine if this 'looking after old folk' scenario is realistic.

<comment><USER9> This movie already exists, and its great - I've watched it twice. The robot in the movie even looks like the Honda robot.

Movie: Robot & Frank [http://www.rottentomatoes.com/m/robot_and_frank/](http://www.rottentomatoes.com/m/robot_and_frank/)

<comment><USER10> Was thinking the exact same thing and expecting this movie to show up in the comments. I really liked the movie from a couple different perspectives.

</comment></comment></comment><comment><USER11> No applause haha, tough crowd! I've certainly seen worse dancing. Very impressive demo.

<comment><USER12> This is the same stuff from 2011 so they've probably seen the drink pouring, hopping on one foot.

</comment></comment><comment><USER13> The critical factor is the speed and precision of the actuators. And the energy of course. If we could increase the speed the robots could behave much more naturally and do much more.

</comment><comment><USER14> Past the Wired junk, there is some good dexterity progress here. They'll get there one day with the amount of dedication that has gone into the project. I'd kill to work on a project like that.

However I wish they'd put some work into getting rid of the gait that looks (as a human) as if ASIMO has pooped itself.

</comment><comment><USER15> The thing about the ASIMO project is that they do a bunch of research and then publish nothing.

<comment><USER14> It's a technology demonstrator for a proprietary internal research project. They don't have to publish anything if they're going to use it themselves.

</comment></comment><comment><USER16> Very nice demo, but still very far from a useful aid.

\- it cannot, I guess, screw on that lid (if it could, they would have demoed it)

\- does it work on slightly uneven flooring?

\- battery live? Anybody's guess, but older ones ([http://en.wikipedia.org/wiki/ASIMO#Specifications](http://en.wikipedia.org/wiki/ASIMO#Specifications)) managed an hour or so. This one will not likely not beat two hours.

Also, it still stands and walks like an ape, with bent knees, I guess because the software that keeps the robot upright always needs to be able to bend the knees both ways.

<comment><USER17> Regarding some of what you mentioned:

[https://www.youtube.com/watch?v=zul8ACjZI18](https://www.youtube.com/watch?v=zul8ACjZI18)

<comment><USER16> Thanks! That's a far better way of showing what it can and cannot do. Looks less scripted, and more as a scientific demo. For example, it does not appear to be able to pick up and put down that tray as smoothly as the bottle (did they spend ages to get him pick up and put down that bottle, or are we talking different hardware/software?)

What would top it of for me is a technical description of what Asimo can do, what design choices they made, and what improved between 'versions', if they call them that way. For example, at first sight, it doesn't look like the hardware of the legs changed in years, but that may not be true. Maybe, the thing is half the weight now, the logic for stance control was moved into the knees, a degree of freedom was added, etc.</comment></comment></comment>


Alibaba and JD.com invest billions in drones and robots for global delivery - <AUTHOR> https://www.nextbigfuture.com/2018/06/alibaba-and-jd-com-invest-billions-in-drones-and-robots-working-to-global-delivery-under-72-hours.html <comment><USER2> Is this kind of robotics investment happening in the US?</comment>


Scheme Bricks - <AUTHOR> http://www.pawfal.org/dave/index.cgi?Projects/Scheme%20Bricks <comment><USER2> Since the actual linked page contains video links that don't work, here's Dave Griffith's blog of Scheme Bricks posts including audio, some images and videos : [http://www.pawfal.org/dave/blog/tag/scheme- bricks/](http://www.pawfal.org/dave/blog/tag/scheme-bricks/)

</comment><comment><USER3> It's a visual programming overlay over Scheme, but the videos don't work, and the hopefully useful wiki link is broken. Kind of useless page...

</comment><comment><USER4> Livecoding is awesome, and one of the coolest resources when I started getting interested in it was pawfal.org and Fluxus. What an interesting way to represent s-expressions.

</comment><comment><USER5> Has anybody managed to install [http://www.pawfal.org/fluxus/](http://www.pawfal.org/fluxus/), the program it's based on?

<comment><USER6> Installation can be tricky and very much depends on the OS you're installing on.

The people on the very low volume mailinglist are usually very friendly and helpful.

Anyone who is interrested should definitely subscribe and ask for help there.

</comment></comment><comment><USER7> can anyone remember the link for a site that showed how it would make parens long enough (horizontally) to cover each part of a definition?</comment>


Mass Mirror Wikileaks - <AUTHOR> http://126.96.36.199/mass-mirror.html

<comment><USER2> Seems like this would have major integrity and trust issues. Do they cryptographically sign all content so you know the ad-hoc mirror hasn't been "curated?"</comment>


Ending the Era of Patronizing Language Design - <AUTHOR> http://blog.objectmentor.com/articles/2009/07/13/ending-the-era-of-patronizing-language-design

<comment><USER2> Our team develops a .NET class library. As a game platform, we have the luxury of breaking binary and source compatability between releases because games are atypically short-lived applications. We provide side-by-side frameworks on both Windows and Xbox, so you don't need to upgrade to the latest framework before you release your game. But that won't stop people from doing it and still complaining.

When Microsoft releases a new version of a library, some subset of users upgrade instantly. They expect that all of their code to keep working. When we break source compatability (something most teams NEVER do), we do it very carefully. We only break things where there is a clear, large win and the upgrade path is straightforward. Customers have complained when we do this every single time because it is not what they inherently expect.

So now back to the original topic at hand: the "After all, we're all consenting adults here." mentality. Yeah, that's great and all, but it requires an incredible amount of discipline. See, for example, how the Django project handles this: <[http://code.djangoproject.com/wiki/BackwardsIncompatibleChan...](http://code.djangoproject.com/wiki/BackwardsIncompatibleChanges>). Personally, I love doing things this way. However, consider a large non- software company. They created some internal app and ran into a small bug or shortcoming of a class library. They find out that the new version fixes their problem, so they they upgrade. BAMN. 10 other things break. Ugh, oh. that's not good. They already laid off the dev team that made this program, they have one vendor making a couple quick fixes to handle their new 2010 business rules. This used to work, why are you breaking me? I just want that one new fix!

In order to prevent situations like this, you need to carefully monitor your public surface area. This is why the _foo naming convention exists in Python. It lets you say "We explicitly do not promise not to change this." Believe me, if you make a type public or a method virtual, some one will instantiate it or override it. I've seen it many times. If you didn't explicitly plan for them to do that, you've still got a backwards compatability bug should you change it. Even if you have it private, someone might call it with reflection and STILL get annoyed when you break them, although this is far more rare.

So in summary: this cultural distinction is a meaningful difference in requirements between open source developers and commercial developers. The respective languages have evolved to meet the needs of their respective customers. One is not necessarily better than the other.

This is why C# 3 and Python are tied for my favorite language :-)

</comment><comment><USER3> There's value in being able to tell the system "I do not want to do X. If I seem to be doing X, it's a mistake, so please stop me." People really do make mistakes, and there's nothing condescending about building a system to accommodate that. That's why my car's steering wheel has an airbag rather than a punji stick.

<comment><USER4> You are right and I agree with you, but I believe the point of the blog post was about the language designer saying "You cannot do this because it is too dangerous."

That is different than an application designer saying "Within the confines of this application, I will never do this so flag and prevent if it seems like it is."

<comment><USER5> I don't think that's really valid. How many recent languages expose raw memory access? The trick to building a great computer system / language is exposing the aspects that are most useful while hiding everything else.

<comment><USER6> But the aspects that are most useful to you are _different_ to the aspects that are most useful to me. Recently I've been trying to write a wrapper for a C library in a couple of different languages, and raw memory access would have made my life much easier. But the languages didn't have it, making my work more difficult.

I think the (paraphrased) aphorism "Make the common, simple. Make the hard, possible" is apt.

<comment><USER5> _the aspects that are most useful to you are different to the aspects that are most useful to me._ Which is why we have so many languages. Also, we don't really need another C or Pearl at this point, but new domains do show up. Such as GPU's with insane amounts of parallelism.

</comment></comment></comment></comment></comment><comment><USER7> "The fact of the matter is this: it is possible to create a mess in every language. Language designers can't prevent it."

I hate stuff like this. It's not a bool, it's a float. Language features (e.g. type checking) help eliminate some errors, reduce the likelihood/frequency of more, and reduce the cost of finding others. Coercing reduction factors into absolutes destroys the conversation for a cheap debate point.

</comment><comment><USER8> > C++ avoided reflection

Not really, its architecture simply didn't really support reflection. C++ actually lets you do almost anything imaginable and then some.

Overall, though, I agree with the premise in part. Certain languages (Java, C#, and to a much lesser extent Python[1]) try to remove features they consider "evil", rather than let the developer have all the rope to tie themselves. What they fail to account for is that we're _developers_ , we should be competent enough to know the dangers of certain features and we should be competent enough to avoid them if they're not needed.

Languages that let you do whatever the hell you want aren't a new thing, though. C, lisp, etc have existed for awhile. If at all, the idea of patronizing programmers is new.

[1] Guido van rossum has said many times that there should be only one way to do anything, and I think you see that with the crippling of lambda in Python (Guido favors named subfunctions). However, Python still has many "dangerous" features if you need them.

<comment><USER9> lambda being crippled in Python is the same story as with C++ and reflection.

It's pretty simple: Python's syntax doesn't let you have a statement inside a statement. Even if it did, handling blocks would be a nightmare!

<comment><USER8> I see your point, and it's a valid one, but then again, Boo managed to work around it.

</comment></comment></comment><comment><USER10> C++ does not omit features because they were worried that programmers would misuse them. This is, afterall, a language with multiple inheritance, allows arbitrary casts and allows programmers to grab a pointer to any arbitrary piece of memory. Stroustrup has said in many places that, in the end, he trusts the programmer and is in favor of including useful features despite their danger.

Full reflection doesn't exist in C++, I assume, because of the runtime overhead costs. The amount of reflection that is present through Runttime Type Information (RTTI) does add overhead, so it's only compiled in when programmers use those features.

Further, I'm not a Ruby programmer, but from reading HN I know there's significant discussion in the Ruby community about monkey patching arbitrary classes. The consensus I've seen is that it, in general, it's a bad idea. This is the same kind of cultural proscriptive advice the author says is not present in the Ruby culture.

<comment><USER11> Don't mistake HN "consensus" with Ruby community consensus. I've been very loud on HN about how monkeypatching is a bad idea, but I am not a member of the Ruby community. (I got my burned-by-monkeypatching credentials from Javascript.)

I never was really in the market for Ruby since I know Python very well, but certainly Ruby's love affair with monkeypatching would be sufficient by itself to turn me away.

<comment><USER12> _I got my burned-by-monkeypatching credentials from Javascript_

Ouch. I cringe just thinking about it.

(In Javascript you can do some truly ugly and unnatural things mixing up what people expect and what they get.)

</comment></comment></comment><comment><USER13> This way of thinking about language constraints misses a key point: language constraints are not only there just to bug the programmer into behaving better. They also provide a way of reasoning about the program to a person trying to understand it. The guarantees that exist in, say Java code, mean that a new person can say with much better precision what any given piece of code does (not what it's meant to do - what it will actually do). In a dynamic language, it might do anything.

I experience this exactly in the dual Groovy-Java universe I inhabit these days. I am faster at writing the groovy code and I think the end result looks nicer and smaller. But when there's some strange problem that needs to be debugged that I don't understand, the java code is much much easier to reason about. Simple questions like "how is this function possibly getting called" can be answered definitively in a fraction of a second with a key-press in Eclipse for java, while I have to run a virtual simulation of the program in my head to figure out what the groovy code might do.

</comment><comment><USER14> Doh ... "the newer breed of languages". Like Lisp?

<comment><USER15> Lisp has been one of "the newer breed of languages" for over 50 years now, and that run does not seem likely to end anytime soon.

<comment><USER3> "Lisp doesn't look any deader than usual to me." \- David Thornley

<comment><USER16> "Lisp is not dead, it just smells funny."</comment></comment></comment></comment>


Comparison of Deep Learning Frameworks - <AUTHOR> https://github.com/zer0n/deepframeworks/blob/master/README.md <comment><USER2> I've been experimenting with [https://deeplearning4j.org/](https://deeplearning4j.org/) It doesn't seem to be very popular but i was testing it and it does seem to work well.</comment>


Hieronymus Bosch's Medieval Painting Comes to Life in an Animation - <AUTHOR> http://www.openculture.com/2016/11/hieronymus-boschs-medieval-painting-the-garden-of-earthly-delights-comes-to-life-in-a-gigantic-modern-animation.html <comment><USER2> I feel the animation doesn't really capture bosch. I grew up with his painting around our house, my dad was a big fan! When we lived in Europe for a few years we would go to all kinds places just to see one his paintings.

However, I feel the animation is trying to be "weird" like bosch rather than "symbolic" like bosch.

<comment><USER3> Desire lacking ability turns to Kitsch.

</comment></comment><comment><USER4> This is better: [https://www.youtube.com/watch?v=1bSZslEDUl0](https://www.youtube.com/watch?v=1bSZslEDUl0)

</comment><comment><USER5> You might like [http://boschproject.org/](http://boschproject.org/) for high dpi scans of original art with a nice js viewer.

Would be nice to have characters from from those scans for animation.

<comment><USER6> This is amazing, thank you so much.

Am I right to understand that currently there are only 4 works available to explore?

The JS viewer is amazing. From the description:

      >you can switch between high-resolution visible, infrared photography, and infrared reflectography images

Can someone explain why infrared and reflectography scans would be interesting?

</comment></comment><comment><USER7> Fans of Bosch might also enjoy this 2d animation inspired by the painting, created by Yoji Kuri in 1972

[https://youtu.be/mKdcQK2v3JQ](https://youtu.be/mKdcQK2v3JQ)

</comment><comment><USER8> The video is pretty cool, imo. I'd definitely be interested in exploring it in VR (I noticed the article links to a trailer for an app that does something similar).

That said, it only really bears a vague resemblance to the original painting. If you remove all the sexual and religious elements, you end up with something very different.

</comment><comment><USER9> Bosch actually belongs to the early renaissance period - he's not medieval.

</comment><comment><USER10> Look at that massive butt plug</comment>


Work for free in exchange for experience. - <AUTHOR>

Am a 3rd year student in Australia studying computer systems and would like to gain some programming experience preferably under the supervision of an experienced programmer. Am competent in c and java. I would like to gain solid skills before i graduate and i think working under the guidance of someone experienced could accelerate that process. I would work completely for free to gain some more experience and maybe a reference. <comment><USER2> Don't sell yourself short. With knowing a few languages there's no reason why you can't get an entry-level programming job that you can get paid to do. You'll get experience and you'll get paid. Giving it away for free doesn't necessarily sweeten the pot.

The real trick is going to be finding a place where you will have a good mentor. You might be surprised to know that many programmers who are employed are not very good at programming even though they get paid for it. You don't want to be learning from someone like that.

Another option might be to talk to some of your professors at school. They might have their own projects going, or know someone who does. They would also better know people who might be good mentors.

<comment><AUTHOR> I will start off with that to see if i can get anything.I have tried getting part time entry level programming jobs but they require me to do uni part time which i cannot do since am international student and have to be full time. Yesterday i went to a career fair hoping to find some companies that take in international students as interns but very few do. So i thought this might be the best place to ask for best places to get that experience.

</comment></comment><comment><USER3> You need to put a email address in the profile notes section of your profile. I was going to send you an email to ask you a few questions.

While it's illegal to not pay someone for useful work in my country (US), if you were a match I'd look into internships and paying intern wages once you showed any capacity to do work we could use after bringing you up to bare competence via starter projects.

<comment><USER4> There are tons of unpaid internships in the US. It's not illegal at all.

<comment><USER3> You would be mistaken. You can be sued for back wages and be fined if you screw up there. Here is the applicable publication from the national department of labor.

From: <http://www.dol.gov/elaws/esa/flsa/scope/er15.asp>

\--

If all of the following criteria apply, the trainees or students are not employees within the meaning of the Act:

The training, even though it includes actual operation of the facilities of the employer, is similar to that which would be given in a vocational school;

The training is for the benefit of the trainees or students;

The trainees or students do not displace regular employees, but work under close supervision;

The employer that provides the training receives no immediate advantage from the activities of the trainees or students and, on occasion, his operations may even be impeded;

The trainees or students are not necessarily entitled to a job at the conclusion of the training period; and

The employer and the trainees or students understand that the trainees or students are not entitled to wages for the time spent in training.

\--

Very few internships in the US can satisfy all of these.

</comment></comment></comment><comment><USER5> My first reaction on reading the title is that you don't need to work for anyone in order to work for free for experience. Just work on some project of your own. What you want is to work for free in exchange for mentoring.

<comment><USER6> Are you sure you read it ? He's got this in there (or was the text edited?)

> would like to gain some programming experience preferably under the > supervision of an experienced programmer.

I think that describes a mentoring situation fairly accurately.

If you can find something that interests you a lot, then contact the lead programmer on the project and see if you are welcome to stick your oar in.

Keep in mind that most people will reluctant to do this because most software guys are under serious pressure to deliver and may not want to take on someone that might slow them down.

If that's their worry make sure you tell them they can nix the deal without hard feelings if they feel that's the case, that might give you an edge on the way in.

</comment></comment><comment><USER7> <http://socghop.appspot.com/></comment>


OS X/iOS Programming - <AUTHOR>

As a high school student I've been taught in class the fundamental principles of Visual Basic, and C++. I'm looking to extend my skills into a more satisfying project, seeking to do so either through writing a Mac OS X application, or an iOS application.
With this said, I'm fairly new to the whole "real world" programming thing, with most of my experience limited to writing command line projects. I'm currently working through Stephen Kochan's "Programming In Objective-C 2.0" and it seems so far to be pretty good.
Ultimately what I'm looking for from HN is a push in the right direction of what other resources are good for learning Objective-C, good places to learn about OS X programming and the iPhone/iPad SDK, and even some hints about what I might read to become better at the interface design aspect of my application. <comment><USER2> The bible is certainly Aaron Hillegass' Cocoa Programming for Mac OS X - [http://www.bignerdranch.com/book/cocoa®_programming_for_mac®...](http://www.bignerdranch.com/book/cocoa®_programming_for_mac®_os_x_3rd_edition)

The Apple documentation is outstanding. <http://developer.apple.com/resources/>

Check out ObjC and iOS podcasts.

My favorite Cocoa website it <http://theocacao.com/>

Delicious might also help you: <http://delicious.com/tag/cocoa>

<comment><USER3> Having looked at both in some detail, Daniel Steinberg's _Cocoa Programming_ book <http://pragprog.com/titles/dscpq/cocoa-programming> might be preferable to Hillegass's book.

<comment><USER4> why?

<comment><USER3> Hillegass spent time and text comparing Cocoa constructs to other programming languages. On distractions.

Steinberg's approach had better technical progression, tighter focus and superior editing.

</comment></comment></comment></comment><comment><USER5> First go through this[1] for a quick intro to Objective-C:

Then again, just checkout hw1[2] in Stanford - HelloWorld to iPhone SDK. This is the best hand-holding intro to Obj-c. If that doesn't suffice checkout the earlier class videos.

[1]<http://courses.csail.mit.edu/iphonedev/> [2]<http://www.stanford.edu/class/cs193p/cgi-bin/drupal/>

</comment><comment><USER6> Is there anything specific that you want to do? In some cases, there might be better books for you to be reading (like OpenGL books, if you want to make some types of games). And targeting Mac vs iOS is rather different in some ways (UIKit and AppKit have lots of little corners in which they differ).

Hillegass is basically bible for Cocoa (Mac) programming. But, its not the best way to learn Cocoa Touch (iOS) for iOS. For that, I'll second Skroob's recommendation of Craig Hockenberry's book. Also, Jeff LaMarche and David Mark's Beginning iPhone Development is rather good and I personally have a nice copy of Bill Dudney and Chris Adamson's iPhone SDK Development that I'll skim on occasion.

But, you don't _need_ to read all three of them; they basically cover the same material in different (but equally good) ways. After you've worked your way through one of them, maybe pick up Erica Sadun's The iPhone Developer Cookbook or iPhone Cool Projects by Wolfgang Ante, Mike Ash and a bunch of other really smart people.

And at some point, move away from the path documented and write your own app!

</comment><comment><USER7> My first resource to get to grips with Cocoa programming was the Hillegass book pointed out elsewhere. But when starting the iPhone focus, the Stanford iPhone Programming Lectures on iTunes U really were a great help for me, even though they didn't cover the latest version of the OS (They were doing it on 2.x when I did it, I suspect the latest one was for 3.x) they really explained a lot about philosophy and methodology, not to mention giving assignments and generally acting like a class.

In fact, I am intent on revisit the latest version of the course, but all the dev videos kind of ambushed me, so I haven't gotten around to them yet. Speaking of which, I really get a lot out of, but I think a lot of the reason for that is taking the iTunes U course first.

</comment><comment><USER8> If you feel comfortable with C++ to some degree, this transitional document might be helpful: <http://ktd.club.fr/programmation/fichiers/cpp-objc-en.pdf>

I've found it does a good job of explaining how Objective-C works, for someone with C++ background.

As far as interface design, I feel that Cocoa is something you just have to tinker with in order to learn. Apple has lots of sample code (register a developer login on developer.apple.com if you haven't). While there's plenty to read, I feel that to really understand things like connections and controllers in Interface Builder, you have to try to build things or inspect the interfaces in sample projects.

</comment><comment><USER9> Objective-C is fairly simple, while Cocoa is vast and complex. The distinct is important.

It might take you awhile to get familiar with Cocoa and all its patterns built on top of NSObject.

"Cocoa Design Patterns, by Buck and Yacktman" is a very good book to get the big picture right, but might be slightly overwhelming at the beginning (as there are many patterns/ways to solve the same problem in Cocoa).

Read Apple's documents: I still find it the best way to learn the details of Cocoa. The writing is dry and quite dense, so you might need to read it multiple times.

Another thing to remember is that Cocoa is a framework: it demands to be followed and not be fought against.

<comment><AUTHOR> I will keep that in mind, thank you.

</comment></comment><comment><USER10> The pragmatic bookshelf books are all pretty good. Just buy one and get started. Once you get oriented, you'll find apple's documentation to be pretty good, especially if you're used to typical open source documentation.

</comment><comment><USER11> If you're going to want to run your iOS apps on actual devices (not just the built-in simulator), you'll need a $99/year iPhone Developer membership from Apple. Said membership comes with access to videos from this year's Worldwide Developer Conference, many of which will be helpful to you.

EDIT: They're available to free dev accounts as well! Thanks for the corrections.

<comment><USER12> You don't need to pay the money to get access to the videos. A free developer account will do. That free program a really hard to find, though, here's the link: <http://developer.apple.com/programs/register/>

</comment></comment><comment><USER13> Craig Hockenberry's Missing Manual book on iPhone development is excellent, and I recommend it to everyone who's interested in learning iOS development. <http://oreilly.com/catalog/9780596809775>

</comment><comment><USER14> Kochan's book is good, but it is far from the "real world" when it comes to Cocoa programming. You don't really need most of what's in there. Just jump in with Hillegass' book and you'll be programming in cocoa much more quickly (I've used both books).

</comment><comment><USER15> Start by doing. I'm 15 and learned iOS programming just by /doing/ it, reading other people's code and working until my code worked as well. My code wasn't too pretty to start with, but it really helped me understand the SDK...

<comment><AUTHOR> I'm curious, do you have any applications in the store right now?

</comment></comment><comment><USER16> Is this some new trend where nobody prefixes self posts with "Ask HN"?

<comment><USER7> It's somewhat redundant, since the domain part is missing from the title, but that being said, I really prefer the prefix as well.</comment></comment>