3K, 60fps, 130ms: achieving it with Rust - <AUTHOR> https://blog.tonari.no/why-we-love-rust <comment><USER3> Aside from the Rust aspect (which is cool!), I can't believe we've come this far and still don't have low-latency video conferencing. Maybe I'm overly sensitive, but people talking over each other and the lack of conversational flow drives me crazy with things like hangouts.

<comment><USER4> The biggest problem is that of the video codecs which ultimately boils down to using interframe compression. This technique requires that a certain # of video frames be received and buffered before a final image can be produced. This requirement imposes a baseline amount of latency that can never be overcome by any means. It is a hard trade-off in information theory.

Something to consider is that there are alternative techniques to interframe compression. Intraframe compression (e.g. JPEG) can bring your encoding latency per frame down to 0~10ms at the cost of a dramatic increase in bandwidth. Other benefits include the ability to instantly draw any frame the moment you receive it, because every single JPEG contains 100% of the data. With almost all video codecs, you must have some prior # of frames in many cases to reconstitute a complete frame.

For certain applications on modern networks, intraframe compression may not be as unbearable an idea as it once was. I've thrown together a prototype using LibJpegTurbo and I am able to get a C#/AspNetCore websocket to push a framebuffer drawn in safe C# to my browser window in ~5-10 milliseconds @ 1080p. Testing this approach at 60fps redraw with event feedback has proven that ideal localhost roundtrip latency is nearly indistinguishable from native desktop applications.

The ultimate point here is that you can build something that runs with better latency than any streaming offering on earth right now - if you are willing to make sacrifices on bandwidth efficiency. My 3 weekend project arguably already runs much better than Google Stadia regarding both latency and quality, but the market for streaming game & video conference services which require 50~100 Mbps (depending on resolution & refresh rate) constant throughput is probably very limited for now. That said, it is also not entirely non-existent - <USER2> about corporate networks, e-sports events, very serious PC gamers on LAN, etc. Keep in mind that it is virtually impossible to cheat at video games delivered through these types of streaming platforms. I would very much like to keep the streaming gaming dream alive, even if it can't be fully realized until 10gbps+ LAN/internet is default everywhere.

<comment><USER5> You can also just configure your video encoder to not use B-frames. Then if you make all consecutive frames P frames then the size is very maintainable. It gets trickier if your transport is lossy since a dropped P frame is a problem but it's not an unsolvable problem if you use LTR frames intelligently.

All the benefits of efficient codecs, more manageable handling of the latency downsides.

The challenges you'll run into instantly with JPEG is that the file size increase & encoding/decoding time on large resolutions outstrips any benefits you get in your limited tests. For video game applications you have to figure out how you're going to pipeline your streaming more efficiently than transferring a small 10 kb image as otherwise you're transferring each full uncompressed frame to the CPU which is expensive. Doing JPEG compression on the GPU is probably tricky. Finally decode is the other side of the problem. HW video decoders are embarrassingly fast & super common. Your JPEG decode is going to be significantly slower.

* EDIT: For your weekend project are you testing it with cloud servers or locally? I would be surprised if under equivalent network conditions you're outperforming Stadia so careful that you're not benchmarking local network performance against Stadia's production on public networks perf.

<comment><USER6> Actually, there are commercial CUDA JPEG codecs (both directions) operating at gigapixels per second. It's not a question of speed, but rather the fact that you can at least afford to use H.264's I-frame-only codec for much lower bandwidth requirements.

<comment><USER5> JPEG is still going to be larger & lower quality than H264. I still fail to see the advantage.

<comment><USER6> ~10x higher framerate?

</comment></comment></comment></comment></comment></comment><comment><USER7> Nitpick: "audiophile-quality sound" it seems, is becoming the new "military- grade encryption."

I don't have many other comments to make other than I am surprised rust- analyzer was only mentioned in passing.

<comment><USER8> The issue with 'military-grade' is that anyone in the military will attest it translates to: Cheapest possible thing that gets the job done.

Audiophile grade at least has roots in high fidelity.

<comment><USER9> > Audiophile grade at least has roots in high fidelity.

Does it though? Audiophiles generally seem to eschew fidelity in favour of something that sounds subjectively _nice_ , including the psychoacoustic effects of spending a lot of money.

Eg. they seem very fond of "warmth". If you asked me to make something sound "warm", I'd be applying some soft clipping and dampening the top end, not eliminating sources of distortion.

Edit: If you actually wanted high fidelity, you'd use studio headphones / monitors, which are designed to be "unflattering", so you can be confident you'll hear any issues when mixing / mastering. People don't normally listen for pleasure with those, because they become fatiguing after a few hours.

Choosing equipment because you like the sound is a very reasonable thing to do, but it's not the same as pursuing fidelity.

<comment><USER10> Our ears are incredibly sensitive sensors and I think attributing warmth to soft clipping and dampening the top end is not a complete picture.

Also warmth is just a single quality. I have a pair of very accurate "cold" headphones that I prefer for music and a pair of "warm" headphones for electronic music and gaming.

Past the headphones, it is not so much warmth as it is space in the sound for me. My headphone amplifier sounds effortless and that's the best way I can describe the quality of what I hear.

<comment><USER11> But those characteristics are based on objective facts of sound reproduction that can be quantified.

The characteristic of warmth is related to amplification of certain harmonics as well as equalization in the signal. This is fairly well understood by now.

</comment></comment></comment></comment></comment><comment><USER12> I wish I read more things like this on hn. "We wanted to know and understand every line of code being run on our hardware, and it should be designed for the exact hardware we wanted"

<comment><USER13> But that statement seems at odds with a dependency on the enormous WebRTC AudioProcessing C++ module. But then they also say they don't use WebRTC so maybe I misunderstand what's going on.

<comment><USER14> My understanding is that the quoted statement was explaining why they moved away from WebRTC.

<comment><USER15> We moved away from WebRTC completely for video, networking, and some audio. We still use webrtc-audio-processing for acoustic-echo-cancellation and some other niceties. Here is our Rust wrapper for that library:

[https://github.com/tonarino/webrtc-audio- processing](https://github.com/tonarino/webrtc-audio-processing)

</comment></comment></comment></comment><comment><USER16> If this actually works, I am desperately keen to get my hands on it. If you have the capacity for high bandwidth, why not use it? Zoom's model must work on whatever crappy broadband people have in their home office. If you have gigabit, it doesn't seem to make use of that extra capacity to improve video quality.

As for sound, I don't think audiophile quality is necessary...

<comment><USER17> _As for sound, I don't think audiophile quality is necessary..._

Given you'll need about 10Mbps upstream for 60fps 3K video it seems a little unreasonable _not_ to add on a 320Kpbs (or more) audio stream.

It could make this useful for things like streaming music concerts.

<comment><USER18> Semi-related note: there's work being done at Stanford to make it possible for remote musicians to play together in an ensemble at low latencies.

JackTrip is the resulting software -- not end-user friendly, but apparently it works.

[https://ccrma.stanford.edu/groups/soundwire/software/jacktri...](https://ccrma.stanford.edu/groups/soundwire/software/jacktrip/)

(Some basic numbers: sounds takes 1 ms to travel a foot, every ms is a foot of separation between musicians, 30ms of latency = 30 ft separation = the max for jamming. So 130ms is not low enough.)

</comment></comment></comment><comment><USER19> I love Rust, but them deciding to redesign/reimplement webrtc after being frustrated after a week seems like a prime candidate for not invented here syndrome with Rust being the justification. There is a reason webrtc is as big as it is, it's a complex problem to solve.

Regarding the premise of high latency in webrtc: Google Stadia has ~160ms round trip latency at 4k from my Macbook to a data center, so it's not like that's unachievable.

<comment><USER20> Google is colocating in your basement.

</comment></comment><comment><USER21> After reading it, I'm still not entirely sure what's being done.

Is it live streaming or is it the transport?

Are they doing video encoding (the audio encoding seems to be done by that webrtc-audio thing)?

Have they chosen a progressive encoding format that compresses frames and pumps them out to the wire as soon as they're done?

Is TCP or UDP involved or a new Layer 3 protocol entirely?

Have I just missed all of those parts or were they really missing amid all the Rust celebration?

<comment><AUTHOR> > After reading it, I'm still not entirely sure what's being done. > Is it > live streaming or is it the transport?

tonari is the entire stack, similar in "feature scope" to WebRTC but with different goals and target environments.

> Are they doing video encoding (the audio encoding seems to be done by that > webrtc-audio thing)?

Yep, this includes video encoding and transport. We don't use the WebRTC audio library for encoding or transport, just for echo cancellation and other helpful acoustic processing.

> Have they chosen a progressive encoding format that compresses frames and > pumps them out to the wire as soon as they're done?

Yep, basically, if by that you mean we don't use B-frames or other codec features that would require buffering multiple video frames before receiving a compressed stream, so we're able to send out encoded frames as they arrive.

> Is TCP or UDP involved or a new Layer 3 protocol entirely?

We encapsulate our protocol in UDP since we operate on normal internet - a new protocol is out of the question without a huge lobbying force and 15 years of patience on your side.

> Have I just missed all of those parts or were they really missing amid all > the Rust celebration?

We intentionally didn't get into the protocol details because we are saving that for a dedicated post (and code to back it up).

<comment><USER21> Thank you very much for the answers. Glad I wasn't too far off.

Looking forward to the technical post. If you're planning on releasing all of this royalty-free and opensource, you'd be quite a boon to the free and open internet. Getting this picked up by the likes of Mozilla and getting it into a browser would be amazing.

</comment></comment></comment><comment><USER22> If anybody is looking for a low latency high bandwidth P2P video streaming solution there is [https://github.com/CESNET/UltraGrid/wiki](https://github.com/CESNET/UltraGrid/wiki) It can do less than 80ms of latency

<comment><USER23> This is cool, thanks for the link. Is this Nvidia GPU only? Mighr give it a try at some point

<comment><USER22> You don't need the GPU, just depends on the type of compression you want. It supports intel VA-API as well as NVIDIA VDPAU

</comment></comment></comment><comment><USER24> Gotta love a writeup with this line in it:

      like Brian's 1970s-era MacBook Pro

That's a writer(s) who knows what it's like to read long (aka thorough) technical articles and not bore the readers to death.

Great article!

</comment><comment><USER25> > We just enforce rustfmt.

After interaction with both rustfmt and go fmt, I have concluded that .editorconfig is solving a problem that really shouldn't be solved. We went through the ordeal of defining our C# coding standards where I work and, let me tell you, people (myself included) care very deeply about their way of structuring code. And it's a bloody waste of their time.

Having the language designers say, "here is how our language should be structured" is a breath of fresh air.

</comment><comment><USER26> Woah this portal thing into another place seems super exciting if they can really pull it off and maintain low latency in the real world.

</comment><comment><USER27> My WebRTC projects haven't suffered that much from latency. The biggest source of delays is usually caused by encoding video for me. I've had to limit streams to 720p and 25fps to reduce the time spent on CPU encoding a vp8 stream. There are also bandwidth considerations (real time encoding = significantly less compression) but the end result is slightly less than 200ms one way latency (including input lag from mouse, 15ms network latency and display lag) without any special settings. All I'm doing is feeding a ffmpeg stream to kurento and letting it broadcast it via WebRTC. This is not a web conferencing application and it is also not using WebRTC via p2p. It's closer to conventional live streaming with a sane amount of latency (compared to up to 30s of latency you commonly see on twitch). Of course I personally would prefer it if the latency can be brought down even further. 100ms or lower is like the holy grail for me and only appears to be doable with codecs that aren't supported by WebRTC. However, people don't want to install apps just for my little service and I certainly won't encode every stream via several codecs just for the tiny minority of the user base that actually ends up using the app.

</comment><comment><USER28> Very cool from a tech standpoint.

From a product point of view, I find it interesting that the illustrations/concept videos for these things always show people interacting very closely to the wall - e.g. playing chess, sitting around a table, etc.

[https://tonari.no/static/media/family.48218197.svg](https://tonari.no/static/media/family.48218197.svg)

But in practice, people tend to keep their distance from it. E.g. the pictures of this setup tend to show people clustered in their own group on each side of the wall, with a solid 2-3 meters from the wall.

[https://blog.tonari.no/images/ea56c74d-a55d-4183-9a7b-d69795...](https://blog.tonari.no/images/ea56c74d-a55d-4183-9a7b-d697954c5159-tonari- frontier-2.png.optimized.jpg)

It makes sense, it's awkward to be close to a large solid (emissive) surface, and humans instinctively get closer to their in group when faced with an out group. I wonder how the system could be designed to encourage participants being closer, if there is an advantage to that.

<comment><USER29> A practical problem to solve there: where do you put the cameras? I would actually prefer putting them behind the screen if possible - a few small pinholes wouldn't be that noticeable. If you could put multiple wide-angle cameras in multiple places, you could stitch them together in software and create a real feeling of closeness.

</comment></comment><comment><USER30> Why exactly do existing video streaming solutions use such small amounts of bandwidth and have terrible quality as a result? Does anyone have a deep dive into why this is the case? It seems that it would be a killer feature to make better utilization of bandwidth.

Even over wifi, speedtest shows 4ms/100mb/100mb on my internet connection, but Zoom, FaceTime, and others never use more than about 0.8Mbit/s for a video stream, and the resulting quality of audio and video is...understandably poor.

Latency too totally feels like a software problem, perhaps with too many layers of abstraction. (60fps->16ms for the camera, ~10ms for encoding with NVENC/equivalents, 35ms measured one-way latency from my laptop to my parents 4000km away, ~10ms decode, 16ms frame delay = 87ms one way). Maybe I'm asking for too much from non-realtime systems (I'm used to RTOS, extensive use of DMA, zero-copy network drivers, etc), but it seems that there is a lot of room to improve.

<comment><USER31> OnLive "solved" encoder latency 15 years ago. You dont wait 16ms for the next frame. Instead you progressively start encoding after receiving first tens of lines. This way your encoded video stream lags just couple of milliseconds behind, same for decoding. You could crudely emulate this by dividing screen into 4 rows and sending 4 concurrent video stream, instant 1/4 latency drop.

<comment><USER30> Sure, many of the operations in the list can be pipelined as you mention. Something like G-Sync would also allow you to sync the destination display to the arrival of the (start of) frame.

</comment></comment></comment><comment><USER32> The bottleneck is not on the CPU. I'm afraid this company may have wasted their time trying to reinvent WebRTC. If you really want to get realtime video, I think the best approach is a custom codec on CUDA or better yet custom hardware (FPGA). You can only go so far on general purpose hardware before you hit a wall and get Zoom/WebEx quality.

<comment><USER33> Is or is not? I'm confused: if the bottleneck is not on the CPU what does CUDA solve?

<comment><USER32> The bottleneck is the video encoding/decoding/rendering, which is done on GPUs to begin with. Of course if it were done on CPU instead, then it would be significantly worse, but that's not where we're starting from. Improving stuff on the host side by, say, rewriting WebRTC in Rust won't improve the latency of your video by much or at all.

</comment></comment></comment><comment><USER34> This is welcome news.

I have been itching to convert a small headshot videostream (thing under 100x100px) to audio, stream it over mumble and then convert it back to video, just to see what the latency is like. It would obviously be a big undertaking, but not as big as this methinks.

</comment><comment><USER35> "We wanted to know and understand every line of code being run on our hardware, and it should be designed for the exact hardware we wanted."

This rings very true for every high-performance thing I've ever worked on, from games to trading systems.

</comment><comment><USER36> Any suggestions on a group video conferencing tool for use on a local network (Ethernet) that's effective? Either self-hosted or online, just for personal usage to talk with others?

</comment><comment><USER37> "A week of struggling with WebRTC's nearly 750,000 LoC behemoth of a codebase revealed just how painful a single small change could be — how hard it was to test, and feel truly safe, with the code you were dealing with."

I _totally_ feel you. It's impressive what the WebRTC implementation has achieved, but it's just not pleasant at all to work with it.

</comment><comment><USER38> 130ms is a world better than 500ms and a much welcome improvement, but it is still terrible.

Latency happens throughout the whole stack; Unfortunately much would need to be fixed outside this project to achieve any further significant improvement.

Operating System, firmware, blackbox hardware are some other non-negligible sources of latency. Everything adds up.

</comment><comment><USER39> @dang - Suggest altering the title to say what it is "Achieving 3K, 60fps, 130ms Video Conferencing with Rust".

</comment><comment><USER40> This is amazing! The first thing that popped to my mind seeing the life sized "portal" was the farcaster portals from the sci-fi novel Hyperion

[https://hyperioncantos.fandom.com/wiki/Farcaster](https://hyperioncantos.fandom.com/wiki/Farcaster)

</comment><comment><USER41> Sounds impressive, but i'm dying to know: what video codec are they using?

</comment><comment><USER42> I wonder how it compares with apple facetime on two new macbooks with ethernet connections on both sides.

They actually work on reducing latency and pushing high res video if your connection supports it.

<comment><USER15> That's a great idea, I've always preferred facetime at least for the video quality. We'll do a latency test sometime, I suspect it'll be quite good!

</comment></comment><comment><USER43>
      for crate in $(ls */Cargo.toml | xargs dirname); do
         cargo build

Why do this instead of

      cargo --workspace build

Is it so you can time the individual crates?

<comment><USER44> Yeah it looks like they wanted to know how long each crate took to build individually.

But as long as we're nitpicking, nobody should just pipe `ls` into `xargs` like this, since it fails if anything has spaces in it.

Instead, do:

        for cargo_toml in */Cargo.toml; do
          crate="$(dirname "${cargo_toml}")"
          pushd $crate
          # ...
        done

Don't be that person who writes a script which won't tolerate spaces in filenames!

<comment><USER45> Alternatively: Don't be that person who clones the repo at a path with spaces in!

<comment><USER44> Not having spaces in your directory names is certainly a good idea, but I'll be damned if I let any of my code have issues with them. Just because something's a good idea doesn't mean it should be a requirement :)

(The main reason for the advice of "Don't put spaces in paths" is really only because it breaks lots of poorly-written software... but that's not an excuse for your software to be poorly-written!)

</comment></comment></comment></comment><comment><USER46> I love their homepage [https://tonari.no/](https://tonari.no/)

<comment><USER47> Thank you so much! Keep an eye for further updates.

</comment></comment><comment><USER48> What's the codec stack for this? x264 --tune zerolatency + opus with opus_delay=20ms?

<comment><USER6> 20ms is wasteful. Use minimum latency where SILK still works, afaik that's 7.5ms.

<comment><USER49> This assumes that video encoding latency is lower than the audio latency.

<comment><USER6> Shouldn't be more than a single frame, which is 16 2/3 ms for 60 fps. And for e.g. JPEG it can be even shorter, especially with a rolling shutter.

</comment></comment></comment></comment><comment><USER50> "we truly don't believe we could have achieved these numbers with this level of stability without Rust"

Oh please. This is just rust sensationalism. People don't truly believe rust is faster than C do they?

<comment><USER51> In some problems Rust is the fastest:

[https://benchmarksgame- team.pages.debian.net/benchmarksgame/...](https://benchmarksgame- team.pages.debian.net/benchmarksgame/performance/nbody.html)

[https://benchmarksgame- team.pages.debian.net/benchmarksgame/...](https://benchmarksgame- team.pages.debian.net/benchmarksgame/performance/spectralnorm.html)

[https://benchmarksgame- team.pages.debian.net/benchmarksgame/...](https://benchmarksgame- team.pages.debian.net/benchmarksgame/performance/revcomp.html)

[https://benchmarksgame- team.pages.debian.net/benchmarksgame/...](https://benchmarksgame- team.pages.debian.net/benchmarksgame/performance/binarytrees.html)

<comment><USER50> Every single one of those rust implementations is using unsafe {}, thus defeating the purpose of using rust in the first place. Run the same benchmark without unsafe {}.

<comment><USER52> >defeating the purpose of using rust in the first place

I don't think this is true; the whole point of Rust is that unsafe operations are _explicit_ , not that you never do so.

Also, I looked at the first one, and it's only using unsafe on what are basically op code calls; I don't think it is realistic to complain about that.

</comment></comment></comment></comment><comment><USER22> I wonder how much bandwidth this uses. The less bandwidth it uses the higher the latency because of compression. Its much easier to get low latency video when you have large (Gbit+) links

</comment><comment> vertex-four Are they still using WebRTC, just their own implementation? Or have they switched to something else on the wire?

<comment><USER53> There's a section in the article about it: "In the beginning (or: why we're not WebRTC)"

<comment> vertex-four I'm interested in what they _are_ using if not WebRTC - there's several good options in this space (SRT would be my go-to choice), so it'd be really interesting to see if they rolled their own wire protocol or used something else.

<comment><USER54> They built it from scratch

<comment> vertex-four Their blog post suggests they wrote _something_ from scratch, but gives no clue as to what, whether they considered building on a more modern protocol specification than RTP (which is a couple decades old at this point), what they've taken from other more modern protocol specs if they didn't use one directly, or anything aside from that they wrote some code really.

</comment></comment></comment></comment></comment><comment><USER55> would loved to see a demo

</comment><comment><USER56> Awesome post

</comment><comment><USER57> But does it have middle out compression?</comment>


Why browse the Web in Emacs? (2008) - <AUTHOR> http://sachachua.com/blog/2008/08/why-browse-the-web-in-emacs/# <comment><USER2> Don't really want to edit in Emacs either.</comment>


Poll - product ideas - vote and submit - <AUTHOR>

I have some products that I need and would like done either by me or someone else.
Since many of us have needs and limited time, why not list our needs and business ideas, and vote. This can be used both ways: to say 'I need this', or to ask 'How many people need this?'.
One vote should mean: I need this.
I'll start with a couple of things I have been looking for since a while. <comment><AUTHOR> Product: CRUD web application "in a box"

Input: a SQL database structure (.sql file)

Output: a complete web app with CRUD interface, admin interface, and user authentication

(something like this -> <http://phreeze.com/cargo/customers> with user authentication)

Use cases: any team of people who need to work on a common database. (I am looking for this since years)

</comment><comment><AUTHOR> Product: lead generation market place "in a box" (or SAAS)

Input: domain name, and some texts

Output: a complete web app "ala redbeacon" for any niche

Use cases: RedBeacon for any niche, any language or location.</comment>


How expensive would it be to build this - asks a non tech?  - <AUTHOR>

This is fantastic - how much would you estimate it cost to build: http://www.thekillersmusic.com/html5# <comment><USER2> Clickable: <http://www.thekillersmusic.com/html5#>

FWIW, my browser isn't supported, I get an image, no links, no interaction, no hint of what to do.</comment>


What I learned as a developer from Soviet accidents in Space - <AUTHOR> https://evilmartians.com/chronicles/what-i-learned-as-a-developer-from-accidents-in-space <comment><USER2> >every issue should change the code or documentation.

This is a really good place to start as my ultimate goal is to get as much traction as I can with users.

Misunderstandings by the user base often present as issues and at bare minimum misunderstandings are a sign that users are having trouble consuming my solution.</comment>


Adobe CVEs - <AUTHOR> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Adobe <comment><USER2> Looking at crazy stuff like this, I'm so glad most browsers can render PDFs natively and I don't have to rely on any Adobe software anymore.

<comment><USER3> OK, but then again: [https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=chrome+pdf](https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=chrome+pdf)

<comment><USER4> Versus Firefox': [https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=pdf.js](https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=pdf.js)

<comment><USER2> Firefox is so utterly underrated these days. Such a shame. It's a good browser which puts the user in control and just gets the job done.

<comment><USER5> They've been moving away from that though, try changing your user agent or disabling JavaScript.

<comment><USER4> Agreed, they are moving with what's popular. I'm just afraid it's necessary to keep market share. When moving browsers people allow a lot more disruption compared to when a browser gets an update. To move forward, old thing probably have to break... or at least, that's what I like to believe because otherwise Firefox is becoming shit.

</comment></comment></comment></comment></comment></comment><comment><USER6> How does Adobe allow this to happen? After enough of these over time, you'd think they'd fine some way to invest majorly in securing their runtimes.... either via another language like Mozilla is doing with Rust, some provably secure math-vm-thingie like Microsoft Research, massive security reviews & reduction of attack surfaces like OpenBSD, or another CS-driven solution.

<comment><USER7> Adobe would definitely profit from languages such as Rust. But they are not a "tech" company in the traditional sense anymore, I don't see them investing in anything that doesn't yield high short term returns. It's a big company that dominates the "creative" market, because it can impose its formats on an industry that does not care about open technologies.

<comment><USER8> Rust isn't a cure-all for every security issue.

<comment><USER9> True, and there are lots of security exploits that are caused by logical error, but the majority of those CVEs are caused by memory corruption, use- after-free and out-of-bounds memory corruption.

All errors avoidable in Rust, as well as other safe languages, outside unsafe blocks.

</comment></comment></comment></comment><comment><USER9> Keywords for the safety minded ones:

\- exploitable memory corruption

\- exploitable heap overflow

\- exploitable use after free</comment>


Ask HN: I'm making a big decision about my career all comments appreciated - <AUTHOR> I have 5 years worth of support experience in large corporate environments and 2 years experience in technical/SAAS support.
I've been with my current company for 2 years. It's a startup and the hours are intense. A big perk has been the chance to see how a software company operates from the inside.
This kind of work is not something I enjoy or find challenging. I'm doing high level support and work as what could be considered a project coordinator for some large projects, but I hate the day to day activities.
Over the past few years, I've been upskilling in my spare time (building a few small web apps and working through most of the FreeCodeCamp curriculum). I started a bachelor degree in CS part time this year. I want to work in development and have made that my #1 goal.
I'm ruminating over two choices:
1. Take a job offer with a larger software company doing the same L2/L3 support tasks as my current role. The pay is much better (a low focus point for me ATM) and they have given me a handshake agreement that I can apply for a developer role when one comes up (I made it clear in the interview that I'm done with support and will be taking the first development opportunity that I see).
2. Self study. I'm spending every free moment working on personal projects and studying, but I cap out at about 2 hours per work day (I work a 10 hours+ per day at the moment) and 6 hours per weekend day. I would like to spend a few months tweaking my projects/developing my skills further (I'm still a bit off getting an interview based on discussions with developers at work, but not that far off) and then start applying for the jobs I'm interested in.
Everyone in my life is telling me to take the job offer, be happy with a pay bump,  and spend the next 5 years finishing my degree part-time before looking for a career change. I'm 28 and the though of waiting 5 years to change my career sounds like my own personalized version of hell.
Any input is appreciated. <comment><USER2> It sounds to me like the constraints are:

\-- You don't care much about money right now, to the point that you're willing to go to $0 for option 2

\-- You work too many hours at your current job to do what you want to do.

\-- You have an outstanding job offer (you didn't say what the expected workload is but it sounds like probably the same?)

It sounds to me that the obvious choice is to ask your current employer to cut your hours but not your pay. Or maybe just cut your own hours. Worst case they say no and you go to the other job or quit. Best case they say yes and you can maintain your income but still get what you want done.

It sounds like your main priority should be more hours to for you to work towards programming, but you need to balance that with the risk that if you quit you may not be able to get another job right away, especially if the economy tanks.

You're in a much better position if you at least have some sort of job so you aren't losing money.

<comment><AUTHOR> The constraints are accurate. I had more information in my original reply, but I hit the character limit.

I have a little over 12 months living expenses saved (and a wife that earns a decent income who's willing to support my possible career detour as long as I pull my shit together in the next 3 years so we can pop out some kids). That's a key factor as well -- I want to have kids in the next couple of years and I wouldn't be able to be unemployed to study with small humans running around.

The new position will be 8.5 hours per day (no more no less).

My current employer isn't in the position to cut my hours (well.. they weren't in a position to discuss any changes to my hours/schedule before I had an offer).

<comment><USER2> > well.. they weren't in a position to discuss any changes to my > hours/schedule before I had an offer

Unless you love the job it's better to switch than to get a counteroffer. Even if they give you one, you'll be the first person they cut when the time comes.

</comment></comment></comment><comment> timothy-quinn Choice 1 - without a contract a handshake means nothing, and as you've said they'll let you apply for the jobs, but that still doesn't guarantee you'll be given them (especially if you become very useful in L2/L3 support).

For me personally I found getting any software development job I could, even though they're really dull large enterprise forms-over-data jobs, gave me a massive boost in development ability and experience, especially because I was thinking about dev for 8+ hours straight every day.

Will the Choice 1 job make you work less hours? If so that frees up more time to work on dev projects on the side, and you could use that to your advantage.

<comment><AUTHOR> > Choice 1 - without a contract a handshake means nothing, and as you've said > they'll let you apply for the jobs, but that still doesn't guarantee you'll > be given them (especially if you become very useful in L2/L3 support).

Yeah, that's literally the situation I'm in with my current role. I asked about moving across to the development team (even as an intern for a month unpaid) and was told "your role is too difficult to fill".

I expect that is a serious possibility. As a plus, I did come into the business with a clear mandate so it won't be much of a surprise if I leave for a dev role after a year.

> Will the Choice 1 job make you work less hours? If so that frees up more > time to work on dev projects on the side, and you could use that to your > advantage.

The hours are fixed (9-5), which is better than my current position.

<comment><USER2> I just read this after my reply.

If option 1 is a new job for more money and fewer hours, I'd take the new job.

You don't want to be without a job in a few months, as there is a good chance of economic downturn near or shortly after the election.

With a 9-5 fixed hour job, you'll have plenty of time to practice coding.

</comment></comment></comment><comment><USER3> Echoing timothy-quinn, a handshake means nothing. Given that better pay is not a high priority, then you might consider holding out in your current position for a development position elsewhere.

Absolutely don't wait 5 years to change your career if you can afford otherwise.

Choice 2 could be a good option if you have savings to last for a few months. Do you enjoy your bachelor CS curriculum? If so, can you go full-time on that? If you've got time to plan ahead for Choice 2 and are US-based or able to travel to the US, then places like 42 school (Fremont, CA) or the recurse center (NYC) can be good for independent study with enthusiastic peers.

<comment><AUTHOR> I'm based in New Zealand.

I would consider going full-time with the CS degree, but it's very theoretical and I'm not sure if it's worth the effort (vs. self study).

</comment></comment><comment><USER4> What is most fascinating about your first choice is that you received an offer _after_ telling them you don't want to do the work. Do you know why they want to hire you despite this?

EDIT: Depending on their reasoning to extend you an offer, option 1 could be an excellent opportunity.

</comment><comment><USER5> Take the new job. Use the free hours to brush up your dev skills.

You should have no problem getting a dev job within a year. Make sure your study is focused, you don't need to know everything about everything. Pick a niche and study that and execute some projects in that niche.</comment>


SpaceX Falcon 9 vs. ISRO's Reusable Launch Vehicle - <AUTHOR> https://medium.com/@rsn/spacex-falcon-9-vs-isros-reusable-launch-vehicle-c52d4d56f87d#.2ymtsfkcu <comment><USER2> Yeah, but...

...SpaceX is not developing launch vehicles for Earth. They're developing launch vehicles for Mars and bootstrapping by using them on Earth. So all of these comparisons are off-base because they're so short sighted.</comment>


India's engineers struggle for work as jobs crisis worsens - <AUTHOR> https://www.reuters.com/article/us-india-election-jobs-insight/ctrl-alt-stall-indias-engineers-struggle-for-work-as-jobs-crisis-worsens-idUSKBN1QT0GS <comment><USER2> I think its likely that surges in demand for all kinds of STEM are going to continue for years. Its not like we haven't seen this before: Too many Lawyers, too many Ship builders, to many coal miners, too many cooks (literally, not figuratively)

Civil Engineering in Australia soaked a lot of very good, skilled graduates from Persia, India, China. But then the boom in gas/oil/coal/iron-ore turned to slump, and they got laid off, and their conditional residency ends, and ..

</comment><comment><USER3> What India really needs to change is a culture of conformity, and to encourage entrepreneurship. I mean, not everyone is constitutionally capable of becoming a great engineer, but their parents push their kids through the same engineer + mba pipeline, all to get a job and generally it's the same type of engineering job (i.e whatever pays the highest at the moment, if it's software, you see like millions of people graduate as "software engineers"). Instead of always having a mindset of "what pays the most?", if the parents can encourage their kids to learn deeply and develop in what they find passion in, i think you'll see a a lot of India's problems being solved, and India developing self sufficiency in economic terms. The brain power is most definitely there but a culture of preferring safety over everything else needs to change.

<comment><USER4> Why is software engineers in quotes?

<comment><USER3> Because there are a lot of lower tier colleges which have no standards when it comes to graduating "software engineers." Basically like paying for a piece of paper and the right to call yourself an "engineer."

</comment></comment></comment><comment><USER5> Interesting article. (Full of anecdotes though) On one hand it blames the government for not bringing jobs, on the other hand it cites youth's 'unemployability' as the driving factor for their joblessness. So which one is it? Their lack of English skills, substandard education in mid tier colleges or absence of jobs?

<comment><USER6> English skills aren't the best but I don't think that's the issue. Substandard education drives the unemployability and poor infrastructure drives the lack of jobs outside the bigger tech metros (Bangalore, Hyderabad, Mumbai IMO).

<comment><USER7> The real reason of substandard education is the lack of better lawmakers IMO. And it's an especially hard problem to solve in India.

Its a vicious cycle where uneducated citizens select equally uneducated lawmakers (because susceptible to propaganda/lies easily). The uneducated lawmakers don't have much incentive to improve education, because that will affect their election results, next time around.

And turning to private institutions is of no use. They have neither the good will nor the cash flow to actually do something about this problem...

<comment><USER8> There's no factual reason to believe that college education reduces susceptibility to political manipulation.

<comment><USER7> I think the current state of affairs in this country don't really need proof. I mean do you really think a person who has studied science will elect this guy as the Chief Minister? ([https://en.wikipedia.org/wiki/Yogi_Adityanath](https://en.wikipedia.org/wiki/Yogi_Adityanath))

<comment><USER5> Yes, yes they will. Studying something in college in no way correlates to your political affiliations and choice of leaders. I'd say stop pushing agendas and quit being smug about it but that would have zero effect on you.

<comment><USER7> So you believe that education is just about technical skill?

<comment><USER5> 'Studying science'? Absolutely.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Is there a way to help? The brain power going to waste is awful.</comment>


National coronavirus response: A road map to reopening - <AUTHOR> https://www.aei.org/research-products/report/national-coronavirus-response-a-road-map-to-reopening/ <comment><USER2> Check the source: [https://www.sourcewatch.org/index.php/American_Enterprise_In...](https://www.sourcewatch.org/index.php/American_Enterprise_Institute)

<comment><USER3> That's normally a sound strategy but in this case, the individual authors matter a lot more than the entity. Scott Gottlieb, the first author, is the ex-commissioner of the FDA and widely trusted by all parties.

The doc is as close as the country has to a plan and has been covered (or recycled) by many mainstream newspapers. Here's Boston Globe's coverage: [https://www.bostonglobe.com/2020/03/30/nation/new-roadmap- la...](https://www.bostonglobe.com/2020/03/30/nation/new-roadmap-lays-out-how- we-might-emerge-coronavirus-crisis/)</comment></comment>


Show HN: SMU – Free music player for Android - <AUTHOR> https://play.google.com/store/apps/details?id=com.smu.player <comment><USER2> I appreciate that the app only seeks the minimum necessary permissions.</comment>


Gender bias in open source: Pull request acceptance by gender [Preprint] - <AUTHOR> https://peerj.com/preprints/1733/ <comment><USER2> I like how this paper is constructed. They form a bunch of hypotheses and test them and aren't afraid to be wrong. Rather refreshing since the typical papers I read are more of the "here's our successful test" variety. I feel like a supplementary qualitative analysis (code quality) would be helpful. My personal hypothesis is that women self-select and the pool of female contributes has a higher average skill than the pool of male contributors.

I have no evidence to back this up but by gut says that it's still socially harder for women to become developers and as a result the ones that "survive" tend to be better on average. While this is a bias I'd argue that the major reason (cause) for the acceptance/rejection of pull requests is the quality of said request which would argue against a bias in the acceptance. I'm not sure how to phrase it well but in summary I think there's a social bias against women in programming (as a career) but I suspect code quality is the main cause of accept/reject decisions and there is no bias there.

</comment><comment><USER3> Was this flagged into obscurity while I was reading the paper? I can't find it on the first five pages anymore. Pretty sad.

<comment><USER4> There was a more successful repost 6 hours later that got some discussion: [https://news.ycombinator.com/item?id=11074587](https://news.ycombinator.com/item?id=11074587)</comment></comment>


Stock Market Tips All Over The World - <AUTHOR> http://www.wikio.com/webinfo?id=13036613 <comment><USER2> Um... why is this a link to a redirect?</comment>


Using GNU Screen to perform a command line demo - <AUTHOR> http://www.trolocsis.com/wp/?p=622

<comment><USER2> I love this hack for hitting C-c C-c in vim and having your current paragraph telegraphed to whatever screen window you want. I imagine it'd work for demos just as well as developing bash scripts.

[http://technotales.wordpress.com/2007/10/03/like-slime- for-v...](http://technotales.wordpress.com/2007/10/03/like-slime-for-vim/)

<comment><AUTHOR> Very cool. I love vim and never came across this post. In fact, the link to Jerris Welt's post on 'Scripting screen for fun and profit' [1] seems handy also.

[1] [http://www.jerri.de/blog/archives/2006/05/02/scripting_scree...](http://www.jerri.de/blog/archives/2006/05/02/scripting_screen_for_fun_and_profit/)

</comment></comment><comment><USER3> The utility used at WWDC is called DemoMonkey: [http://developer.apple.com/mac/library/samplecode/DemoMonkey...](http://developer.apple.com/mac/library/samplecode/DemoMonkey/Introduction/Intro.html)

 _edit_ : The description in the article sounds like they could have used DemoAssistant [http://developer.apple.com/mac/library/samplecode/DemoAssist...](http://developer.apple.com/mac/library/samplecode/DemoAssistant/Introduction/Intro.html)

<comment><AUTHOR> Thanks for the reference to the OSX tools. I was wondering what they used.</comment></comment>


Show HN: Hype Pro uses Matter.js for Physics animations without writing code - <AUTHOR> http://tumult.com/hype/pro/ We're integrating with the awesome project Matter.js (http://brm.io/matter-js/) as a Physics engine for our HTML5 animation app.  Here's a quick demo video showing it specifically in action:
https://www.youtube.com/watch?v=LHI-hNjiors
In developing, I'd often spend hours playing with it making complex rube goldberg setups and pinball machines :). <comment><AUTHOR> We're integrating with the awesome project Matter.js ([http://brm.io/matter- js/](http://brm.io/matter-js/)) as a Physics engine for our HTML5 animation app. Here's a quick demo video showing it specifically in action:

[https://www.youtube.com/watch?v=LHI- hNjiors](https://www.youtube.com/watch?v=LHI-hNjiors)

In developing, I'd often spend hours playing with it making complex rube goldberg setups and pinball machines :).</comment>


Summer reading: Novels that get Linux - <AUTHOR> http://en.wikipedia.org/wiki/Cryptonomicon Looking for some open source summer reading?  How about leaving a comment below with the author and title of a book in which Linux plays a role.  My suggestion is Neal Stephenson's Cryptonomicon. <comment><USER2> Despite the thread title, this is really just a link to the Wikipedia page for Neal Stephenson's _Cryptonomicon_. From the comment also posted by OP, it looks like this should (aside from the question of whether it belongs on HN at all) have been something like "Ask HN: What novels or other fictional works have Linux in a significant role?"

</comment><comment><AUTHOR> Looking for a some summer reading? How about leaving a comment below with the author and title of a book in which Linux plays a significant role.</comment>


CEO of Yipit on how he learned to code & changed the trajectory of Yipit - <AUTHOR> http://www.davidblerner.com/david_b_lerner/2011/03/venture-studio-4-vinicius-vacanti-ceo-of-yipit-part-1.html

<comment><USER2> <http://viniciusvacanti.com/>

His blog has great advice for new entrepreneurs. Especially when you don't have a tech co-founder... He covers in depth how he went about learning to code a basic prototype and provides a solid outline to go about doing so.

<comment><AUTHOR> yup, one of the best blogs for a tech entrepreneur out there...</comment></comment>


Gogo injects false SSL certificates for google.com domains - <AUTHOR> https://twitter.com/__apf__/status/551083956326920192/photo/1 <comment><USER3> Captive portals really need to die. Fake DNS entries, URL redirects, injected html/javascript, false certificates, all are very annoying essentially train users on bad behavior, and provide opportunities for nefarious actors (either by the hotspot provider themselves or attackers spoofing hotspots)

Plus the user experience is awful, sometimes when I join a network the portal shows up immediately, sometimes I only get it when I open a browser. Sometimes I open my mail first and get 10 error messages about incorrect certificates.

Is there any good alternative / standard that could serve the purpose without all of the current drawbacks?

<comment><USER4> Captive portals are fine if you use a VPN. When I go on a flight, I visit a non-https site, get redirected to the WiFi login-or-pay, pay, and then connect to my VPN. All traffic after that (to the airline) is encrypted. Plus, airlines would never start blocking VPNs because you would lose all of your business customers.

<comment><USER5> Captive portals need to die not because of any technical reason - they have the same problem as the "UAC" pop-up showing up far-too-frequently: it teaches people to ignore what should be a serious security warning. A SSL certificate suddenly changing to a strange new signing authority is the kind of problem that _should_ be a serious warning. By _de facto_ teaching that it is ever valid to ignore important security measures, captive portals badly hurt the real education that needs to happen about how to handle computer security.

Worse, this is another example of where laziness and convenience tend to promote these bad habits. Never-mind the average user - way too many technical people[1] fall into these bad habits - including programmers and sysadmins that _really_ should know better. This isn't just WWW/HTTPS - did you always use a VPN? With a properly secure login that you know does not involve a MitM?

[1] I mean in the general, statistical sense - any resemblance to people posing in this thread is an unintended coincidence.

> never start blocking VPN

That's easy - you just push PKI (alreadyd used in many places) and make up some excuse why this new version is needed for "airplane security". We live in an age where airlines (w/ the TSA/.gov) make a big deal about confiscating water bottles and regularly steal from luggage; do you really expect "business customers" to get angry over VPNs while allowing the past decade of security theater?

<comment><USER6> Maybe certificate pinning needs to include being able to forbid clicking through a warning. WiFi services would change their methods fast if they got sudden drop in users.

</comment></comment></comment></comment><comment><USER7> Random guess - this is probably because many people have a their homepage as a SSL'd google site. In order to be able to show the "login or pay" message to someone when they fire up their browser, Gogo needs to have a cert to communicate over 443 without the browser refusing to display a page.

Not condoning the practice, but thats my guess at the motivation. I also imagine it doesn't work very well, as many new browsers will refuse to display if the cert chain is broken.

<comment><USER8> My samsung tablet is aware of login and opens browser after it connects to wireless network.

My guess is caching (thats in airplane).

<comment><USER9> Apple does the same thing (apparently they request [https://www.apple.com/library/test/success.html](https://www.apple.com/library/test/success.html) and see if it returns the correct SSL and contents).

</comment></comment></comment><comment><USER10> I wonder if it's related to this workaround that allowed access to some Google IPs to bypass the captive portal, which someone managed to then use to access app engine, and a proxy running there to reach the entire internet: [http://bryceboe.com/2012/03/12/bypassing-gogos-inflight- inte...](http://bryceboe.com/2012/03/12/bypassing-gogos-inflight-internet- authentication/)

quote from that article:

"There is, of course, one other possible solution: Gogo could man-in-the- middle the desired Google web services in order to perform filtering on the HTTP host header. However, this approach could have unforeseen consequences. Therefore, I do not recommend it."

<comment><USER11> Well they would be facing the _unforeseen consequences_ while not even filtering the HTTP host header (the youtube page is displayed). Unless they _forgot_ to disable the MITM once the user is granted full internet access...

EDIT: Those are two nice insights about what Gogo does behind the scene, but I would bet the fact Google is involved with both is a coincidence (or is it considering the multiplicity of Google's Services?)

</comment></comment><comment><USER11> According to tweet author[1], this happened only with Youtube, and was not related to captive portal mechanism whatsoever. So I would side with her on the why: Poor plane internet access was overloaded by videos streamed from Youtube and somebody hacked together a very ugly solution that's going to have bad consequences...

[1] [https://twitter.com/__apf__/status/551132865555996673](https://twitter.com/__apf__/status/551132865555996673)

[https://twitter.com/__apf__/status/551096550516994048](https://twitter.com/__apf__/status/551096550516994048)

<comment><USER12> Correct! I've checked and it's also doing it for Vimeo, DailyMotion and probably other video sites.

</comment></comment><comment><USER13> This is a mistake on Gogo's part. I can't think of anything legitimate they could do using this that they couldn't also do in a more reasonable way. The illegitimate things they could conceivably do with this (if they wanted to do, which seems unlikely), they can't do reliably or without getting quickly discovered. A lot of people are going to see the pinned browser warning and wonder what's up.

Of course, that this is a mistake doesn't mean it will be corrected soon, so VPN is probably the way to go, which maybe it is anyway.

EDIT: perhaps this is intended to plug the hole mentioned here: [http://bryceboe.com/2012/03/12/bypassing-gogos-inflight- inte...](http://bryceboe.com/2012/03/12/bypassing-gogos-inflight-internet- authentication/) That really should be only applicable to people who haven't paid, however.

</comment><comment><USER14> I wonder if there is any trademark/service mark issue here? They are issuing a certificate that identifies itself as Google's, but it is not.

Note that if Google sued over this, Gogo would not be able to use anything in its TOS as a defense, because the TOS is between Gogo and its users, not between Gogo and Google.

</comment><comment><USER15> that funniest thing is the comment from David Aronchick about midway down:

"@__apf__ i love that people are trying to explain to you what's going on - <USER2> you folks know who she is? :)"

So I'm like, who is this girl? I've never heard her? What's the big deal with people taking guesses about what is going on?

Then I check her profile on twitter:

Engineer & usable security researcher. Google Chrome security team.

Yep... sometimes when you throw your two cents in, you get hit in the head with a quarter.

</comment><comment><USER16> This is SOP at many employers that want to snoop use of their private Internet feed.

<comment><USER13> _...SOP at many employers..._

That's true, and I can't believe we _still_ haven't seen someone suing an employer over leaked personal banking creds. Many firms just have the proxy running, and haven't actually thought very hard about what assets (and whose) that proxy sees.

<comment><USER17> Any such lawsuit would immediately run into the problem that your employer gives you a computer to work for them, not to conduct your personal online banking and you'd need to be willing to lose your job banking on that lawsuit succeeding and generating a large enough settlement to be worth it.

The far more likely grounds for a ruling against a sloppy proxy operator will come from something like a HIPAA violation or perhaps one of the financial trading companies.

<comment><USER18> > The far more likely grounds for a ruling against a sloppy proxy operator > will come from something like a HIPAA violation or perhaps one of the > financial trading companies.

In general, I don't think a proxy operator would be covered by HIPAA; if there's any HIPAA issue there, its with the HIPAA covered entity with which the user is communicating using a communication mechanism vulnerable to an MITM attack in the first place.

<comment><USER17> That's only true for generic public proxies. In the context we're talking about, however, it's too easy to imagine a company which has patient records installing a corporate monitoring proxy but configuring it in some way which either revealed data to people who shouldn't have it or failed to retain mandatory records like audit logs. Some places feel corporate proxies are necessary for compliance auditing but they're enormously risky since you're creating a single point of failure which has access to almost everything.

</comment></comment></comment></comment></comment><comment><USER19> On gogo wifi right now and I'm not able to replicate the results. After paying for access I've tested several google services with no certificate issues(checked with latest Chrome, and openssl's s_client).

I opened another laptop(I travel with two), and without paying I started testing outbound connections with openssl's s_client and curl. It appears that the gogo wifi system will allow between 5-10 ssl connections before starting to block all outbound ssl connections. Without paying all http requests include a redirect to the captive portal, but at no time did I see a self signed cert for any of the https connections attempts.

</comment><comment><USER20> I'm not sure what all of the fuss is about. They didn't somehow obtain a copy of Google's real certificate; they made a fake one with the same contents, but not signed by a certificate authority your browser trusts. Your browser erects the standard "woah wtf" alert. There is a ton of infrastructure built into your browser to make sure you are aware of this.

I suppose the main reason to be concerned is that, sadly, many people will click through this; generally, though, they are the same people who will download random software and install it, join untrusted wifi networks, click on attachments, etc etc -- in other words, they are already victims of clicking-before-thinking or clicking-without-understanding.

This is _less_ horrible than silently modifying pages, injecting JavaScript, etc -- at least you get a warning and can go to a non-ssl page and pay for your wifi (and then use a VPN if you so desire). It isn't just GoGo that does this. Various other public WiFi, such as hotels, airports, etc, often do things like this as well (though usually just to extract payment rather than selectively block certain sites).

</comment><comment><USER21> I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?

<comment><USER22> I doubt this is them trying to block YouTube.

The certificate has SAN entries for things like google-analytics.com, android.com, *.cloud.google.com, goo.gl, g.co, urchin.com, and a plethora more[0].

If they wanted to just block YouTube, there are ways to do that without forging certificates. For example, modern browsers will send the domain name in plain-text even for HTTPS connections for SNI to function. They could easily block based on that.

[0] [http://imgur.com/a/C8Tf4](http://imgur.com/a/C8Tf4)

<comment><USER23> They just cloned the list of SANs in the standard Google certificate, which YouTube also uses.

Captive WiFi portal (or some sort of traffic-shaping) is likely the right answer, as the other poster above points out.

Given that the issuer is an internal IP I'm pretty sure they are just proxying HTTP(S) requests, grabbing the remote certificate, duplicating the subject and signing it, allowing them to on-the-fly MITM any HTTPS traffic. Trying this with a different HTTPS site will easily show this, I don't think they're specifically targeting Google directly.

</comment></comment></comment><comment><USER24> I noticed this back on Dec 8 [1]. Sadly, looks like I got the wrong twitter account when trying to report it.

[https://twitter.com/moyix/status/542079755659390976](https://twitter.com/moyix/status/542079755659390976)

</comment><comment><USER25> Imagine if Gogo gets compromised and that cert is stolen. Suppose it will end up on a CRL or just quietly replaced?

<comment><USER26> It wouldn't matter, the certificate is signed by Gogo so isn't valid by default on anyone's devices.

</comment></comment><comment><USER27> Seems like someone should instigate a class-action lawsuit against them for DCMA / HIPPA violations.

<comment><USER28> DMCA doesn't apply here; there is no copyrighted media being copied.

HIPAA doesn't apply either; the in-flight wifi carrier is not a health care provider.

<comment><USER27> DMCA is more than copyright....its also about "Anti-circumvention", the idea that a supposed secure connection being circumvented.

For HIPAA: What happens when you search google for your healthcare issue that they intercept? Since they have your name (from your credit card info), now their severs have sensitive healthcare info...are they HIPAA compliant?

</comment></comment></comment><comment><USER29> TSA's influence I'd imagine. Because we all know terrorists like to double- check their how-to videos on youtube before actually commencing the act.

</comment><comment><USER30> Could be completely unrelated, but I seem to recall that anyone who bought certain lines of Chromebooks was supposed to be given 10 free complementary wifi sessions through Gogo. I wonder if Gogo was given the cert by Google for that.

<comment><USER31> If they were, it would be signed by Google, not self-issued by Gogo</comment></comment>


FBI chief Comey: "We have never had absolute privacy" - <AUTHOR> http://arstechnica.com/tech-policy/2016/08/fbi-chiefs-complaints-about-going-dark-arent-going-away-will-be-revived-next-year/ <comment><USER2> But we have also never had as powerful instruments as we do now. Photographic, videographic, audiographic and textual evidence all in one device. We need extraordinary privacy because we have extraordinary vunerability.

The FBI used to have to go in person to set wiretaps, to steal documents, to access a safe deposit box. Now they can do it from miles away, and despite what Comey implies, they can do it without a warrant.

I'd like to imagine a future where citizens would have enough privacy to stage a revolution, and enough freedom of speech to broadcast widely without the government's consent.

<comment><USER3> > We need extraordinary privacy because we have extraordinary vulnerability

I don't understand that statement. Do you mean we need a widely defined right to privacy, aggressively enforced, because observation is so easy?

I view it the other way. Observation by anyone/everyone is so easy and natural. We should not expect more privacy from law enforcement than we would from any other stranger.

More specific to the posted article, it makes sense that a corporation should be able to sell secure encryption and possibly win in the marketplace because users appreciate their privacy. If users turn out to appreciate convenience instead, then they should expect the FBI to have the same capability that the vendor has to look at users' data.

<comment> white-flame > We should not expect more privacy from law enforcement than we would from > any other stranger.

We should most certainly expect a greater measure of accountability, care to rights, and due process from law enforcement than from random encounters with strangers.

Random people see where you are, their cell phones make incidental record of you in their photographs and videos, but these aren't really actionable for said random person. ISPs and cellular providers have all sorts of info on you, but in theory this isn't being used for continual judgment of suspicion against you (though it wouldn't surprise me if it was). Aggregated together and accessible to law enforcement, though, becomes a greater threat to individuals due to false positives, corrupt police organizations, bad laws, suspicion via incidental association automatically eroding rights, and so on.

Add to this the basic human nature in that our unthinking day to day actions and thoughts are messy, flippant, and not done with care to judgment. We need privacy to be socially healthy.

I think what happened in response to the Boston marathon bombings is a reasonable model: Private cell phone footage and CCTV captures were held individually, and voluntarily offered up to law enforcement for analysis for a particular, egregious crime. In the hands of unaffiliated private parties, that information is innocuous. Aggregated, it is too powerful to not be bound by a far stricter due process. Law enforcement only had access to this because the situation warranted it, not because they had carte blanche access to everything unchecked.

<comment><USER3> > aggregated

It is unreasonable to expect a typical stranger to have access to aggregated surveillance data. Therefore, law enforcement should need a warrant to access such data.

BTW, in the article, Comey is talking about what access is possible _with a warrant_.

<comment> white-flame Yes, Comey's words, at face value, always do come across as respecting due process. But what even is a "warrant" anymore as it applies to three letter organizations? What are the scopes of these things nowadays?

And the tradeoff that Comey doesn't like and that is out of his hands is that we the people want _no mechanism for any digitally remote third party to gain access to our data_. In the cell phone case, we don't even want physical access to our devices to provide access to our data by others. Law enforcement's access is collateral damage in this fight, which makes warrants moot anyway. But it's either accessible or not, blind to who is doing the accessing, so closed it should be.

</comment></comment></comment></comment></comment><comment><USER4> Well he's incorrect in that we always had absolute privacy of thought. Its true we're no different from our predecessors who used cyphers, satire and concealment to communicate. It is also depressingly true that we are approaching a turning point in technology where our thoughts - from a purely technical aspect, may not remain private or even be fully our own.

[https://en.wikipedia.org/wiki/Thought_identification](https://en.wikipedia.org/wiki/Thought_identification)

[http://www.nature.com/news/brain-decoding-reading- minds-1.13...](http://www.nature.com/news/brain-decoding-reading- minds-1.13989)

I would argue this is the reason a bias toward privacy must exist, modeled after the same international conventions that outlaw use of WMD and torture.

<comment><USER5> Agreed. There is often a lack of imagination on the part of folks as regards the potential future abuse of privacy invading tech. There will come a day when thoughts can be decoded with ease.

</comment></comment><comment><USER6> There is more _evidence_ than ever before in human history. More and more human activity is mediated by and observed by network-connected digital recording equipment, providing what is essentially a distributed cornucopia of evidence - which is conveniently paid for by us! It's quite an exciting time to be in law-enforcement.

</comment><comment><USER7> And the government has never had omnipotence. Fuck you Comey.

</comment><comment><USER8> Unless you illegally run an email server as a public offical. Then take your time and delete anything "private", we'll wait.

</comment><comment><USER9> We probably never had a honest FBI chief ever.

<comment><USER10> What are you talking about? This guy:

[https://en.wikipedia.org/wiki/J._Edgar_Hoover](https://en.wikipedia.org/wiki/J._Edgar_Hoover)

Was an upstanding american!!!!

<comment><USER9> He ran the program to collect fingerprints.

<comment><USER10> Sorry, forgot the /s

</comment></comment></comment></comment><comment><USER11> The FBI could do a better job of advocating for increasing it scope of powers: "Give us this little change in our access to information, and we will be able to go after Rachel in Card Services." If they went after spam, and fraud, like they do terrorism, people would roll over. :/

</comment><comment><USER12> Well then things are improving!</comment>


Why Exercise Makes You Less Anxious - <AUTHOR> http://well.blogs.nytimes.com/2009/11/18/phys-ed-why-exercise-makes-you-less-anxious/ <comment><USER2> Would driving a race car or something like that for 20 minutes a day give some of the same benefits as actually exercising?

I have this theory that anxiety and depression are most commonly caused by sensory deprivation, which is obviously counter-intuitive, but it seems to match with both the clinical data and also with anecdotal evidence about how people self-medicate.

<comment><USER3> In terms of sensory deprivation tanks, Wikipedia says that it actually can relax you in the short term, and only causes anxiety after prolonged exposure (or lack thereof).

<http://en.wikipedia.org/wiki/Sensory_deprivation>

<comment><USER2> To explain my theory, basically I propose that the brain has two parts: the part that processes thoughts and patterns, and the part that processes incoming sensory data. With depression, information coming from the thought processing part of the brain becomes more salient, and the information coming from the sensory perception part of the brain becomes less salient. And basically the way to fix depression is by stimulating your sensory system with the right amount and type of sensory stimulation at the right time.

More specifically, my proposed mechanism is that during a state of depression, outside stimuli don't get processed properly because they are more than the brain can handle, thus you are essentially suffering from the effects of mild sensory deprivation even though you are surrounded by a normal amount of stimuli. And the way to fix this is by starting with less stimulation and then layering more stimuli on top so that you can 'jumpstart' the brain, so that it goes back to being able to normally process the level of incoming stimuli in the outside environment.

Note that this doesn't contradict any of the established ideas about serotonin deficiency, and I'm not at all recommending forgoing the traditional treatments.

My thinking is that the reason SNRIs and traditional treatments work is because they either involve stimulating the sensory processing part of the brain, or else (with CBT) they help people to avoid triggering excessive rumination.

What's the data? Look at both the recommended treatments and also the ways people self-medicate: there is listening to classical music, wearing more cologne, cuddling with someone else, cutting themselves, TMS/ECT, SSRI/SNRIs, acupuncture, exercise, increasing social contact, etc.

All of these are activities that increase the activity in the sensory perception part of the brain, so my thinking is that you can purposely increase the activity in this part of the brain by applying the right stimuli at the right time, and thus ultimately fix the problem by bringing your sensory perceptions back to the proper salience.

Anyway I was doing a little reading on depression a month ago on behalf of a couple friends, and this is just sort of a pattern I picked up. Not sure what to make of it, but I think it holds and is also very easy to test empirically, although I'm not a scientist so take it cum grano salis. Obviously there are purely biological or nutritional causes as well, but based on the extremely high efficacy of non-drug treatments it seems like there is something similar to what I'm describing going on.

<comment><USER4> I like your theory. However, an alternative hypothesis within your framework could be that depression is a disorder where internal thoughts are _overrepresented_ rather than external sensory experiences underrepresented. It seems like this could also result in the same coping behaviors eg cutting.

I wonder if a way to test these hypotheses would be to consider situations involving the expectation of a sensory experience and look for a mismatch between that and the actual sensation. You could do this with the rubber hand illusion or immersion in a virtual reality environment. A depressed person would putatively have an abnormal congruence between the magnitude of their internally generated brain states and external sensation.

<comment><USER2> "an alternative hypothesis within your framework could be that depression is a disorder where internal thoughts are overrepresented rather than external sensory experiences underrepresented."

I think both are happening. Basically internal thought processes increase to an unhealthy degree as a way of compensating for the decrease in sensory perception, which is the same thing as happens in a sensory deprivation tank.

I think the initial cause of the depression can be either not enough sensory stimulation or too much thinking, as happens when there is a traumatic or very stressful event. If the latter is the root cause then you may need CBT or meditation or something like that. But in both cases using my sensory jumpstart method would work to fix a bout of depression, although it will keep recurring until you change your lifestyle (sensory as root cause case) or come to terms with whatever is stressing you, or at least learn to avoid the negative thought triggers.

</comment></comment></comment></comment></comment><comment><USER5> Exercise does seem to steady my emotions, but that's not the greatest benefit I get from exercising. Health benefits aside, I can simply focus more. There's nothing like being able to sit down and fully comprehend the problem at hand because you went for a run earlier.

<comment><USER6> I think increased ability to focus and steady emotions are basically the same thing.

<comment><USER7> Not so for me.

Also, exercise doesn't seem to improve my ability to focus, though I've not tried controlling for other things (sleep, stimulants, etc.). Could be my focus would be worse were I not exercising regularly.

</comment></comment></comment><comment><USER8> It seems like an odd test to me. Swimming in cold water would test fitness more than ability to handle stress. And since some rats did not exercise they became less fit and would not handle the cold water test as well. Am I missing something?

<comment><USER9> My guess is that they didn't push them beyond the level where fitness mattered. Sort of like having a group of people run a couple of laps around a track - which even sedentary people could probably manage without much stress on their bodies. In the article it was stated that rats do not like swimming in cold water and so they are apparently testing the affects of that kind of stress rather than just the stress of physical fitness.

<comment><USER10> I'm not sure how they can separate stress caused by fear from stress caused by the physical challenge alone. I don't think this is a good experiment.

</comment></comment></comment><comment><USER11> A recent Ask HN seemed to reveal there are a lot of people here with bipolar disorder (or bipolar tendencies, at least). For those of you who are bipolar, have you found exercise to be a cure-all or to work in combo with lithium/medication, or...? Basically looking for anecdotal advice here. (FWIW, I have bipolar II.)

This article just reminded me I wanted to raise the question here, but I don't think it warrants its own post.

<comment><USER12> For me, the most important thing is to stick to my daily schedule. Every single day of the week.

Once I skip one or two meals, work long hours, or stay up late, my life starts spiraling out of control. So I live on a fixed schedule now, which includes three hours of exercise per day:

* One hour of swimming at 7AM; this forces me to get out of bed on time, and makes me hungry for breakfast.

* One hour of rowing at 5PM; this forces me to stop working, and makes me hungry for dinner.

* One hour of running at 11PM; this forces me to stop whatever I am doing that evening, and gets me tired for bed.

(In addition I have hundreds of small rules: never go shopping alone, the bed is only for sex and sleeping, dinner must take at least fifteen minutes to prepare, ...)

It does take a lot of time and self discipline (and monitoring by others), but it sure helps me to keep my life under control.

</comment></comment><comment><USER13> The problem is that there are some really fundamental differences between rats and humans in terms of metabolism. (E.g. things as different as that they have a type of muscle fibre, type IIb, that we do not have at all.)

You just can't take studies on rats like this and assume that they have any relevance to humans. There are many many known metabolic effects that work on rats but not on people.

<comment><AUTHOR> In human subjects, I would wonder if exercise outdoors in sunlight is more efficacious for reducing anxiety and stabilizing mood than exercise with indoor lighting. I also wonder if exercising with a friend is better than exercising alone for Homo sapiens. All I've got on this issue from personal experience are anecdotes,

<http://norvig.com/experiment-design.html>

but I would be interested to see if there are human-specific effects that wouldn't generalize back to other animals.

</comment></comment><comment><USER14> Hmm,

The reasoning involved in the experiment seems rather tenuous to me.

if we tried to under a computer only by how many 0's it wrote to memory for a given input, our understanding would be rather limit.

If a brain is highly tuned and complex thing, our ability to read the meaning of certain things firing or not firing for certain events is going to be limited.

The thing is the real progress is being made in far more detailed approaches than this - simulating whole fly brains or large parts of a cat brain. I suspect that this is where any real understanding is going to come from.

</comment><comment><USER15> So the rats were more stressed out from cold water than getting killed and getting their brains examined? interesting.

</comment><comment><USER16> I always assumed that this was because my brain is part of my body, and doing stuff that is good for my body would be the same stuff that is good for my brain.

For some reason we draw this weird metaphysical distinction between the brain and the other organs in the body that make results like this seem strange, when they clearly are not.

The idea that healthy people think better should not shock us. (Think better in terms of lower incidence psychological problems, although i always feel smarter after I exercise as well...)</comment>