IP Over QR Code - <AUTHOR> http://seiferteric.com/?p=356 <comment><USER10> That is an awesome project, much better than the QR Clock I did.

My experience with the clock was that I really needed ECC mode 'M' to get the maximum ECC bits which worked around all sorts off issues with differences in scan rates between display and reader.

In my setup the QR clock is displayed on an array of 64 x 64 LEDs, when the LEDs were operating at a 60hz refresh rate you could induce some pretty interesting interference with the camera scan rate on phones with QR readers, once I boosted the refresh rate to 240 hz that interference went away, then it was a question of how much "dwell time" did the code need to be recognized and I got it down to 100mS as the fastest I could go and the QR libraries on the iPhone and Android could still pick it up.

So for reliability considerations maximize the display refresh rate and the ECC correction level.

</comment><comment><USER11> oh how i wish Microsoft didnt 1] have a patent on color barcodes 2] choose to do nothing with it

Still, perhaps we could get a decent barcode format with some of its ideas, idk if they are all patented. It uses triangles which can be packed a lot more densely than squares, and has four- and eight-color modes. The density is nuts. You could theoretically download a decent size book via color barcodes in a couple seconds. It could revolutionize all kinds of things, being able to have large amounts of data in a barcode, rather than just a URL.

<comment><USER12> Let's assume a version 6 QR code, which is 41x41 (larger is unreasonable IMO). Now let's assume that using triangles is a twice as dense packing, and we use 8 colors. Also we don't need error correction.

Then we have 3x41x41x2/8 = 1260 bytes of storage. Even with compression that's still not a decent sized book.

\---

EDIT: I'm guilty of not reading the article first. I assume now you meant a 'QR film' that you scan for a couple seconds, rather than a static image. In that case you can apply above calculation to '1260 bytes per frame', at 10FPS that'd be 100Kbps, which is reasonable.

<comment><USER11> Not a film, something printable, that lasts without battery or can be put on a poster at a protest. At 3kB/in^2 in a 3x3 grid of barcodes you'd scan left-to- right, top-to-bottom, if the text itself were compressed with PPMd down to 25% of its original size, that 3x3 barcode grid gives you 108kB of text

or 12kB in a single barcode (of plain text, compressed down to 3)

wikipedia says: "Microsoft claims that laboratory tests using standard off- the-shelf printers and scanners have yielded readable eight-color HCCBs equivalent to approximately 3,500 characters per square inch"

so I'm being optimistic, but not wildly so

Here's some neat pics: [https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/hccb-hccbsamples.jpg)

[https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/hccb-lightexamples.jpg)

I've read about this a bit and I really wish there were an unpatented color barcode and a reliable/fast open source reader also, even if it's not quite as dense as my dreams. I think it would make for some neat possibilities.

<comment><USER13> You can still generate them from a Microsoft site:

[https://www.microsoft.com/tag/m/Make.htm](https://www.microsoft.com/tag/m/Make.htm)

There are some phone apps in the wild still that will read and/or generate them.

At one point circa 2010 there was an [https://tag.microsoft.com](https://tag.microsoft.com) homepage for them, but trying it just now it doesn't seem to resolve any more.

</comment></comment></comment></comment><comment><USER14> This is similar: [https://github.com/fta2012/serverless-webrtc- qrcode](https://github.com/fta2012/serverless-webrtc-qrcode). Here, the author replaces communication via stun server with communication via animated QR codes.

<comment><USER15> Hey I'm the author of the project you linked to! The blog post is better for details: [http://franklinta.com/2014/10/19/serverless-webrtc-using- qr-...](http://franklinta.com/2014/10/19/serverless-webrtc-using-qr-codes/)

Flashing qr codes was just a quick hack and actually doesn't work super well. I think if I had more time I would try compressing and stripping down the message more so it would fit in a single qr code instead (like in [https://webrtchacks.com/the-minimum-viable-sdp/](https://webrtchacks.com/the- minimum-viable-sdp/)).

<comment><USER16> Hey, how serendipitous... I've been trying to do a wiimote project myself and saw your post; do you have any pointers to /resources for troubleshooting the connection to the remote?

</comment></comment></comment><comment><USER17> Very cool :) I wonder if you could potentially use colour to increase the data rate a bit? (although then it wouldn't be a standard QR code I guess)

[http://www.jammarcade.net/backer-32/](http://www.jammarcade.net/backer-32/) \-- I've got one of these devices, which was used back in the day, to store data on a VHS tape, in a similar way to what you're transmitting.

In the spirit of uncommon data transfer methods, here's my ridiculously slow version, using a cddrive:

[https://www.anfractuosity.com/projects/cditter/](https://www.anfractuosity.com/projects/cditter/)

To transmit 'hello' it takes around 13 minutes ;)

<comment><USER18> A simple way to use color might be just to send 3 qr codes at once, one in each RGB channel.

<comment><AUTHOR> Woah that would be cool. So the red would be invisible to the blue/green and visa versa? Seems like that could be easy to add....

<comment><USER19> Not OP here: Yes that would definitely work, but you have to be aware that color channels of the monitor and camera are not mapped 1:1, there will be some overlap.

Also be aware the light in the environment influences the light received by the camera (or emitted by the monitor surface, depending on the way you want to look at it). You may have to tweak the threshold if the light changes.

@OP: please do this, it will triple your data without additional costs. Don't ignore the color channels!

<comment><USER20> It shouldn't be so difficult, because you only have to recognise 8 distinct colours and thus separate out the bits accordingly:

       RGB
       000 - <USER2>
       001 - <USER3>
       010 - <USER4>
       011 - <USER5>
       100 - <USER6>
       101 - <USER7>
       110 - <USER8>
       111 - <USER9>

<comment><USER21> I think that even using more than one bit per RGB channel isn't hard. For example, 0 -64-128-192-255 for each RGB would increase the speed for 15 times. The 1-2kbps would become 30kbps, a modem from few years ago.

When using the real webcam (and not just passing files around), just one frame for calibration and no auto-white balance should be enough.

</comment></comment></comment></comment></comment></comment><comment><USER22> "First, you need some way to acknowledge that the other side read my message" This is incorrect. Assume a protocol like UDP where the messages are unreliable. You do not get acknowledgement of packets.

<comment><AUTHOR> Actually just removed that stuff and seems to be faster, there is a qrtun_async.py script now with no seq/ack. That being said, my concern was that if creating/displaying the qr code was much faster than detecting/decoding, and a lot of packets were coming in at once, you could maybe display multiple packets/qrcodes before the other side was able to decode the first one. That would result in drops of course which should be re transmitted though, so I guess its okay.

<comment><USER23> You could also decouple image capture and packet processing, so that if the former starts to run ahead, you can buffer until the latter catches up. NICs do this a lot, for much the same benefit.

I'm not great with Python, but your code seems quite legible, and it doesn't look like there's any buffering or backpressure in place right now - which is perfectly reasonable for a fantastic proof of concept like this! Just a thought for when you next get around to hacking on it.

</comment></comment></comment><comment><USER24> It's funny I actually had the idea of doing this exact project yesterday, although I would probably have never gotten around to it.

Rather than just being a fun little project, I could see there being a few practical uses for this: If you could modify the protocol so that the 'QR code' could dynamicly resize down to be in the worst case 1 pixel for the whole screen, you could potentially do line of sight communication using just laptops between tens of kilometers away[1]. There aren't a lot of situations where you'd need that, but I could see scientists on a remote research mission finding in handy to be able to just pull out their laptops and send messages between mountain tops by just double-clicking some kind of application.

A crappy webcam that could do 10 frames per second that was looking for an entire monitor in the on/off state could send O(10) bits per second which would be useful enough to send small text messages. If you used a telescope, you could actually send real amounts of data.

[1] [https://www.technologyreview.com/s/539826/how-far-can-the- hu...](https://www.technologyreview.com/s/539826/how-far-can-the-human-eye- see-a-candle-flame/)

Edit: Upon close inspection of the article I linked, it says later in the article that you could only see the flame 2.76 km away, but I don't think that changes my point very much since a laptop screen would be brighter.

<comment><USER25> In practice you're limited to sending information at half the theoretical maximum resolution[1], so 5 fps. Still has some very interesting possibilities.

[1] [https://en.wikipedia.org/wiki/Nyquist_frequency](https://en.wikipedia.org/wiki/Nyquist_frequency) (updated link, s/rate/frequency/)

<comment><USER26> I don't think so. We aren't interested in reconstructing the signal, so if we have 10 samples of the flashing screen we will have 10 bits.

If I'm wrong please correct me.

</comment></comment></comment><comment><USER27> Let's call it QR-Video, theoretically the world's most useless protocol as you only need a link and one still frame will suffice. However there is something nice about QR codes and it would be cool to stream information in this big visual way between phones, e.g. a business card sized piece of information.

The problem I have with QR codes is that they do not just work. You need to download a QR code reading app, this functionality should be hard coded at a deeper level, a notification appearing for QR codes no matter what you are doing with the device.

Many of the apps for QR codes do things like sneaking in affiliate marketing codes, this can malform a URL and do some redirection along the way for monetization purposes unknown.

Maybe QR codes deserve the video mode to become a protocol like this of sorts to be there for innovators with uses to be invented. QR codes are here to stay, they are too useful. They need acknowledgement as a thing and for phones to do a lot better out the box at hzving QR code readers baked into the OS.

</comment><comment><USER28> Nice job! Some prior projects have done similar things as well:

[1] (2011) [http://stephendnicholas.com/posts/quicker-video-qr- codes](http://stephendnicholas.com/posts/quicker-video-qr-codes)

[2] (2014) [http://thruglassxfer.com/](http://thruglassxfer.com/)

[3] (2014) [https://github.com/Neohapsis/QRCode-Video-Data- Exfiltration](https://github.com/Neohapsis/QRCode-Video-Data-Exfiltration)

<comment><USER29> The visual data transfer used in the Electric Imp (2013) is pretty awesome too: [https://electricimp.com/platform/blinkup/](https://electricimp.com/platform/blinkup/).

<comment><USER28> Kind of like the Timex Datalink (1994) [1][2]

[1] [https://en.wikipedia.org/wiki/Timex_Datalink#Wireless_data_t...](https://en.wikipedia.org/wiki/Timex_Datalink#Wireless_data_transfer_mode) [2] [https://youtu.be/2VmtPaiOBwI?t=1m3s](https://youtu.be/2VmtPaiOBwI?t=1m3s)

<comment><USER30> I had one of those! It was almost useable

<comment><USER31> I had one of those too. I was telling my 13 year old and 9 year old son about it last week. They looked at me like I was insane, then went back to their tablets.

</comment></comment></comment></comment></comment><comment><USER32> Due to limited datagram size, maybe RFC1149 and RFC2549 could serve as inspiration for further development ;-)

</comment><comment> dylan-m Oh, funny, I'm working on something similar for a course at school, too: an IP over Avian Carrier modem. (I convinced some folks to build one with me :b). In our case we print the barcodes with a thermal printer, so there's an interesting constraint that we need really simple, easy to scan barcodes that fit on that paper but are still data rich. I have happily ignored the printing / scanning part of the project, but I think we're sticking with Data Matrix, and I've set an MTU of 300 bytes on our network interface just to be sure. We're using tun/tap, too! It's really handy.

Alas, carrier pigeons are difficult to employ, but that's okay. Part of our goal is to demonstrate network protocols in a tactile way, since you see every frame that gets sent and received _as it happens_. (And read them, too - we're including a hex dump with strings). I think it's a fun alternative use for projects like mine and like the article's :)

Haven't thought about performance much at all, so I'm curious to see what the author has in mind there.

</comment><comment><AUTHOR> Code is on github :) [https://github.com/seiferteric/qrtun](https://github.com/seiferteric/qrtun)

</comment><comment><USER33> I had a somewhat similar idea (which never materialized) where the sender would print QR codes (or something else) on a long paper roll (like those used for receipts in stores), which would then be scanned on the other end. The idea was about being about to visualize things like a ping or a TCP session progressing between computers.

If anyone wants to steal the idea, please go for it! And send me a link to the video when you're done. :)

<comment><USER34> Like this? [https://www.youtube.com/watch?v=CL2OpWNCpmY](https://www.youtube.com/watch?v=CL2OpWNCpmY)

</comment></comment><comment><USER19> Now, how about reducing the resolution and increasing the speed? E.g. a one pixel display and a one pixel camera that runs at MHz or GHz Speed? You'll have to add some modulation though, otherwise you can't sync the two devices.

Wait, isn't that called FSO or LiFi :D?

</comment><comment><USER35> [http://thruglassxfer.com/](http://thruglassxfer.com/) (click "technical") did this too.

</comment><comment> d--b Neat, the perfect tool to steal data from your job without being caught!

</comment><comment><USER36> I assume this is how we will achieve IP over Avian Carriers?

<comment><USER37> Could have sworn that had already happens, via OCR and packets printed in hex.

<comment><USER38> Yep. In 2001

[http://www.blug.linux.no/rfc1149/writeup/](http://www.blug.linux.no/rfc1149/writeup/)

[http://www.blug.linux.no/rfc1149/vegard_bilder/](http://www.blug.linux.no/rfc1149/vegard_bilder/)

<comment><USER37> Huh, i had forgotten that Alan Cox participated.

</comment></comment></comment></comment><comment><USER39> snowcrash</comment>


Madoko – Write full-blown academic articles in Markdown - <AUTHOR> https://www.madoko.net <comment><USER2> You also might want to take a look at GitBook ([https://www.gitbook.com/](https://www.gitbook.com/)).

It supports both Markdown and AsciiDoc and is used by authors to write books, documentation, research-papers (GitBook has great TeX support, in all outputs: web, pdf, epub, mobi). (Here's a math heavy book for example: [http://jandeleeuw.gitbooks.io/bras1/content/blockrelaxation/...](http://jandeleeuw.gitbooks.io/bras1/content/blockrelaxation/bls.html))

The format and toolchain itself is open-source ([https://github.com/GitbookIO/gitbook](https://github.com/GitbookIO/gitbook))

There's a ecosystem built on top of that such as a Desktop Editor ([https://www.gitbook.com/editor](https://www.gitbook.com/editor)), plugins ([http://plugins.gitbook.com/](http://plugins.gitbook.com/)), and more ...

I don't want to hijack the current thread, Madoko seems really cool, I thought some of you might be interested in a more established solution. I'm happy to answer any questions !

Disclaimer: I'm one of the GitBook co-founders

<comment><USER3> > GitBook has great TeX support

You probably want to update your website in that case: "Markdown, books are written using the markdown or AsciiDoc syntax. TeX support is planned."

<comment><USER2> By TeX support I meant that we fully support TeX equations.

The website mentions TeX but means LaTeX, I'll get that fixed, sorry for the confusion.

Our TeX support allows you basically to write Markdown/Asciidoc and use TeX formulas wherever you need to, which gives you the best of both worlds (the simplicity of Markdown and the power of TeX formulas).

<comment><USER4> FWIW I still found it confusing. I think you'd better leave out the 'is planned' part all together (just makes it seem half-finished), and instead replace that with 'TeX equations are fully supported.'.

</comment></comment></comment></comment><comment><USER5> Emacs' Org-mode is pretty good for writing articles. It can be configured to use whatever package / setting one wants while exporting to tex / pdf, e.g. use some .sty files (presumably, I haven't needed them yet), or use the beamer class to make a slideshow. It can be integrated with the ESS package so that it can be used as a live programming environment for R, or whatever else the package supports. And it also supports todo lists, agendas, and any sort of note-taking from the first moment.

Example config for latex export (although I do not write academic articles):

[https://github.com/cadadr/emacs.d/blob/c81ff8afa3ca4ab553013...](https://github.com/cadadr/emacs.d/blob/c81ff8afa3ca4ab553013c0e5151c3595391aedb/gk/gk- org.el)

<comment><USER3> I wouldn't recommend org-mode for writing professional documents. It is more unstable than any other major piece of software I've used. I use it daily, but not for writing. Things get changed in each release, the documentation is rarely in sync, and in a lot of cases major changes are not documented at all.

I learned the hard way. I wrote some presentations using org-mode. Then they changed the exporters without updating the documentation. It would be especially problematic to write an academic article in org-mode, because you might have to return a year or two later, and that's not when you want to find out how much has changed since you last worked on the paper.

<comment><USER5> One can keep the intermediary .tex files should they export to pdf. Or for any substantial project one can fix the version of org, as other projects do so with the versions of the compiler or of the libraries. Still, if you are correct, then it is a problem for every user. I haven't encountered such problem in my use, although my use of ox-latex has been rather superficial (some homeworks, a tiny CV).

</comment></comment></comment><comment><USER6> Site seems to be offline, but in addition to what talles mentions, there's these:

[http://madoko.codeplex.com/](http://madoko.codeplex.com/)

[http://research.microsoft.com/en- us/um/people/daan/madoko/do...](http://research.microsoft.com/en- us/um/people/daan/madoko/doc/reference.html#sec-performance-and-license)

[http://webcache.googleusercontent.com/search?q=cache:azgHiPZ...](http://webcache.googleusercontent.com/search?q=cache:azgHiPZpp2MJ:https://www.madoko.net/+&cd=1&hl=en&ct=clnk&gl=us)

<comment><AUTHOR> Actually, it was my mistake, it's [https://www.madoko.net](https://www.madoko.net) (it's not working without www).

Could someone correct it?

<comment><USER7> Thanks! We updated the link.

</comment></comment></comment><comment><USER8> > Can I write my academic paper, manual, book, thesis, etc. in Madoko instead > of LaTeX?

For me a strict requirement for this is that I can use a particular template and document class. Unfortunately I don't have any choice as to what the particular format is. It's not clear if Madoko makes this possible.

<comment><USER9> This is the problem if you want to publish. A lot of journals want .docx or Latex files, not PDFs, and they will simply reject submissions that don't comply with their requirements.

It would be nice if journals would accept Markdown, but frankly I don't expect that to happen anytime soon.

<comment><USER10> Personally, I've never encountered a journal that wanted a LaTeX file. Always the PDF.

<comment><USER8> I've had journals ask for both. However they claim to only use the LaTeX file as reference in case there are issues in typesetting. In any case, it's still necessary to produce a LaTeX file in order to use the LaTeX template.

</comment></comment></comment></comment><comment><USER11> It's interesting seeing the different approaches to combining the power of a structured formatting language with the ease of use of a (relatively code free) text editor.

I'm one of the founders of Overleaf [1], and we've taken the route of keeping the full power of LaTeX there for anyone that needs it, but providing a 'Rich Text mode' [2] overlay for those who prefer a less code-like experience. If you give it a try, let us know what you think!

[1] [https://www.overleaf.com](https://www.overleaf.com)

[2] [https://www.overleaf.com/blog/81](https://www.overleaf.com/blog/81)

<comment><USER12> I wrote my master's thesis in overleaf about a year ago, because my laptop was starting to break down and I needed a solution that allowed me to easily switch between university computers without having to constantly set-up my workspace on each individual PC. That was before the rich content editor was implemented, but I loved the experience nonetheless. The whole thesis was, next to my research, an exercise in cloud-based software. VM's on Cloud9, Code repo on github and my text editor on overleaf. Thanks a lot for making it available to a poor student like me!

<comment><USER11> Thanks, that's great to hear! :) I'm impressed you used your thesis as a testbed for cloud-based software, hope it didn't cause any/too much additional stress! If you generated any datasets during your work, you may also want to check out figshare[1] as a handy data repository.

[1] [http://figshare.com/](http://figshare.com/)

(Note - we work in the same office as figshare, so this is probably a biased recommendation!)

<comment><USER12> Thanks for the link! My thesis was basically a data analysis project, improving on work my supervisor did prior to me starting my thesis. Figshare is good to keep in mind, but I don't think I'd have had much use for it, as the whole point of my thesis was to get certain figures within a reasonable time.

I actually had quite a lot of fun figuring out how to get everything working in the cloud. Set up my home desktop as my personal computer "cluster" (i5 processor, so a cluster of 4 cores!), I find it hard to work in an environment that I tend to do other stuff besides work in. Derived a small representative dataset from the massive one I had to quickly iterate over my analysis scripts in Cloud9 (while having github take care of my revision history). Then ssh'ing into my desktop PC whenever I needed to run the scripts on the full data set.

I considered adding a section on open science and cloud-based software to my thesis, but in the end decided not to due to a lack of time. Open science is based on open source principles, where everything that can be shared should be shared. The Cloud VM angle is quite interesting in this sense, as being able to share the machines that software for a research project was ran on is often quite difficult (or nigh impossible), and a cloud-based VM seems to bridge this gap somewhat. In theory, anyone could log-in to the VM and play around in the workspace I set up for my thesis project, not that many would want to I suppose.

</comment></comment></comment></comment><comment><AUTHOR> By the way, I came to find Madoko while researching for Koka (it's written in it): [https://news.ycombinator.com/item?id=10131071](https://news.ycombinator.com/item?id=10131071)

Also, there's this presentation: [http://research.microsoft.com/apps/video/default.aspx?id=238...](http://research.microsoft.com/apps/video/default.aspx?id=238813)

</comment><comment><USER13> To achieve the same functionality on my blog I use:

\- Pelican - static website generator, like Jekyll but in python.

\- MathJax to render Latex

It is easy to synchronize Pelican with dropbox or github, and it is incredibly convenient.

You can use this article:

[http://technivore.org/posts/2014/01/03/blogging-with- dropbox...](http://technivore.org/posts/2014/01/03/blogging-with-dropbox-and- pelican.html)

To configure it in such a way that all the updates happen automatically.

For example I can simply write an article in Editorial on my iPad, and it gets immediately published/updated, without me having to do anything at all, exactly zero mouse clicks.

</comment><comment><USER14> There's also "paper-now" which uses Jekyll Now + GitHub Pages.

[https://github.com/PeerJ/paper-now](https://github.com/PeerJ/paper-now) [https://peerj.github.io/paper-now/](https://peerj.github.io/paper-now/)

<comment><USER15> I hadn't heard of paper-now. I really like what they've done with the sidebar.

My only complaint is that I'd imagine reading academic articles in an ultra- thin sans-serif font might get tiring after a while.

</comment></comment><comment><USER16> For what it's worth, there's also `asciidoc` and its implementation asciidoctor ([http://asciidoctor.org](http://asciidoctor.org)). It has an both official JVM and JS packages in addition to the Ruby version, as well.

Notably missing is math support, however, because rather than Madoko's approach of using LaTeX and then using a LaTeX-to-HTML renderer, asciidoc renders directly to HTML (or Docbook, or LaTeX). IMO, the end result doesn't necessarily look like an academic article placed on an HTML page… But it's nicer for consumption in a browser—the whole asciidoctor site is generated from asciidoctor.

EDIT: this means asciidoc is a better fit for documentation, in book or article or whatever form—but I think once it gains math support (which they're working on) it would be quite useful for this as well.

<comment><USER17> I don't understand what you mean about lacking math support. I am writing math exercises using asciidoctor right now, as it integrates with Mathjax.

I would highly recommend asciidoc over markdown for scholarly work in succint plain text. Markdown is limited in its capabilities by design, as evidenced by all the different flavors of Markdown extension. It's what I would use to write an e-mail or blog post. Asciidoc, in the design of the language, anticipated extension and post-processing and has better support for using it as part of a complete document processing toolchain. After all, it's just syntax sugar for DocBook XML.

</comment></comment><comment><USER8> > The editor has 'hick-ups'!

I'm not sure if this is a joke I'm missing, but "hiccups" is the spelling of the term referring to involuntary inhalation as well as (informally) a minor difficulty or setback[0]. A "hick" is an unsophisticated person[1].

[0] [http://dictionary.reference.com/browse/hiccup?s=t](http://dictionary.reference.com/browse/hiccup?s=t)

[1] [http://dictionary.reference.com/browse/hick?s=t](http://dictionary.reference.com/browse/hick?s=t)

</comment><comment><USER18> Or, just use LaTEX? What makes this better? Pure TeX is hardly that esoteric, and extra power is there if you want it.

</comment><comment><USER19> Oh, wow, this could be great. LaTeX only for the math, markdown for everything else.

What if you need to futz with margins and styles or use a publisher's standard .sty file?

<comment><USER20> I concur -- do any of the markdown environments listed above accept imported .cls latex style files? Would they even be compatible?

It seems like this would be essential for writing research papers according to a conference's template. If so, I would definitely use....

<comment><USER21> When Pandoc converts Markdown to LaTeX, it uses a template that speciefies what header and footer material to add ([http://pandoc.org/README.html#templates](http://pandoc.org/README.html#templates)).

You could modify the default template to use whatever style file you want.

Pandoc also supports references with a .bib file, and inserting TeX math formulae between dollar signs.

<comment><USER22> Exactly. I've been using raw markdown processed with Pandoc as my sole document-creation tool for the past 3 years and it's worked excellently so far. Pandoc's pretty awesome.

</comment></comment></comment></comment><comment><USER23> I'm not sure if I'll have an opinion that isn't commonly shared, so I figured I'd elucidate: I deeply love the simplicity of using markdown + LaTeX, however I realize that I'm somewhere on the gradient of complexity where I'm sacrificing some power for simplicity. Currently I think the tool that is used most is pandoc, and there are some offshoots that give pandoc more 'academic' power, like scholdoc.

I've just been hoping that the pandoc world would progress (add more scholarly features) so that I could continue to keep my own data locally, manage it in my own vcs, and process it with a makefile.

The only reason I see to hop on the software as a service bandwagon is for collaborative real-time editing (and some projects benefit greatly from this). I'll plug sharelatex for that, primarily because their model releases the software so that you can run your own if you don't want to pay for the service.

<comment><USER24> Is Madoko a SAAS app? If so I'll note another problem - madoko.net is currently timing out when I go to access it; any data inside is stuck there for the duration.

On the Markdown+LaTeX note, I wrote my own Markdown parser ([https://github.com/etherealmachine/markdown](https://github.com/etherealmachine/markdown)) to drive my github.io site ([https://etherealmachine.github.io](https://etherealmachine.github.io)). Basically it's what you describe - easy mixing of Markdown+LaTeX to construct nice looking HTML.

<comment><USER25> You can download Madoko and run it yourself.

[http://madoko.codeplex.com/](http://madoko.codeplex.com/)

[http://research.microsoft.com/en- us/um/people/daan/madoko/do...](http://research.microsoft.com/en- us/um/people/daan/madoko/doc/reference.html)

</comment></comment></comment><comment><USER26> Scholarlymarkdown is nice and I like the way you can add captions and references to equations and images. [http://scholarlymarkdown.com/](http://scholarlymarkdown.com/)

</comment><comment><USER27> Perhaps someday there will be computer programs where you can write things without typing in funny codes.

TeX embedded in Markdown seems painful.

How about writing in a restricted subset of HTML, as some forums (notably Slashdot) allow? <h1>, <h2>, .., <title>, <p>, <i>, <b>, <blockquote>, and a few others let you do what Markdown does. For math, there's MathML: Square root of two: <math><msqrt><mn>2</mn></msqrt></math>

<comment><USER28> I written TeX embedded in markdown the time with Pandoc for reports and papers. It's much easier than writing all TeX.

<comment><USER28> wow, what was i thinking when i wrote that sentence? doesn't make any sense.

</comment></comment></comment><comment><USER29> Yet another Markdown flavor...

Markdown is really not sufficient, this markup looks very cool but I'm missing compatibility again.

I'll see if I can make it yellow cms compatible when exporting html...

<comment><USER25> The Madoko document states that it implements different flavors and extends it slightly.

> Madoko is fully compatible with basic Markdown syntax and passes the entire > test suite. It also implements most extensions, like Github flavored > markdown, PanDoc, Markdown Extra, and multi-markdown, and it adds quite a > few features itself to make it really useful for writing academic and > industrial documents.

</comment></comment><comment><USER30> Good try, but in fact it is useless to use something other than Latex to write academic articles. Most journals in mathematics and engineering accept Latex, but I have never seen one accepting markdown. Which means that you will have to convert to Latex source anyway -- and in many cases make sure that the Latex code uses the style package of the publisher. This seems to me just to be asking for more trouble.

</comment><comment><USER31> For School most of my papers require MLA formating. I found a mla latex template and so now I just use pandoc and that template to do my papers. When they want a docx I also made an odt template that I the use libreoffice to convert to docx. If madoko had an option to do that, then I'd be interested, otherwise it's no use to me.

</comment><comment><USER32> Softcover [1] covers many of the same bases as well. Actually supporting all of LaTeX's features in HTML is basically impossible, though, so no matter which tool you use it's best to go in with tempered expectations.

[1]: [http://www.softcover.io/](http://www.softcover.io/)

</comment><comment><USER33> We use a simple md2pdf script internally that takes a markdown, throws on the company logo & font, and produces a pdf document.

Process is md (vim/mou) -> cmark -> wkhtml2pdf -> pdf

This works well for us, but would be nice if we could sort of merge this with an online wiki of some sorts.

<comment><USER34> Have you considered pandoc? That allows to reduce it to md → pandoc → pdf, and in my experience pandoc generates much better PDFs (working links, etc.)

</comment></comment><comment><USER35> Doesn't org-mode already a kind of do that? I think it will handle most of the requirements just fine, handle LaTeX when necessary and what's better is that it comes within emacs allowing all kinds of easy customizations and extensions.

</comment><comment><USER36> Typora ([http://typora.io/](http://typora.io/)) does similar, but it is an OS X application (Windows coming, so the author says).

<comment><USER25> Can you do LaTeX on Typora?

<comment><USER36> It can! See [https://twitter.com/Typora/status/637495313259892740/photo/1](https://twitter.com/Typora/status/637495313259892740/photo/1)

</comment></comment></comment><comment><USER37> Well the html rendering is quite nice but Markdown is so limited it seems like you're just writing latex with '['s replacing some of the '('s.

</comment><comment><USER38> > Madoko also automatically synchronizes your changes to the cloud storage > every 30 seconds or so.

Does it make a new push to GitHub every 30 seconds?

</comment><comment><USER39> A few months ago I created my own Markdown-like lightweight markup language supporting LaTeX equations, which can be compiled to either HTML or LaTeX: [http://lawrence.lu/programming/dllup/](http://lawrence.lu/programming/dllup/)

</comment><comment><USER40> Not sure how this is really different from pandoc markdown...

</comment><comment><USER29> pfew, but the generated html is ugly (missing breaks, strange inline styles and classes)

</comment><comment><USER41> This is really nice. Does it allow to work on multi file documents? i.e. when wiring a big document like a thesis, it's nice to have the chapters divided by different files.</comment>


TeamViewer stores user passwords in registry, encrypted with hard-coded key - <AUTHOR> https://whynotsecurity.com/blog/teamviewer/ <comment><USER2> They're doing nothing too wrong, the person criticising them doesn't understand basic computer security.

When the user hits "save password" on the client-side, the client needs to save the actual (plain text) password in order to replay it for future logins. A hashed password cannot be stored, otherwise that hashed password becomes the plain text password anyway (essentially destroying any benefit hashing would have here). The rules that apply to servers/services aren't the same as those for clients/saved logins.

Using reversible encryption is unavoidable, because they ultimately need plain text to send to the TeamViewer remote service. It is still marginally better than storing the actual plain text even if it is security through obscurity (using a hard-coded key in this case).

Storing it in the user's registry hive instead of a higher privilege allows the TeamViewer client to run in the user's context, instead of needing to run as administrator, have a broker, or similar.

One potential upgrade might be to use Windows' Data Protection API. It works essentially the same way as their current method, but Windows is responsible for protecting the encryption key (and has a broker than can house it at a higher privilege level).

But ultimately if you have a process running in the user's context and can manipulate the TeamViewer client, you can bypass the Data Protection API pretty trivially (e.g. injected DLL, UI hooks, other misc memory hooks, etc).

So my question would be: Describe the scenario where a bad actor has the ability to arbitrarily read data within a user's execution context, but not manipulate the TeamViewer Client also running in that same user's context? Because I got nothing.

My security advice here is simple: Don't save passwords to your local machine if you don't want them saved to your local machine. And don't leave backups of your saved passwords in insecure locations. I'm going to research if I can get a CVE assigned to that.

<comment><USER3> A smart use of "save password" is where you authenticate and store the login token locally. You can then log in without a password, but also your session can be invalidated any time you say... change your password, or ask for a session to be kicked off.

We have to do this with web apps all the time. Nobody stores passwords in local browser store.

<comment><USER2> I don't know if that applies to TV's circumstances because you can use the client to connect to endpoints without either end being internet accessible.

TeamViewer does operate account infrastructure like you're describing, but that isn't exclusively what they offer. They do point-to-point too.

<comment><USER4> Yes, looking at this page it's possible to disconnect the client from Team Viewer's online infrastructure entirely: [https://community.teamviewer.com/t5/Knowledge-Base/Can- TeamV...](https://community.teamviewer.com/t5/Knowledge-Base/Can-TeamViewer- be-used-within-a-local-network-LAN-only/ta-p/4618)

> Hint: If you choose Accept exclusively, TeamViewer will disconnect from the > internet – that means it will no longer be possible to make or receive > connections using the TeamViewer ID, and the Computer & Contacts list will > no longer be available.

</comment></comment></comment></comment><comment><USER5> I'm not an expert so I'm just gonna ask the question. How is this different than what my web browsers do with all the passwords they memorize for me? They are stored locally, and encrypted, not hashed, with a key that is hard-coded somewhere. Right?

<comment><USER6> No- Chrome actually uses the Windows DPAPI, which encrypts passwords using your user login credentials. 3rd party password managers use a master password with a PBKDF.

<comment><USER7> It's still absolutely trivial to dump these though. Especially in the case of Chrome. iStealer is a classic script kiddie tool designed to exploit this.

</comment></comment></comment><comment><USER8> Why on earth would you store user passwords with AES locally _and then use a hardcoded key to encrypt them_???

<comment><USER9> $employer has recently been acquired by a big international corp. As part of the acquisition they have been "auditing" (really checkbox ticking and superficial API scans) our applications. One of the issues that came up is that we were using bcrypt as password hashing algo and our new overlords had a whitelist policy that only included sha2 variants and perhaps ripemd or something like that. We argued that their whitelist was totally inadequate for password hashing and pointed to multiple national standards bodies. The people doing the audit just ignored everything we explained to them and repeatedly pointed at the policy (which they weren't in charge of themselves).

Several people on my team were opining to just comply because it's the easiest way to do and they were concerned about their job security if they would go "against security".

My takeaway from that experience was that the people in charge of corporate security policies and audits are not experts in security, they are experts in reshuffling responsibility and covering asses. And many developers are easily cowed by them.

The result is compliant software, not secure software.

<comment><USER10> Compliance is really the biggest source of bullshit jobs. All the paperwork you need to get certified, the manhours spent reviewing it, all for marginal benefits.

<comment><USER11> Many (most) processes like that started because someone got burned by something, and the people ultimately responsible said "make a process so it doesn't happen again".

Often times companies go through this with internal processes as they grow, and some grow out of that phase.

Other times (especially at even larger companies) processes are adopted "from the industry". While not necessarily bad, it also requires flexibility from feedback. In parent's case, auditing to ensure sensitive data is encrypted to a minimum standard is reasonable , auditing to ensure any encryption is limited to a very narrow set of algorithms is not.

I worked on a project once that contracted out security audits to HP and those were distressingly _not_ good security audits, just vague automated checkbox- checking of a list put together with zero context.

</comment></comment></comment></comment><comment><USER12> Storing on the _local machine_.

Versus what they should have been doing - authenticating the password and then storing a session cookie.

</comment><comment><USER13> Ironically, TV tweeted recently:

"January 28 is Data Privacy Day! TeamViewer is a Data Privacy Day Champion. As an organization, we understand the importance of being open and honest about how we collect, use and store your information."

<comment><USER14> >Send email to the Director of Security November 14th, 2019

>Send email to Director of Security notifying them there is now a CVE assigned to this November 18th, 2019

>Receive first and only email back from vendor "We're looking into it" email January 13th

Good one TV.

</comment></comment><comment><AUTHOR> Twitter thread here: [https://twitter.com/blurbdust/status/1224212682594770946?s=2...](https://twitter.com/blurbdust/status/1224212682594770946?s=21)

</comment><comment><USER15> One more reason to flush this turd.

It worked well for me until it started flagging some very non-commercial use (family IT support) as commercial. I actually tried to use their process to unflag myself. Gave up and am happy with AnyDesk now. Not sure what they do with passwords... guess I should check!

<comment><USER16> Yeah just checked Anydesk, 100 Euros a Year and no online address book really?

</comment></comment><comment><USER17> I'm on the fence about this security practice, but does anyone know a good FOSS alternative to TeamViewer? As in something that lets me remote into any of my devices from any other and doesn't require a fixed up?

<comment><USER18> VNC?

</comment></comment><comment><USER14> I spent 3 weeks stepping through a program to reverse their blowfish encryption a long time ago...

So I won't say he messed up by stepping through code for 6 hours to find the AES decrypt sequence but the instruction he could have scanned for is a special CPU instruction now!

aesdec xmm0,xmm1

How many separate routines could they have that directly call AES instructions?

<comment><USER19> Not all AES implementations will use AESNI instructions. Support for those instructions is relatively new -- many systems in productions still lack them -- and they're hardly necessary for a non-performance-critical implementation like this one.

A better signal is the presence of the S-box tables (63 7C 77 7B...). Even that won't detect applications which use an implementation from a shared library, though.

<comment><USER14> Yea, that's how I did a blowfish program, just looked for the big constant table, but you know there are some clowns out there that "make their own" s-box :) you know, to "be even more secure".

</comment></comment></comment><comment><USER20> I am in the middle of a cyber incident response engagement and we identified compromises basis this. Wrote a quick and dirty code to enumerate it en masse and do automated connection analysis basis available teamviewer logs. The results, are actually eyepopping. Good analysis and w00t!

</comment><comment><USER21> Perhaps misleading title?

Teamviewer saves remote passwords in registry, encrypted with hard-coded key

The biggest ambiguity here is that the passwords in question are just user- saved "remote server passwords" and the key takeaway is that remote desktop software should not be left running.

</comment><comment><USER22> I've seen recommendations to move away from Teamviewer for a few years now. They may have been good and _free_ in the past but not much reason to use them anymore when the casual user can use chrome remote desktop, and more tech focused can use splashtop.

</comment><comment><USER23> How do you do this if you're storing passwords to send on to another end point.

Never had to store passwords in anything but a hash. My way is just to get the user to enter it again and never store passwords.

</comment><comment><USER24> Could anyone tell me if this affects MacOS? not sure if I should rush to uninstall teamviewer on my home computers?

<comment><USER25> I guess when you've used those credentials on a windows machine?

</comment></comment><comment><USER26> There's an open source teamviewer equivalent that's free to use if you build it yourself - looked really slick, but I can't for the life of me find it now. Anyone got any ideas what it could have been? (Wasn't VNC/RDP based). Dammit, wish I could remember

</comment><comment><USER27> The OS doesn't have something like a keyring or what? It's the same as registry, but explicitly states the intent.

</comment><comment><USER28> It's pretty surprising that something this silly gets upvoted so heavily here.

Lack of hashing isn't the problem here, the fact that low privileged users can access these credentials is.

The author isn't to blame for the silliness though, whoever decided to editorialise this title for HN is.

<comment><USER29> I've taken a crack at rewriting the title. If anyone can suggest a better one (i.e. more accurate and neutral, preferably using representative language from the article), we can change it again.

<comment><AUTHOR> Sorry I took the title verbatim from Reddit and wasn't editorializing. It seemed blunt without sensationalizing anything to me when I submitted.

</comment></comment></comment><comment><USER30> Kudos to the security expert for the finding but his web page gave eye cancer.

Seriously, consider lowering the contrast or chaging typography... Don't know, but it was hard to read in its original form...

<comment><USER31> IMHO, the website was a wonderful and easy-on-the-eyes experience to read.

I am visually impaired. I need sites to look like this just to consume them.

This was my experience and yours was different. Being able to let the viewer choose is critical so that everybody can use the web.

</comment></comment><comment><USER32> Seeing shit like this daily is holy demoralizing. Makes me feel like writing software for a living is a lost cause.

<comment> munk-a This particular issue reeks of "roll your own" when a lot of out-of-box token based solutions would just do a better job. The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong.

The benefits of leaning on a third party for common logic should be carefully reviewed on a case-by-case basis unless that software is related to security, in which case, please do lean on a third party.

<comment><USER33> >The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong.

fuck, I need to tell that to all top CTF teams that their members should stop competing and leave their jobs and focus on PhD

It may be a little bit offensive, but did you even graduate?

<comment> munk-a Sorry, I was a bit hyperbolic - let me clarify. I didn't mean that educational experience is a critical portion - more that working in the security field is a lot more theoretical than most and requires a much higher investment of time to start to comprehend. People without degrees absolutely can be security experts, and people with degrees can be utterly clueless - but if you're working on a webapp and given a week to write a login system then it almost certainly will be vulnerable.

So it's less specifically required that people have PhDs and more... this stuff takes time to fully understand, I know a lot of pitfalls on the topic but I wouldn't say I'm an expert - I just know enough to know that I don't know.

</comment></comment></comment></comment><comment><USER34> Yes another sloppy product that reeked of security flaws the first time I used it. How do these products become so widely accepted within a technically savvy user group? It doesn't take a lot of knowledge to see the obvious flaws in how poorly the desktop sharing is implemented in this software. No wonder it is a favourite of scammers.</comment>


Random Acts of Kindness: A Social Site I'd Love to See - <AUTHOR> http://zenhabits.net/2008/08/random-acts-of-kindness-a-social-site-id-love-to-see/ <comment><USER2> I dont think it would really work, there isnt much you could do for an internet stranger than give money. pretty sure swapping book sites etc already exist.

so it seems like it would just be swamped with people wanting someone to randomly paypal them money, along with a sob story.

plus as mentioned in the comments, it kinda games the idea of karma if you have some badge pronouncing how "good" you are.

I think random acts of kindness are best done off the internet. I think what might make a cool site is somewhere for people to post random acts of kindness people have done for them. no real point to it, just feel good stories

</comment><comment><USER3> Y'know, I started reading that post with a view towards making a cynical, snarky comment, but by the end it didn't seem such a bad idea.

You'd need to make sure the karma system couldn't be gamed, though -- either by automated actions (kind comments on everybody's walls) or collusion (two people [or a person and a sockpuppet] conspiring to give each other karma). I'm not sure that's solvable.

<comment><USER4> Gaming can be solved by introducing attack resistant trust metric. The best one the humankind has come up so far is money.

<comment><USER5> A brilliant comment, but sadly, electronic and paper money is not attack resistant.

<comment><USER4> Money is attack resistant. Those who think otherwise might end up in jail.

<comment><USER6> Money is attack resistant? Not entirely. Not to governments, who can raid your savings by printing more. Not to central banks, who have the same powers, despite not being part of the government. Not to corporations that are seen by corrupt governments as "too large to fail." Not to all manner of con artists who pass themselves off as legitimate people involved in finance.

And unfortunately, only a small minority of the above get jailed.

Yes, markets have remarkable resilience. But there are lots of vulnerabilities in markets in the world as it stands now.

</comment></comment></comment></comment></comment><comment><USER7> Sounds like a fun game to me.

I'd put a "426 karma points" badge on my Facebook profile.

</comment><comment><USER8> It sounds a lot like LETS:

[https://secure.wikimedia.org/wikipedia/en/wiki/Local_Exchang...](https://secure.wikimedia.org/wikipedia/en/wiki/Local_Exchange_Trading_Systems)

</comment><comment><USER9> This would be a fantastic application in Facebook. I think you'd have luck in applying for the Facebook Fund.</comment>


Unexpected evidence of a new particle at LHC - <AUTHOR> http://www.nature.com/news/who-ordered-that-1.19514 <comment><USER2> So just to be clear, this particle is not predicted by the standard model? I'm no physicist, but that seems like a huge deal.

<comment><USER3> The standard model currently has 17 particles[1]. This number has grown over time, most recently when the Higgs boson was added a few years ago. The standard model makes no claim as to how many particles there can be, what their masses should be, what spin they should have, and so on. Those are unsolved questions outside of the scope of the standard model. Instead, it uses the particles we know about to make predictions about how they behave.

A new particle doesn't necessarily violate the standard model in the same way that discovering a new element wouldn't necessarily violate the periodic table. It could just expand the types of predictions that it is capable of making. It is also possible that a new particle could have properties that do violate constraints predicted by the standard model, but I don't know it well enough to know whether this particular particle does so.

[1] [https://upload.wikimedia.org/wikipedia/commons/0/00/Standard...](https://upload.wikimedia.org/wikipedia/commons/0/00/Standard_Model_of_Elementary_Particles.svg)

<comment><USER4> > If it turns out to be true, the chart linked below showing the 17 known > elementary particles would be expanded to show an 18th.

no, actually the standard model would fundamentally break down. The math does not allow for such a heavy particle. No charts could save it.

<comment><USER5> That's not really the case. The standard model would need to be extended, sure (as the 750 GeV particle isn't predicted by the current SM). But there's no fundamental reason this can't be done; in fact in the weeks following this announcement by ATLAS/CMS, there were literally hundreds of theory models posted to the arXiv, claiming to extend the SM to account for the (potential) new resonance.

<comment><USER6> But the fact that there were hundreds of theory models posted means that there is no "standard model" for this new particle at the moment (if it is a real particle).

</comment></comment></comment></comment></comment><comment><USER7> Last time there was an "unexpected reading", we spent 3 months being excited about faster-than-light particles until someone found the error. Let's not get too excited just yet.

<comment><USER8> I'll take three months of excitement, damn the consequences.

<comment><USER9> The pursuit of discovering something new and interesting that could potentially change your entire understanding of the universe, is what makes science so utterly satisfying. It's like being re-born. Everything you once knew was completely wrong and you have to re-learn everything.

<comment><USER10> > Everything you once knew was completely wrong and you have to re-learn > everything.

It's really cool in practice but the way you phrased it makes it sound dreadful :)

</comment></comment></comment></comment><comment><USER11> Can anyone tell me if there are any practical applications for this, or it is 'just' a further understanding of the world around us (albeit an important one)?

<comment><USER12> It is about thirty to fifty years too early to expect any practical applications from this.

<comment><USER13> The coolest thing we can do with the last unexpected particle, the muon, is this:

[https://en.wikipedia.org/wiki/Muon- catalyzed_fusion](https://en.wikipedia.org/wiki/Muon-catalyzed_fusion)

It's not in the "Mr. Fusion" stage, of course, but pretty neat nonetheless.

</comment></comment></comment><comment><USER8> "[...] before the experiment shut down for its winter recess."

Can anyone shine a light on why the particle accellerator needs recess?

<comment><USER14> Geneva needs power for the winter.

(not joking)

[http://home.cern/about/engineering/powering- cern](http://home.cern/about/engineering/powering-cern)

"At peak consumption, usually from May to mid-December, CERN uses about 200 megawatts of power, which is about a third of the amount of energy used to feed the nearby city of Geneva in Switzerland."

<comment><USER15> Well, not quite. They don't shutdown in the first place because of the power usage, but they choose the timing for the shutdown when it is most economical. Regular maintenance is unavoidable.

</comment></comment></comment><comment><USER16> ELI5: Presumably this was a result of the LHC's power upgrade to 13 TeV. If so, should they now be able to repeatedly get these results again and again?

<comment><USER6> Yes, the energy needed was reachable because of the upgrade. And yes, they should be able to repeatedly get there.

</comment></comment><comment><USER17> About time! I can see how scientists were excited when the LHC confirmed existing theories, but the thing was kinda expensive, so it would be nice to get some new physics out if it instead of just a "yup we were right".

</comment><comment><USER18> This is one case of ambulance chasing: [http://arxiv.org/abs/1603.01204](http://arxiv.org/abs/1603.01204)

EDIT: I just noticed that this is also linked in the article.

</comment><comment><USER19> "An unexpected data signal that could change everything has particle physicists salivating."

I know I'm like an old man screaming into the wilderness, but I can't be the only one that's profoundly sad that even nature.com has to resort to this sort of horrible clickbait formulation for a headline.

Notwithstanding my aesthetic dislike of it, the thing about these headlines that makes me really upset is the fact that _they aren 't actually telling the truth._

Not to be pedantic, but they have not observed any particle physicists with an unusual amount of saliva, presumably. There is no anecdotal or visual evidence of people drooling, nothing.

It seems to me this is like the most horrible way to start off an article in a publication that is _about the scientific method_ for gods sakes, where precision and accuracy is sort of the whole point.

Would it really be so hard to have a headline like "Shocking and unexpected evidence of a new particle" or something similar that actually says or at least approximates what the news is?

<comment><USER20> I got to the second sentence before getting frustrated with the integrity of an article by Nature:

"They have tried to recreate dark matter, reveal extra dimensions of and collapse matter into microscopic black holes."

The missing word was slightly irksome. I find the claim that anyone has intentionally tried to create microscopic black holes bombastic.

CERN's own site:

"According to the well-established properties of gravity, described by Einstein's relativity, it is impossible for microscopic black holes to be produced at the LHC. There are, however, some speculative theories that predict the production of such particles at the LHC. All these theories predict that these particles would disintegrate immediately. Black holes, therefore, would have no time to start accreting matter and to cause macroscopic effects." \- [http://press.web.cern.ch/backgrounders/safety- lhc](http://press.web.cern.ch/backgrounders/safety-lhc)

They have certainly looked into it for safety sake but if CERN's intent was to create microscopic black holes, I suspect it would be a very different machine.

<comment><USER21> > They have certainly looked into it for safety sake

Actually, when I worked at CERN there was never much fuss about such risks. The tunnel is just 100 m under, but I've yet to hear from someone worried about his house being sucked in.

<comment><USER22> They aren't worried _because_ they looked into it. You could argue that "comparing max theoretical energy to that of cosmic rays" doesn't constitute "looking into it" but that's splitting hairs.

</comment></comment></comment></comment><comment><USER23> The Trisolarians are coming!

<comment><USER24> Sophon lockdown begins?

<comment><USER23> Finishing Dark Forest made me really wish I could speak and read fluent mandarin, so that I wouldn't have to wait another 4 months for the final volume! They pushed the publication date back again...

<comment><USER24> Oh that's sad to hear. It's one of the best sci-fi series I've ever read no doubt.

<comment><USER25> I had some serious problems with the Three Body Problem, which annoyed me enough to put a pause on reading the next novel. I loved all the interpersonal stuff - I haven't liked a character as much as I like Big Shi in a long time - but the tech and science of it seemed implausible to me.

It's hard to go into details without being spoilerific, but: the problem is hard to _solve_ , but you can still make very useful short-term predictions; the technology they have access to is being insanely under-utilized given their goals; and I don't believe the actions of the scientists given how they use that technology - I would expect the reaction to be _the exact opposite_ of what ends up happening.

I left a review on GoodReads: [https://www.goodreads.com/review/show/1553897979](https://www.goodreads.com/review/show/1553897979)

<comment><USER23> I liked this essay on plot holes (and more generally good writing) despite the all caps and rather long winded style: [http://birthmoviesdeath.com/2012/10/30/film-crit-hulk- smash-...](http://birthmoviesdeath.com/2012/10/30/film-crit-hulk-smash-hulk- vs.-plot-holes-and-movie-logic)

Personally, I found the strength of TBP and DF to be the depth that Liu achieves with his plots at the highest level, and it's important to take a step back and not judge him as pure hard SF (as it seems to have been sold to you, based on your review) but as a writer of literature using SF as his medium (as might have Heinlein, PKD, or Asimov who is his clear and direct inspiration).

The science "plot holes", the suspension of disbelief were I think fair play as a base to deploy his explanation of the Fermi paradox (which is to an extent the point of the whole series). Like psychohistory in Asimov's Foundation or Batman's seeming invincibility in Nolan and Ledger's masterpiece, it helps plot development and the greater ideas about human nature, politics, information operations and so on that are put forward by the book.

The analyses of human nature, particularly of bureaucracies and destruction via inaction (to quote Admiral Rickover, "the person who disclaims responsibility is correct: by taking this way out he is truly not responsible; he is irresponsible").

What makes a good book/movie/narrative work of art? To me it is increasingly about the plot and, to quote FCH, about how long the work can make you think about it after you're done reading it. It's clearly working since it's been weeks since I've read the books and I still couldn't resist making the quip despite the increasing amount of karma it is costing me for being off-topic.

Compared to another famous recent Hugo winner, Rainbows End, I thought Liu's work was much more enjoyable, because it was technically unpolished but had a great, interesting, innovative plot (and I'm sure half of the polish went missing in translation), whilst the latter was technically impeccable if now a little dated, but had little in the way of plot; the plot was almost a frame in which Vinge was developing his ideas about wearable tech and information operations' logical conclusion. It's like Esterhase mysteriously putting on a bad Hungarian accent in Smiley's People when he was the epitome of the try- too-hard British arriviste in TTSP - you can forgive them the glitch since the core of the writing is so exceptional and both Esterhases were fabulous characters with great depth.

Liu's ability to toy with the reader and take unconventional paths is rather rare in today's crop of writers. I would draw a parallel there with many of Charlie Stross' books; the polish is not always there, but he keeps reinventing himself and (at least for me) each foray into a new genre or avenue of thought is a success (and a source of great movies and books to explore).

As a side note, I thought it was one of the few successful depictions of a truly alien culture (what you call near-Strong-AI?) in SF today (and no, I didn't think Vinge's FOTD's Hugo winning hive-dogs were truly alien: put human heads instead, set it in medieval "Ireland-Spain", and you get Game of Thrones, down to an epic fire battle before the walls of King's Landing).

As a second side note, isn't it fun to draw parallels between TBP and the real world? How do you, today, as the PLA, deal with the fact the NSA can hear and read everything except your thoughts when planning defense strategy? Suddenly the sophons don't seem so alien... I don't like tin foil hats, so I didn't try too hard to put myself in the Chinese position, but it was definitely an interesting line of thought.

<comment><USER25> Yeah, the human nature aspects were what I really loved about it. Liu could have left out most of the interstellar scifi, and told a story just as good.

I'm not sure if I buy the alien-culture, though. The Trisolarians seemed just as human as ... humans, especially given their introduction in the titular video game, and the Sophons barely seem to have a culture at all.

(I also agree about the Tines; I really love them as a species, but I hated the sequel, because I don't really care about basically pre-tech societies enough to read long fiction about them - same problem I had with Stephenson's Baroque Cycle, and the reason I haven't read any of the ASoIF novels.

<comment><USER23> > I'm not sure if I buy the alien-culture, though. The Trisolarians seemed > just as human as ... humans, especially given their introduction in the > titular video game, and the Sophons barely seem to have a culture at all.

Did you really think so? I can't remember where DF started, so I'm going to have to be careful with spoilers but in my view, the "game characters" were either humans (professor Ye if I remember well), or weak AI game characters programmed by the Trisolarians in an attempt to map their propaganda to humans. The game itself is an information operation: it is designed to cultivate a resistance within humanity and disinform humans psychologically in order to gain yet another edge over them militarily.

However Trisolarians themselves are a "superior civilisation" which is both helped and hindered by a particular feature of theirs which we don't have (related to the Tines, actually) and which becomes the core plot point enabling most of DF to play out (like the Wall Facer project). Sophons are just sophisticated communication devices, there to send back information to Trisolarians so they can better understand, hinder and later destroy Earth; they are not themselves strong AI (and therefore not a civilisation).

Thus what makes it interesting is the game theoretic aspect of it, and especially the treatment of information flow. Trisolarians know everything except the thoughts of humans (and, initially, they also lack the information that humans are capable of private thought).

It is not what they say (which is purposely adapted to look human) but how they react to learning bits of information that makes them a fully fleshed out alien culture (such as learning abstract concepts like deception, then figuring out the game theory of deception and altering their conversation onto the ETO accordingly).

The human fifth column goes from being a convenient tool of further aggression, to a core path to avoiding the one realistic chance humans have against the invasion. The ability of the Trisolarians to create a high quality "virtual machine of human minds" within their civilisation capable of such manipulation makes them a convincing "higher civilisation" (which is what will make the third book interesting, I bet, especially after the closure brought by DF).

<comment><USER25> Ah, ok, I haven't read DF yet. I think what you've given me here is a bit of a spoiler, but enough to make me actually want to read it.

Is the English translation that's out right now good enough? I've heard very mixed reviews about it - does it make sense to wait for a possible new translation, or should I just dive in?

Also, I thought that the Sophons _were_ an AI, and that their actions on Earth were largely self-controlled - not driven by Trisolarians remotely.

<comment><USER23> I think the rules for the sophons are not entirely clear, because he set them up as a plot device for a few of the things he needed (FTL, no more science, omniscience of the enemy) in order to create the special conditions that force humanity to defend itself by creative thinking and this is also why I didn't spend too long cross-referencing their viability. Nevertheless I vaguely remember them being some kind of giant PCB when unfolded in 2D with a fairly high level of abstraction and autonomy without being strong AI (and therefore a new civilisation). It's a given in the plot anyway that you don't want to create a higher civilisation, because of the DF... well, I'm not going to spoil it, but the Trisolarians have very good reason not to create real intelligence capable of resetting its goals.

The translation is as good as it's going to get. The main issue is that Liu is from the PRC and spent most of his life there. It took me years in Asia to slowly realise how differently the Chinese think from Westerners (hell, Westerners themselves think very differently just across borders - compare the worldview of a Brit to that of a Nordic or a Frenchman). If you compare Strugatsky and Asimov, you also get this huge cultural difference that is untranslatable because of the large amount of metadata bagage that Russians would already have coming into Strugatsky's work after growing up in Russia.

The book is "very Chinese", if that makes sense, which I think is what confuses people (and to me is a feature). A quick intro to what that means might be watching a few episodes of If You Are The One (非诚勿扰), a slightly crazy dating show that since the second season has had a government censor added to the panel to moderate the gold diggers; an Australian TV channel has started subtitling a bunch of episodes, although I unfortunately could never find the infamous season 1 ("I'd rather cry at the back of a BMW than smile on a bicycle"). You both get a sample of PRC normal citizen thinking and a taste of how the government is setting the tone culturally.

<comment><USER25> I'd love to get an annotated translation that dives deeper into the characters' motivations. The translation I had was full of footnotes, but mostly explaining historical and cultural allusions. But I think the book would probably be three times longer, and would raise more questions than it would answer.

Thanks for taking the time to have a nice, long conversation with me about this!</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Silicon Valley's self-regulating days probably should be over, Nancy Pelosi says - <AUTHOR> https://www.recode.net/podcasts/2019/4/11/18306834/nancy-pelosi-speaker-house-tech-regulation-antitrust-230-immunity-kara-swisher-decode-podcast <comment><USER2> "Communications Decency Act, which says that internet companies are not responsible for what is posted on their platforms"

So Pelosi opposes this and thinks "internet companies" should be held accountable and monitor every single communication or media file posted on a website/platform. So it's just private censorship mandated by the government. Pretty unoriginal work around to suppressing free speech.

<comment><USER3> Do you feel that they should be held to a different standard to every other media? Television stations are responsible for what is televised, radio stations for what they broadcast, newspapers for what they print - but somehow internet companies are not responsible for what they store and communicate due to the number of messages they must monitor?

OK, that's fine, we'll treat them like common carriers and regulate them.

<comment><USER4> Television and radio are heavily regulated in part because there is limited spectrum set aside for broadcasts. Television, radio, and newspapers exert a great amount of editorial control.

Common carrier is a great model for this. AT&T isn't responsible for the content of phone calls, and they also don't exert any editorial control over them. Many popular platforms are kind of trying to be free to do whatever, but also exert editorial control, which seems untenable.

Disclaimer: i work for a silicon valley company; opinions are mine, not my employers.

<comment><USER3> > AT&T isn't responsible for the content of phone calls, and they also don't > exert any editorial control over them.

AT&T is a common carrier for mobile and voice services so I'm not sure why you are raising them as a counter example. While they are not responsible for the content that is sent on their network, they do work with law enforcement and the intelligence community to ensure that specific crimes which occur only over telecommunications (i.e. threatening someone over the phone) can be investigated and proscecuted.

> and they also don't exert any editorial control over them.

Also, this is a requirement of being a common carrier. They have to send everything from A to B regardless of (lawful) content. Facebook, Twitter, et al, seemingly want to create an environment in which they can self- editorialise but are not held up to even the basic standards of a common carrier.

<comment><USER5> Ahh but they are not common carriers for mobile since they prioritize traffic.

<comment><USER3> A correction to what I said - they are not common carrier for mobile _data_. They _are_ common carriers for mobile voice communications.

There is a whole series of FTC v AT&T lawsuits which outline this argument and the extent to which they are subject to FTC regulation, if you're interested.

<comment><USER5> Voice over LTE is technically packetized and delivered over IP. So that they prioritize traffic still may be an issue.</comment></comment></comment></comment></comment></comment></comment>


The hunt for a million-dollar haul of ocean gold - <AUTHOR> http://www.bbc.com/future/story/20160210-inside-the-hunt-for-a-million-dollar-haul-of-ocean-gold <comment><USER2> It is plausible that gold coins are no longer on the wreck. It just seems too pat that every one of the 600+ souls was rescued, yet the coins were not.

Suppose the Connaught's purser and some crew members were in on it. Leak, unexplained fire and convenient rescue may all have been planned: opportunity, diversion and getaway. The feel-good story of the rescue would only serve to hamper investigations.</comment>


I'm not wearing any clothes and I just realized it - <AUTHOR> https://medium.com/@titusblair/i-am-not-wearing-any-clothes-and-i-just-realized-it-let-s-start-doing-and-being-instead-of-6529c5a3e29c

<comment><USER2> I thought this would be about becoming a naturist, like Mick Aston of Time Team fame, or perhaps reference Heinlein's "Stranger in a Strange Land" where the Nest has a sign "did you remember to put clothes on" just inside the door (Spider Robinson says he had the same arrangement in his home).

Instead, it seems vague anti-nudist, by insisting (in its analogy to the Emperor's New Clothes) that having clothes on is better than not having clothes on.

That's seems like needlessly negative views towards an admittedly small portion of the population, when the point is mostly to just start doing real things, and nothing to do with actual clothes.

<comment><AUTHOR> I would appreciate any positive thoughts you have in regards to the context of the article contents :)

<comment><USER2> It seems that I was not direct enough.

Several people I know and respect are or were nudists/naturists, including one who lives in a clothing optional community. I live in Sweden and have been socially naked in the company sauna with co-workers, in private saunas with friends, in public saunas, and skinny dipping with friends in summer. I have also been in the conference sauna for PyCon Finland, with about 50 other attendees. While I do not practice it, I support the German Freikörperkultur.

The article implicitly discriminates against those who practice or support clothing optional practices. Eg, "So what is my strategy now that I know I am not wearing any clothes? To start wearing clothes of course!" \- why _not_ stay naked?

Therefore, you should read my previous comment as a complaint. I see no reason to contribute positive comments to something whose basic analogy is one I disagree with.

<comment><AUTHOR> The article has nothing to do with clothing but with the fact that someone was deceived into thinking they were wearing clothes when in fact they were not. If you take it within the context of the story you should be able to see it in a new light :)

<comment><USER2> As I wrote "That's seems like needlessly negative views towards an admittedly small portion of the population, when the point is mostly to just start doing real things, and nothing to do with actual clothes."

The context of the story is that one should wear clothes in real life. Otherwise the underlying analogy doesn't make sense.

Also, regarding "Not sure why it's called going viral, it should be going exponential, lol!". The assumption is that the dynamics of how they spread is similar to model of population growth for viruses, bacteria, etc. These follow a logistic function - a sigmoid or 's' curve. Early on the growth appears exponential, but at some point it flattens out. After all, there are only about 7 billion people in the world, which sets a hard upper limit.</comment></comment></comment></comment></comment>


China's Maxim: Leave No Access Point Unexploited - <AUTHOR> https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1050&context=mca <comment><USER2> Strange how this story is not on HN's frontpage..

<comment><USER3> I don't think this title conveys enough information about the paper.</comment></comment>


Startup Selling Viagra and Rogaine to the Instagram Crowd - <AUTHOR> https://www.bloomberg.com/news/features/2018-07-18/hims-is-selling-generic-viagra-and-rogaine-to-the-instagram-crowd <comment><AUTHOR> Related HN discussion on Amazon's potential movement towards online pharmacy: [https://news.ycombinator.com/item?id=17417282](https://news.ycombinator.com/item?id=17417282)</comment>