Unbreakable crypto: Store a 30-character password in your subconscious memory - <AUTHOR> http://www.extremetech.com/extreme/133067-unbreakable-crypto-store-a-30-character-password-in-your-brains-subconscious-memory <comment><USER2> > _It also gives you deniability: If a judge or policeman orders you to hand > over your password, you can plausibly say that you don't actually know it_

The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data.

Failing to make the data intelligible (whether that's failing to provide the passphrase or whatever) carries a 2 year prison sentence for some people, with possibilities for a 5 year sentence for others.

tl:dr - this does not prevent law enforcement from getting the password.

Also, using this to guard against rubber hosing is stupid. People prepared to use torture will do so, whether there are laws preventing it or if it's going to provide any useful evidence or not.

\---- EDIT: META:

Extremetech articles are really lousy. The self-posting by the author of a poorly written article is a problem; the heavy ad load is another problem, but I find it hard to believe that there isn't a vote ring up-voting these lousy articles.

A quick glance shows that about 90% of Mrs Ebastian's subs are to articles that they've written, for their employer.

<comment><USER3> To add to that, the article doesn't make it clear why torture wouldn't work...

One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

<comment><USER4> The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to.

You can't _produce_ the password. You can only _subconsciously recognize_ it.

From the original paper:

       Further complicating the attacker's life is the fact
       that subjecting a person to many random SISL games may
       obliterate the learned sequence or cause the person to
       learn an incorrect sequence thereby making extraction
       impossible.

They can, at best, try to log in as you, record the sequence the terminal gives, have you (under duress!) play against that sequence in a remote location, determine the code, and train themselves. But that requires a login failure; this particular system is supposed to panic after even one login failure.

<comment><USER5> I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?

<comment><USER4> Sorry for the late reply. This system isn't designed to be used on a terminal over the net. From the original paper:

        The proposed system is designed to be
        used as a local password mechanism requiring physical
        presence. That is, we consider authentication at the
        entrance to a secure location where a guard can ensure
        that a real person is taking the test without the aid of
        any electronics.

And . . .

        We note that physical presence is necessary in
        authentication systems designed to resist coercion
        attacks. If the system supported remote authentication
        then an attacker could coerce a trained user to
        authenticate to a remote server and then hijack the
        session.

If you're allowed remote attempts and multiple failures, the system is insecure in several ways. It's designed to work in a scenario where you get ONE attempt, and there's an armed guard who doesn't take kindly to it if you fail.

<comment><USER6> If the attacker has long-term control (e.g. hostage, blackmail, etc.) this is useless.

If the attacker does not, you'll simply ask for help as soon as you're there.

If the attacker wants to impersonate you, a photo check will work as well and is much faster

The authors and the news coverage claim this offers some sort of rubber-hose defense but the only scenarios described are either contrived or duplicate more proven techniques (e.g. duress codes, biometrics)

</comment></comment></comment></comment></comment></comment><comment><USER7> Some clarification/speculation: This is a method of authentication, not encryption. The trained sequence is not used to unlock/decrypt your data. In the multi-factor authentication scheme, this is probably best thought of as "something you are", and might be used along with something you have (RSA token, physical key, RFID badge) and something you know (encryption password, secret handshake). The threat model in the paper talks about protecting physical access and ensuring the person is watched by a guard.

 _"Threat model. The proposed system is designed to be used as a local password mechanism requiring physical presence. That is, we consider authentication at the entrance to a secure location where a guard can ensure that a real person is taking the test without the aid of any electronics"_

Many of the comments I see here tend to assume that this is directly applicable to protecting a remote system such as logging in to a website. Perhaps with adaption this could be a useful technique for authenticating into a website, but as far as I know no authentication scheme can protect against an intruder with a gun to your head forcing you to log in. Instead, the use case here is to prevent someone who has stolen your ID badge and forced you to give up your PIN from being able to get access to the top-secret bunker.

</comment><comment><USER8> Quite the login method:

1) Tell me who you are, so I can load up your secret 30 character "password" from some database (the fact that this needs to be stored in a retrievable way makes this entire system insecure)

2) Here's one random sequence of 30 characters. Look at it for a little bit, ok now try to reproduce it from memory.

3) Repeat several times (not stated how many).

4) One of those attempts was your specific password, let me check to see if you did significantly better at it than the other (random) ones.

</comment><comment></comment><comment></comment><comment></comment><comment>==

EDIT: Upon re-read, it sounds like 2-4 are a bit different:

2) Play a long sequence of characters "Guitar-Hero" style. The computer will "slip-in" the true password and watch to see if you do better on that section.

Still storing the password in the clear and still susceptible to being watched several times and finding the "common" sequence.

<comment><USER9> I'm not sure you've got 3-4 right, but it doesn't matter. Step 1 sinks the whole thing.

<comment><USER8> There's also the fact that your password will ALWAYS be shown as one of the sequences. Would-be hacker just tries 5 times and notes that THIS sequence keeps showing up, that must be the right one.

Maybe there's a more obtuse use-case but this seems like more of a cool experiment on human memory than a practical cryptography tool.

<comment><USER10> The paper is cheap and assumes they have a human attacker." Threat model: The proposed system is designed to be used as a local password mechanism requiring physical presence. That is, we consider authentication at the entrance to a secure location where a guard can ensure that a real person is taking the test without the aid of any electronics."

</comment></comment></comment></comment><comment><USER11> This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano.

Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

<comment><USER12> I don't even need to be drinking, but sometimes I'll fat finger it a few times and get frustrated. The only way I can get logged in is to type really really fast.

<comment><USER11> Yeah, I find speed is important too. The quicker you can type it, the easier it is to recall. Another thing, if I slow down I notice i'm sort of humming parts of the pattern in my head, as if each character held a sort of audible weight that indicates where my fingers should go next... again, kind of like playing an instrument. Yet I can't play anything. Weird.

<comment><USER13> Sounds like that could be a sort of synaesthesia:

<http://en.wikipedia.org/wiki/Synaesthesia>

<comment><USER14> I've been wondering for a while where the boundary for being diagnosed with synaesthesia is - nearly everyone I know has _some_ sort of synaesthesia, even if it's only associating numbers with colors. Yet, it's no where near the viewing-numbers-as-landscapes of Daniel Tammet's Born on a Blue Day or Nabokov's gift with words.

<comment><USER13> I suspect almost everyone has a little synaesthesia, just like almost everyone has a little depression, a little anxiety, a little Borderline Personality, a little schizophrenia...

I guess it's only worth giving your mental quirks a name if, say, they're 2σ above norm. I dunno, ask your doctor (or statistician :P).

</comment></comment></comment></comment></comment></comment><comment><USER15> > _If a judge or policeman orders you to hand over your password, you can > plausibly say that you don't actually know it_

Surely for this system to help in allowing you to plausibly say that, you'd have to reference this system (or equivalent) and demonstrate that it is indeed used for the authentication the police want access to. And in that case, surely the police could just say "in that case, please authenticate for us"?

<comment><USER16> Hopefully stress means that you won't be able to do it properly anyway, which means coercion is useless.

The real problem is the device stores the password, so the real defence is the tamperproof-ness of the device, not whether you can be tricked or coerced into outputting the sequence.

<comment><AUTHOR> Yeah, the research paper notes that they need to implement 'coercion detection'. From page 12:

"Since our aim is to prevent users from effectively transmitting the ability to authenticate to others, there remains an attack where an adversary coerces a user to authenticate while they are under ad- versary control. It is possible to reduce the effective- ness of this technique if the system could detect if the user is under duress. Some behaviors such as timed re- sponses to stimuli may detectably change when the user is under duress."

<comment><USER17> That's more of a bug than a feature when you're the one under duress.

</comment></comment></comment></comment><comment><USER18> So all the clever people have concluded that this system is useless, because you can pull a gun on someone and force them to play the game. Not to mention: it's not even that much entropy! So let's all just forget about it move on with our lives, right?

No. Of course not. What this system provides is a unique -extra- method of authentication. I really doubt this is meant for putting this on your laptop in place of a password scheme. But you might use something like it as part of multi-factor authentication, e.g. into a secure facility. Remember all those movies where somebody's eyeballs are removed/replaced/copied in order to fool a retina scanner? I can't comment on how plausible that is, but I can certainly tell that if it were this system, they could not have broken it, period. I think that's pretty useful don't you?

<comment><USER6> The authors are claiming that it helps against duress but the system as described only does so in the most limited theoretical scenario where the attacker and defender both have significant, contrived restrictions. There's a reason why you remember those retina scanner tricks from movies: in the real world, security is about protocols and those tricks would fail in any realistic scenario short of, say, aliens with body-sculpting nanobots.

As a trivial example: this system assumes a single attempt in a guarded facility. What benefit does this offer over a duress password which our poor hostage provides knowing that it will trigger a full security response and locking out of their access? For that matter, why not have the same guard who looks for tricks check your face against the employee database?

</comment></comment><comment><USER19> Some critics are getting hung up on the hard-to-understand details, or zeroing in on a few stretch claims about potential usefulness in certain situations. There is still novelty and innovation here. It is a different way to train, prompt, and evaluate authentication attempts.

Even if not perfectly resistant to all kinds of coercion, or ideally strong in an information-theoretic sense, its weaknesses in various dimensions are different than more traditional systems. It is thus suggestive of other potential directions in the design space, leveraging other aspects of human memory/behavior.

It bears some similarity to systems which add the timing of a person's typing as an added authenticating factor.

<comment><USER6> People are reacting to the authors overselling their work, as amplified by extremetech: they're claiming this as hardening against rubber-hose cryptoanalysis, which is simply untrue. Their paper actually describes a system which actually has nothing to with cryptography - it's authentication - and has failure modes which are identical to password authentication, except where it imposes significant new barriers to practical application.

If they'd published it as a minor curiosity suggesting an area for future research there'd be far less backlash.

</comment></comment><comment><USER20> Beside the title being misleading (it's a 30-symbol password, not 30-character, as "character" implies printable ASCII to most people), the math doesn't quite make sense:

 _Before running, the game creates a random sequence of 30 letters chosen from S, D, F, J, K, and L, with no repeating characters. This equates to around 38 bits of entropy_

So that's 6 choices for the first character, and 5 choices for each of the next 29 gives us log2(6*5^29) =~ 70 bits of entropy. Does anyone know where this 38 bit figure came from?

<comment><AUTHOR> Yep, from the research paper, page 4: <http://bojinov.org/professional/usenixsec2012-rubberhose.pdf>

<comment><USER20> Ahh, wow. Thanks. This was totally glossed over in the article copy:

 _We only use 30-character sequences that correspond to an Euler cycle in the graph shown in Figure 2 (i.e. a cycle where every edge appears exactly once). These sequences have the property that every non- repeating bigram over S (such as 'sd', 'dj', 'fk') appears exactly once. In order to anticipate the next item (e.g., to show a performance advantage), it is necessary to learn associations among groups of three or more items. This eliminates learning of letter frequencies or common pairs of letters, which reduces conscious recognition of the embedded repeating sequence [5]._

</comment></comment></comment><comment><USER21> This is interesting in regards of the brain, but not so much when it comes to waterboarding cryptoanalysis... I mean, instead of asking for the password, they'd ask you to play the game: same difference, right? Or am I missing something?

<comment><USER22> It analyzes the performance of _your sequence_ compared to the benchmark random sequences. It's no longer a black-and-white comparison in cryptography.

<comment><USER21> So? That doesn't have anything to do with what I just said/asked.

</comment></comment></comment><comment><USER10> This proves Authentication, not key storage that enables encryption/decryption. Per the paper, for authentication "a participant is presented with multiple SISL tasks where one of the tasks contains elements from the trained sequence." Hence the system must already know the secret password. If that system is your laptop, then the feds already have the key when they seize it and don't need to resort to rubber hose or its russian variant thermal-rectal cryptography.

Also, the paper assumes physical presence of a live human at some terminal for authentication. At the point that you can make assumptions about who is operating your authentication system, biometrics seem to be a far faster and more reliable authentication system. Both those limitations,however, could change with further research.

</comment><comment><USER23> >The most important aspect of this work is that it (seemingly) establishes a new cryptographic primitive that completely removes the danger of rubber-hose cryptanalysis — i.e. obtaining passkeys via torture or coercion.

Does not compute. If there is a mechanism by which you can authenticate, you can be coerced into authenticating through that method.

The paper covers this of course:

>Coercion detection. Since our aim is to prevent users from effectively transmitting the ability to authenticate to others, there remains an attack where an adversary coerces a user to authenticate while they are under adversary control. It is possible to reduce the effectiveness of this technique if the system could detect if the user is under duress.

I take issue with the the article suggesting it's completely resistant to coercion. A system that detects duress... interesting I guess but seems like a stretch.

>This equates to around 38 bits of entropy, which is thousands/millions of times more secure than your average, memorable password.

Really? Playing around with KeePass briefly, it seems this is comparable to a 6 character password that includes upper, lower, numeric, and special characters. I wouldn't consider that very strong. Besides the fact that it appears you're not entering the password exactly, but only (if I'm understanding correctly) "good enough".

</comment><comment><USER24> This is pretty awesome, but the following is noteworthy:

> creates a random sequence of 30 letters chosen from S, D, F, J, K, and L, > with no repeating characters. This equates to around 38 bits of entropy

Which is not so bad for certain applications, but certainly isn't the 180+ bits you'd have in a true random 30 character password.

I wonder what applications they have in mind where this password system could be used.

</comment><comment><USER25> Obligatory xkcd: <http://xkcd.com/538/>

Only this time you'll have to log-in/decrypt on the spot rather than cough up your password.

<comment><USER26> This

It may be an interesting research, but it certainly won't help with that issue (with noting passwords down maybe)

And one thing may happen, you can have no clue of what your password is, or write it down, but you may need to look at the sequence to remember it! (Piano players may identify there)

</comment></comment><comment><USER27> While this does sound interesting from a psychological/neurological perspective, I feel bad for anyone who actually tries to implement a password system based on this. 38 bits of entropy is nothing, a standard password with 38 bits of entropy would take about 5 minutes to crack (assuming a GPU that can compute 1 billion hases/second). Nevermind that by the NIST specification for human-generated passwords, a 30 character string of alphas would be 45 bits of entropy. Also, as some others have pointed out, storing people's unique strings in the clear invalidates any strength this scheme could hope to achieve.

Source: [http://en.wikipedia.org/wiki/Password_strength#Human- generat...](http://en.wikipedia.org/wiki/Password_strength#Human- generated_passwords)

Conclusion: Interesting psychological experiment, not actually backed by any appreciable crypto knowledge.

Edit: disregard my NIST comment, someone linked the paper used to get the 38 bit figure, <http://bojinov.org/professional/usenixsec2012-rubberhose.pdf>.

<comment><USER28> 38 bits of entropy for authentication may be plentiful if other security controls are put in place. Bank card security would not be noticeably increased by having 6 or 8 digit PINs instead of 4 digit PINs. The risk is mitigated by account lockout (swallowing cards), surveillance, damage limitation (daily withdrawal limits) and similar measures. The system proposed in this paper could be a valid mitigation against authentication risks in very specific circumstances.

A better argument against this system would be one that addresses human usability and unnecessary cost/complexity.

<comment><USER27> Fair enough. My numbers are of course based on an unsalted hash which has been stolen from a db or otherwise obtained by an attacker.

Further arguments include high overhead for learning (not to mention changing passwords) a given password, storage of passwords, and the idea that your password isn't summonable on demand.

</comment></comment></comment><comment><USER4> They had me until this part . . .

        Authentication requires that you play a round of the game —
        but this time, your 30-letter sequence is interspersed with
        other random 30-letter sequences.

Which makes it sound to me like your password could be deduced from a single (failed) login attempt, and then reproduced after a session in the trainer.

<comment><USER4> Their discussion of that attack, from the paper itself:

        If the attacker is allowed multiple authentication
        attempts — iterating the extraction and test phases,
        alternating between the two — then the protocol may
        become insecure.  The reason is that during an
        authentication attempt the attacker sees the three
        sequences k0; k1; k2 and could memorize one of them (30
        symbols). He would then train offline on that sequence so
        that at the next authentication attempt he would have a
        1/3 chance in succeeding. If the attacker could memorize
        all three sequences (90 symbols), he could offline
        subject a trained user to all three sequences and
        reliably determine which is the correct one and then
        train himself on that sequence. He is then guaranteed
        success at the next authentication trial.

        We note that this attack is non-trivial to pull off
        since it can be difficult for a human attacker to
        memorize an entire sequence at the speed the game is
        played.

. . . which isn't all that reassuring, given that if I were trying to break in using this technique, I wouldn't be _memorizing_ , I'd be _recording_.

But it sounds like the system is designed to only give an attacker one trial (notionally opening a trap door under his feet if he fails even once), and it does seem much more secure in that context.

</comment></comment><comment><USER29> On the topic of courts: There is a US court case in the 11th circuit where a federal judge, in fact, ruled that people are not required to give up their encryption passwords under the 5th amendment. It isn't a supreme court case however.

[http://www.techrepublic.com/blog/tech-manager/personal- data-...](http://www.techrepublic.com/blog/tech-manager/personal-data- encryption-it-and-the-fifth-amendment/7467?tag=nl.e019) "Last week in San Francisco, a federal court for the first time ruled that the Fifth Amendment of the U.S. Constitution — the right to not self-incriminate — protects against "forced decryption." The judge, from the 11th Circuit in San Francisco, ruled that a Florida court violated a defendant's rights when its Grand Jury gave him the choice to either reveal his TrueCrypt password or go to jail."

</comment><comment><USER30> Nitpick: This is not unbreakable crypto. This is more of a more secure key storage mechanism. Perhaps also a good defense against phishing attacks.

And it's not unbreakable. For starters, this system absolutely requires that the passwords be stored in the clear.

<comment><USER31> What about encrypting your 'secret' password with normal password? So you get assigned this 30 characters password, which you learn. Then you use normal password (like 'password123' :) ) to encrypt that string. Then when you need to log on, you first type in you normal password to decrypt your 'secret' password, which is then used to authenticate you further. I know, sounds ridiculous, just thinking out loud.

edit: yes, i know, encrypting the key with another string makes it just that tiny little bit secure, technically it's still plain text...

<comment><USER32> It sounds ridiculous for a reason. The weakest link in that chain is still the low-entropy password.

</comment></comment></comment><comment><USER33> It may not be even close to unbreakable or torture-free as the author implies, but this encryption system (or similar approaches) could work to tighten some classic security flaws with passwords.

For instance, this could prevent employees of a large corporations from writing down or sharing a password with a coworker, or even spelling out their password over the phone to a bogus "support engineer" -- although probably fingerprint/eye/face recognition systems are more practical and easy to implement than a "guitar hero" learning session. But then the OP method has an advantage over those: you can change your implicit-learned password easier than your face or fingerprint...

</comment><comment><USER34> I don't see what's new here. I already use muscle memory to remember my passwords. I am awful at rote memorization, but when I train my fingers to perform a 12 character password dance, everything is fine and I can remember the password for a long time.

The good thing about memorizing passwords this way is that it doesn't matter how random the password is - totally random letters, numbers and symbols or a sentence are the same when it's a keyboard dance.

As long as you have a keyboard anyway...

I have to find a keyboard to figure out half of my passwords when setting up my phone.

</comment><comment><USER35> Isn't there a slight problem whereby someone denies knowing the password, you just put them in front of the keyboard and just ask them to type something? Due to it being a subconcious memory, it 'just happens'.

<comment><USER36> It wouldn't necessarily 'just happen'. From what I can glean, the idea is that if you are trying to play the game as well as possible, then the portion that you originally learned would be played better. You could certainly intentionally play the entire game poorly, thereby masking which portion is the password.

</comment></comment><comment><USER37> This explains why I could never remember my locker combo, but could unlock it if you handed me the blasted thing. Same goes for pin numbers. The second I think of what the real number is I lose it...

</comment><comment><USER38> Does this mean the system will have to store your password as plain text? I more trust myself to choose a secure password than any service to keep the plain text password secured.

</comment><comment><USER39> Crypto? This is a solved problem: <http://www.halfbakery.com/idea/ATM_20handshake_202>

</comment><comment><USER40> Wouldn't it be better to lock a system up after X number of failed attempts and then require another unknown person to also login, perhaps even remotely?

</comment><comment><USER41> >> can't be obtained via coercion or torture "Hi, yes that is a gun to your back, please log in to your system for me"....."atta boy"

</comment><comment><USER42> It's not going to fly because it's not compatible with the corporate policy of changing password every 60 days.

</comment><comment><USER43> I store a passphrase which is 31 characters in memory.

</comment><comment><USER44> This is a sensationalist headline, and this is not a strong password length. Based on the information in the article, this is really equivalent to a "strong" 5-character password - not very secure.

It's not "30-character unbreakable cryptography", you can crack it in minutes on your phone or desktop.

 _Technical details:

The article actually says that each 'character' you learn is one of only 6 possibilties - for only 2.5 bits per character and total entropy of 38 bits.

To see how woefully little entropy this is, if you code, try writing a program that counts to 2^38 - or on a 32-bit system go through the 4.2bn possible values of an integer 64 times. That's how many possible keys there are in a 38-bit password. It really just takes minutes - certainly far less than the 45 minutes the article says it takes to learn this password!_

<comment><USER44> just want to point out that the "entropy of 38 bits" comes from the researchers - the first character has entropy of 2.5 bits but not all 30-length 'passwords' are valid, only a very small number of them, according to the researchers.

38-bit keys/passwords are not secure by any stretch of the imagination, no matter how they are chosen. (i.e. even the best random number generator on Earth doesn't help if you can just try every possibility in minutes.)

</comment></comment><comment><USER45> Unbreakable? Bah, torture would work, and that's much faster than cracking a password.</comment>


In praise of failure: the key ingredient to children's success - <AUTHOR> http://news.nationalpost.com/2013/02/02/in-praise-of-failure-the-key-ingredient-to-childrens-success-experts-say-is-not-success/ <comment><USER2> Here's a link to a FAQ I have prepared for my local mathematics students, "Courage in the Face of Stupidity,"

<http://www.epsiloncamp.org/CourageandStupidity.php>

designed to prevent exactly the kind of problem mentioned in the article kindly submitted here. School curricula in many parts of the United States (and perhaps elsewhere too, as I note the article is from Canada?) are designed so that most pupils will succeed in school assignments most of the time. That doesn't provide enough practice in taking on HARD tasks, and inadequately prepares young learners to succeed in either

a) study of more than one really difficult subject at the same time

or

b) successful problem-solving in adult life in private employment, when the problems are often open-ended and ill-defined.

As a parent of four children, and as a teacher of elementary-age pupils, I'm all about first bolstering children's expectations that initial failure is not a sure predictor of never succeeding, and then introducing CHALLENGING problems into their education so that one thing they practice while young is overcoming failure.

<comment><USER3> I'm partially only writing this reply as a slightly more "+1" than a simple upvote, but from my experience employing and leading people (programmers, generally) this certainly applies in the UK as well. Not only at elementary school age either, but right the way through education. More and more in the past few years I've come across people who've achieved degrees in subjects without ever really coming across a problem without a potential solution discussed in the near vicinity - perhaps an adjacent chapter.

When presented with just a problem, and no hint of where to find a solution, the end result has often been a mix of horror/terror/anger/paralysis. They have all of the knowledge required in the toolbox, but no practice at applying it in non-directed ways or of having to try (many) failing ideas before one works.

Very good luck with your teaching - I wish we had a lot of teachers over here who thought the same way.

</comment></comment><comment><USER4> It's odd they don't mention Carol Dweck's growth- vs fixed- mindset stuff. Quick overview: <http://en.wikipedia.org/wiki/Carol_Dweck> An interview with a little bit of depth: <http://en.wikipedia.org/wiki/Carol_Dweck> one from stanford news [http://news.stanford.edu/news/2007/february7/dweck-020707.ht...](http://news.stanford.edu/news/2007/february7/dweck-020707.html) She's been on HN a lot, so search should reveal more.

I want to add that along with letting kids figure it out for themselves, or explicitly teaching them might be supplemented by examples of failure. e.g. Steve Jobs getting kicked out of Apple; Usain Bolt stalling early in his career; and of course Edison's "I haven't failed 1000 times; I've discovered 999 ways that don't work". But these are distant. Seeing an actual person you know fail and then succeed right in front of you is very reassuring. This is why, when I was demonstrating/tutoring at uni, I never tried to cover up my mistakes in front my students. Instead, highlight them, and show how to recover from them. I'm pleased to say those students did really well.

</comment><comment><USER5> My grandfather was a psychiatrist and hypnotic therapy was one of the last resorts he would turn to for chronic patients.

So one day, when I was about 8-9 years old a young boy maybe 4-5 years elder me to was brought to my grandpa for consultation. The case I figured was very severe. I couldn't somehow accept that kids my age can have these issues; I had only seen middle-aged patients till then.That kid went through a lot of trauma. He went through hypnotic medication and was finally shifted to a permanent treatment facility.

Life passed on and one day I asked my grandfather about that case. The kid, he explained faced a failure for the first time in his last year of high school that he couldn't accept it could happen to him. His parents were so obsessed seeing him be the first ranker (an Indian school system grade) in the class; he was trained to be that all throughout his life. Until this happened.

I think failing earlier on in life gives us that ability to not freak out when it happens later on.

<comment><USER6> If you have kids do yourself and your kid a favor and read "Building Resilience in Children and Teens: Giving Kids Roots and Wings"

[http://www.amazon.com/Building-Resilience-Children-Teens- Giv...](http://www.amazon.com/Building-Resilience-Children-Teens- Giving/dp/1581105517/ref=sr_1_3?ie=UTF8&qid=1359920737&sr=8-3&keywords=Resilience)

</comment></comment><comment><USER7> > and if kids of privilege have never experienced setbacks, they've never > learned to persevere.

And this is why ordinary schools are harmful to the intellectually gifted: too low expectations don't provide opportunities to learn perseverance, resilience, and will-power from failure.

(Disclosure: personal experience, not scientific truth)

<comment><USER8> Speaking as someone who went through a gifted program, this is a good thing to recognize, but not enough. I never remember having anything challenging enough to fail at in my gifted courses (and I'm not _that_ "gifted"). Even into college, I never failed (although I scraped by many a course because I could pass with no effort), but when I was challenged, I enjoyed it. It wasn't until the working world that I experienced failure.

Then there are things like "rejection therapy" which to me sounds like something that shouldn't be necessary, ie, you learned to deal with rejection and failure through living.

Another thing to consider: I found Salman Khan's TED talk very interesting when he talked about looking at different "snapshots" of students' progress, and some would look like they were way behind ("remedial"), while others were way ahead, but in the end, they all reached the same level of progress by the end of the course. Picking a point in time and then binning students via that one data point is, quite frankly, retarded.

</comment></comment><comment><USER9> I didn't see any data in that article. Does anyone know if there is any validity in that point of view? I mean from a moral sense, it sure sounds powerful, but does it really show results?

</comment><comment><USER10> Failure doing what you are passionate about is an opportunity to learn, to get better, to come back stronger.

The key driver is to become elite. To be elite and respected usually means you have talent coupled with an intense work ethic..

That's what I associate with American culture looking at it from here in Ireland...I would say that in Ireland for too long failure was frowned upon and it stifled innovation to a degree, whereas now that fear of failure is much less prescient.

Personally I have never feared failure maybe it was my upbringing, I always have been a trier, driven by my passions. I frequently set myself goals and timebox them, keeps the mouse running around the wheel!

</comment><comment><USER11> Well, stop disclosing students' grades to anyone but the students themselves, and that cuts out that problem. (At least most of it.) Especially don't disclose to future educational institutions.

As an adult, no one gets my grades. They are for my personal growth and no one else's business. If someone wants to evalute my abilities, they have to do it by sitting down with me and figuring it out themselves, or looking at Github or something.

If I'm responsible for a child's future, and for her/him to have a decent future I have to do certain reasonable things that some backwards educational culture considers "cheating", I'll do it.

(Of course, I wouldn't want to put the child in such a toxic environment in the first place, where her success might put others at some weird disadvantage. There are more enlightened schools.)

<comment><USER12> At a university level, that was the original idea of the University of California Santa Cruz, which gave students written evaluations of what they had done well and poorly on in each course, rather than numerical or letter grades (though you could still fail a course). As a result, there were also no GPAs or rankings. My understanding is they eventually abandoned it precisely because external people wanted to see the grades and rank students: employers and grad schools like looking at GPAs. So even if pedagogically it worked great (I would need to read more to determine if that were true), external factors made it difficult to continue with.

<comment><USER13> The college I attend only uses narrative evaluations. <https://en.wikipedia.org/wiki/New_college_of_florida>

<comment><USER12> Neat. I like the idea. As a prof a school with grades, I'm often disappointed by how grade-oriented, rather than learning-oriented students are, being _much_ too concerned with what precisely is going to be on the test, how many points each thing is worth, etc. But it's hard to blame them personally for it, when the entire incentive structure of grades, GPAs, and class rankings is set up to encourage them to focus on it.</comment></comment></comment></comment>


Defending Switzerland's coffee stockpile - <AUTHOR> https://www.economist.com/europe/2019/11/21/defending-switzerlands-coffee-stockpile <comment><AUTHOR> This was blowback from [https://www.reuters.com/article/us-swiss-coffee/swiss- govern...](https://www.reuters.com/article/us-swiss-coffee/swiss-government- says-coffee-not-essential-stockpiling-to-end-idUSKCN1RM226).

</comment><comment><USER2> So they just have a bunch of green coffee beans sitting around and getting old? Are they constantly discarding old stock to make room for new beans?

<comment><USER3> Green coffee doesn't really go stale—it can be kept in storage for long periods of time without loss of quality.

Once you roast it, it's a different story—it's recommended to consume coffee ideally within two weeks of roasting.

</comment></comment><comment><USER4> If the world goes to shit and the Swiss are the only ones left with coffee, then I'll be most pissed off.

The Swiss, quite frankly, don't deserve coffee. They don't know how to make it, and they don't know how to drink it. The Swiss are good at many things, but coffee is not on that list.

<comment> barry-cotter I kind of doubt anywhere that close to Italy, large portions of whom speak Italian, has uniformly bad coffee.

<comment><USER5> In some mountain huts without tap water and only disconnected solar electricity you can't have espresso machines. You'll get filter coffee from melted snow. It's heartwarming, though.

<comment><USER6> I mean we don't really use espresso machines in Italy, we use moca's. Moca machines can run easily on a camp stove. Try it, you'll get better coffee from a camp stove than most espresso machines, promised!</comment></comment></comment></comment>


NASA To hold Major Announcement After AI Makes Major Planet-Hunting Breakthrough - <AUTHOR> http://www.independent.co.uk/life-style/gadgets-and-tech/news/nasa-announcement-today-latest-kepler-breakthrough-google-ai-artificial-intelligence-a8102966.html <comment><USER2> If it's anything like the TRAPPIST-1 discovery announced in February then we're in for a treat.

[http://www.newsweek.com/seven-earth-sized-planets-orbit- near...](http://www.newsweek.com/seven-earth-sized-planets-orbit-nearby-star- and-three-are-its-habitable-zone-559728)

</comment><comment><USER3> >The event will take place on 22 February

Gonna have to wait for while....

<comment><USER4> I think they corrected the page, no mention of the 22nd of February, just "Thursday" (so December 14, 2017).

So... intelligent extra-terrestrial life? That'd be freaky.</comment></comment>


Facebook releases 'Safety Check' - <AUTHOR> http://newsroom.fb.com/news/2014/10/introducing-safety-check/

<comment><USER2> Seems nice , but would be interesting to read more articles on :

>>When the tool is activated after a natural disaster

1)What all disasters count as natural disaster ?

>>and if you're in the affected area,

2)how does FB get data on radius of affected regions all over the world?Or how is affected region measured for each type of disaster

>> you'll receive a Facebook notification asking if you're safe.

3)Priorities in times of disaster and connectivity questions .Lets say connectivity is disrupted and even if the person is safe ,b/c he/she did not respond to notification would it mark that person as unsafe or unknown ?

</comment><comment><USER3> So what if you aren't safe? There doesn't seem to be an option for "nope I'm in serious trouble here. Help me out."

<comment><USER4> A person's response to an emergency situation isn't symmetric in the case of safe/unsafe. If you _aren 't_ safe, you should either be on the phone with emergency services (911 here in the states), or someone who can help you directly. Facebook isn't the appropriate conduit through which you should communicate. That's why you don't see a "I'm in trouble" option. Facebook doesn't want to present themselves as a means to send distress messages.

<comment><USER5> Bradley hit the nail on the head -- we display a localized emergency services number in the Safety Check UI in case anyone needs to contact the actual authorities. We're not a conduit for life-or-death information like that (which is better handled by the government).

Source: engineer on the project

</comment></comment></comment><comment><USER6> I think this is actually a rather good feature, although it does mean that there is more of a need to check facebook when a disaster is occurring... ad infinitum

<comment><USER7> It's a win-win situation.

\- Users know that their families are safe.

\- Facebook gets more user time.

Everyone wins.

</comment></comment><comment><USER8> This is a pretty great idea. I have a lot of friends in Japan and it could be pretty handy in case of a tsunami or taifun.</comment>


Show HN: Color in movies over time - <AUTHOR> http://roadtolarissa.com/film-strips/

<comment><USER2> Very cool. This could have other uses as well. I'd like to be able to seek through a video with that hover effect you have.</comment>


It's Not Like Learning French - <AUTHOR> https://www.philandrews.io/post/its-not-like-learning-french <comment><USER2> I disagree that learning programming is harder than learning a natural language. At least, that was not true for me. Beware of broad generalizations. There is also problem solving involved in designing a sentence, and even more so, a coherent spoken/written argument. Plus there is pronunciation, accents, etc., etc.</comment>


React VR: Building Virtual Reality Experiences on the Web - <AUTHOR> https://code.facebook.com/posts/215238872297197 <comment><USER2> Andrew from React VR here. We've been gathering developer input for months as we tweaked APIs and prepared for a 1.0 release, and now we're excited to open up things to the broader community for contribution: [https://github.com/facebook/react-vr](https://github.com/facebook/react-vr)

<comment><USER3> I'll ask the obvious question: why should I use this when A-Frame already exists and has the momentum?

<comment><USER2> Very similar to asking why you should use React when Angular came first. A-Frame and React VR represent different styles, and they both excel at different scenarios. If you're building a relatively static scene, or really like the idea of having a small amount of HTML with super powers, then run with A-Frame. I think it's a fantastic product.

If you know React, find React's declarative style of programming desirable, or have a more complex, stateful application, then React VR is your best bet. It's true that the A-Frame community is larger than the React VR community, and there's more code out there for it, but React VR integrates with the entire history of React tooling and libraries – React VR doesn't need a specific data management or navigation library, because it's just React. Our goal is to take all web developers who know React and enable them to become VR developers as well.

<comment><USER3> > A-Frame and React VR represent different styles

They both use HTML-like markup to declare scene graphs. I think the only difference is that procedural content is easier to generate with React VR. But then again, if I need to generate objects programmatically, why not just use Three.js directly? It's a very easy library to use.

> React VR integrates with the entire history of React tooling and libraries

That doesn't strike me as a good thing. Once developers start writing VR scenes in React, it's only a matter of time before they pull in abstractions like Redux. This means using a state library to drive React to drive Three.js to drive WebGL. This seems unnecessary and inefficient in an environment where framerate is king (because as I'm sure you know, dropping frames in VR causes motion sickness).

Given ReactVR is just a thin wrapper over Three, I think most developers would be better equipped just to learn that. They're going to have to at some point, because last I looked ReactVR had a pretty limited set of inbuilt entities.

> Our goal is to take all web developers who know React and enable them to > become VR developers as well.

My goal is to remind JavaScript developers that there is a world outside React, just like there was a world outside Angular and even jQuery before that. I believe the sooner they engage with the fundaments and free themselves of proprietary abstractions the more powerful they become.

To that end, I think the React monoculture is holding us back, and perhaps that's why I have mixed feelings about your project.</comment></comment></comment></comment>


Show HN: HipsterVision.org - funky geolocation instagram image search - <AUTHOR> http://hipstervision.org <comment><USER2> I'm not usually negative, but I hate coming across stuff like this because it's just a waste of time. I couldn't figure out what your site was offering in 10 seconds. I was reluctant to search, but I proceeded anyway in hopes that it would clear things up. It didn't. I entered the suggested "San Fransisco" and received a nice big "Something fishy with the server :(". I have no idea what "strictly ironic!" and "Ironically popular" signify, nor does "We're having new age fun with a vintage feel!" tell me anything at all about what we're doing here.

In fact, just about the only thing that I do understand on your site are the facebook + twitter buttons on the left.

<comment><AUTHOR> Yes, sorry for the server trouble. I've fixed that.

As for the point of the site ... well there really isn't any. I just wanted to make something silly in node.js with the instagram API.

Think of it as a big joke. I just called everyone on instagram (including myself) a hipster.

Also, the page title comes from this song: <http://www.youtube.com/watch?v=Xzocvh60xBU>

Actually ... let me just add an explanatory text on the first page. Thanks for the suggestion :)

</comment></comment><comment><USER3> Is the motto from this video? <http://www.youtube.com/watch?v=lVmmYMwFj1I>

<comment><AUTHOR> Yes, yes it is in fact. :)

</comment></comment><comment><USER4> Note: You have left the html5 boilerplate hot pink text-selection colour in the CSS. To optimize for irritatingly smug faux-irony, you should change it to a slightly hotter shade of pink.

<comment><AUTHOR> Actually ... I noticed that, then I didn't have the heart to remove it.

</comment></comment><comment><USER5> I'm extremely happy that there are "No hipsters in Kamnik, Slovenia :'(" :)

Great job dude. And I can recommend Swizec if you are looking for somebody to do some coding for you. He's really a smart bloke.

</comment><comment><USER6> Works well and snappy. I like the tiled presentation

Entered my neighborhood and actually got a bunch of instagrams of locations within walking distance of my office.

</comment><comment><USER7> Are you having server issues. All I can see is a pair of empty iframes.

I joke. Does the "ironically popular" use the input field's data in any way? If not, I'd say: don't put that button there. I typed a search request and couldn't decide what button to press. Until I read the explanation. Even know I don't know if I need to type something in to click on the "ironically popular" button.

<comment><AUTHOR> The server has been getting a bit slow though, might have to do some spread over more than one node.js instance ...

Any suggestions where to put the "ironically popular" button? It doesn't use search input since Instagram has a global popular thing.

<comment><USER7> My suggestion: Make it a link, in the WTF area and call it something like: "These pictures were cool before everyone else liked them".

<comment><AUTHOR> Done. Thanks.

<comment><USER8> The help text still references the button which has been removed ;)

</comment></comment></comment></comment></comment><comment><USER9> It's either "Google won't talk to us :/" or "Something fishy with the server :(" for every search I tried.

<comment><AUTHOR> Fixed the problem with server crashing.

Google won't talk to us ... well, there isn't really much I can do there I don't think :(

</comment></comment><comment><USER10> It looks like you never set a favicon from the default given by html5boilerplate.</comment>


The New York Times Is Now Supported by Readers, Not Advertisers - <AUTHOR> http://nymag.com/daily/intel/2012/07/new-york-times-supported-by-readers-not-advertisers.html <comment><USER2> The Economist Group, parent of _The Economist_ , made 48.9% of revenue from circulation and 35.08% from advertising for fiscal year 2012 [1].

[1] [http://www.economistgroup.com/results_and_governance/annual_...](http://www.economistgroup.com/results_and_governance/annual_and_interim_reports.html)

<comment><USER3> Not a fair comparison IMHO. NYT delivers mostly news, and despite their quality, there plenty of other substitutable sources of news.

The Economist on the other hand is mostly analysis, and have extremely dedicated readers who gladly pay the premium.

<comment><USER4> The Economist's newsstand price is quite high, but if you have a subscription, it's not that much of a premium that I have to `gladly pay'. I am quite a dedicated reader, though, and read the thing cover to cover almost every week.

</comment></comment></comment><comment><USER5> The key to the fourth estate is to separate it from biased monetary concerns: government funding (can be cut if critical of the government) and corporate funding (aka ads- if you criticize the advertisers, they leave).

If news can effectively transition to direct reader support, it is a good thing for everyone.

NYT has yet to prove that this direction is profitable...

<comment><USER6> I disagree; corporate funding (ads and advertisers) need not have influence over the institution itself in order to place ads in a news source. From a journalistic standpoint, your value is based upon how trustworthy you are as a company. If you are trustworthy, you have readers, and you will never be short on advertisers.

Readers can stop reading if the newspaper stops agreeing with its viewpoints perhaps even more readily than advertisers can. Coming from Utah most of the uber-conservatives that live near me mock the New York Times as propaganda yet watch Fox News and call it "truth." Unfortunately, as was mentioned offhand in Aaron Sorkin's "Newsroom," today, "People don't choose the opinions they want, they choose the facts they want." Reader supported is just as prone to bias as is corporate supported.

<comment><USER7> > If you are trustworthy, you have readers, and you will never be short on > advertisers.

This works extremely well with small publishers or niche markets: Mother Jones can criticize Monsanto while publishing ads for organic food, and Penny Arcade can make fun of Blizzard while still running Blizzar ads (they can always run ads from Valve instead if they don't).

But for a mass market publisher like NYT, a large advertiser with a steady ad budget absolutely wields an influence over content, even if they never say a word. Suits at media companies have every incentive not to rock the boat, and so soften stories, or simply focus more effort on news that is unlikely to threaten ad revenue (ie, crime and celebrity news). Occasionally, this kind of self-censorship is blatant, like the infamous Fox/Monsanto milk hormone story, but usually the effect is subtle, like the warping of a gravitational field.

Admittedly, readers _do_ create their own distortion effect on news, perhaps even bigger than advertisers. But since that's a factor either way, I still see reduced reliance on advertising as a positive trend in mass media.

</comment></comment></comment><comment><USER8> TL;DR NY times now gets (slightly) more revenue from paying subscribers than advertisers, but they still lost $88 million last quarter.

I think it's an interesting milestone, and wonder how many other papers have now had that happen (and how many were already doing that).

EDIT: mention the loss

<comment><USER9> I'd add the fact that they had a quarterly net loss of $88.1 million to you TL;DR.

<comment><USER10> The real headline is that the NYT is supported by neither, but gets more money from subscribers than advertisers. It will be interesting to see if they can get enough subscribers to become profitable again.

<comment><USER11> It doesn't matter.

The NYTimes is the official mouthpiece for the US government, no matter who is in the White House. They will never be allowed to fail. (until some other mouthpiece for the White House emerges)

Before you 'junk' me, why not read the words the editor of the NYTimes, Bill Keller, spoke 2 years ago:

[http://ggdrafts.blogspot.com.br/2012/07/bill-keller-and- us-g...](http://ggdrafts.blogspot.com.br/2012/07/bill-keller-and-us- government.html)

<comment><USER12> That blogpost in no way supports your statement. In fact, quite the opposite.

</comment></comment></comment></comment></comment><comment><USER13> I want the NY Times to stay around, so I bought their digital delivery. What rubs me the wrong way is the arbitrary distinction between devices...

You pay more for nytimes.com + iPhone + iPad. It's a little silly. Charge me 1 price regardless of where I consume it! I bought the full $4.38 / week plan but I think it's too much when it goes to $8.75. I can switch to paying $3.75 and just instapaper all the articles I want to my iPad.

[https://img.skitch.com/20120730-xky5qiifbdf2ki122swbwnbhb3.p...](https://img.skitch.com/20120730-xky5qiifbdf2ki122swbwnbhb3.png)

<comment><USER14> In my case, it was cheaper to pay for a physical Sunday delivery subscription which includes digital. I don't really want the Sunday paper, but it's a better deal.

</comment></comment><comment><USER15> Newspapers are no longer the primary, or most effective connecting point for ideas and information between people.

From where I see it, Tomorrow's generation simply doesn't use newspapers the same way as anyone has in the last 200 years.

Paywalls are another kiss of death for newspapers that are already searching for relevancy in today's world. I have zero clue why they're doing them again, they had tried them before and failed. Short of industry wide collusion, if one paper in town charges, and the other doesn't, all the online traffic will go to the free one. Not to mention we can get more information, quicker, from multiple sources online and it's only going to get easier.

The rise of bloggers on newspaper websites shows how many other places we're willing to get our information.

I don't want newspapers to go away. I like the experience of reading a paper. It's almost relaxing compared to the constant distractions from screens.

Still they're massively laying off people and not publishing on certain days. Newspapers need to find a way to make money and be sustainable. Maybe there's a middle of a new kind of subscription of not getting access to the articles right away without paying.

My background: Worked in the newspaper industry for 4 years around the last dotcom boom. Remember the horror then..

<comment><USER16> With the proliferation of "noise news" online, I find that my two options for filtering the noise are (1) peer curated sites like HN, or (2) to pay for (what is hopefully) quality writing from sources such as NYT or the Economist.

<comment><USER15> Peer-curation seems to get me information just fine, if not a wider variety that isn't filtered through the eyes of one editor.

</comment></comment></comment><comment><USER17> From the comments thread:

> "I used to do the NYT but after the subscription thing I discovered the BBC > News is much more focused on the US than you would expect."

The BBC, of course, has always been funded by the readers, and not the advertisers. Just not US readers.

<comment><USER18> The majority of the BBC's revenue comes from the British government, which mandates a nearly £146 "licensing fee" to every person in Britain who receives access to broadcast television. Source: <http://en.wikipedia.org/wiki/BBC#Revenue>

This in stark contrast to the NYT, where readers voluntarily opt to fund the paper by purchasing subscriptions.

<comment><USER19> However much like NHK here in Japan, it wouldn't be at all surprising if many people simply snubbed the collections guy because they don't own a TV, don't watch BBC, or just don't want to pay.

<comment><USER17> Not true in the UK. Evasion is very low.

"The latest official evasion rate for the United Kingdom is 5.2% of all licensable places (for the 2009/10 financial year). The official evasion rate estimates the percentage (not the number) of all premises (not individuals or households) evading the licence fee in the UK. It is calculated for the Department for Culture, Media and Sport using a model that compares the number of licences in force to external statistics on the number of households and other licensable places in the UK."

This is based on data that suggests "Under 3% of UK households don't have a television set (this figure does not include other premises like businesses)." Approximately 25 million TV licenses are in force.

Possibly there is more evasion in things like holiday homes and caravans, which should be licensed. But generally data suggests, as does my anecotal evidence, that most UK home-owners just see the TV license as a standard bill that is paid annually.

[http://www.tvlicensing.co.uk/about/foi-licences-facts-and- fi...](http://www.tvlicensing.co.uk/about/foi-licences-facts-and-figures- AB18/)

<comment><USER19> Interesting, thanks for the info. This article (<http://www.japantimes.co.jp/text/fl20060801zg.html>) is a couple years old but give a decent summary in English of what the situation is here. An official billing with all the necessary legal documentation would probably go a lot further than some of the goons going around as collection agents.

</comment></comment></comment></comment></comment><comment><USER6> "Supported by the readers" is an extremely (and intentionally) misleading title. Reader revenue has only just surpassed advertiser revenue, and The New York Times still has huge net losses quarter after quarter (this round we're talking $88.1 million).

Also, I can't be the only one that finds the tone of the article ironic considering how hard it was to work your way through the spammy ads before actually reading it.

</comment><comment><USER20> I bought the digital subscription then I cancelled it after I kept seeing ads. I hope this changed.

<comment><USER21> Publications can charge more to advertise to paying customers.

<comment><USER20> They are just too greedy.

<comment><USER21> Is that really the right word to use? Greedy people have enough of something but still want more. The New York Times is _losing_ money. I don't think any of their efforts to make money could be called greedy.

<comment><USER20> It's not my fault if they are operating at a very high cost is it? A company that wants me to pay for its content and sprinkle its ads around it is greedy for sure.

Paid content or ads. Pick one. Picking both obviously isn't working.

</comment></comment></comment></comment></comment><comment><USER22> This is expected. The "free" income from advertising goes down, many papers who only make a partial effort get in trouble, leaving more of the market free, and then the best papers who do have real value and produce real value conquer that market. That's because people are willing to pay for their paper if only they can choose theirs from a smaller set of quality papers rather than from a gazillion advertisement-funded attempts at journalism.

</comment><comment><USER23> What I don't get about newspapers in the US in general, is that it seems that their adoption is extremely low, compared to European countries. NY Times, supposedly the third largest newspaper, has a daily circulation of 1mm whereas _De Telegraaf_ (the biggest newspaper in The Netherlands, a country with a population of only 16mm) has a daily circulation of 700K!

Why is that, don't people read newspapers in the US?

<comment><USER24> The New York City metro area has a population of about 20M. NYT has only really expanded into the national market in the last 15 years. It is primarily a local/regional paper. NYC has a higher periodical subscription rate than other regions, partly due to the reliance on mass transit. NYT competes with the Wall Street Journal and other local/regional dailies.

</comment></comment><comment><USER25> That is some top-notch lede burying.</comment>


Nice list of show HNs - <AUTHOR> http://www.google.com/webhp?hl=en#sclient=psy&hl=en&site=webhp&source=hp&q=show+hn

<comment><USER2> Alternatively:

By date: <http://searchyc.com/submissions/Show+HN%253A?sort=by_date>

By points: <http://searchyc.com/submissions/Show+HN%253A>

<comment><USER3> Or [http://www.google.com/webhp?hl=en#hl=en&safe=active&...](http://www.google.com/webhp?hl=en#hl=en&safe=active&site=webhp&q=site:news.ycombinator.com+show+hn&aq=f&aqi=&aql=&oq=&bav=on.1,or.&fp=2b46d9948ae83371)

<comment><AUTHOR> Yes, that's what I was querying with, but the results link to HN threads while I wanted to look at actual sites/products.</comment></comment></comment>


God Help Us All - <AUTHOR> http://blog.loganfuller.com/god_help_us_all/

<comment><USER2> God help his webserver, apparently.

<comment><AUTHOR> I'm trying to get the cause figured out. Spun this up yesterday on a spare dev server - not the best idea in hindsight!

<comment><AUTHOR> It's back up now.

<comment><USER3> FYI, I couldn't read this on my iPhone because your sidebar is position:fixed and gets all in the way. Your face stared back at me on top of the text.

<comment><AUTHOR> Thanks for the heads up - I'll fix that now.</comment></comment></comment></comment></comment>


Jack Ma: US-China trade war will kill jobs, opportunities and hope - <AUTHOR> http://www.scmp.com/comment/insight-opinion/article/2141070/us-china-trade-war-will-kill-jobs-opportunities-and-hope <comment><USER2> I sure hope so. Get the Americans to think more creatively and get more people to work at higher salaries. AGIs have been stagnant for over a decade. Enough with the free trade which is only unilateral.</comment>


Battleship (Not the movie) - An analysis of strategies used to play the game - <AUTHOR> http://www.datagenetics.com/blog/december32011/index.html

<comment><USER2> Very cool, but still some room for improvement. You can see at the very bottom that the algorithm doesn't know how many battleships there are in the game. Specifically, even though every other ship has been sunk, and it knows the battleship runs up/down, it still has non-zero probability for ships going off to the left. It should be able to rule those gray tiles out completely by that point.

Also this leaves open the question of how best to place ships to avoid being hit? :)

<comment><AUTHOR> Actually it does take this into account (in a roundabout way). After two hits on the last ship it _does_ know orientation of the ship. It gets this information by applying a massive weighting to the locations where the ship could be that pass through this location.

"and so hit squares are treated as unvisited space squares for deciding if a ship 'could' pass through this square, and then a heavy score weighting is granted to possible locations that pass through a point we know already know contains a hit."

You'll notice that as soon as it wings the ship and knows the orientation that it continues in that direction.

(I concede your point, however, that without this weighting the probability density would be the superposition of all possible locations of the ship independant of other information - that would be a much more complex calculation).

As to how best to place the ships, there is no correct answer, as those who study game theory will tell you. If you had a strategy, then if the opponent _knew_ that there was this strategy, then he could foil you be firing into these locations first, but if you knew that he knew ... etc.

See this <http://en.wikipedia.org/wiki/Nash_equilibrium>

<comment><USER2> Well that last slide is just a hint that the algorithm isn't completely right yet. It is clear that _every_ square to the left should be completely white because there is no chance of a ship being there.

A better way to calculate would be: given that a ship is here, what is the probability that _other_ ships are in the other spaces. It's more complex but you can rule out a lot more spaces.

I'm aware of Nash equilibrium, I'm just curious about what it is for this game.

<comment><AUTHOR> I get what you are saying, but you can only pick _one square_ to fire on next. Knowing the exact probability of every square left (differnetiating between white and almost white), does not help you if, on each move, you take the square with the next highest probability.

If you have a bag containing 85 red balls, 10 yellow balls, 3 blue, and 2 black, and had to draw one and predict its color, are you going to change your answer about red even if you are told that someone stole one of the blue balls before you picked? :)

<comment><USER2> I think it will make a bigger difference in some circumstances. I guess the only way to resolve this is to run a few million simulations and see if the answers are different :)</comment></comment></comment></comment></comment>


Shipping Insurance - <AUTHOR> http://blog.easypost.com/post/53524813913/shipping-insurance <comment><USER2> Is there any sort of guarantee that my claim will be accepted? Or, do you have some trade secrets that increase the likelihood of a claim being accepted?

Many years ago, I had to file a claim on a damaged package and it was denied. Photographic evidence of a moderately crushed box with several open holes was not convincing enough. That day, I swore that I would never buy shipping insurance again.

I would love to insure packages again if I knew that a legitimate claim would be accepted.

<comment><AUTHOR> I'm happy to email over our policy. Would that reassure you? Can email us direct and insurance at easypost dot com

<comment><USER2> Sorry, I think we may have misunderstood each other. I have confidence in _your_ service and the submission of claim paperwork. I just am not sure about the actual shipping company accepting the claim and writing me a check because they may not agree with you and me that the package was damaged.

edit: from reading a couple of other comments, it seems like you are the insurer, too. So, my original comment is probably moot.

<comment><AUTHOR> Yeah, that's what I wanted to clarify. It's with us, not the same insurance as through the shippers. Let us know if you're interested!

</comment></comment></comment></comment><comment><USER3> From the blog post:

 _There are no country restrictions, and only standard restrictions for things like guns, gold, and humans._

I'm curious why the restrictions on firearms? The USPS has no restrictions on shipping and insuring firearms that are mailed in compliance with federal law.

<comment><USER4> IANAL, but I don't think it is legal to ship a firearm across state lines to anyone other than an FFL Dealer (Federal Firearms License)

<comment><USER3> Yes, this is true. It's a violation of federal law to ship to an individual out of state. It is, however, legal to ship to individuals within the state or to FFLs either way. It's very common for firearms purchased over the internet to be sent USPS to the local FFL, and it's common for individuals to ship firearms to manufacturers, FFLs or smiths directly as well.

</comment></comment></comment><comment><USER5> There's no need for purchasing shipping insurance, unless it's a one time shipment of a relatively very high value. Packages do not get lost or damaged, contrary to what insurance providers might want to make you believe.

If you ship a lot of high value items, just save some of your profits for such a rare eventuality (also called "self-insurance").

<comment><USER6> I'm sorry, but are claiming that the rate of packages being damaged or lost by the USPS is literally 0%? Do you have evidence for this extraordinary claim?

<comment><USER5> No it's not zero percent, and no one will tell you what it actually is. I was simply suggesting that package Insurance is a HUGE profit center. And the only way for it to be a profit center is if in reality packages don't get lost / damaged.

<comment><USER7> They just need to make people believe their package will get damaged and then take all possible steps to not pay out for a claim.

I thought that's how all insurance worked?

<comment><USER5> Correct. Except that in the case of Life insurance, Health insurance, Auto insurance etc., there may be more at risk, so the case for having some protection may be greater.

</comment></comment></comment></comment></comment><comment><USER8> Not much to see there. I'd suggest you write longer blog posts, maybe include some anecdotes of the problem you are solving with your new service. "Here's a service, there's no details, want to join the beta?" isn't very compelling.

<comment><AUTHOR> Noted! I'll add to it, thx

<comment><AUTHOR> how's that?

<comment><USER8> Honestly, that is much better. Very nice.

</comment></comment></comment></comment><comment><USER9> Will be good to have a competitor to shipsurance and u-pic.

Oh wait, it's just a claim processing service?

<comment><USER10> Hi ck, we take care of the whole insurance process from purchasing it to dealing with claims.

You'd buy your shipping labels and insurance through the EasyPost API; and if you ever need to make a claim you just email us the details and we take care of the rest!

</comment></comment><comment><USER11> This is awesome, and would be even more awesome if you supported other countries.

<comment><AUTHOR> We can probably do this -- emailing you now</comment></comment>


Philip Greenspun: Aaron Swartz - <AUTHOR> http://blogs.law.harvard.edu/philg/2013/01/12/aaron-swartz/ <comment><USER2> "Generally the minimum cost to defend a federal criminal lawsuit is $1.5 million."

Wow, the US justice does really need a reform.

<comment><USER3> That is appalling. Effectively, by simply charging someone with a crime, the government is actually immediately _convicting them of a crime_ with a de facto punishment of a $1.5 million fine. Forcing someone to pay $1.5 million to defend themselves, is, in and of itself, depriving that person of property without due process of law, and therefore a violation of the fifth amendment.

<comment><USER4> Why is anybody not fixing it? Nobody even talks about it. A large majority of the tech world supported Obama. But the issue of piracy, prosecution and law never ever came up. Why is nobody bothered? When will this shit end?

<comment><USER5> > A large majority of the tech world supported Obama.

I didn't. Fuck Obama. He had voted to give retroactive immunity to telecom companies for spying on American citizens when he was a senator. That showed his true character. Everything else was just marketing.

He even got awarded the "Marketer Of The Year" award from AdAge. Beating Nike, Coke, and Apple. Since then I feel largely my hunch has turned out to be true. We are still at war, we are still engaged in extra-judicial rendition, we spend our tax money trying to show 25 year old programmers in jail for 30+ year for downloading scientific papers, the list goes fuck.

</comment></comment></comment></comment><comment><USER6> I had forgotten that Aaron was the 12 year old whom won the ArsDigita prize. Thank you Philip.

</comment><comment><USER7> Alas, people who suggest fighting terrorism with Anything other than terrorism do not have the slightest understanding of terrorism. You can try and be the bigger man, but please just understand that you will not stop anyone. If this wasn't true, we would not have armies in just about every country on earth, because, well, you need tanks to fight someone with guns, and guns to fight someone with knives. A government that requires you to have a minimum of $1.5 million to start to defend your liberty is anything other than a democracy.

Sadly, my friends, the way in which we want to fight this condition is not through firing (1) person, or signing petitions. That will only allow people to talk about it for a little while until Lil Wayne drops another album, then it is off to other news.

They have proved to us they can use "their" laws to force a young man into taking his own Life. While the answer is not to take another life, it is to hit them where they can feel it without hurting them physically.

I suggest Anonymous.

</comment><comment><USER8> _The lawyers asked me "Why would someone download a huge body of academic journal articles?" (my response was "I would be guessing but my best guess would be that they wanted to experiment with some kind of text processing algorithm. [...])_

Is it really so difficult to imagine for some people that perhaps he simply wanted to give the world free access to information?</comment>


E-mail error ends up on road sign - <AUTHOR> http://news.bbc.co.uk/2/hi/uk_news/wales/7702913.stm <comment><USER2> "It's good to see people trying to translate, but they should really ask for expert help."

The sad thing is: they _did_ ask for expert help, and this is what it got them.

<comment><USER3> That's what happens when you ask for things you don't understand and you trust the answer from just one person.

<comment><USER4> If I wrote my out of office message in Lisp I'm not sure I would be able to blame someone else for any resulting screw ups.

</comment></comment></comment><comment><USER5> No idea if the translation here is right, but it's sufficient for a sanity check:

[http://www.tranexp.com:2000/InterTran?url=http%3A%2F%2F&...](http://www.tranexp.com:2000/InterTran?url=http%3A%2F%2F&type=text&text=No+entry+for+heavy+goods+vehicles.+Residential+site+only.&from=eng&to=wel)

<comment><USER6> I prefer sanity checking the translator by reverse-translating his output:

 _Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu._

 _Bit I am being crookedly the office at this time. You send any time I w translate._

That would give me pause before I painted it onto my street sign.

<comment><USER5> That's an even better idea.

</comment></comment></comment><comment><USER7> If they used xml this wouldn't have happened

</comment><comment><USER8> Although it is a bit different, this shows you should proofread your email before you hit SEND.

<comment><USER9> This is irrelevant - it was an email auto-responder.

Maybe a better observation is that if you're the only person in a company that can read/write a language, _don't write your auto-respond message in it_.

<comment><USER10> I'm guessing that the auto-respond was written in both languages, but somebody forgot to read the English bit and just copied down the bit that looked Welsh.

Of course, if these people were rational they might take a step back at this point and say "If Welsh-speaking skills are so rare here in Wales that this kind of thing can happen, why are we bothering to translate everything into Welsh?"

<comment><USER9> I think it's because they're politically pressured to; there are cultural groups trying to keep the Welsh language from dying out. (I don't know Welsh or live in the UK, though, so I'm going to defer to anybody who knows better.)</comment></comment></comment></comment>


Nearby Friends: Facebook Places meets Google Maps - <AUTHOR> http://apps.facebook.com/nearbyfriends

<comment><AUTHOR> I programmed this little Facebook app (Nearby Friends) last night to show your friends' recent Facebook Places check-ins on a Google Map. Let me know if you have any problems using it-- I've hopefully fixed all of the major bugs!

</comment><comment><AUTHOR> I just added each friend's Facebook check-in history. Click on a friend's photo to view history and other details.</comment>


Uber denies Waymo theft claims on grounds it never used custom LiDAR - <AUTHOR> https://techcrunch.com/2017/04/07/uber-denies-waymo-theft-claims-on-grounds-it-never-used-custom-lidar/ <comment><USER2> So time to clear up what appears to be a few misconceptions on this thread:

The hearing so far has been about Waymo filing a preliminary injunction against Uber. The scope of the injunction requested was along the lines of "uber needs to stop building all self driving cars until we're done with this civil case". What Uber is arguing is "you're [waymo] saying that we stole your LIDAR, but all of the Lidar tech we use is off the shelf velodyne stuff, which is super obvious that we didn't steal, we purchased from velodyne, this is not worthy on an injunction". Waymo then argued that uber was independently develeoping its own lidar system in parallel with the velodyne stuff it was using, and it wants to stop development there, and uber rebutted along the lines of "there are huge material differences between the lidar we're designing, and the lidar waymo uses, so even if levandowski stole a bunch of info and has it on his personal computer, its not in our product or our research pipeline, or servers, so your theft issue with with our boy levy, not with us, uber the company."

All of the argument so far are around the injunction, the actual trial happens in october.

</comment><comment><USER3> "Uber denies Waymo theft claims on grounds it never used custom LiDAR"

"Uber admitted in court filings today that it still uses commercially- available LiDAR systems in its self-driving vehicles because its in-house technology isn't ready for the road."

Am I reading this right. Uber is saying that they shouldn't be sued as they haven't used the stolen information in their self driving cars on the road. However they are not saying if they have used stolen information to make their own lidar units that are currently in development.

I'm assuming they are doing this so that the injunction only applies to their custom lidar tech.

<comment><USER4> No, they're also claiming that their LiDAR is "fundamentally different" than Waymo's.

<comment><USER5> How would Uber know they are different implementations unless they knew what Google's implementation consists of?

<comment><USER6> Not defending Uber here (it's pretty obvious that they fucked up big time here), but in these cases it's common to allow counsel (and counsel only) to look at both companies' IP as part of the discovery process. Counsel then giving access to information they found in that process would be grounds for pretty immediate disbarring.

</comment></comment></comment></comment><comment><USER7> I thought the most interesting but unexplained phrase in the piece was "contrary to paperwork filed with the Nevada DMV".

As in, "Uber also claims that, contrary to paperwork filed with the Nevada DMV, it has never deployed a custom LiDAR system in any of its cars or trucks and will not be ready to do so by the time the case is slated to go to trial in October."

(Edit for formatting.)

<comment><USER8> It is explained further down actually:

"But in paperwork filed with Nevada regulators last July, Otto claimed that it "developed in house and/or currently deployed" a 64-laser LiDAR system in its autonomous trucks. Uber now says this was an error. "Every single self-driving car that Uber has put on the road to date uses commercially available LiDAR sensors from third parties," Uber wrote in its filing."

<comment><USER9> The latest statement, at least the part quoted here, says nothing about the "developed in-house" clause of the initial paperwork.

</comment></comment></comment><comment><USER10> There doesn't seem to be any direct evidence against Uber itself so far, which makes me question why Uber didn't fire Levandowski five minutes after he plead the fifth and refused to let his personal devices be searched for the stolen files. It would go a long way towards removing their guilt through association, and weaken Google's case against Uber (Levandowski seems hosed either way).

As an outsider, I can only think of one logical reason why they haven't done this. It seems likely that someone in Uber -- possibly Travis Kalanick himself -- knew about the IP theft ahead of time and approved the purchase of Levandowski's company anyway. So if they throw Levandowski under the bus, he may turn around and testify against Uber proper as part of a plea bargain. This fits the old law of criminal conspiracies: you _have_ to hang together, or else you'll all hang separately. :)

</comment><comment><USER2> Hypothetical question for the IP lawyers on here:

Lets say we have two companies, evilCorp and goodCorp. goodCorp files a law suit against against evilCorp alleging that evilCorp stolen trade secrets for its self driving cars, and they file an injunction against evilCorp for it to stop developing self driving cars. During the injunction process, it is discovered that evilCorp has two separate departments, espionage and development, and the two departments never talk to each other, ever, and thats a provable fact somehow. The espionage department has in its possession stolen documents from goodCorp, but the self driving car project in the development department is very clearly entirely different from what is in those stolen documents, has its own dev, etc. What happens to evilCorp in the civil case?

<comment><USER11> [https://en.m.wikipedia.org/wiki/Clean_room_design](https://en.m.wikipedia.org/wiki/Clean_room_design)

</comment></comment><comment><USER12> Wasn't the lawsuit kicked off by Waymo accidentally receiving an attachment intended for Uber from a manufacturer that looked incredibly similar to their designs? Isn't that design proof that they were using Waymo's custom LiDAR?

</comment><comment><USER13> The LIDAR issue is a sideshow. Neither Waymo nor Uber should be developing a LIDAR; that's what parts suppliers are for. Until recently, the available LIDAR options sucked, but it's getting better. It will get a lot better when Continental, the big auto parts manufacturer, turns on production of the flash LIDAR technology from Advanced Scientific Concepts.[1] That's known to work well; it just costs too much in small volume. They could probably make those units in volume now, but it's too soon to turn on the parts factory and make millions of them. No market volume yet. Or maybe Quantergy, a startup which says they are "the leading provider of solid state LiDAR sensors" but isn't shipping, will get their act together.

Waymo only found about about the LIDAR thing by accident. The question is, how much other technology did Uber get?

[1] [http://www.continental- corporation.com/www/pressportal_com_e...](http://www.continental- corporation.com/www/pressportal_com_en/themes/press_releases/3_automotive_group/chassis_safety/press_releases/pr_2017_01_04_umfeldmodell_2_en.html)

<comment><USER14> I disagree that they shouldn't be developing LIDAR. It is such a critical piece of Waymo's implementation that they would be fools not to have a development program.

Google has more money to invest in this than any part supplier. Why would they let another company own their destiny?

</comment></comment><comment><USER15> So once the injunction is served (which is looking increasingly likely), what will the spillover effects look like? I'm assuming Uber valuation tanks at this point, but how does that propagate?

<comment><USER16> i don't know why an injunction would be served if Uber's in-house technology is significantly different from Waymo's. That, and the fact that Uber is apparently using 3rd-party hardware on their current self-driving vehicles.

<comment><USER15> "Uber also claims that, contrary to paperwork filed with the Nevada DMV, it has never deployed a custom LiDAR system in any of its cars or trucks and will not be ready to do so by the time the case is slated to go to trial in October."

via [https://www.engadget.com/2017/04/07/ubers-legal-defense- waym...](https://www.engadget.com/2017/04/07/ubers-legal-defense-waymo-does- lidar-better-for-now/) \--

"A Waymo spokesperson told Engadget: "Uber's assertion that they've never touched the 14,000 stolen files is disingenuous at best, given their refusal to look in the most obvious place: the computers and devices owned by the head of their self-driving program. We're asking the court to step in based on clear evidence that Uber is using, or plans to use, our trade secrets to develop their LiDAR technology, as seen in both circuit board blueprints and filings in the State of Nevada."

If they've legally filed with the state of Nevada as using proprietary LiDAR tech, doesn't that put the nail in the coffin?

As an aside, if it is found that the stolen documents were disseminated internally, don't they have a near-impossible burden of proof that no trade secrets were integrated into the braintrust of the company? How is this typically handled? I imagine it involves rebuilding the division and dismissing any previous project participants.

<comment><USER15> Additional information on Nevada filings --

[https://backchannel.com/how-my-public-records-request- trigge...](https://backchannel.com/how-my-public-records-request-triggered- waymos-self-driving-car-lawsuit-1699ff35ac28)

"Otto noted that it had developed an "in-house custom built 64-laser (Class 1) emitting 6.4 million beams a second at 10Hz.""

...

"Lidow explained that many lidars today use 32 lasers and 1 or 2 million beams per second, and that a 64-laser system emitting 6.4 million beams a second would give superior vertical resolution and quicker refreshes. This would be better able to capture small, fast objects such as bouncing balls or animals darting into the road. It would also be technically challenging to build. "But I don't think the speed of the system or the number of laser pulses are definitive in any way to tell you whose system it is," he said."

While Velodyne has a 64 channel product, I can't find any reference of a Velodyne system that comes close to that 6.4M beam per second refresh.

</comment></comment></comment></comment><comment><USER17> It's for high profile cases like this that Groklaw was an indispensibile site for in-depth legal analysis. Are there any sites that offer similar content like techdirt?

<comment><USER18> Pacer :-)

</comment></comment><comment><USER19> Isn't this like saying you didn't steal a CD because you never listened to it?

</comment><comment><USER20> > "Then why did he steal this stuff? That's the story the jury's going to want > to know about," Judge William Alsup retorted.

I find it alarming that the judge assumes a "guilty until proven innocent" position. Obviously outsiders like us would take a stance like this, but for a judge on the bench to operate in that manner sets off all kinds of red flags for me.

<comment><USER21> My (admittedly limited) understanding of the case so far is that neither Uber nor the former Google employee dispute that the theft did in fact take place.

<comment><USER22> Forgive my ignorance, but can Uber dispute that the theft did in fact take place if ther former Google employee isn't saying anything? Could they not be as ignorant as you or I?

<comment><USER23> They could be as ignorant, but the fact that they haven't forced their employee to disclose anything appears to the judge that they're trying to have their cake and eat it too.</comment></comment></comment></comment>