Enroute Airbus A380 wake flips Challenger business jet upside down - <AUTHOR> http://flightservicebureau.org/enroute-a380-wake-flips-challenger-604-upside-down/ <comment><USER2> For anyone interested, there are several great youtube videos[1-4] that show the wakes (the wingtip vortices in particular) created by various aircraft.

This incident brings the Reduced Vertical Separation Minima (RVSM)[5] into question. Strategic Lateral Offset Procedure (SLOP)[6] can be used used to avoid such incidents.

[1] [https://www.youtube.com/watch?v=E1ESmvyAmOs](https://www.youtube.com/watch?v=E1ESmvyAmOs)

[2] [https://www.youtube.com/watch?v=dfY5ZQDzC5s](https://www.youtube.com/watch?v=dfY5ZQDzC5s)

[3] [https://www.youtube.com/watch?v=uy0hgG2pkUs](https://www.youtube.com/watch?v=uy0hgG2pkUs)

[4] [https://www.youtube.com/watch?v=KXlv16ETueU](https://www.youtube.com/watch?v=KXlv16ETueU)

[5] [https://en.wikipedia.org/wiki/Reduced_vertical_separation_mi...](https://en.wikipedia.org/wiki/Reduced_vertical_separation_minima)

[6] [https://en.wikipedia.org/wiki/Strategic_lateral_offset_proce...](https://en.wikipedia.org/wiki/Strategic_lateral_offset_procedure)

<comment><USER3> Those wingtip and flap effects on 2 are gnarly! I assume that those occur near dewpoint? or some other atmospheric conditions?

<comment><USER4> If you recall Boyle's Law from high school physics - Temperature is proportional to pressure. Aircraft wings generate an intense area of low pressure over the top of the wing (which is what essentially generates the lift). This low pressure area is magnified when flaps and slats are deployed.

On a humid day, the lowering of the pressure over the wings can basically force the air temperature at that point to lower and reach dew point temperature, essentially forming temporary clouds that are whipped around by the moving air vortices.

Once the aircraft has passed that point, the temperature generally stabilises and conforms to surrounding air temperature, which usually dissipates the temporary condensation.

The 'twirly' bits on the wingtips is basically spillover from the high pressure under the wings to the low pressure above the wings, creating that mini tornado vortex. This is also the reason that many modern aircraft have those 'winglets' on the wingtips, to try and minimise these spillover vortices which can cause problems for trailing aircraft, as well as induce extra drag on the source aircraft.

<comment><USER5> Wings generate lift primarily by deflecting air downward. There is an area of low pressure over the wing where air is taking a longer path than under the wing, but that is only responsible for a small fraction of the lift.

<comment><USER6> "Longer path" has no bearing on reality. A flat plate can generate plenty of lift even with both sides the same. It's also hard to define "path," as the air starts convecting well ahead of the wing in subsonic flow.

<comment><USER4> Sorry, but I don't subscribe to the 'flat plate' theory. There is a reason that almost every commercial (and most military) aircraft have leading edge slats to generate lift at lower speeds (by making the top of the wing more convex and the bottom of the wing more concave).

If _pure_ 'flat plate' theory was valid, then all those aircraft speeding down the runway with the leading edge of their wings canted downwards 20 or so degrees would result in the airplanes simply being pushed towards the ground and never lifting off...

And Boeing, Airbus et al would build planes with flat slab wings mounted at a 45 degree angle to the airflow, because that would give the maximum lift by the 'flat plate' theory, wouldn't it?

Not that I disbelieve that a flat slab cannot generate lift - but that it is probably a very inefficient way to generate lift compared to the standard aerofoil shape.

[0] - [https://upload.wikimedia.org/wikipedia/commons/thumb/3/3b/Bo...](https://upload.wikimedia.org/wikipedia/commons/thumb/3/3b/Boeing_727-2S7_Advanced_Champion_LAX.jpg/1200px- Boeing_727-2S7_Advanced_Champion_LAX.jpg)

[1] - [https://www.metabunk.org/sk/20141127-081301-jrgr5.jpg](https://www.metabunk.org/sk/20141127-081301-jrgr5.jpg)

<comment><USER7> The shape of the wing makes a huge difference, so a plate or a piece of wood wouldn't make a good wing, but it is still able to fly.

Proof? Inverted flight on low power aircraft and gliders.

<comment><USER4> And as I have mentioned elsewhere on here - I have flown inverted a few times, and to do so take a tremendous amount of _forward_ pressure on the control stick to even try and attempt to hold altitude while inverted, in order to counteract the wings natural (slight) positive AoA and the tendency for the wing to move towards it upper surface. In fact, most of the aircraft I have flown would not be able to sustain inverted flight at all. The fact that full aerobatic and military jets do, is because they (as I explained earlier) usually don't have that curved 'fish' shape cross section, but are usually symmetrically shaped on the top and bottom of the wing.

To whit, I've had the fortune to fly an old DH Tiger Moth biplane - on that little baby, when you approach the stalling point, you can actually see the the canvas on _top_ of the bottom wing bulge and contort with pressure differential, and you can hear the sucking sounds as the airflow struggles to 'stick' to the wing. There is a little movement on the bottom surface of the top wing too, but not as pronounced.

I'd be interested to see in this thread, who here has actually studied aeronautical engineering, or flown actual aircraft, and who is relying on YT videos or a pure theoretical approach to come up with these theories?

Also interestingly, I believe most of the textbooks I used at flight school were filled with data from NASA and other US military branches with regards to flight dynamics etc., and here on this thread we see articles from NASA (albeit aimed at K-12 audience rather than trainee pilots) basically disproving their earlier academic research.

<comment><USER8> > I'd be interested to see in this thread, who here has actually studied > aeronautical engineering

I studied Aerospace Engineering (PhD in Aerodynamics), and I stay out of internet conversations over "how" lift is generated. For me it is one of those topics that is just not worth debating. It seems that people get _really_ attached to their personally preferred theory of lift.

<comment><USER9> Can you point to a source for those of us who want to know the right answer (like, sailors)?

<comment><USER10> Not the previous poster, but this was on HN a week ago:

[http://ljjensen.net/Maritimt/A%20Review%20of%20Modern%20Sail...](http://ljjensen.net/Maritimt/A%20Review%20of%20Modern%20Sail%20Theory.pdf)

[https://news.ycombinator.com/item?id=13829625](https://news.ycombinator.com/item?id=13829625)

<comment><USER9> Perfect. Thank you!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> This is a reminder that the announcement that you should "keep your seat belt fastened at all times when you're in your seat" isn't just something someone made up. It's a small price to pay in case you ever encounter severe turbulence en route, but it might be one of these things that most people don't realize until it happens to them. Hitting your head against the cabin ceiling can seriously put a damper on your trip.

<comment><USER12> Yeah I'm pretty sure that's the first rule that goes out the window when you're on a private jet.

<comment><USER13> There's a reason that people with money and power don't always experience good outcomes. Sure, you can do what you like on your jet, and therefore expose yourself to risk that most people never experience. Likewise skiing off-piste or a number of other equally silly activities that you _can_ do, but absolutely shouldn't.

<comment><USER14> Probably they have a different idea about risk management than more risk- averse people. Worrying a lot about very low probability events is not compatible with the risk-taking typically required to make a lot of money. After all millionaires are largely a "survivor club" filtered from high risk appetite workaholics.

<comment><USER13> I don't know about that. I think mostly it has to do with having the power to pick and choose critical service providers, bully them, etc. If Michael Jackson and Steve Jobs had not been as wealthy and powerful as they had been, they would also both probably be alive.

Neither has much to do with being risk-takers, although you might be right that a higher arousal threshold desensitized them to risk. It may also be that people used to winning, on some level, expect to keep winning. Either way, we're not just talking about Fortune 500 C-levels here, plenty of people with loads of money and power did nothing to get it, and have no special qualities associated with that ability to get it.

They still often have bad outcomes.

<comment><USER15> I feel like Steve Jobs is an odd choice... He turned down treatment I thought?

<comment><USER16> He wasted precious time indulging quackery.

<comment><USER17> Anecdotal but I notice in my circles only less financially well off people endulge in quackery. The latest is that you do not need treatment for anything if you do enough marijuana and reiki (not to mention a lot of poor people burn their last money on reiki training....) especially not doing chemo when they sbould is hard to witness.

<comment><USER18> I can't say I know anyone who's indulged reiki, but I've got a lot of flak from my brother telling me that cannabis cures cancer, when I told him that I was doing chemoradiotherapy for my Stage 3 rectal cancer. Today I've finished a cycle of six weeks of treatment, and while I'm extremely tired, the signs are good that it's in remission. If I'm lucky, I'll have a full pathological response, i.e., it's gone.

Despite the number of people who go through cancer, it's rarely brought up in polite conversation. It wasn't until I got it myself that all manner of people came out of the woodwork to talk about how someone they knew had gone through the same thing. Many of them have been using concentrated cannabis oil (which my brother also said I should do). After reading a couple of studies, it does have a positive effect on cancers, but the level depends on the type of cancer. In the case of colorectal cancers, it seems to stop the cancer but not kill it, most likely due to the CB1 receptors in the tumour being hypermethylated (as in, the gene isn't being expressed). The level of evidence isn't that of a systematic review, but it's enough for me to give it a go and certainly enough for further research. Unfortunately, the two sides of the argument seem to think that it either doesn't do anything (there's not enough evidence) or that the medical establishment is just a ruse and that cannabis cures all cancer. I prefer to use my critical thinking skills and get the best of both worlds.

I can understand why people might indulge in quackery - I've got surgeons telling me they need to cut out my rectum and part of my lower intestine, even with a full pathological response. Possible side effects are shitting 3 times a day (not so bad) and erectile dysfunction (worse). This has been the gold standard of care for 15+ years now, and the surgeons don't give a fuck about my quality of life, they just want to cut. There's mounting evidence to show this might be overtreating the problem, and that you can get away with a heavier dose of chemo with the radiotherapy. Frankly, I don't want anyone cutting anything out of me unless it's absolutely necessary, but it's hard finding an advocate who would be willing to tell the surgeons to fuck off.

I'm lucky, in this sense: I understand the research and I have access to upcoming studies (I used to work at an institute that did systematic reviews of evidence). Most people won't have such advantages, so they just sit there and do what the surgeons tell them to do, as if they don't have any options other than no treatment. If that's all the choice I got, I'd be wary of the medical establishment too.

<comment><USER15> I'm not sure about cannabis _curing_ cancer, but there's ample research to support that it can help tremendously with the side effects of chemo. Basically, it can make life more comfortable while you go through treatment.

<comment><USER17> I would advocate, for many reasons, taking regular treatment and cannabis at the same time, but refusing regular treatment because cannabis will do it is a bit over the top. I am a cancer survivor so people tend to talk to me about it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Had to google around to understand wake turbulence. If I read the wiki correctly, it's basically a horizontal tornado that emanates from the wings. That would explain the rolling that the aircraft encountered.

On another note, I fly every week for work, can't imagine rolling five times and engines losing power with a drop of 10k feet. That's absolutely insane. I've had engines lose power before, but it was quickly regained such that the drop was more moderate.

<comment><USER2> It's helpful to think of an aircraft's wake in two parts.

The wing is deflecting air downward to provide lift; this creates a volume of downward-moving air behind the aircraft.

There's higher pressure under the wing and lower pressure on top, so air from below tries to get above the wing at the wingtips. This causes circulatory motion, yielding wingtip vortices (see my top-level comment for some visualizations).

<comment><USER20> Do you happen to know how arial refueling works then ? E.g. in this image [1] the jet is flying where I would expect a lot of deflected air to be moving to ? Or is it just deflected much more steeply ?

[1]: [https://upload.wikimedia.org/wikipedia/commons/d/d6/US_Navy_...](https://upload.wikimedia.org/wikipedia/commons/d/d6/US_Navy_041104-N-3799S-001_An_F-A-18F_Super_Hornet_conducts_in- flight_refueling_from_an_U.S._Air_Force_KC-135_Stratotanker_assigned_to_the_Alaska_Air_National_Guard.jpg)

<comment><USER2> The other two replies covered your questions well, so I'll just add that wakes don't descend particularly fast. According to the FAA's Pilot's Handbook of Aeronautical Knowledge[1] (page 14-28), "Tests have also shown that the vortices sink at a rate of several hundred feet per minute, slowing their descent and diminishing in strength with time and distance behind the generating aircraft."

Considering the Challenger's encounter with the A380's wake, it took 1-2 minutes for the Challenger to hit the wake, so the wake probably had 1-3 minutes to make the 1000-foot descent. That very roughly fits the expected "several hundred feet per minute" descent rate.

Considering the case of refueling, the wake's motion downward is much slower than the aircrafts' horizontal motion, so it wouldn't have descended much by the time it's left behind entirely.

[1] Available for free at [https://www.faa.gov/regulations_policies/handbooks_manuals/a...](https://www.faa.gov/regulations_policies/handbooks_manuals/aviation/phak/)

</comment></comment></comment></comment><comment><USER21> This is quite interesting. I've been living underneath a flight plan for the last few years, and every now and then I've noticed a strange noise that seems to come from the air a few seconds after a plane has passed overhead on approach. The best way I can describe it is as a tearing noise, somewhat like a long stretched version of a tear in paper, or fabric. I've long suspected that it may be due to turbulence, and this article certainly suggests that the turbulence for some aircraft is much more powerful than I'd suspected.

<comment><USER22> That's likely the sound of jetwash striking (nearly) stationary air as it exits the engine.

I'm familiar with the roar of jets taking off. Some years back I happened to be biking past an airport, at the end of the runway, just as a passenger jet was lining up for takeoff, headed away from me. I thought I'd pause to watch.

Only as the engines spooled up did I think, "hrm, this could get loud".

 _It didn 't._

Instead, what I heard was ... the engines spooling up. Loud, yes, but not a roar, just an increasing pitch, until the airplane started accelerating down the runway.

It wasn't until some 15-20 seconds later that I heard the familiar roar, echoing off of hills five or so miles away. That's when I realised that the _whine_ was the sound of the turbines, but the _roar_ was the sound of exhaust gas, streaming out of the engines, hitting stationary air and generating intense turbulence, _and radiating outward in a perpendicular line to that jetwash_. So I didn't hear it directly (it was moving away from me), only the reflection (as that wall of noise, now reflected off the hills, was directed back toward me.

I doubt the vortex would make any particularly loud sound, though you might hear the rushing of air. Speeds are in the tens of miles per hour rather than hundreds as with jetwash.

</comment></comment><comment><USER23> Big problem is the use of autopilot navigation locked to the GPS route.. this pretty much guarantees that you will fly right below the wake of the above plane on the same route! (Before GPS it will be _very_ odd to flight exactly the same path) ..

<comment><USER24> Eh. e.g. the north atlantic tracks have been around since the 1960s. GPS wasn't available to the public until Korean Air Lines Flight 007 in the 1980s.

<comment><USER25> The OP means that satnav ensures that two aircraft on a reciprocal or identical track will now pass over one another, whereas there used to be navigational slop that would give some unintentional but useful lateral displacement.

<comment><USER26> Ironic that you should use the term 'slop', since that's exactly how they avoid flying the same route across the Atlantic tracks for example (Strategic Lateral Offset Procedure).

<comment><USER2> Also worth noting for the transatlantic paths is the direction of traffic. When it's morning in North America, traffic is predominately westbound. When it's night, traffic is predominately eastbound.

Right now, it's the middle of the day (12:50p Central). There's a bit of a mix[1], but it's still predominately westbound.

The consequence of this is that most traffic will be separated by at least 2000 feet. Eastbound traffic will (generally) be at odd Flight Levels (so 29000 feet, 31000 feet, etc.) while Westbound traffic will be at even FLs (30000 feet, etc)[2]. This assumes RVSM airspace.

[1] I'm just looking at the transatlantic traffic on [https://flightaware.com/live/](https://flightaware.com/live/)

[2] [https://www.law.cornell.edu/cfr/text/14/91.179](https://www.law.cornell.edu/cfr/text/14/91.179)

</comment></comment></comment></comment></comment><comment><USER27> The wakes of large aircraft are such that even big passenger planes make sure to keep plenty of separation.

[https://en.wikipedia.org/wiki/American_Airlines_Flight_587](https://en.wikipedia.org/wiki/American_Airlines_Flight_587)

Is another example (though pilot error likely made a bad situation worse in that particular incident).

<comment><USER28> I was looking at FlightRadar24 and listening to ATC while an A380 took off from Dulles near DC. Not only did they warn for wake turbulence when the plane was already well away, they held other aircraft for a runway inspection after the plane took off. I'd imagine that kind of wake could kick up some significant debris on the ground as well.

<comment><USER29> I believe warning of wake turbulence is very common after take off of any large and heavy aircraft.

Wingtip vorticies can sit over a runway (or even drift over to parallel runways) for minutes after a takeoff. They are very dangerous to smaller aircrafts.

The key to avoiding vorticies is to take off at a point earlier than the previous aircraft and to climb at a steeper angle (vorticies travel behind and downwards from the aircraft that made them).

Example: [http://www.boldmethod.com/images/learn-to- fly/aerodynamics/a...](http://www.boldmethod.com/images/learn-to- fly/aerodynamics/avoid-wake-turbulence-during-takeoff-and-landing/takeoff- profile.jpg)

Helicopters can also produce serious turbulence as well!

<comment><USER30> Helicopters. Indeed - there is a state known as "settling with power" [https://en.wikipedia.org/wiki/Vortex_ring_state](https://en.wikipedia.org/wiki/Vortex_ring_state) where a helicopter is sitting inside its own vortex, and is incapable of climbing straight up with full power.

<comment><USER29> Super interesting! Never knew this about helicopters. Thanks.

</comment></comment></comment></comment></comment><comment><USER31> The physics of this are insane. Then again, by my calculation the A380 displaces roughly 11 million cubic feet of air per second at the max landing weight.

<comment><USER32> Why does the landing weight effect the air it displaces?

<comment><USER33> Not displacement (volume), but pressure from velocity: lift. The amount of lift by definition has to equal the weight of the aircraft at 1G.

<comment><USER34> ... and the force of that lift on the plane has an equal and opposite on the air. A Heavier plane disturbs the air more.

</comment></comment></comment></comment><comment><USER35> Good video of the same (similar?) effect on a small plane after taking off after an Antonov-2

[http://www.youtube.com/watch?v=KXlv16ETueU](http://www.youtube.com/watch?v=KXlv16ETueU)

<comment><USER36> I just love An-2 planes. They can take off and land almost everywhere, they're one of the slowest and lowest flying planes that I've ever seen (which I find cool), plus the propeller/engine has a special sound. There's a couple of them stationed just outside my parents' village in Eastern Europe, if you look on the GMaps link that thing close to them it's actually a sheepfold ([https://email@example.com,27.5250523,386m/data=...](https://firstname.lastname@example.com,27.5250523,386m/data=!3m1!1e3?hl=en)).

<comment><USER37> "It's Russian, hah."

</comment></comment></comment><comment><USER38> I've been on a widebody caught in an A380 wake before. Some seriously violent turbulence for a few seconds, and the pilot came on afterwards to tell us what happened.

</comment><comment><USER39> Holy smokes that must have been terrifying. Glad nobody died. I hate flying as it is (not that I'm likely to ever find myself in a private jet anytime soon).

</comment><comment><USER40> Wow. Uncontrolled roll at least 3 times, maybe 5. G-loads severe enough to damage the airframe beyond repair. And this was a 9-passenger bizjet, not a tiny light single.

<comment><USER41> Compared to an A-380 a 9-passengers bizjet _is_ a tiny feather.

</comment></comment><comment><USER42> Pilots should be aware of wake turbulence and wingtip vortices in particular, and should be aware that being at a lower altitude than the generating aircraft is the most dangerous position (the vortex pattern is denser than the surrounding air and therefore descends).

Also, an invisible vortex is no less turbulent for its invisibility.

</comment><comment><USER43> Landing at O'Hare in a smaller bombardier 2x2 (crj 700 I think) jet following a jumbo was an interesting (white knuckle) ride I had in recent memory. The plane turned over lake michigan east of the city and felt like it went completely 90deg to the ground losing a good amount of altitude which I do not believe was the pilots intention. I definitely heard a few gasps, the stewardess curse and my wife grip my hand hard. Followed by 10 minutes of bumps, drops, and wing waggling and a landing that felt like we simply dropped 10 feet on to the tarmac.

Those little jets man... they're fine most of the time but what a spooky experience that was.

</comment><comment><USER44> IMO this has slightly better info: [https://avherald.com/h?article=4a5e80f3&opt=0](https://avherald.com/h?article=4a5e80f3&opt=0)

</comment><comment><USER45> Tangentally related - We deal with this a lot in Wingsuit BASE jumping (well, in wingsuit skydiving as well, but wake vortices and turbulence (aka 'burbles') have killed more than a few extremely talented pilots in the last year).

It's fucking wild how small of a wing can put off a sizable wake. With wingsuits, if you fly behind and slightly above a buddy, you're going to hit his burble and you're going to immediately lose lift and possibly start spinning. There's a clip floating around of a bunch of us on a training jump in race suits and one of the guys hits a burble from the group and just gets dropped a few hundred feet damn near immediately.

EDIT: Found it - [http://giphy.com/gifs/cBP3YE9hf9oVa](http://giphy.com/gifs/cBP3YE9hf9oVa)

Here's a solid article that touches on it w/r/t lift - [http://base- book.com/speed-to-fly](http://base-book.com/speed-to-fly)

...and here's one that's a bit more applied that has to do with how burbles affect canopy deployments - [http://base-book.com/some-thoughts-on-wingsuit- openings](http://base-book.com/some-thoughts-on-wingsuit-openings)

</comment><comment> gingerbread-man Right now, the vertical separation minima for aircraft worldwide are not conditional on size. At altitudes above 28,000ft MSL, the minimum vertical separation is 1000ft, even for superjumbos. It is probably a rare event that two aircraft come so close both vertically _and_ horizontally, but I wonder if there will be a rule change because of this incident nonetheless.

By contrast, the _horizontal_ separation minima vary dramatically based on the size of the leading aircraft.

<comment><USER46> The way the FAA tends to run things is rules are either written in blood or incident reports.

</comment></comment><comment><USER47> I don't know much about aviation, but 1000ft seems kinda close to pass another aircraft. How normal is that distance?

<comment><USER48> By law, 5 (nautical) miles horizontal separation or 1000 feet vertical separation is required. When aircraft were smaller, that was probably more than sufficient. The A380 is another beast entirely, though.

<comment><USER49> The question is then - are there any systems that can ensure that two airraft aren't passing eachother at just 1000 feet if one of them is a behemoth? Will the corridors magically widen when an A380 enters it?

Will nearby aircraft be warned when crossing right under an A380 that they are basically on a collision course, while had it been a small aircraft it wouldn't be a problem?

<comment><USER50> I never understood why corridors at opposing directions aren't by default offseted both in altitude and lateral separation - there have been quite many collision already because navigation aid reduced the positional error within a corridor to few meters

</comment></comment></comment></comment><comment><USER51> > one thousand feet above

Are the imperial units of measurement an aviation thing, or an American thing, or a bit of both?

<comment><USER52> Mostly an aviation thing but descended from the fact that many early airplanes were American/British. IIRC only China, Russia and the DPRK use metric units.

EDIT: ahahaha <3 HN commenters

<comment><USER53> Containers are also sadly measured in TEU (twenty foot equivalent units) stemming from their American design.

Global, impossible to upgrade standards that mean we are stuck with imperial units for a hundred years yet or more.

</comment></comment></comment><comment><USER54> "until the crew was able to recover the aircraft exercising raw muscle force"

Any more info on that??

<comment><USER55> Under normal flight conditions, the aircraft's engine supplies hydraulic power to the flight controls (flaps, ailerons, elevator), like power steering in your car. Very necessary for big/fast aircraft, as the plane is heavy and the force of the air resisting the movement of those control surfaces is very high.

If the engines fail, you still need to be able to control the plane, so there is something called a ram air turbine[1] which can be deployed out of the side of the aircraft. It is basically just a little propeller which spins in the breeze, which powers a pump, which supplies the hydraulic pressure to control the plane. So if the power goes out, you can still deploy that thing and have "power" assistance in controlling the plane.

The article says the ram air turbine did not deploy, possibly because the g-forces were holding it in, or perhaps because the g-forces or aerodynamic stresses were flexing the body of the plane so much that the turbine was held in place by the bending. So the pilots did not have "power steering" on the plane, and had to pull on the controls with "raw muscle force".

There is probably some mechanical advantage, probably both from the leverage afforded by the mechanics of actuation, and from the aerodynamics of the wing, that allow a single human to move the whole plane around. But it would still be very, very hard to control the plane without power assist, especially under such extreme conditions.

(Any pilots/aerospace engineers feel free to chime in/correct mistakes here).

[1] [https://en.wikipedia.org/wiki/Ram_air_turbine](https://en.wikipedia.org/wiki/Ram_air_turbine)

<comment> gingerbread-man Cessna pilot here-- I've never flown an aircraft with hydraulic controls. (Small planes use pushrods or cables to actuate the controls. It's all muscle power for us.)

The physics of flight produce a very useful convenience: the amount of force needed to effect a particular degree of attitude change (e.g. a 10 degree bank) remains the same, regardless of speed. Planes up to the size of small jets (the Cessna Mustang, for instance) use fully manual controls with no power assistance. The Challenger is a bit bigger, but even after the remaining pressure in the hydraulic system completely dissipated, I doubt more than 30lbs of pressure would have been required to actuate the controls. And the rotational inertia of the turbines should have provided at least some assistance on top of that. (I have no idea what would have happened if an airliner lost both engines simultaneously in a stall.)

</comment></comment></comment><comment><USER56> I thought controllers space aircraft based on their takeoff weight for this reason. Is this true?

A380s are HUGE, so this isn't surprising. wake turbulence is a killer

<comment><USER57> The (current) top thread in the comments section references the reduced vertical separation minima (RVSM): [https://en.wikipedia.org/wiki/Reduced_vertical_separation_mi...](https://en.wikipedia.org/wiki/Reduced_vertical_separation_minima)

It appears that there is a section of air between 29,000ft and 41,000ft, where flights are allowed to be closer than is normally allowed. Instead of 2,000ft apart, they are allowed to fly 1,000ft apart. In order to operate continually in this airspace, a plane must be "RVSM approved". Otherwise they have to either request special permission or make a continuous climb through said airspace while complying with their usual 2,000ft requirements.

The article mentions that the A380 and Challenger 604 were 1,000ft apart. So, I would assume they were both RVSM approved. This event could call the RVSM into question.

</comment></comment><comment><USER58> That was some flying by the Challenger pilots (to my layman's eyes at least). I'm glad I wasn't on that flight.

</comment><comment><USER59> I wonder the private plane had to be written off...was the damage that bad? It's like the plane broke apart ..maybe the probems were mostly internal

<comment><USER60> When an airframe is stressed beyond its design limits it can't be put back into service. It's conceivable that it could be put through a "C-check" type process of disassembly and inspection, but given the age and residual value of the plane that might not have been cost effective.

</comment></comment><comment><USER61> this is horrifying. does anyone have a sketch of how many flips the jet underwent before regaining control?</comment>


One – Read Hacker News, Designer News, Product Hunt, Reddit, Slashdot in One App - <AUTHOR> https://play.google.com/store/apps/details?id=com.hackplan.one <comment><USER2> Awesome! I also just discovered I can install apps on my Android phone via Chrome. I'm sure everyone knows this but I'm new to Android and just tickled. I don't miss iOS a bit.

</comment><comment><USER3> Great find, installing it now.</comment>


Neuralink product demo webcast (3pm PST) - <AUTHOR> https://twitter.com/elonmusk/status/1299422822205452288 <comment><AUTHOR> Might be good to update the link to [https://neuralink.com/](https://neuralink.com/) when the time comes</comment>


Ruby One-Liners - <AUTHOR> https://benoithamelin.tumblr.com/ruby1line/ <comment><USER2> I knew Ruby copied a lot from Perl, but I wasn't prepared for just how much these are exactly how you would do the same thing in perl, just with the the order of passing lists reversed.

The command line switches are the same, the BEGIN/END block stuff is the same, the $F auto-splitting is the same.

Good on Ruby, that's the stuff that makes Perl one-liners actually worth coming back to again and again.

<comment><USER3> What is that BEGIN{...} and END{...} syntax? I've seen a good amount of Ruby, but haven't encountered that yet.

<comment><USER4> It's basically there to make Ruby an equivalent to AWK. It only makes sense if you are looping over the lines with -n. The BEGIN block runs at the start of the run, and the END block at the end. They are useful for things like initializing a sum variable to zero at the start and printing it out at the end.

</comment></comment></comment><comment><USER5> What about getting some Obfuscated Ruby one-liners, like the well known Perl Obfuscation Contests? [https://www.foo.be/docs/tpj/issues/vol4_3/tpj0403-0017.html](https://www.foo.be/docs/tpj/issues/vol4_3/tpj0403-0017.html) :)

<comment><USER6> I think the natural successor to IOCCC and the Obfuscated Perl Contest is the Code Golf^1 community on stack exchange

^1: [https://codegolf.stackexchange.com/questions?tab=Votes](https://codegolf.stackexchange.com/questions?tab=Votes)

</comment></comment><comment><USER7> If you're going to write unreadable code why not use Perl? It's much faster than Ruby. Or Awk, even though it's one of the worst programming languages ever created?

<comment><USER8> Why is awk one of the "worst programming languages ever created"?

</comment></comment><comment><USER9> I made a compilation of Ruby one-liners [1] as well last year.

There's plenty of stuff that is similar to Perl, which in turn had borrowed from awk, sed and other tools. The biggest difference I'd pick is Perl's context based operation.

        # Ruby requires explicit conversion with to_i
        ruby -ane 'print if $F[1].to_i > 35'
        perl -ane 'print if $F[1] > 35'

Performance is slower compared to Perl, but to those who already know Ruby, this would suit better than learning the nuances of another language.

[1] [https://github.com/learnbyexample/Command-line-text- processi...](https://github.com/learnbyexample/Command-line-text- processing/blob/master/ruby_one_liners.md)

<comment><USER10> There are other significant other functionalities that I find very handy in oneliners, notably:

\- automatic associative array instantiation

\- the return value of regular expressions with a capture group is the value matched by it (in Ruby, the closest to this is `[/regex/, <group_i>]`)

</comment></comment><comment><USER11> I always liked this one I wrote ages ago, to generate strong (at the time) passwords:

[code lang="ruby"]

((33..126).map { |i| i.chr }).to_a.shuffle[0..14].join

[/code]

<comment><USER12> A bit more efficient:

14.times.map { rand(33..126).chr }.shuffle.join

<comment><USER13> Why shuffle? Does it do something rand doesn't already do?

At any rate, would probably want to use [https://ruby- doc.org/stdlib-2.5.1/libdoc/securerandom/rdoc/S...](https://ruby- doc.org/stdlib-2.5.1/libdoc/securerandom/rdoc/Securerandom.html) for password generation.

Also, I think you might just want an alphabet and use sample: [https://ruby- doc.org/core-2.5.1/Array.html#method-i-sample](https://ruby- doc.org/core-2.5.1/Array.html#method-i-sample)

# unsure if you need a:

require 'securerandom'

(33..126).sample(14, random: SecureRandom).map(&:chr).join

<comment><USER12> You're right, probably doesn't need shuffle :)

</comment></comment></comment></comment><comment><USER14> OT: on mobile the authors bio fills up the entire screen. The headline is beneath the fold.

</comment><comment><USER15>
      1.upto(100){|n|puts'FizzBuzz'[i=n**4%-15,i+13]||n}

</comment><comment><USER16> Maybe I'm being pedantic, but half of these use ";" to separate statements so I wouldn't really call them one liners.

<comment><USER2> A one liner does not mean "one line of source code in a file", it means "a single shell statement". That's why the Ruby command is prefixing them all. I routinely write 10-20 statement Perl one-liners at work for one off things.

For example, just yesterday it was to parse a log, grep for specific lines, pull out a time and a number per line, display name, number, and some number of characters afterwards as a quick abnd dirty graph of the magnitude to make it obvious if there were major outliers and to try to see trends over time. Still a one-liner.

<comment><USER14> In theory, couldn't you then compile a Rails app into a one-liner? (Seems the max line length varies, but is at least hundreds of thousands of characters in most OSes)

<comment><USER2> You could, but it would be stupid to do so if it wasn't a trivial app, since nobody wants to support something like that, even if it's lifetime is measured in minutes or hours. It's a one-liner, just a pointless one.

That said, if rails has a super simple default startup that could serve a file, then it might be useful to start that as a one liner in select circumstances.

<comment><USER17> Rails has generators for that. Invaluable for greenfielding projects in an iterative manner. Blow everything away and recreate with a single command.

[https://guides.rubyonrails.org/generators.html](https://guides.rubyonrails.org/generators.html)

</comment></comment></comment></comment></comment><comment><USER18> This is what I love Ruby for: one-liners! :) Thanks for the summary, truly helpful.

</comment><comment><USER19> I would never be able keep straight the escaping for these incantations. Writing code at the shell is not fun.

<comment><USER20> Not really an issue unless the one liner itself has single quotes in it, or perhaps you're using Windows?

</comment></comment><comment><USER21> I like to build lots of cool command-line one-liners in Python with the Mario tool.

[https://github.com/python-mario/mario](https://github.com/python-mario/mario)</comment>


Apple Should Buy Tesla – And Make Elon Musk CEO - <AUTHOR> http://www.marketwatch.com/story/apple-should-buy-tesla-and-make-elon-musk-ceo-2016-05-02 <comment><USER2> Elon Musk is a visionary. Steve Jobs was a salesman. Musk's talent would be wasted at Apple, he's not a toy maker.

<comment><USER3> Well said. Jobs was in it for his self. Musk is in it for the species. The difference is one or more orders of magnitude.

"I saw my life as an arc and that it would end, and compared to that nothing mattered"

Steve Jobs

<comment><USER4> What a shamefully misleading presentation of that quote. Jobs said that to show how thoughts of death gave him the courage to follow his heart. "Nothing else mattered" because we have nothing to lose. Might as well follow your heart. Isn't that exactly what Musk is doing?

"Apple just makes toys" is so wrong. Every computer is a Mac, every smartphone is an iPhone. Apple's "toys" define industries - that is what Apple achieves at its best. Imagine if every car were a Tesla. Then you'd really have something!

<comment><USER3> What's misleading? It's exactly my point. you're dying, and nothing else matters... except the iPad? To Musk I think a lot would still matter.

Remember, this is one of the _very fee_ billionaires who never donated to a single charity, as far as we know. Totally his right, and I'm not judging. But Musk he is not.

</comment></comment></comment></comment><comment><USER5> I think this could work. It seems highly unlikely to me, but Apple needs someone like Musk. Steve Jobs, while often called a poser by his detractors, was very good at coordinating teams to accomplish his vision. Elon Musk strikes me the same way.

</comment><comment><USER6> While I don't know Elon Musk personally, everything I've read in the media says that he's completely focused on humanity's long term survival.

Thats climate change and becoming multi-planetary. Not gadgets.

</comment><comment><USER7> That's exactly what we need. More and more big firms collecting other firms to build conglomerates...

</comment><comment><USER8> Bahahahaha yea no. These journalists are funny.</comment>


What Good Shall I Do This Day? - <AUTHOR> http://dustyreagan.com/what-good-shall-i-do-this-day/#

<comment><USER2> Ugh.

I wish people would not post blog entries about things they are going to do. Life is full of empty promises. .

It would be much more interesting if one just kept quiet (I know, it's hard for anyone who has the kind of personally that necessitates a blog) until they've gathered experience and _then_ report something (or nothing if they fail to follow thru).

<comment><USER3> Sorry to dissapoint. :p I'll report back in a few years.

</comment></comment><comment><USER4> Also, telling people what your going to do causes a decrease in the internal motivation to do what you said you were going to do.

<http://sivers.org/zipit></comment>


Early Impacts of Certificate Transparency - <AUTHOR> https://www.facebook.com/notes/protect-the-graph/early-impacts-of-certificate-transparency/1709731569266987/ <comment><USER3> From [1]:

> In one case, a prominent Dutch CA (DigiNotar) was compromised and the > hackers were able to use the CA's system to issue fake SSL certificates. The > certificates were used to impersonate numerous sites in Iran, such as Gmail > and Facebook, which enabled the operators of the fake sites to spy on > unsuspecting site users.

When this happens as the result of malicious actions (unlike the case FB shows here), what actions can the legitimate site operator do to protect their users from this eavesdropping? Presumably you could contact the CA and get the revocation. But even if the CRL's updated, what is the latency to get the browser's trust store sync'd up? And can't state actors just block CRL updates? Do browsers warn users when the CRL can't be updated (after so many attempts or so much time)?

[1] [http://www.certificate-transparency.org/what-is- ct](http://www.certificate-transparency.org/what-is-ct)

<comment><USER4> The general consensus is that certificate revocation is essentially broken right now. CRL updates can be blocked (some browsers don't even check) and OCSP defaults to soft-fail in most scenarios, so that's not going to do much against a state actor. IIRC some browsers push their own blacklists for high- profile compromises, but I'm not sure how reliable that is - it could probably be blocked as well.

There's a number of mitigations you can put in place right now. Many of them are not widely supported yet, but will eventually prevent most of the damage an attack could cause. Not all of them apply directly to misissuance, but could be relevant in case of a key compromise or something similar:

\- Use HPKP. This allows you to pin your domains to a list of public keys. Most deployments pin to the public key of their CA, as well as a backup CA in case the primary is compromised. It's also possible to pin to your site's public key (along with at least one backup key), although that can go seriously wrong if your key is compromised or lost. HPKP is a trust-on-first- use mechanism, so it will only help protect returning visitors.

\- Use a CAA DNS record to forbid any CA other than the ones you're using from issuing certificates for your sites. Some CAs have started supporting CAA, but it's not mandatory yet - hopefully, that'll change! This won't protect you in all scenarios, but depending on how the CA is compromised, a CAA record might be a roadblock. (It would have been in Facebook's case!)

\- Use the Must-Staple TLS extension in your certificate. Browsers with Must- Staple support (just Firefox for now) won't accept HTTPS connections unless the web server sends a valid OCSP response as well. This won't help with misissued certificates, but is a good mitigation in case your private key is compromised, essentially fixing the revocation system.

\- Future versions of Chrome will support the "Expect-CT" header, which will send a report to an URI if a site fails to deliver CT information. This will ensure that an attack is, at the very least, detectable, even if it doesn't help prevent it.

</comment></comment><comment><USER5> Is there an API for certificate transparency logs? I'd love to have a monitoring system that checks if unauthorized certificates are detected for my domains.

<comment><USER4> The API is essentially a paginated list of certificates. There's no "search by domain" or anything like that. Monitors are expected to continuously get the latest entries and check them according to their rules.

COMODO has a site[1] which allows you to search through a dump of various CT log servers by domain (and various other X.509 fields). It's a great tool, but it doesn't provide the guarantees you get when you scan CT logs directly - <USER2> can't be sure the information hasn't been tampered with.

I'm currently working on a side-project where I'm essentially pushing CT log data to a pubic dataset on Google BigQuery, allowing researchers and CT monitors to easily query any CT data. As with COMODO's tool, however, you lose out on the cryptographic assurances a real CT log server provides.

[1]: [https://crt.sh/](https://crt.sh/)

</comment></comment><comment> jake-low > [A thank you to Let's Encrypt] Let's Encrypt's issuance in this event was > technically correct, and thanks to their commitment to best practices like > CT, we were able to discover our internal policy violation and take action > to prevent these types of issues in the future. The security team at Let's > Encrypt responded quickly and helpfully to our inquiries. Facebook continues > to support the Let's Encrypt project and we appreciate their assistance with > this investigation.

I continue to be impressed with the Let's Encrypt team's professionalism in their interactions with everyone in the security community. It makes me happy to see post-mortems like this one where everything went as it should have and the issue was resolved without any breech in security. Really reflects well on Let's Encrypt and Facebook's product security team.</comment>


New incubator for designer-developer teams launches - <AUTHOR> http://venturebeat.com/2012/03/27/brooklyn-beta-summer-camp-incubator-designers-developers/ <comment><USER2> "The process of building software is getting cheaper and cheaper," said Borthwick."The production buzzwords of our era — 'betas,' 'agile development,' and 'pivots' — are all an outgrowth of micro-development, which makes it less expensive to build more. As the cost of building and operating software-based businesses decreases, increasing value will accrue to design."

That's a scary thought, but I don't think developers are going to be commoditized anymore than designers. Web templates are just as plentiful as API</comment>


The Truth about the Lone Startup Founder - <AUTHOR> http://www.scrapages.com/scraps/show/172 <comment><USER2> Here are a few resources for spiffing up your "artist" and "seller" hats:

=== The Artist ===

. _The Non-Designer's Design Book_ , by Robin Williams. This short, easy read details four essential design principles that will help you consciously communicate better visually. It's also available on O'Reilly's safari service.

. _Universal Principles of Design: 100 Ways to Enhance Usability, Influence Perception, Increase Appeal, Make Better Design Decisions, and Teach Through Design_. This book will help you build your design vocabulary and better understand concepts in design that you likely haven't thought of. It will help you describe the ways in which this page - <http://www.sandstromdesign.com/nav.html> \- sucks (it lacks external consistency and it contains interference effects, to begin with). The book has a great format, describing a topic on one page with visual examples on the following page. The descriptions are short of enough that you can read them in about 4 minutes.

. <http://www.hallwaytesting.com> \- this is actually my own site. You can post your site for usability feedback and give usability feedback. Live usability tests allow you to get more details, but the users on my site also give valuable feedback, and it doesn't cost you any money or nearly as much time. I try to give feedback for as many sites as possible and am usually pretty thorough about it. Users have told me that the site has helped them a lot.

=== The Seller ===

. <http://www.marketingexperiments.com> . This site is absolutely the best web development resource I've found, ever. It contains articles on developing a unique value proposition, doing competitive analysis on the Internet, and of course actually marketing your site using PPC, SEO, and other online marketing techniques. Perhaps the most valuable thing I learned from this site is that online marketing _is_ online testing.

. _How to Win Friends and Influence People_ , by Dale Carnegie. For a long time I didn't want to read this book because I thought doing so would make me a sleaze ball. Instead it's made me a more effective communicator. When you think about it, honing our skills in most areas involves learning how to communicate with other humans better. As The Tech Wizard it's essential that you communicate the purpose of your code. As The Artist it's essential you communicate the purpose of a site and each of its elements. As The Seller you must know how to communicate value. Dale Carnegie's book will show you how to effectively communicate value.

</comment><comment><USER3> Even if you are the perfect seller, artist, and coder, you will still only have one opinion on everything. You need someone to be right when you are wrong, and wrong when you are right.

<comment><USER4> Yes, and at the end of the day a decision has to be made.

This is where companies get in trouble- the founders have different opinions. I've seen two companies struggle because founders differed... and I've known one company where the founder knew what was going on and was clearly in charge (which there were some founding employees, there was no question of who made the decisions)... that company succeeded until the VC forced a new CEO who couldn't make a decision to save his life on us....

More people to spread out the early work is good. Multiple founders can be ok.

But one needs to be in charge.

</comment></comment><comment><USER5> I want to applaud you for emphasizing the "seller" hat. Marketing and sales are REALLY tricky for technical people, who seem to believe that the market is somehow fair...that having a "better" product will naturally result in the customers abandoning the competition and running to your product. Only in the idealist's world are buying decisions made based on features and benefits. In many markets the users of a product or service ARE NOT the same people who make the decision whether to buy the product the product or service. The users and the purchasers may have completely different interests. I learned this the VERY HARD WAY starting a business...sometime better and faster doesn't matter when your competition has a prestigeous brand or the purchasing decision maker only cares about price (since the users are a different group...the purchasers don't really care about making the user's life better).

I would actually separate the "marketing" hat from the "sales" hat. Sales guys want a list of leads to call or visit. They seldom have ideas about how to generate leads. Sales guys can get the door slammed in their face or the phone hung up on them multiple times in a day without needing antidepressants. Marketing people need to go to the therapist when someone hangs up on them but they can figure out how to get a list of the right people for your sales guy to call and they can figure out what word to spend your google adsense budget on.

</comment><comment><USER6> I don't think anyone is arguing that lone founder startups can NEVER succeed; the argument is lone founder startups have a lesser success rate, probably.

And in a game of numbers, it easy to see why YC would want to focus on multi- partner startups over single when there is no shortage of them.

-Zaid

<comment><AUTHOR> I'm not trying to downplay the importance of co-founders so much as try to show people what they need to be looking for in cofounders as well as what they need themselves. YC has every right to want multiple founders, but for someone who doesn't get in, or doesn't apply, this information could help them know where to focus their time.

</comment></comment><comment><USER7> I don't think a lone founder needs to be an artist at all. I am planning to hire someone to make my site shine once I have the functionality where I want it to be. That probably also applies for selling. If you have a good idea, and enough drive, why not just hire people instead of giving away equity?

<comment><USER8> What do you mean by functionality? If you think the shiny surface of your product can be that much of an after-thought (i.e. not considered alongside the functionality you choose to code), you either have wonderfully abstracted code (or lots of useless code) (in which case you're delaying it because you can), or you have a different definition of Artist than I do (in which case you're delaying it because you've confused design with gloss).

<comment><AUTHOR> I agree with that. Artist doesn't mean someone to make the logos, it means some one to design your site and make it pleasing to the users. I've found that the sooner that happens in the process the better. In fact I'm starting to lean toward the 37Signals method of making the layout work before it's even attached to the code. Thinking about how things happen from the user's pov can really help your final product.

<comment><USER2> I've come to realize that how things happen from the user's pov / what the user sees IS your product. That's what the user's paying for. The user cares as much about _what_ your app purports to do as _how_ your app does it. The _how_ determines whether the user will save more time/money/resources with your app than without it.

That said, I do agree with original commentor that it's possible to get all the functionality working (the interface, the AJAX, the domain model) and then have someone take your visually uninspired HTML+CSS and turn it into something beautiful. Sometimes that's all a hacker will need, and sometimes a hacker will need much more.

</comment></comment></comment></comment><comment><USER9> More than the need for different skills. I think as a single founder you have to be willing to wear all of these hats.

The big assumption that everyone makes with multiple founders is that everyone contributes and that the founders really know each other. Remember that your performance is averaged with others, so if the other founders aren't contributing, you still have the burden of reaching decisions with multiple people.

I find that with one founder its easier to divide work.

</comment><comment><USER10> I've been reading the "E-Myth," which also describes three roles of the founder: Technician, Manager, and Entrepreneur. (These roughly corresond to the roles you outline). The first part of this book is an excellent analysis of why many startup companies fail. The rest of the book's advice gets worse, and by the end it is a naked advertisement for the author's seminars and consulting services.

Get it from the library.

</comment><comment><USER11> You links at the bottom of the page like FAQ etc is not working. I wonder if its because you are a lone founder... Jokes, I am a lone founder too.

<comment><AUTHOR> Hahah, exactly! I just decided to start using my own product even though it's not completely finished. :)

</comment></comment><comment><USER12> Interesting post!

Obviously, a person can theoretically have all of the skills to pull off a startup alone (though I can count the number of people I know who are good coders AND good UI designers on one hand).

The big plus of a co-founder (IMHO) or two is motivation and energy.

Oh, and intelligence. Two good brains are generally more than twice as smart as one. :-)

</comment><comment><USER13> The author has been bang on target. Its quite possible to be one man army and still pull off with a great company but it would take time and this lone guy must work 3 to 5 people's work. Second thing is, having more people who match the same level of thinking helps hammering out loop holes and building better products.</comment>


Obscure Bash Options You Might Want to Know About - <AUTHOR> https://zwischenzugs.com/2019/04/03/eight-obscure-bash-options-you-might-want-to-know-about/ <comment><USER2> I'm a heavy shell user, both interactively and in scripting. I'm a big believer in it and it can take you a long way, if you use it properly and realise its limitations. I haven't seen a few of these and they do look pretty useful, but only interactively. For scripts I swear by POSIX shell, of course that won't save you if you are using GNU-isms on BSD or macOS. What really annoys me is seeing a .sh file with a #!/bin/sh shebang and it still uses bash. Please don't.

<comment> matt-attack Is there a better suffix to indicate bash?

<comment><USER2> .bash, but it's less about the suffix and more about the shebang. On some systems sh is linked to bash or perhaps the `sh` executable includes bashisms. The .sh can be argued is signifying Bourne shell compatible/descended shells which would cover both.. but still.</comment></comment></comment>


The Cookie Monster ( A Privacy Hole ) - <AUTHOR> http://jdavid.net/?p=119

<comment><AUTHOR> disabling referring sites to login providers might be another solution.</comment>


"It's not a bug, it's a feature" – The problem with SemVer - <AUTHOR> https://medium.com/@jonathangrosdubois/its-not-a-bug-it-s-a-feature-the-problem-with-semver-cb067de7843c <comment><USER2> > Sometimes you need to use your understanding of the project and the > ecosystem to make informed probabilistic decisions when it comes to > versioning.

ie. your knowledge of the API's semantics. Hence, semantic versioning. Mystery solved?

<comment><USER3> I personally don't think so. As the author mentions, it's possible (rightly or not) for developers to use some upstream behavior that ends up being classified as a bug. Then what appears as a bugfix actually causes a breakage, which (I believe) is what Semantic Versioning is supposed to help prevent.

I think that's one of the reasons why Packager Versioning can be useful: The packager picks an upstream release, forming the base of the package version (for example, "12.2.2"), and appends an indicator that this is the first release of the package (so now we have "12.2.2-1"). Increasing that last number means updating the packager's changelog with an explanation of which fixes were cherry picked, and what other changes are done.

There's also capability for derivative packagers to add their own information, and for testing/backports packages that are lower-priority than the more "official" ones.

So, although Semantic Versioning is fine, I still like having packager version numbers!</comment></comment>


What You Really Believe In - <AUTHOR> http://programminggeek.com/essays/what-you-really-believe-in.html

<comment><USER2> I find it puzzling that the author always has to work with "arbitrary deadlines". Deadlines are established according to business needs and resource availability. They shouldn't be arbitrary. If they seem arbitrary to the team, maybe this is not the right team for the project.</comment>


Show HN: Who Died Here? - <AUTHOR> http://whodiedhere.com/

<comment><USER2> Interesting concept. Where did you source the data from? Are they from public records or Wikipedia?

<comment><USER3> I think some of them are definitely from Wikipedia, if you search for "Brisbane" you'll get a couple of job-descriptions, as well:

Arthur Morgan (Queensland politician) ---- Paddington, Queensland, Brisbane, Queensland, Australia

And that one's definitely from Wikipedia: [http://en.wikipedia.org/wiki/Arthur_Morgan_%28Queensland_pol...](http://en.wikipedia.org/wiki/Arthur_Morgan_%28Queensland_politician%29)

</comment></comment><comment><USER4> Fun.

Only two deaths at motels? Good start. Also, searching for "John" provides fast results on a single page. OK, but searching for "e" is not as quick.

There is a usual degree of data inconsistency, for example for "Titanic".

</comment><comment><USER5> How is the data ordered?</comment>


Show HN: A browser extension to remind you who people are in articles you read - <AUTHOR> https://danstillman.com/firstmention/ <comment><AUTHOR> Hi folks. This is something I found myself wanting all the time while reading longer news stories, so I finally turned it into an extension.

I made versions for Chrome, Firefox, and Safari, as well as a bookmarklet that works anywhere. (You have to activate the bookmarklet on each page, so it's much more annoying to use, but so is searching the page for a name on an iPhone. The Firefox version is a UI-less WebExtension, so (I'm told) it actually works automatically on every page in Firefox for Android, which is pretty neat. I'd love it if Apple added support for running extensions automatically on iOS, but that seems pretty unlikely due to battery life concerns.)

The code is open source and up on GitHub.</comment>


Screen – a CSS for desktops, tablets, & phones - <AUTHOR> https://screencss.com/ <comment><AUTHOR> As part of a design refresh of my personal website, I released version 0.2.0 of Screen. I would love to get some feedback and, hopefully, more people using it. It is open source under a MIT License.

<comment><USER2> Looks pretty bare bones (not a bad thing but is there any focus on a single thing here?).

I think it's just me but I find the difference between h1 and others too stark which could be a good thing for some use cases but without knowing what those are or what the focus is, that limits its usage.

Value proposition of your project might improve by focusing on problems others aren't. Not everything needs to be generalized (this area is too competitive). :D

Nice work!

<comment><AUTHOR> Good point. Thanks for your feedback. I will try to focus the next version on a more specific use case.</comment></comment></comment>


TLS 1.2 Session Tickets - <AUTHOR> https://blog.filippo.io/we-need-to-talk-about-session-tickets/ <comment><USER4> The article and the comments here lack a bit of context. At the time where tickets were starting to be deployed (around 2011), ECDH ciphers were not in use and PFS was therefore quite expensive (and therefore, almost never used). Around the same time, the move from 1024-bit certificates to 2048-bit certificates were making TLS difficult to deploy at scale for everyone except Google.

Session tickets were primarily a mechanism to help to reduce to load of TLS connections. The reduced latency is a happy side-effect. At the time, it was already well-known that this would negatively impact PFS (something I already mention in my own blog article about session tickets in 2011).

Moreover, many seem to build a scenario where session tickets are recovered by an attacker but not the private keys. Usually, session tickets are in memory only and private keys are persisted. This makes those tickets more unlikely to be recovered by anyone unless you get access to a running web server. In this case, you have far more serious trouble than those tickets (even if the attacker still cannot decode past recorded data).

Even today, TLS handshakes are quite expensive, both for the server and the clients. Using session tickets (with rotated keys) still outweigh the downsides of not using them. That's why every major site are using them.

</comment><comment><USER5> So if like me you want to know how to disable session tickets in Apache httpd, you need to be running at least httpd 2.4.8 with OpenSSL 1.0.2. Then you can set:

      SSLOpenSSLConfCmd Options -SessionTicket

Alternatively, if you're running at least httpd 2.4.11 with OpenSSL 0.9.8f, you can set this instead:

      SSLSessionTickets off

See also:

[https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslopenss...](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslopensslconfcmd)

[https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslsessio...](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslsessiontickets)

<comment><USER5> Also, if you're running RHEL/CentOS 7, you'll want to switch to the SCL version of Apache httpd (2.4.25) as the version in the base repositories (2.4.6) is too old to support either setting:

[https://www.softwarecollections.org/en/scls/rhscl/httpd24/](https://www.softwarecollections.org/en/scls/rhscl/httpd24/)

<comment><USER6> Well, technically RHEL7 runs httpd-2.4.6-67, which is RedHat's 67th patched version of 2.4.6.

They backport a lot of stuff from later versions, don't see why they could not have done this (they haven't, I checked).

</comment></comment></comment><comment><USER7> > An attacker with the STEK doesn't need to wait until session resumption is > attempted. Session Tickets containing the current session keys are sent at > the beginning of every connection that merely supports Session Tickets. In > plaintext on the wire, ready to be decrypted with the STEK, fully bypassing > Diffie-Hellman.

I found this flaw to be the scariest, by far. It means that a connection with "forward secrecy" gives up this property as soon as it begins.

<comment><USER8> Gives up the property _before_ it begins even. But I completely agree with you. I would go as far to say a connection does not have PFS if you are sending the DH session key encrypted only by a [geographically replicated] static key before the session starts. You are literally destroying the entire purpose of the DH handshake in doing so.

I always assumed the STEK-encrypted session key was sent inside the established TLS PFS stream. To send it outside the stream is mind-numbingly insane!

Browsers should not report connections as having PFS if tickets are enabled in TLS 1.2. This is like NSA slide "PFS added and removed here :-)"

<comment><USER9> You're clearly not destroying _the entire purpose_ of the DH handshake, because the STEK is rotated and so the time window of compromise is limited to by the rotation interval. Even with poorly rotated ticket keys, you're still better off with a PFS suite than without it --- without the DH, every client has an unlimited window of exposure if the server's private key is compromised.

<comment><USER8> True, it does not destroy the entire purpose _if and when_ the STEK is securely and properly rotated. But to call this PFS stretches the truth in ways that boring crypto never does.

The number of real-world cases where PFS is reduced exactly to the non-PFS state by the existence of session tickets with fixed STEKs is not only non- zero, but rather I would venture a guess it is staggeringly large.

E.g. Configuring Session Tickets [1]

 _While Apache offers the SSLSessionTicketKeyFile directive to specify a key file that should contain 48 random bytes, it is recommended to not specify one at all. Apache will simply generate a random key on startup and use that to encrypt session tickets for as long as it is running.

The good thing about this is that the session ticket key will not touch persistent storage, the bad thing is that it will never be rotated. Generated once on startup it is only discarded when Apache restarts. For most of the servers out there that means they use the same key for months, if not years.

To provide forward secrecy we need to rotate the session ticket key about daily and current Apache versions provide no way of doing that. The only way to achieve that might be use a cron job to gracefully restart Apache daily to ensure a new key is generated. That does not sound like a real solution though and nothing ensures the old key is properly overridden._

...

 _Nginx, too, provides no way to automatically rotate keys. Reloading its configuration daily using a cron job might work but does not come close to a real solution either._

...

 _HAproxy does not allow configuring session ticket parameters. It implicitly supports this feature because OpenSSL enables it by default. HAproxy will thus always generate a session ticket key on startup and use it to encrypt tickets for the whole lifetime of the process._

[1] - [https://timtaubert.de/blog/2014/11/the-sad-state-of- server-s...](https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side- tls-session-resumption-implementations/)

Note that's from 2014 -- has it changed since then?

<comment><USER9> The 'P' in 'PFS' has always stretched the truth, which is why a lot of practitioners elide it.

Even if you never rotate STEKs and never reset systems to get a new STEK accidentally, the DH handshake is still providing forward secrecy value for clients who don't do session tickets.

<comment><USER8> Do such clients actually exist in mainstream usage? The one crypto bug which you are actually _protected_ from by using IE on Win7!

<comment><USER9> I don't know, but the cost that session tickets are saving are almost entirely an externality to clients, and the privacy benefit of not honoring tickets isn't, so there would seem to be some value to a Chrome extension that busted that cache.

<comment><USER8> Yeah but it's not the client sending the resumption ticket but sending the capability in the ClientHello which exposes the session key under a possibly fixed key. So you can't fix this by busting the client cache I think. You need the capability flag off.

Even so could an active adversary turn on the capability in the ClientHello and still get a chance to see the STEK encrypted session key even against legacy (or intentionally ticket-disabled) clients? This I don't know - would a client just drop the ticket message and proceed or would it abort? But at least it would have to be an active attacker.

<comment><USER9> Yep, this got pointed out to me several times on Slack. Session tickets suck.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> If you're using OpenSSL, you can disable RFC 5077 Session Tickets via SSL_OP_NO_TICKET:

[https://wiki.openssl.org/index.php/SSL/TLS_Client#Session_Ti...](https://wiki.openssl.org/index.php/SSL/TLS_Client#Session_Tickets)

Figuring out how to access that option from your library/language is an exercise for the reader.

Looking into this for Python. Python 3 supports sessions and the tickets may be disabled:

[https://docs.python.org/3/library/ssl.html#ssl.SSLSession](https://docs.python.org/3/library/ssl.html#ssl.SSLSession)

[https://docs.python.org/3/library/ssl.html#ssl.OP_NO_TICKET](https://docs.python.org/3/library/ssl.html#ssl.OP_NO_TICKET)

For Python 2, I see no way to get at the session object (at least on the client side), much less disable session tickets:

[https://docs.python.org/2/library/ssl.html](https://docs.python.org/2/library/ssl.html)

Under Python 2, pyOpenSSL has better support. You can make use of it on Python2 (and 3) via requests by installing `requests[security]` instead of just `requests`. Using `[security]` causes requests to pull in pyOpenSSL, cryptography and idna packages.

Under the covers, requests is using urllib3 and it ends up makes this call if pyOpenSSL is installed:

        urllib3.contrib.pyopenssl.inject_into_urllib3()

[http://urllib3.readthedocs.io/en/latest/reference/urllib3.co...](http://urllib3.readthedocs.io/en/latest/reference/urllib3.contrib.html#module- urllib3.contrib.pyopenssl)

That's as far as I've gotten. There's no documentation so it's going to require reading the urllib3 source to figure out what's going on under the hood.

Edit: nope, urllib3 doesn't support SSL session re-use. There's an open PR:

[https://github.com/shazow/urllib3/issues/590](https://github.com/shazow/urllib3/issues/590)

</comment><comment><USER11> Related: [https://crypto.dance/projects/6239406](https://crypto.dance/projects/6239406)

<comment><USER12> What is Cloud Flare's policy for managing STEKs? Are they distinct per geographic region as the article recommends?

<comment><USER13> TL/DR: we rotate them every hour, but need to keep history of previous STEKs for 18 hours to support the maximum session lifetime:

$ openssl s_client -connect cloudflare.com:443 2>/dev/null | grep "lifetime hint" TLS session ticket lifetime hint: 64800 (seconds)

\--

We've written about how we manage TLS session tickets here: [https://blog.cloudflare.com/tls-session-resumption-full- spee...](https://blog.cloudflare.com/tls-session-resumption-full-speed-and- secure/).

Additionally, I wrote here about a bug that we encountered with Microsoft's implementation of TLS session resumption: [https://blog.cloudflare.com/microsoft-tls-downgrade- schannel...](https://blog.cloudflare.com/microsoft-tls-downgrade-schannel- bug/).

Here's a snippet from my blog post:

Session Tickets at CloudFlare CloudFlare's solution to this problem, documented in previous blog posts, is to frequently regenerate and synchronize these session ticket keys across our entire global network. We currently do this once per hour. This means we need a mechanism for turning over session ticket keys. For instance, if a client instantiates an HTTPS session at 12:00pm and continues using that ticket past 1:00pm, our edge network will re- encrypt the ticket with a brand new session ticket key.

To accomplish this, our web servers must have both the full history of all previous keys that could have encrypted the ticket (i.e., one per hour dating back to the maximum session lifetime of 64,800 seconds) as well as immediate access to each newly generated key. The previous keys are used exclusively to decrypt tickets presented by the client, while the new keys are used to "refresh" the encryption on existing tickets and encrypt tickets for entirely new sessions.

<comment><USER12> These are great details, but they don't really answer my question.

</comment></comment></comment></comment><comment><USER14> One of the original goals of Google's QUIC[0] protocol was to achieve 0-RTT handshake. I wonder how TLS 1.{2,3} Session Tickets will affect the future of that protocol. Has it achieved it's purpose (applying the right pressure to the TLS working group)? Will it be phased out now?

[0] [https://blog.chromium.org/2013/06/experimenting-with- quic.ht...](https://blog.chromium.org/2013/06/experimenting-with-quic.html)

<comment><USER15> I felt like Google was not going to move to TLS 1.3 if they had not included 0-RTT. Now that TLS 1.3 has agreed to include it, it seems logical to terminate QUIC crypto.

</comment></comment><comment><USER16> Hm, looks like maybe a ticket should be filed against:

[https://github.com/ssllabs/research/wiki/SSL-and-TLS- Deploym...](https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment- Best-Practices)

As it stands, the point on resumption reads a little on the positive side?:

> 3.2 Use Session Resumption

> Session resumption is a performance-optimization technique that makes it > possible to save the results of costly cryptographic operations and to reuse > them for a period of time. A disabled or nonfunctional session resumption > mechanism may introduce a significant performance penalty.

Does http2 have similar issues with session resumption (especially: compromised pfs)?

I came across this, which documents how cloudscape does this securely - <USER3> least they rotate - but looks like read access to memcache+compromise of a single web server is enough to compromise the past hour or two of ssl traffic that goes through cloudflare?

[https://blog.cloudflare.com/tls-session-resumption-full- spee...](https://blog.cloudflare.com/tls-session-resumption-full-speed-and- secure/)

[ed: also came over this:

[https://github.com/mozilla/cipherscan](https://github.com/mozilla/cipherscan)

Which looks very handy for sanity-checking servers.]

<comment><USER17> > I came across this, which documents how cloudscape does this securely - <USER3> > least they rotate - but looks like read access to memcache+compromise of a > single web server is enough to compromise the past hour or two of ssl > traffic that goes through cloudflare?

but (depending on how you get in) you can probably also compromise the _next_ few hours, so one extra hour doesn't seem like a huge difference, given that the scenario is somewhat unlikely in the first place.

<comment><USER16> It's relevant in terms of pfs. Say, you happen to have ciphertext of all traffic to a domain for the past three years (whitepower.forum.example.ru), and you get an urgent need to read that ciphertext. Now, if you could get physical access to any one cloudflare server, and perhaps dump the ram, or do a cold boot attack - that might have been enough to read all that data. Assume for the sake of argument, that the servers hosting the site is (physically) out of reach.

<comment><USER17> aiui getting the current keys won't magically let you decrypt those three years of traffic. that's the whole point of rotation.

<comment><USER16> Yes, I wasn't trying to say rotation is useless - just highlight that n servers still lead to n avenues of getting at traffic for all n servers, and that cloudflare did something to deal with the pfs issue. It's worse than n servers without session resumption, but better than it could be.

[ed: per [https://news.ycombinator.com/item?id=15360922](https://news.ycombinator.com/item?id=15360922) the window is 18 hours]

</comment></comment></comment></comment></comment><comment><USER18> If I understand the article correctly, are all of the issues listed addressed by TLS 1.3?

<comment><USER19> TLS 1.3 still has problems with STEKs. If you use STEKs with 0-RTT mode, then you lose forward secrecy and that's where the most sensitive data is likely to be: your request, password, credit card number, etc ...

0-RTT doesn't have to use STEKs, there's a better way to do it, but TLS1.3 won't enforce or require it (though it could), so it'll be up to the marketplace of ideas and security standards to sort it out.

<comment><USER20> 0-RTT is an awful idea anyway; the equivalent of spray-and-pray. Some folks under HTTPbis are working on an Internet Draft on Early Data's (~0-RTT's) ramifications [1] in HTTP.

0-RTT trades performance at the expense of security properties inside the same tunable protocol, which is the sort of wishy-washy stuff I (and others) were hopeful we'd get away from, the same way PFS ciphersuites went from obscure to preferred overnight, the same way cleartext HTTP has been marginalized, the same way broken ciphersuites were aggressively blacklisted and underused ciphersuites were pruned.

[1] [https://tools.ietf.org/html/draft-ietf-httpbis- replay-00](https://tools.ietf.org/html/draft-ietf-httpbis-replay-00)

</comment></comment></comment><comment><USER21> I understand that TLS 1.3 is in draft stage currently. Is there an expected date of when TLS1.3 is supposed to be available in common libs and browsers ?

Also at current rate it sounds like it's going to take years to phase out TLS 1.1. Would mordern browsers take a stand and refuse to initiate connections for older versions of TLS and its not just browsers right, there are other odd ball clients and enterprises using IE7 or something super old. I liked the way Apple had taken a stand with App Transport Security initially but even they backed down and pushed the deadline indefinitely.

<comment><USER22> > Also at current rate it sounds like it's going to take years to phase out > TLS 1.1.

It's already more or less phased out. On my webservers, TLS 1.1 accounts for 0.1% of traffic, and about half of that is junk requests like exploit attempts.

Check out SSL Pulse, specifically the Protocol Support graph:

[https://www.ssllabs.com/ssl-pulse/](https://www.ssllabs.com/ssl-pulse/)

This used to show 100% support for TLS 1.0, which is now at 92.6% as some sites are now going 1.2-only. That's just webserver _support_ , not _usage_. Huge real-world difference. Like my car supports not wearing a seal-belt but I always use it. The vast majority of usage is 1.2, and a large percentage of 1.0/1.1 traffic is unwanted garbage traffic. Hence why some people are disabling 1.0/1.1 in their webservers. It also exposes more code for questionable benefit.

BTW I'd love to know what sites support TLS 1.0 but not 1.2. What's the breakdown of the Alexa Top 1000 or so? I suspect it's mostly banks and unknown sites.

<comment><USER23> > It's already more or less phased out.

Was TLS 1.1 ever "phased in"? It was the "most recent" TLS version for only a couple of years, so the early adopters went quickly to TLS 1.2, while the late adopters stayed at TLS 1.0 (or even "TLS 1.0 but disabled by default, therefore actually SSL 3.0"). Once the later adopters catch up, there's no reason for them to not jump directly to TLS 1.2.

</comment></comment></comment><comment><USER24> We are doing all these session tickets gymnastic to reduce the round trip. Mostly considering web applications. In case of native mobile application, we could just add a splash-screen/quick 2 sec animation hiding the worst case 3x200ms round trip latency overhead. So at the start of the app we simply create a fresh perfectly secured TLS connection.

It appears a better choice from security standpoint, UI can always be cleverly tricked into being smooth.

<comment><USER25> In case of 2.5G connections (I still get 2.5G on a regular basis, e.g. in some specific train stations on my way to work in the morning) it can easily be 800ms per RTT - so 2.4 seconds before you have a chance to request any content.

And no, you cannot really ignore this if you are interested in fostering TLS' adoption in the real world. Every tenth of a second causes a measurable loss in user interest, and in many organizations this metric will drive the decision. We cannot legislate from our ivory tower and expect the world to follow against their (perceived) best interest.

</comment></comment><comment><USER26> For HAProxy 1.7 (may be present in older versions, didn't check), there's the 'no-ssl-reuse'[0] directive for the server.

[0]:[https://cbonte.github.io/haproxy- dconv/1.7/configuration.htm...](https://cbonte.github.io/haproxy- dconv/1.7/configuration.html#5.2-no-ssl-reuse)

</comment><comment><USER27> Well, on the bright side h2 and keepalive are other ways of reducing the overall number of tls handhakes required if you're doing http.

Too bad session resumption has issues.

</comment><comment><USER28> NewSessionTicket is sent before ChangeCipherSpec means the message is not encrypted using the master secret exchanged with the handshake and is not necessary means that the session ticket is in plaintext. Quite contrary, it has been encrypted using the server secret key. In the page 3 of RFC5077, it states "a ticket that is encrypted and integrity-protected by a key known only to the server." and in the page 11, "Tickets must be authenticated and encrypted to prevent modification or eavesdropping by an attacker."</comment>


The Cost of Kidding Yourself - <AUTHOR> http://acrossthestreetnet.wordpress.com/2012/11/28/the-cost-of-kidding-yourself/ <comment><AUTHOR> Well this sounds kinda scary:

 _Total U.S. GDP growth in the 20th century was $9.93 Trillion, while the government accumulated $5.5 Trillion in debt. In the 21st century, the US has borrowed $10.7T and has a grand total of $5.30T in GDP growth._

<comment><USER2> It sounds scary, but it's misleading. Comparing a century with 12 years is meaningless.

</comment></comment><comment><USER3> _The US has been in recession 9 of the last 10 years._

This is not true as recession is defined by the NBER. If the author means to imply that we should change our definition of recession: I don't believe he produces a convincing argument that (US GDP) / (World GDP) is more indicative of a protracted economic slump than our current definition. When this ratio is declining for a particular nation, it simply means that the worlds economy is becoming relatively larger.

<comment><USER2> (US GDP) / (World GDP) is only interesting if the world economy is a zero sum game, which it isn't.

I for one am happy that people in developing nations are doing better.

</comment></comment><comment><USER4> First chart's huge dropoff is an artifact of choosing a yrange of 21-41 instead of 0-100. It's a common deficit of charts created under motivated cognition.

<comment><USER5> This comment misses the mark. The chart shows 9/10 down periods in a row. Its the time-series consistency that is the point. viz, the only bold in the inro para:

 _The US has been in recession 9 of the last 10 years._

The consistent decline is the story (at least as the author is telling it). The slope is not up and to the right, just the opposite. The concern you raise about the labeling of the Y axis is noted, but hardly a concern for anyone paying attention.</comment></comment>


Economists are prone to fads, and the latest is machine learning - <AUTHOR> http://www.economist.com/news/finance-and-economics/21710800-big-data-have-led-latest-craze-economic-research-economists-are-prone <comment><USER2> Not sure if there's a theoretical basis behind this, but I've noticed that the true game changing technologies tend to sprout up along the fringes of popular fads. The social network hype didn't bring us more social networks, but may have ushered in the hybrids like snapchat and Instagram.

I can say the next big thing probably won't be an AI breakthrough, I'm guessing it will be a new way of using existing machine learning structures like CNN's. Maybe a new use for the incredibly powerful gpu's being pumped out for machine learning applications?

<comment><USER3> Went to an AI event recently - it seems small devices with AI chips with NNs on them is going to be the big new thing?

<comment><USER2> A wild guess, but a lot of the advances in neural networks can be directly applied to control problems normally be handled by PID controllers. It will be interesting to see where this leads

<comment><USER3> Can a pid controller do facial recognition? That is one of the applications.

<comment><USER2> Not just the typical image recognition stuff, but things like process control.

A lot of big industrial processes have a ton of different control loops that try to optimize parameters. The systems are usually complicated enough that the ideal state for these parameters is unknown, so controllers try to approximate.

An easy example is the engine controller in cars. It tries to optimize for power, efficiency, emissions, engine longevity, etc...

Machine learning could crunch tons of historical data from these systems to build a CNN that performs better than the usual controller.

In some systems, like stoplight timings or freight packing.... An AI driven controller could possibly be revolutionary, performing orders of magnitude better than current algorithms.

</comment></comment></comment></comment></comment><comment><USER4> I suspect there are fundamental limits to what one can predict using a rear view mirror. Still there are good reasons economists are fad prone and they are purely economic:

\- first mover advantage. You establish a new way of doing things. Others pile in. Your investment goes up.

\- marketing. Your chances to stand out and as employee attract management attention or if you are a fund attract more money to manage is a powerful incentive.</comment>


Ask HN: For a note taking app, would you prefer standalone desktop or a web app? - <AUTHOR> I am in the planning phase of a note taking app project, which I will be writing in Python (backend - Flask probably).
For the frontend I am deciding between making it for desktop and solving the cross-platfom issues later (if I decide to make it cross-platform).. and making it in ReactNative.
My issue is.. I've never liked note taking apps in the browser. They feel impersonal and "un-safe". For example, I am able to write long documents in LibreOffice or Evernote, but I would never write a journal entry in a web interface, I am too paranoid for that.
So, for my question: For a note taking app, would you prefer standalone desktop or a web app? <comment><USER2> To answer your question, standalone desktop that can spit out a Library-of- congress-approved archive format like xml, sqlite, rtf etc.

You could also take the NoteWiki idea which is a simple text control which auto-creates hyperlinks on camelCase words and saves each page as a separate file. Then you could have whatever existing sync solution the user uses (or syncthing) handle backups etc. Having a rich text editor where one can paste images and is saved as a per file format would be ideal for me personally but truthfully I'd like to hear more about what your desired use case is.

<comment><AUTHOR> Journaling sw with emphasis on text analysis and good encryption.

</comment></comment><comment><USER3> I'd prefer an API that plugs into Sublime Text, personally.

I've been using QuickSimpleNote to sync sublime text to simple note to my phone for the last year or so and been more or less very happy.

</comment><comment><USER4> Choose some good structure storage / format.

I have been looking into org mode but without Emacs, thinking of making a backed, to which I would connect via web app and also ttk based app. Syncing with syncthing, on mobile orgzly works pretty well.

Good luck !

</comment><comment><USER5> Why write a backend? Sync user data with whatever the platform offers (iCloud, Google Drive (I think), "Roaming app data" on Windows (again, I think that's what it is called)

Also, does the world need another "a note taking app"? What new feature do you bring to the table?

</comment><comment><USER6> For note taking, I just send emails to myself.

</comment><comment><USER7> A native desktop app</comment>


Radare2: a portable reversing framework - <AUTHOR> http://www.radare.org/r/cmp.html <comment><USER2> Easily one of the best pieces of software ever written.</comment>


No, the Government Shouldn't Break Up Facebook – Reason.com - <AUTHOR> https://reason.com/2019/05/09/no-the-government-shouldnt-break-up-facebook/ <comment><AUTHOR> The reasons for the use of force by the government are very poor.</comment>


Building a Simple CRM Integration to Xero - <AUTHOR> https://devblog.xero.com/building-a-simple-crm-integration-to-xero-part-1-e44b5cb4f9ef <comment><USER2> lol. this isn't spam. sure...</comment>


Logic Production Systems runtime implemented in JavaScript - <AUTHOR> https://github.com/mauris/lps.js <comment><USER2> rules system in JS I guess?

<comment><USER3> looks like it</comment></comment>


Australia passes new law to thwart strong encryption - <AUTHOR> https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/ <comment><USER2> Governments need to stop giving their hacking tools to all the bad guys in the world so none of us need super encryption.</comment>


Simon Hackett (MD of Internode) talks about Australia's NBN Costs - <AUTHOR> http://simonhackett.com/2013/07/17/nbn-fibre-on-a-copper-budget/

<comment><AUTHOR> Text comment: Internode is a popular ISP here in Australia, who are well known in the tech/enthusiast industry. Simon, who is the managing director and founder of Internode, was asked to do a ~20 minute presentation on how to reduce the costs of Australia's National Broadband Network (NBN), which is a government-funded national FTTH network. He discusses many of the current issues around their cost and explores ways he'd go about making it a lot cheaper, if he had a blank slate.</comment>