Future of Interface - <AUTHOR> http://futureo.us/future-of-interface/

<comment><USER2> I agree except for the mechanics of input. It needs to be controllable input, and because we can't "control" our heartbeat or how much we sweat, how could we precisely input into the system?

<comment><AUTHOR> There are two parts to the proposed solution: \- Brain computer interactions: this would be a way to control your devices without doing any muscle movement. This is in line with what Miguel Nicolelis (Duke University) and others are researching. \- A.I.: could act to predict controls based on inputs from brainwaves, biofeedback, usage patterns, etc.</comment></comment>


Soviet Underwater Firearms - <AUTHOR> http://warisboring.com/articles/underwater-firearms-are-a-thing-and-russia-is-really-into-them/ <comment><USER2> Re: the last gun in the article:

> The rifle's effective firing range underwater is about 25 meters at a depth > of 30 meters and 18 meters at a depth of 20 meters, according to Russia > Today.

Earlier in the article they associate an increase in depth with a lessened range, but with this one it's the reverse? Is that a typo or a nuance of the technology?

<comment><USER3> I'm only guessing, but it's probably a nuance of the technology. The earlier weapons used cavitation created by the dart's blunt tip to stabilize it and give it range below the surface. The last gun uses a gas bubble to create a _super_ cavitation [1] effect, which based on my quick skimming of the linked Wiki article, seems to be more effective at greater depth.

Anyone with a more thorough (read: any) understanding of fluid dynamics is encouraged to correct or expand this.

[1] [https://en.wikipedia.org/wiki/Supercavitation](https://en.wikipedia.org/wiki/Supercavitation)

<comment> semi-extrinsic Ok, let's try: boiling and (super)cavitation are two sides of the same thing. A liquid will turn to vapor (boil) when a physical property of the liquid called "vapor pressure" becomes greater than the actual pressure.

When you normally boil water, you increase the temperature of the water, which increases the water property "vapor pressure" until it becomes equal to atmospheric pressure at 100 C. Or if you are at Mt. Everest, where the pressure is lower, water boils at 71 C.

When cavitation occurs, the opposite is done: you lower pressure until you reach the vapor pressure of the liquid at the current temperature.

In supercavitation, you create a shockwave in front of the bullet/torpedo/propeller which raises and then lowers pressure such that the water boils/cavitates. Why is this good?

Because it lets you put most of the velocity difference between the bullet and the water inside a gas layer. This gas layer has much less resistance to velocity differences than water. Running in water is _much_ harder than running in air, right? So far so good.

So what happens when a supercavitating bullet is fired at greater depth? The pressure is higher, so it's harder to create cavitation, because you have to lower the pressure more to get to the vapor pressure.

Why is that good? Doesn't it reduce the nice gas layer? Yes, it does. My guess is that it also reduces the length of the cavitation bubble behind the bullet, and that reduction in drag is bigger than the increase in drag from a thinner gas layer.

In the older guns, the trailing gas bubble is much shorter because of the projectile shape, and the reduced bubble length at greater depth causes part of the projectile to be outside the bubble, increasing resistance.

You could probably put some decent numerical estimates up by spending an afternoon with White's Viscous Fluid Flow and a steam table.

</comment></comment></comment><comment><USER4> Underwater guns are still being developed and marketed. Here's a description of a modern supercavitating Norwegian one: [http://www.hisutton.com/Special%20Forces%20diver%20technoloy...](http://www.hisutton.com/Special%20Forces%20diver%20technoloy%20-%20DSG%20Supercavitating%20Ammunition.html)

(The book that website promotes is a good buy if you are into this kind of thing.)

<comment><USER5> No, that is a underwater round, not an underwater gun. Most guns can be used underwater, but range is limited. The bullet in that round extends range from normal rifles. It has the added advantage of being able to be used in air as well (for "over the beach" assaults).

But you are right, they are still developing them. Russia unveiled a new one a couple of years ago (I don't have a link on hand)

<comment><USER6> The article has pictures and details of a Russian weapon that was new in 2013..

</comment></comment></comment><comment><USER7> Ah, I recognize these from Depth ([http://www.depthgame.com/guide/?command=diver](http://www.depthgame.com/guide/?command=diver)). Didn't know they were real-life firearms.

<comment><USER8> That day when you find XCom: Terror from the Deep items were actually built by the Soviets? Apparently that's a Monday.

[http://strategywiki.org/wiki/X-COM:_Terror_from_the_Deep/Equ...](http://strategywiki.org/wiki/X-COM:_Terror_from_the_Deep/Equipment)

</comment></comment><comment><USER9> "fall apart and sink" is a pretty mild way of describing what happens when a rifle round hits water....

</comment><comment><USER10> These are cool but I wonder if they actually see a lot of use in the wild. SCUBA diver fighting shows up in James Bond a lot but I have to imagine in real life it's more efficient to just cut an enemy diver's air hoses or wait for them to surface and shoot them while they're taking their equipment off.

<comment><USER11> How are you going to cut their airhose when they're shooting you with an underwater assault rifle?

And if you can get close enough to accurately cut the airhose, why not just stab them in the heart?

<comment><USER12> > And if you can get close enough to accurately cut the airhose, why not just > stab them in the heart?

Because the hose is easier, but your first point applies.

<comment><USER13> It's not going to be easy getting a knife through a rib cage and it must be hard to get leverage underwater.

</comment></comment></comment></comment><comment><USER14> Defense in depth.

</comment><comment><USER15> Nato has also had the H&K P11 since the 70's.

[https://en.wikipedia.org/wiki/Heckler_%26_Koch_P11](https://en.wikipedia.org/wiki/Heckler_%26_Koch_P11)

<comment><USER6> That weapon is mentioned and linked in the article already though, no?</comment></comment>


Show HN: Toc Messenger – A distributed messaging app that syncs across devices - <AUTHOR> https://github.com/lewisl9029/toc <comment><AUTHOR> Hi HN,

Toc is a project I've been working on for more than a year now. I'd love to hear what you guys think about it. =)

Toc is a proof-of-concept distributed messaging app designed from the ground up to support user data synchronization for use across multiple devices. It uses Telehash for its messaging stack, and is built on top of an Om-inspired architecture oriented around a central app state tree that gets encrypted using a custom encryption layer for persistence locally, and then synchronized seamlessly between devices using remoteStorage.

Originally, Toc started as our group's fourth year Computer Engineering design project at the University of Waterloo. After we graduated in May, I wanted to polish it up a bit before releasing, but evidently went a bit overboard and ended up working on it for another six months (albeit with a healthy dose of procrastination sprinkled throughout that period).

Toc is only a proof-of-concept, and has a list of awful issues that makes it rather unsuitable for long term general use. However, I'm hoping that by releasing Toc, we can bring more attention to the awesome technologies for building great decentralized applications that Toc uses, and inspire more developers to take another serious look at building distributed apps, as I hope we have demonstrated with Toc that a decentralized app can in fact have great UX if you design your apps with UX in mind from the start.

With that said, I am now officially looking for work. If you have any openings for a ClojureScript frontend project, or a React project that makes heavy use of functional techniques and immutable data, I'd love to hear about it. You can reach me through the email on my GitHub profile[1], HN profile[2] or through my Toc account[3]. ;) (disclaimer: that last option might not be completely reliable)

[1] [https://github.com/lewisl9029](https://github.com/lewisl9029)

[2] [https://news.ycombinator.com/user?id=lewisl9029](https://news.ycombinator.com/user?id=lewisl9029)

[3] [http://toc.im/?inviteid=9b0d50b86dd596aa8c7a94bd116c2ed4a24f...](http://toc.im/?inviteid=9b0d50b86dd596aa8c7a94bd116c2ed4a24ffb0f2d88d44231d3747f655fb27a)

<comment><USER2> Dude. Nice.

Is this the most advanced GUI Telehash Client?

<comment><AUTHOR> Glad you like it!

Not sure about whether it's the most _advanced_... Toc's feature set is pretty sparse (text chat only) considering what Telehash is capable of. We do hope it's the most user friendly one though. =)

</comment></comment></comment><comment><USER3> Interesting. How does this scale? Any idea on how the clients world perform with say, 10000 users logged in?

<comment><AUTHOR> The seed server I'm running probably can't handle all of them doing bootstrapping at the same time, but once they're bootstrapped and have their own lookup tables stored locally, theoretically it should scale much better than a traditional centralized app since individual messages and status updates won't need to be coordinated through any single server.

Of course, the Telehash version I'm using is very old and unsupported, so there's no guarantee that its integrated DHT can handle any significant scale.

</comment></comment><comment><USER4> Great. However...

Your name is way too close to Tor Messenger which last release a few days ago shows very good progress.

Why this matters? Your project states that it's not secure. Their project aims at being secure. One person wanting security may inadvertently install your and end up being in a less secure state as what he would get with Tor Messenger.

Changing names following name space collision is no big deal... At the beginning ;) When your name is well known it's a total different matter.

</comment><comment><USER5> Have you planned for group chat as well ?

<comment><AUTHOR> Yep I did plan for it.

All messages in the app are sent through channels that support an arbitrary number of recipients. That arbitrary number just happens to be always set to 1 at the moment.

A naive group chat implementation (i.e. an inefficient one where every participant sends each message to every other participant until they receive it) should be very doable, but I decided against implementing it for the release because it'd add quite a bit more complexity and would be rather tedious to test.

</comment></comment><comment><USER6> Looks pretty sweet, going to have to give this a look.

</comment><comment><USER7> Can I talk to someone not on my seed server?

<comment><AUTHOR> Probably not, unless the DHTs the two of you belong to are connected somehow. For example, if the other person's seed server uses your seed server as a bootstrapping server.

</comment></comment><comment><USER8> As mentioned in the readme, the name is really unfortunate given Tox exists.</comment>


Development of Sports Team Management Apps: Essential and Extra Features - <AUTHOR> http://gbksoft.com/blog/development-of-sports-team-management-apps-essential-and-extra-features/?utm_source=cmsharing&utm_medium=referral&utm_campaign=post_link <comment><AUTHOR> Here's some extra food for thought on this topic. [https://goo.gl/6vPX6V](https://goo.gl/6vPX6V) A list of special features for team management apps.</comment>


LSD — My Problem Child by Albert Hofmann - b-man http://www.psychedelic-library.org/child.htm

<comment><AUTHOR> Late Syd Barrett of Pink Floyd was into LSD when his career went off the tracks. Such a shame, he was amazingly good.

Another British band, Porcupine Tree, explored LSD in their early works, from "Lynton Samuel Dawson" to the amazing "Voyage 34", which includes the following remark:

      *They're not drug addicts
      Wandering around, not knowing where they are
      They're your most creative, most courageous
      And like it or not, they're going to build you
      A new civilization...*</comment>


CSS Tricks: How to Speed Up CSS Rendering - <AUTHOR> http://www.onextrapixel.com/2012/05/03/css-tricks-how-to-speed-up-css-rendering/

<comment><USER2> This is premature optimization, considering you could spend your time optimizing things that have higher impact.

Paul Irish said related to this: "If aren't getting 90+ Page Speed scores, its way too early to be thinking about selector optimization"

[http://paulirish.com/2012/box-sizing-border-box- ftw/#comment...](http://paulirish.com/2012/box-sizing-border-box- ftw/#comments)

<comment><USER3> If a designer knows some of these tips at the beginning of the design process, and is able to complete the initial design with them in mind (assuming time remains constant), then I'd argue "premature optimization" isn't an issue, but the end output is still faster.

<comment><USER4> Premature optimization still takes a hit - the cognitive effect of optimizing these things is definitely an issue.

</comment></comment></comment><comment><USER5> Wonder why such an article came up on HN startpage. There are no tests showing the effort of this performance tips, or how much this is true for different browsers. Is the CSS selector performance a real world problem in all browsers and all pages or only for large pages in mobile browsers? The article gives no answer.

</comment><comment><USER6> Unless you are talking about mobile devices, there are so many other things one needs to look into before trying to tune the CSS for getting better performance. Stuff like gzipping, caching and CDN will all contribute to page load performance in a much more significant way.

<comment><USER7> I visit websites that will make my CPU max out when I scroll pretty much every other day. If this guide is related to that, then it is definitely worth it.

<comment><USER8> 9 times out of 10 it's related to JS or some sort of external embedded resources. The other big culprit tends to be box-shadow which have pretty horrific performance in Chrome[1], but don't do that well in other browsers either.

I find that selector performance is not a problem unless you're dealing with large-scale one-page apps.

[1] <http://nerds.airbnb.com/box-shadows-are-expensive-to-paint>

<comment><USER9> Yeah, definitely JavaScript. Don't forget web fonts too. I can't tell you how many times I see an entire page load then have to wait several seconds for any text to show up. It's always good to write clean efficient CSS but I think articles like this are more like coder porn than anything else. The performance gains are trivial especially when compared to JavaScript, embeds/like buttons, videos, images, and slow database queries. I know DB queries arent rendering related but I know many somewhat experienced developers working on sites that run a CMS who start optimizing everything except their database and drive themselves crazy trying to figure out why pages are loading so slow. Point is, optimized CSS is probably not that high of a priority for the vast majority of sites.

<comment><USER10> Not sure why you're being downvoted, you've got some good points.

Maybe because you said definitely JavaScript, and the GP said he had javascript disabled, but your point still stands.

</comment></comment></comment></comment></comment><comment><USER11> The _only_ time I've ever seen CSS make a difference to page rendering speed is the use of large drop shadows (e.g. 25px wide, on page-size elements) on large DOM elements. Just five of them kills scrolling performance.

Anything else, page rendering times for me have only ever been slowed by too many DOM elements (> 1000). I've never come across a real-world case of the actual selector syntax making a difference.

</comment><comment><USER12> if you are developing websites for clients don't get into this much detail cause no one will ever appreciate the work you made.

on the other hand if you are running a single web app and have the time to spare it might be a good idea to look into this cause apart from nice visuals and intuitive UI, the more responsive your web app is the more likely users will not give up on it.

<comment><USER13> >if you are developing websites for clients don't get into this much detail cause no one will ever appreciate the work you made.

That's only true if you don't know how to sell yourself. Considering that you can make people think something is faster just by telling them that it is so, you should be able to get appreciated for actually making a difference.

But don't do this kind of thing in the course of your development. If you make something 10% faster without being asked, nobody is going to appreciate that. Fine-tuning and optimization is a separate service, and if you set realistic expectations and then deliver on them, your efforts will be appreciated.

</comment></comment><comment><USER14> Though I'd like to have seen some stats on improvements in speed, etc. etc. I agree with most of the comments that optimizing for css selectors is probably overkill.

But being aware how browsers are interpreting your CSS and being a bit mindful during development can be helpful.

</comment><comment><USER15> _Don't do this:

form#UserLogin {} ID selectors are unique; it just makes them less efficient as they don't need a tag name to go along with it. Classes aren't unique, but it's a good idea to avoid this method on classes too._

Re: classes - at least in IEold, and at least with jQuery, I found that performance for a selector like table.foo was orders of magnitude faster than .foo (for a page with a too-large DOM). IEold does not have a native document.getElementsByClassName so jQuery was searching the entire DOM for a .foo. This may be different for CSS vs JS though.

</comment><comment><USER16> Does anybody recommend a CSS-optimizer that takes into account these suggestions? I'd love to plug a page into one and get some suggestions.

</comment><comment><USER17> I find it really interesting how expensive it is to have <img> tags without specifying a width/height. I always knew this was best practice, then stopped doing it once I started experimenting with "responsive web design."

<comment><USER8> You probably know this but you can just specify something like "height: auto; max-width: 100%;" within a media query if you have an image that's supposed to at most fill the full column width. That would then override the inline height and width attributes.

<comment><USER18> This is interesting, and I hadn't heard about it until now. Would you care to elaborate, or point to further information?</comment></comment></comment>


A Texting Truth Often Forgotten in Politics: Your Phone Remembers Everything - <AUTHOR> http://www.nytimes.com/2016/08/12/nyregion/a-texting-truth-often-forgotten-in-politics-your-phone-remembers-everything.html <comment><USER2> Another truth often forgotten: the _recipient 's_ phone remembers everything, too. You might use full-disk encryption on your phone, but that doesn't matter if the recipient doesn't.

<comment><USER3> And the networks on both the sender's and receiver's side keep a copy of the messages for a certain time. Depending on local data retention laws, these may then be kept for some mandatory longer period.

<comment><USER4> It's a good idea to assume that texts are stored forever. There's no technical reason to remove ~140 bytes of data when storage is cheap.

Your local data retention laws and the network's practices may vary or they may be under pressure from law enforcement to keep things longer than necessary. They will not disclose in public how long they are stored, so better assume forever.

<comment><USER5> Especially when that 140 bytes is text, one of the most compressible forms of data

</comment></comment></comment></comment><comment><USER6> "Data are liabilty" has become a mantra of mine.

And while it frequently afflicts those utterly disenfranchised (see the parallel HN item on asset forfeitures, aided by scanning or having employees hand over travel records), it also hits those in power. The difference is that whilst the disenfranchised may find themselves arrested or disencashed, the powerful seem to find a harsh spotlight shined on them, but largely avoid harsher penalties.

Not always, and not entirely successfully. But information, it turns out, is not _power_ , but a _power multiplier_. If you have a great deal of power, information used _against_ you diminishes that somewhat, but can only multiply your attackers' own power by so much.

It's a rather interesting dynamic.

<comment><USER7> I wish politicians used that mantra, too, and made laws that basically split information into various classes or levels of sensitivity. Companies would still be free to collect whatever data they want. But the higher the sensitivity level, the punishment becomes progressively bigger, too, in case of a data breach that exposes that information (and the punishment should be almost automatic when it happens).

I believe that should give companies enough incentive to:

1) collect only the absolutely necessary data that they need

2) if they do collect more sensitive data, invest heavily in protecting it

<comment><USER8> I disagree. Cynical me thinks this plan would first and foremost give companies incentive to gain control about whichever agency is tasked with setting the sensitivity levels - and make sure all interesting data is classified as "minimum sensitive"...

You could even use this as a tool to gain an unfair market advantage:

1) develop some proprietary (reversable) obfuscation algorithm

2) market the algorithm as "data anonymization" and lobby to get the "anonymized" data classified as insensitive

3) you can now collect the same data as your competitors but have to obey lesser security standards than they have. Unless they purchase the algorithm from you.

4) profit!

But even if that scheme worked, it doesn't seem to protect the end user against things companies intentionally do with the data that are not in the user's interest. Including "intentional data breaches", aka selling the data to third parties. (or getting acquired by a third party)

<comment><USER9> "anonymized" is mostly a joke anyway. Seems more likely to indicate they removed your name and email than any attempt to prevent identifiability.

Cynical me says 95% of everything in this area is profit, to hell with anything else.

</comment></comment></comment></comment><comment><USER10> "Dance as if nobody is looking, write emails as if they will be read aloud in a deposition"

<comment><USER11> But when you are dancing somebody could be filming and updating to YouTube so maybe you should dance accordingly.

<comment><USER12> I guess the point of that proverb is that even if you dance badly, you'll at most be ridiculed, but possibly become a hit. You will likely not be imprisoned.

(Well, in Western countries anyway... except if the dance contains hand movements or such that are illegal. I mean, if it's just a dance, no problem.)

<comment><USER13> Exactly, and once these sorts of videos become common enough in society that everyone has at least one, they won't even harm your chances at employment.

</comment></comment></comment></comment><comment><USER14> i'm not sure the problem is the careless messages - its the bad behaviour that is 'let slip'

i know its not exactly the point of the article, but the way i deal with my frustration over this is by doing whatever i can whenever i can. if everyone did this our leaders might actually be doing the important work of maintaining and improving society, law and order instead of the bullshit work of being power hungry scum.

the fact that we call them politicians says it all imo...

</comment><comment><USER15> An additional node, or vector: You phone's IME.

You probably don't think about your IME that much. I started thinking about it when it made typing various strings of pinyin (input of Romanised Chinese) much easier because it recognised what I was typing.

</comment><comment><USER16> This is interesting - I can't tell from the article if the text message was divulged by the receiving party or through a subpoena. I understand that SMS can be captured by the provider and they can be subpoenad, but what about messages sent via a third party service (iMessage, WhatsApp, etc) that are (at least notionally) encrypted and not visible to the service? Would an individual be compelled to present these in court?

</comment><comment><USER17> How long until they start subpoena-ing your browsing history from Google?

<comment><USER18> [https://www.aclu.org/blog/how-private-your-online-search- his...](https://www.aclu.org/blog/how-private-your-online-search-history)

</comment></comment><comment><USER19> This just ins't politics and it isn't just text messages. Anything you send over the wire could comeback.

</comment><comment><USER20> Yes, they are sorry they got caught. Next time you hope they will use better ways to hide their secrets.

What great journalism.

*they = could be anyone.

</comment><comment><USER21> So do photographs and screenshots. :)

<comment><USER22> I disagree: [http://i.imgur.com/bkjvUCy.png](http://i.imgur.com/bkjvUCy.png)

Screenshots prove nothing. A better choice are 3rd-party archives (EG: Internet Archive) where you can view a page or take a "snapshot" of what the page looked like at a certain time.

While it isn't arguably 100% secure - it is far more trustworthy than random screenshots since it adds several steps before anyone can say "it is manipulated".

</comment></comment><comment><USER23> This story is silly.

<comment><USER24> Why? (not agreeing or disagreeing, just asking)

</comment></comment><comment><USER25> This is why you use Wickr instead.

PS Down vote is annoying. This is _precisely_ why I use Wickr for some communications. It gives me a text message like experience with messages that are automatically deleted from my phone and recipient's.

<comment><USER2> That assumes you can trust 1) the (proprietary) application on the recipient's end to delete the message, 2) the recipient to not save the message some other way, and 3) the opaqueness of the protocol preventing anyone from writing a replacement client that doesn't delete messages.

There's no way to guarantee deletion; if the recipient can read it, the recipient can save it.

<comment><USER26> In the end it will always come down to the 'analog hole' \- no matter how airtight the digital implementation, you'll never stop the user at the other end from taking a photo of the screen.

<comment><USER27> Not an analog photo, no. However, an airtight digital implementation would absolutely do stop anyone from recording anything they're not allowed to record -- and it wouldn't be really airtight if ownership of non-aligned equipment was tolerated :P</comment></comment></comment></comment>


Tesla vs. Target: Which CEO wrote the better transparency letter? - <AUTHOR> http://thenextweb.com/entrepreneur/2013/12/23/tesla-vs-target-ceo-wrote-better-transparency-letter/?fromcat=all#!qwxgy

<comment><USER2> _People want facts, then maybe feelings_

Generally speaking I think this is actually backward they are moved by feelings then use the facts to back them up. Just look at the best sales technique (across industries): Telling a story. The "feelings" angle is actually much more powerful for PR activities.

The Tesla response was, as the author points out, for "Tech savvy people" \- the kind of people who would or would nto buy a tesla.

This is comparing messages that are targeting the median customer of two different core markets: tech savvy early adopters vs mid-range product consumers (there are undoubtedly overlaps between Tesla customers and Target customers). These messages probably separately work great for their target market.</comment>


Lisp is non-functional - <AUTHOR> https://groups.google.com/forum/?fromgroups#!topic/comp.lang.lisp/cf9y_A9F7II <comment><USER2> People mistake me ("Xach") for Xah all the time. Pretty annoying.</comment>


If we made testing a language's first class citizen - <AUTHOR> we'd be able to live code everything we make, by requiring a mock and expectations for every class we should be able to see output live as we code.<p>yes some already (Golang or D) do this and they should be able to run their tests inline with a pretty editor to create an live-code-esque environment. <comment><USER2> This is already a thing. It's in the form of static typing and runtime type- checking. If you use one (or both) properly in a language that supports them, you'll end up needing nearly zero unit tests, and you can focus on integration tests.

<comment><AUTHOR> I think unit tests are good to make sure code has proper logic. all types could be used properly yet it doesn't behave as intended.

I'm not sure how it would look but maybe declaring methods using demo literals and ending them with an expectation could be the way to go.</comment></comment>


Defending a website with Zip bombs - <AUTHOR> https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html <comment><USER2> I would think Transfer-Encoding would be a better choice than Content- Encoding. It's processed at a lower level of the stack and _must_ be decoded – Content-Encoding is generally only decoded if the client is specifically interested in whatever's inside the payload. (Note that you don't have to specify the large Content-Length in this case as it is implied by the transfer coding.)

Also worth trying is an XML bomb [1], though that's higher up the stack.

Of course you can combine all three in one payload (since it's more likely that lower levels of the stack implement streaming processing): gzip an XML bomb followed by a gigabyte of space characters, then gzip that followed by a gigabyte of NULs, then serve it up as application/xml with both Content- Encoding and Transfer-Encoding: gzip.

(Actually now that I think of it, even though a terabyte of NULs compresses to 1 GiB [2], I bet _that_ file is itself highly compressible, or could be made to be if it's handcrafted. You could probably serve that up easily with a few MiB file using the above technique.)

EDIT: In fact a 100 GiB version of such a payload compresses down do ~160 KiB on the wire. (No, I won't be sharing it as I'm pretty sure that such reverse- hacking is legally not much different than serving up malware, especially since black-hat crawlers are more likely than not running on compromised devices.)

[1] [https://en.wikipedia.org/wiki/Billion_laughs](https://en.wikipedia.org/wiki/Billion_laughs)

[2] [https://superuser.com/questions/139253/what-is-the- maximum-c...](https://superuser.com/questions/139253/what-is-the-maximum- compression-ratio-of-gzip/579290)

<comment><USER3> > EDIT: In fact a 100 GiB version of such a payload compresses down do ~160 > KiB on the wire. (No, I won't be sharing it as I'm pretty sure that such > reverse-hacking is legally not much different than serving up malware, > especially since black-hat crawlers are more likely than not running on > compromised devices.)

[http://www.aerasec.de/security/advisories/decompression- bomb...](http://www.aerasec.de/security/advisories/decompression-bomb- vulnerability.html) has a triple-gziped 100GB file down to 6k, the double- gzipped version is 230k.

I'm trying on 1TB, but it turns out to take some time.

<comment><USER4> One useful trick is that, for gzip, d(z(x+y)) = d(z(x) + z(y)).

So you don't need to compress the entire terabyte.

<comment><USER3> I'd expect that to provide a lower compression, though it may not matter given the additional followup gzips.

The compression finally finished after 3h (on an old MBP), "dd if=/dev/zero bs=1m count=1m | gzip | gzip | gzip" yields a bit under 10k (10082 bytes), and adding a 4th gzip yields a bit under 4k (4004 bytes). The 5th gzip starts increasing the size of the archive.

<comment><USER4> It does, though I once used that trick to create a file containing more "Hello, World" lines than there are atoms in the universe. By, hmm, quite a large factor. It probably isn't a serious concern.

It still fit on a floppy disk. :)

</comment></comment></comment></comment></comment><comment><USER5> How come when I posted this (my blog post) here I only got 2 points? [https://news.ycombinator.com/item?id=14704462](https://news.ycombinator.com/item?id=14704462) :D

<comment><USER6> I'm also intrigued by this, it also happens in comments, that the top post with 20+ upvotes can have the same content as the most down-voted post with -3 points, but not as common as reposts getting to the front page, while the original only got 2 points.

After submitting something to HN I like to watch the HTTP logs, I get a lot of visitors from bots, but it's actually only ca 10-20 real people that actually read your blog. I don't know eneough of statisitcs to explain it well, but as 20 people is so small amount of the total HN readers, it's basically _luck_. And the representation of those who reads the "new" section might be a bit skewed from those who only reads the front page. If you want to help HN get better with more interesting content, you can help by actually visiting the "new" section.

<comment><USER7> We know how to deal with this, and have for years. A bot which instruments and invokes humans, learning about content and individuals both. Few humans are needed each time, and those need not be experts, if used well. 20 people is much more than enough. A candy machine, in an undergraduate lounge, can grade CS 101 exams.1 Ah, but discussion support - from Usenet to reddit (and on HN too), incentives do not align with need. Decades pass, and little changes. Perhaps as ML and croudsourcing and AR mature? Civilization may someday be thought worth the candles. Someday?

1 [http://represent.berkeley.edu/umati/](http://represent.berkeley.edu/umati/)

Edit: tl;dr: Future bot: "I have a submission. It has a topic, a shape, and other metrics. It's from a submitter, with a history. Perhaps it has comments, also with metrics, from people also with histories. I have people available, currently reading HN, who all have histories. That's a lot of data - I can do statistics. Who might best reduce my optimization function uncertainty? I choose consults, draw the submission to their attention, and ask them questions. I iterate and converge." Versus drooling bot: "Uhh, a down vote click. Might be an expert, might be eternal September... duh, don't know, don't care. points--. Duh, done."

<comment><USER7> Hmm, two downvotes. My first. So comments would be especially welcome.

Context: The parent observed that with a small number of people up/down voting, the result was noisy. I observed the numbers were sufficient, if the system used more of the information available to it. And that the failure to do so is a long-standing problem.

Details, in reverse order: "Civilization": Does anyone _not_ think the state of decision and discussion support tech is a critical bottleneck in engineering, business, or governance? "AR": A principle difficulty is always integrating support tech with existing process. AR opens this up greatly. At a minimum, think slack bots for in-person conversations. "crowdsourcing": or human computation, or social computing, is creating hybrid human-computer processes, where the computer system better understands the domain, the humans involved, and better utilizes the humans, than does a traditional systems. "ML": a common way to better understand a domain. As ML, human computation, textual analysis, etc, all mature, the cost and barrier to utilizing them in creating better discussion systems declines. "Usenet": Usenet discussion support tooling plateaued years before it declined. Years of having a problem, and it not being addressed. Of "did person X ever finishing their research/implementation of tool Y". "decades": that was mid-1990's, two decades ago. "little changes": Discussion support systems remains an "active" area of research - for a very low-activity and low-quality value of "active". I'm unclear on what else could be controversial here.

For anyone who hasn't read the paper, it's fun - it was a best paper at SIGCHI that year, and the web page has a video. A key idea is that redundant use of a small number of less-skilled humans (undergraduates grading exam questions), can if intelligently combined, give performance comparable to an expert human (graduate student grader). Similar results have since been shown in other domains, such as combining "is this relevant research?" judgments from cheaper less-specialized doctors with more-expensive specialized ones. On HN, it's not possible to have a fulltime staff of highly skilled editors. But it _is_ technically plausible to use the exiting human participants to achieve a similar effect. That we, as a field, are not trying very hard, reflects on incentives.

</comment></comment></comment></comment><comment><USER8> Reminds me of a time I once wrote a script in Node to send an endless stream of bytes at a slow & steady pace to bots that were scanning for vulnerable endpoints. It would cause them to hang, preventing them from continuing on to their next scanning job, some remaining connected for as long as weeks.

I presume the ones that gave out sooner were manually stopped by whoever maintains them or they hit some sort of memory limit. Good times.

<comment><USER9> I do the same to "Microsoft representatives" that call me because I have "lots of malware on my computer".

Keep them on line by being a very dumb customer until they start cursing and hang up on me. : - )

<comment><USER10> 1-347-514-7296 is a phone number that automates this. Add it to a conference call, and frustrate the caller with no additional work. [http://Reddit.com/r/itslenny](http://Reddit.com/r/itslenny) is the closest thing it has to an official site.

<comment><USER11> It just rang forever when I tried it...

<comment><USER10> Ah, apparently you need to be whitelisted, my bad. There's more information in the Reddit link.

EDIT: Nope, apparently the person who runs it takes it down at night for some reason. Maybe to minimize people using it as a prank call?

<comment><USER12> You do have to get whitelisted though, last I checked. I was able to use it one time and now if I call it I get a message about whitelisting. Same for JollyRoger.

</comment></comment></comment></comment></comment></comment><comment><USER13> Interesting and related re attacks on a Tor hidden service: [http://www.hackerfactor.com/blog/index.php?/archives/762-Att...](http://www.hackerfactor.com/blog/index.php?/archives/762-Attacked- Over-Tor.html)

And the follow up: [http://www.hackerfactor.com/blog/index.php?/archives/763-The...](http://www.hackerfactor.com/blog/index.php?/archives/763-The- Continuing-Tor-Attack.html)

<comment><USER14> Very interesting read indeed. I've a question about it; the article is about defeating malicious crawlers/bots affecting a TOR hidden service, so my question is, how might the author differentiate bot requests from standard client requests on a request-by-request basis? I mean, can I assume that many kinds of requests arrive at hidden service through shared/common relays? Would this mean other fingerprinting methods (user agent etc) would be important, and if so, what options remain for the author if the attackers dynamically change/randomise their fingerprint on a per-request basis?

</comment></comment><comment><USER15> Wait a minute... He is doing the exact same thing as the former RaaS (ransomware as a service) operator Jeiphoos (he operated Encryptor RaaS). It's know that Jeiphoos is from Austria. Exactly one year after the shutdown of the service, someone from Austria is publishing the exactly same thing an Austrian ransomware operator were doing a year ago.

<comment><USER16> Aha! the Hackernews detectives are on the case!

</comment></comment><comment><USER17> Does anyone know if this kind of white hat stuff has been tested by law?

Because it seems in the realm of possibility that if a large botnet hits you and your responses crash a bunch of computers you could do serious time for trying it. I'm hoping there's precedent against this...

<comment><USER18> There are laws allowing person to shoot intruder in their house. And I can't serve nulls from my own web server? That would be ridiculous.

<comment><USER19> From what I've read, in some parts of America it seems okay to shoot at intruders running away from your house, which I find unreasonable.

A farmer here in UK stirred up a whole load of shit when he shot two burglars [1] trying to escape from his property.

[1] [https://en.wikipedia.org/wiki/Tony_Martin_(farmer)](https://en.wikipedia.org/wiki/Tony_Martin_\(farmer\))

<comment><USER20> The UK (or English?) law about self defence is "back to the wall", i.e. you can invoke leathal force to defend your own life when your back is against the wall, when you have no other option, and no way to escape. In other words, if you can retreat from the situation, then you must retreat.

Some places in the USA have "stand your ground" laws. These say you aren't required to retreat, that you can "stand your ground", that you can use (legally) leathal force without requiring that your back is against the wall.

<comment><USER21> As I recall, stand your ground laws, based on castle doctrine, means that "but you could have fled your own home" does not invalidate self-defence. I think you are still required to retreat when on the street.

As for people running away, the only way I see self defence working is when they still pose an 'imminent threat to life' which seems rather hard to argue.

<comment><USER19> Your last line is the bit I've never been able to understand. If someone is running from you, do you have any legal argument for killing them?

<comment><USER22> What if they have stolen your property. Do you not have the right to get it back by force? Does the value of the property matter? If so, who gets to decide that in the moment?

<comment><USER23> You have zero right to kill someone for stealing.

<comment><USER24> In Texas you may make use of your weapon to stop the execution of a crime if you yourself are not also engaged in criminal activity. It's far larger than castle doctrine because it applies anywhere.

I'm not arguing for actually using the law to shoot people: I don't ever want to be in that situation myself, but I'm saying depending on the situation you do in fact have the law on your side.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> This is why web crawlers are built with upper boundaries on _everything_!

Nobody malicious brings down crawlers. It's just unexpected things you find out on the internet.

<comment><USER26> > Nobody malicious brings down crawlers.

You're wrong about that. I've more than once brought down crawlers on purpose, especially the ones that didn't respect robots.txt.

</comment></comment><comment><USER27> The article says that 42.zip compresses 4.5 petabytes down to 42 bytes. It should say 42 _kilobytes_.

I don't see a way to comment on the article itself, but hopefully the author reads this.

<comment><USER28> Thank you. I was going crazy trying to think of what the contents of that 42 bytes would have been.

<comment><USER29> Without any headers, metadata or padding and using RLE one byte for 0 and 8 bytes for the number of zeroes: 10^15 will easily fit 9 bytes and can be used to generate a file filled with one petabyte of zeroes.

<comment><USER30> Well, yes, but that's not ZIP encoding.

</comment></comment></comment></comment><comment><USER31> I don't think this "Defends" your website. If anything, it draws attention to it.

Might also be used for some kind of reflection attack. Want to kill some service that let's users provide a url (for an avatar image or something) - point it to your zip bomber.

<comment><USER32> To be fair, people wanting to do that don't need author to have create a zip bomber, they can do it by themselves.

Actually, I don't see how to defend this. Is there any way to ask a gzip file which size it will be once unzipped, without needing to decompress it?

<comment><USER33> I think this is exactly what the HTTP 'HEAD' verb is for: [https://developer.mozilla.org/en- US/docs/Web/HTTP/Methods/HE...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Methods/HEAD)

<comment><USER32> Wouldn't a HEAD give the size of the zipped content, and not the size of the content once decompressed?

<comment><USER33> This is a great question. I'm actually not sure, since gzip encoding/decoding is built-in to several webservers and browsers.

</comment></comment></comment></comment></comment><comment><USER26> A friend of mine has a very useful little service that tracks attempts to breach servers from all over the world:

[https://www.blockedservers.com/](https://www.blockedservers.com/)

It's a lot more effective to kill the connection rather than to start sending data if you're faced with a large number of attempts.

<comment><USER34> Interesting page :) I'll write your friend an email with improvements for the site. The text shadow in the code blocks make them barely readable and the map color coding is bad for color blind people.

<comment><USER26> I'm sure he will appreciate that. He's sysadmin at a Dutch IPSP and this is his side project.

</comment></comment></comment><comment><USER35> This is like the soft equivalent of leaving a USBKill device in your backpack, to punish anyone who successfully steals it and tries to comb through your data.

<comment><USER36> Way to make friends with the TSA. ;-)

<comment><USER21> Is this actually illegal? I'm sure they'd arrest you, but could they actually charge you?

I guess if you see them try to use the USB killer, you'd be obligated to report it. Otherwise I don't think its an issue.

<comment><USER36> Regardless of what the law says, in practice, breaking TSA equipment, interfering with TSA duties and, above all else, pissing off a TSA officer are all arrestable offences.

If there's any question about culpability, all they have to do is ask you, "Is there anything in your baggage you think we should know about?" and if you don't disclose it then, you're screwed.

What? You say you were never asked such a question? You say you even tried to warn them? Well I have sworn testimony from a TSA officer that says they ALWAYS ask that question, and you're the guy who was caught carrying a piece of equipment designed for trickery and vandalism. Case dismissed.

</comment></comment></comment></comment><comment><USER37> I think the natural next step is to make this into a Wordpress plugin.

</comment><comment><USER38> This would be an entertaining way of dealing with MITM agents as well, over HTTP. As long as the client knows not to open the request, you could trade them back and forth with the MITM spy wasting tons of overhead.

<comment><USER39> It would be an interesting way of streaming data if both sides used a custom decompression algorithm that skipped n bytes without allocating it anywhere.

The payload could be encrypted text of two chat bots talking jibberish.

<comment><USER40> Now _that 's_ very interesting. Maybe hack a custom ssh with this feature. Adversaries that intercepted data or attempted MitM would be inconvenienced.

Edit: Or even more useful, bbcp. Which is the _best_ file transfer app that I've ever used.

<comment><USER33> This is similar to kippo or cowrie, SSH honeypots:

[https://github.com/desaster/kippo](https://github.com/desaster/kippo)

[https://github.com/micheloosterhof/cowrie](https://github.com/micheloosterhof/cowrie)

<comment><USER40> I meant more than a honeypot. But rather, a functional SSH app that messes with standard SSH apps and libraries.

</comment></comment></comment></comment></comment><comment><USER41> Another method is wasting attackers' time by sending out a character per second or so. It works so well for spam, that OpenBSD includes such a _spamd_ honeypot.

<comment><USER42> I would love to know how to configure this for ssh connection attempts

<comment><USER43> fail2ban, in a general sense.

<comment><USER44> No, this is a tarpit. Fail2ban simply rejects or drops vua iptables.

<comment><USER43> [https://gist.github.com/Belphemur/82d27b1b6dfd675d15f2](https://gist.github.com/Belphemur/82d27b1b6dfd675d15f2)

Tarpit Action for Fail2ban with rate limit

</comment></comment></comment></comment></comment><comment><USER45> We need some legal advice in this thread.

What if the compressed file is plausibly valid content? How could intent be malicious if a request is served with actual content?

<comment><USER46> In this day and age, finding a vulnerability in a system like a mistakenly open API and running a script to call it a few times to investigate the weakness is considered hacking.

It probably shouldn't be, but law is funny that way.

Intentionally sending a zip bomb could potentially get you in trouble as well. Especially if you're just one private person or a small company without a legal division to brush it off.

There isn't a real black/white interpretation though, at least not outside the US (where there may be history to influence ruling on the subject), and obviously most victims wouldn't report you, but more often than not you wouldn't want to test interpretation of IT related law.

</comment></comment><comment><USER47> Reminds me a bit of Upside-Down-Ternet: [http://www.ex-parrot.com/pete/upside- down-ternet.html](http://www.ex-parrot.com/pete/upside-down-ternet.html)

</comment><comment><USER48> Defending by throwing things back at the attacker, instead of simply locking your door.

<comment><USER47> This is more that the thief is parked at your front door permanently trying to pick the lock, so you replace the valuables he's looking for with big chunks of lead.

<comment><USER49> More like hungry bears.

</comment></comment></comment><comment><USER50> A great way... to provoke a war with people running botnets.

</comment><comment><USER51> This could also be seen as a bug on the browser side. I'd also be interested in the browser results for the petabyte version.

I wonder if there's room to do this with other protocols? Ultimately we want to crash whatever tool the scriptkiddy uses.

<comment><USER52> I thought of http2's hpack. It does have built in protection though...the client sets a maximum header table size. Which encourages client implementations to think about it.

</comment></comment><comment><USER53> About a month ago one of my websites was being scraped. They were grabbing JSON data from a mapping system.

I replaced it with a GZIP bomb. It was very satisfying to watch the requests start slowing down, and eventually stop.

</comment><comment><USER54> Interesting!

That also crossed with another thought about pre-compressing (real!) content so that Apache can serve it gzipped entirely statically with sendfile() rather than using mod_deflate on the fly, so unless I've misunderstood I think that bot defences can be served entirely statically to minimise CPU demand. I don't mind a non-checked-in gzip -v9 file of a few MB sitting there waiting...

[http://www.earth.org.uk/note-on-site- technicals.html](http://www.earth.org.uk/note-on-site-technicals.html)

</comment><comment><USER55> Similar topic a couple of months ago:

[https://news.ycombinator.com/item?id=14280084](https://news.ycombinator.com/item?id=14280084)

</comment><comment><USER56> Directly serving /dev/zero or /dev/urandom also gives interesting results. (Be aware of bandwidth costs)

<comment><USER14> Oh this seems quite an interesting experiment. Curious though if this defence poses no additional risks (beside bandwidth) on the server. I mean, is there any significant chance that the random data could cause a glitch on the server implementation?

</comment></comment><comment><USER36> Wow, you killed Tails!

I tried visiting the payload site with Tails OS (a Linux distro for privacy minded) and the whole OS is frozen.

</comment><comment><USER57> Both ZIP and GZIP file formats store the uncompressed filesize in their headers. You could stream and check for these headers to determine if the a zip bomb is being delivered. Obviously something script-kiddies aren't going to do, but the scripts they use can be improved and redistributed fairly easily.

<comment><USER14> Could the head be spoofed in such a way that the header says 1MB, or might the clients/bots be typically strict on ensuring header values are valid? I think your raised issue is important though, and any serious client/bot should be ignoring files with 1KB -> 1GB decompression ratios.

</comment></comment><comment><USER58> Was there a reduction in ip's that Fail2ban would have picked up but instead were treated with the zip bomb?

</comment><comment> brian-armstrong Do browsers protect against media served with Content- or Transfer-Encoding like this? If you use something that lets you embed images, what's to stop you from crashing the browser of anyone who happens to visit the page your "image" is on?

<comment><USER59> Nothing. I mean, crashing browsers with a client-side DoS is possible in many ways.

With some horrible WebGL code I've crashed the macOS compositor before.

</comment></comment><comment><USER60> A similar `slow bomb` could be created for attempted ssh connections to a host using a sshrc script. For example clients which do not present a key, just keep them connected and feed them garbage from time to time. Or rickroll them.

</comment><comment><USER61> doesn't this incur large bandwidth data charges for the defender?

<comment><USER62> no, it's just sending a tiny zip file, decompression occurs at the other end

<comment><USER63> 10 MB (the compressed GZIP given in the example) can be considerable. Even more so if you consider just how frequently bots are hitting those wp endpoints.

<comment><USER64> Non-cloud providers don't rake you over the coals for transfer.

</comment></comment></comment></comment><comment><USER65> Wouldn't all but the most naive scanners use time-out settings, maximum lengths on bytes read etc?

<comment><USER14> > Wouldn't all but the most naive scanners use time-out settings, maximum > lengths on bytes read etc?

It wouldn't save a scanner from crashing to use a time-out or max read bytes. The defense can send the 100kb zipped data in a matter of seconds. The client then decompresses the zipped data which expands to gigabytes, causing crashes by out-of-memory.

<comment><USER65> Was thinking more about a maximum length for the decompression stage.

<comment><USER14> User ruytlm has posted links to hacker factor blog, and it seems some sophisticated scanners (e.g., Eddie) were crashed by the exploit. In that blog the author postulates that Eddie is a nation-state level (not script kiddie) scanner, so I'd say that the answer to this question will be in your definition of naive. It's tempting to qualify any scanner which crashes on this as naive though, I'd agree. Especially moving forward with the publicity of this post/topic.

Well actually from memory the author of the blog was doubtful if this exploit actually crashed Eddie or not, but it did crash the other bots (Eddie V1 did go offline, possibly as a crash), so it would appear you are correct. Only truely naive bots might well be affected by this.

</comment></comment></comment></comment><comment><USER66> What are good strategies for protecting your website against ZIP bomb file uploads?

</comment><comment><USER67> Ironically, it looks like the site has been DOSd by HN.

</comment><comment><USER68> you better have unlimited bandwidth to try 10G))

<comment><USER69> In the example, the server only sends 10MB. The data is 10GB only after unzipping, which occurs on the client.

</comment></comment><comment><USER70> brilliant

</comment><comment><USER71> Interesting, on FF54 the test link pegs a CPU but the memory doesn't rise. Eventually it stops and CPU returns to normal. But then I did a 'view source', and the memory use rose until the browser got oomkilled (20GB free ram + swap)

<comment><USER72> I wonder is the browser is smart enough to not decompress when viewing or just uses it at a stream?

</comment></comment><comment><USER73> * Firefox: Memory rises up to 6-7gig, then just loads endlessly. Tab closable.

</comment><comment><USER74> Just tried it using piedpiper's middle-out algorithm and seeing astonishing results. It's so simple! D2F.1 = D2F.2, D2F.3 = D2F.4</comment>


Computerworld by Baron Fig X Codecademy - <AUTHOR> https://www.baronfig.com/products/computerworld <comment><AUTHOR> The limited paper type is called 'Code Ruled.' It's designed to reflect a dev code environment: numbers from top to bottom; indentation markers.</comment>