Spectre is here to stay: An analysis of side-channels and speculative execution - <AUTHOR> https://arxiv.org/abs/1902.05178 <comment><USER2> >> These attacks leak information through micro-architectural side-channels which we show are not mere bugs, but in fact lie at the foundation of optimization.

So we'll need to have non-speculative execution for cloud CPUs and stronger efforts to keep untrusted code off our high performance CPUs. This may even lead to chips with performance cores and trusted cores.

<comment> Tuna-Fish No. The paper notes that Spectre can, and will in the future be able to defeat all programming language level techniques of isolation. With properly designed OoO, Spectre cannot defeat process isolation. The fundamental lesson that everyone must take to heart is that in the future, any code running on a system, including things like very high-level languages running on interpreters, always have full read access to the address space of the process they run in. Process isolation is the most granular security boundary that actually works.

Or in other words, running javascript interpreters in the same address space as where you manage crypto is not something that can be done. Running code from two different privilege levels in the same VM is not something that can be done. Whenever you need to run untrusted code, you need to spin up a new OS-managed process for it.

<comment><USER3> So this is something that I've never gotten a full answer to: what is the difference between a "thread" and a "process" in this model?

This isn't a facetious question. A thread is just, at its core, a process that shares memory with another process. (In fact, this is how threads are implemented on Linux.) But _all_ , or virtually all, processes _also_ share memory with other processes. Text pages of DLLs are shared between processes. Browser processes have shared memory buffers, needed for graphics among other things.

What separates processes that share memory from threads that share memory regarding Spectre? Is it the TLB flush when switching between processes that doesn't occur between threads? Or something else?

<comment><USER4> For meltdown (spectre v3, iirc) It's not so much sharing memory as sharing address space. Processes have different page tables. Threads within a process share page tables.

For spectre v1 and v2, right now (on existing hardware) mostly nothing separates threads from processes. In the future, process isolation is a good candidate for designing hardware + system software such that different processes are isolated (via partitioning the caches, etc).

You probably still want threads within a process to share cache hits.

<comment><USER3> So, if that's true, why is Chrome considered to have solved Spectre? Browser content processes from different domains share some memory. Moreover, if process boundaries don't have any effect on the branch predictor on current hardware, then why is process separation relevant at all? Doesn't all this mean Spectre is still an issue?

<comment><USER4> I guess I jumped the gun a bit in my comment above.

In terms of the _possibility_ of exploit, as I understand there isn't at this point any isolation between processes.

In terms of the _ease_ of exploit, being able to run untrusted code in the same process as the victim helps quite a bit. Otherwise, you have to find a gadget (i.e. qualifying bounds check for v1, indirect branch for v2) in the victim process that you can exploit from the attacker process. Possible, but quite a bit harder than making your own gadget.

This all ignores the forward looking reasons process isolation is a good idea. I can't keep track of the latest mitigations in Linux, but they pretty much all will only help between processes by flushing various hardware data structures. And hopefully someday we will have hardware actually designed to restore the guarantees of isolation between processes.

I'm pretty sure this is accurate, but I'm just a random guy on the internet so don't trust my word for it too much.

<comment><USER5> It's not really about process isolation then, but the amount of control untrusted code can have over a process. Which means if everything that code can do is masked to some part of the process, it should be able to achieve the same isolation between such subprocesses but within the OS process boundaries. Although the paper claims this is too hard.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> How about CPUs without speculative execution and simultaneous multithreading (SMT / Hyper-Threading, which has similar issues)? We would, of course, need other optimizations to claw back the performance loss--an engineering problem I feel we can solve.

I've wondered if the solution is more, simpler cores. We concentrate on smaller, faster cores, and the programming to utilize them better. Perhaps advances in memory architectures as well. Hardware isn't my specialty, so I'm just brainstorming here.

Perhaps this is where ARM and even RISC-V based systems can step in.

But I'm a software guy, so what do I know? I just know I'd feel more comfortable with systems based on simpler CPUs that just cannot be exploited by the recent side-channel attacks discovered, rather than trying playing whack-a-mole with patches, along with trying to reason when it might be safe to use CPUs with these optimizations.

<comment><USER7> I don't know why this is being down-voted.

A few things: ARM and RISC-V definitely have specEx baked in (though you can not include SpecEx module on RISC-V). There are interesting alternatives to SpecEx. DSPs use delay slots, and I've seen delay slots used quite well in a GP-CPU. Getting high instruction saturation on a CPU with delay slots is a "hard compiler problem", but I have a few things to say about that:

Despite jokes about "better compilers", compilers _are_ getting better (e.g. polyhedral optimization). One way to think of what OOOex/SpecEx is that it's figuratively the CPU JITting your code on the fly. The most popular programming language JITs aggresively anyways so one wonders if there isn't some reduplication going on.

Furthermore, the most popular programming language isn't entirely the most raw-power performant, and it's pretty clear that in our current ecosystem just pushing operations through the FPU (which is what x86 optimizes for) isn't necessarily the most important thing in the world; uptime, reliability, fault- tolerance, safe paralellization, distribution, and power conservation might be more important moving forward.

HM, oops, apparently RISC-V has OOOEx, not SpecEx.

<comment><USER8> > Despite jokes about "better compilers", compilers are getting better

The compiler has to make static decisions. The hardware knows what is actually happening. There is an inherent information asymmetry at work that a "sufficiently smart" compiler seems unlikely to overcome.

My intuition says software can't beat the speed of a superscalar OOO CPU anymore than a GP CPU can beat a roughly equivalent DSP for algorithms suitable to run on the DSP, but I have no proof for that.

I'll also note that we've been promised "smarter compilers" for decades. Intel has tried that route several times. No one has ever made it work.

<comment><USER9> I think it's definitely worth exploring this angle because modern JIT compilers have become very advanced, and there's still a lot of juice left to squeeze there. Look at some of the things Graal is doing and it looks a lot like what OOO speculation is doing - it'll recompile branches on the fly based on profiling information and things like that.

<comment><USER10> Nvidia Denver couples a software based jit/translator with an inorder VLIW backend. It is vulnerable to spectre.

</comment></comment></comment></comment></comment><comment><USER11> Side-channel attacks are some of the most terrifying to me, because fundamentally your code works fine, it's just some detail in the timing that gives away information. At least with buffer overflows there are automated ways to try and find them, like fuzz testing. It's not perfect, but at least it's something to try and validate you are doing the right thing. Is there some sort of fuzz testing that could potentially find side-channel timing attacks? Maybe some sort of statistical analysis on the timing results? I found this [https://arxiv.org/pdf/1811.07005.pdf](https://arxiv.org/pdf/1811.07005.pdf) but it seems to be fairly recent, and I don't know how mature this area is.

<comment><USER12> One of the interesting aspects of quantum computing is that it upgrades these issues into actual bugs. Bit flips are errors in the Z basis, and phase flips (information leaks) are errors in the X basis. [1][2]

Trying to build large scale quantum computers could lead to styles of optimization that provably don't have side channel issues.

[1]: [https://www.scottaaronson.com/blog/?p=3327](https://www.scottaaronson.com/blog/?p=3327)

[2]: [https://www.youtube.com/watch?v=uPw9nkJAwDY](https://www.youtube.com/watch?v=uPw9nkJAwDY)

</comment></comment><comment><USER13> I found some good reads here if anyone would like to review and get a good perspective:

[https://www.realworldtech.com/sandy- bridge/10/](https://www.realworldtech.com/sandy-bridge/10/)

[https://en.wikipedia.org/wiki/Out-of- order_execution](https://en.wikipedia.org/wiki/Out-of-order_execution)

[https://googleprojectzero.blogspot.com/2018/01/reading- privi...](https://googleprojectzero.blogspot.com/2018/01/reading-privileged- memory-with-side.html)

[https://bugs.chromium.org/p/project- zero/issues/detail?id=12...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1272)

</comment><comment><USER14> Has there been an in-the-wild exploit found for many of these micro-arch side channel attacks?

I still have reservations that Specter can be actually exploited, and certainly not by JavaScript running in a browser it seems (even without the timing fixes -- just too much noise in the system to get a real world exploit). All the proof of concepts I saw effectively needed a running start (and a much lower bar to clear). I'm still not sure if we are just making too much out of many of these attacks.

Also, many of these exploits require running native code to really even be possible, and a JIT offers a large degress of protection. Most of the machines I use, if you are already able to run native code, the battle has already been lost.

I think the security community can sometimes have Chicken Little syndrome. I most definitely wouldn't want performance enhancing techniques that might have side-channel vulnerabilities to not be produced or used because they might be exploitable in a use case (eg, web serving and rendering) that doesn't fit most others (eg, internal servers).

<comment><USER15> The article states in Section 4.5 (Page 20):

 _As part of our offensive work, we developed proofs of concept in C++, JavaScript, and WebAssembly for all the reported vulnerabilities. We were able to leak over 1KB /s from variant 1 gadgets in C++ using rdtsc with 99.99% accuracy and over 10B/s from JavaScript using a low resolution timer._

<comment><USER16> This is nice, but is there a _real world_ exploit, not a POC? Example: pulling session cookies for another site, or extracting an SSH private key?

<comment><USER8> What are you basing this unearned confidence on? We've seen this same pattern repeat thousands of times:

1\. This might be a vulnerability in theory but there's no POC 2\. Well it's just a POC, no one has actually weaponized this. 3\. Sure someone weaponized this but it is very difficult to pull off. 4\. Oh the script-kiddie toolkits can build exploits for this automatically. Who could have seen it coming?!?

(Step #2 is probably where the various governmental spying agencies start deploying the exploit in targeted ways)

Perhaps this time things are different but it seems unlikely.

<comment><USER16> Reading 10B/sec from JS, which is under ideal conditions, does not sound like a fast path to exploitation. I agree it is a concern, but I think it is overblown, similar to pcwalton below.</comment></comment></comment></comment></comment>


Can you recommend me sites to download certification courses/dumps/etc? - jchristian- I'm looking for sites to download general courses, certification courses, dumps etc. Can you name a few? Thanks. I used to get it from http://certcollection.org/forum/ but now it's down :( <comment><AUTHOR> I'm not sure what kind of courses or certs you're looking for, but [https://itpro.tv](https://itpro.tv) has IT-focused courses geared towards getting certifications. To be completely transparent, I work for ITProTV.

</comment><comment><USER2> try [https://certcollection.net/forum/](https://certcollection.net/forum/)</comment>


Learn React.js in a weekend - <AUTHOR> https://nodecasts.io/learn-react-js-weekend/ <comment><USER2> I don't recommend learning Redux the first weekend you learn React. This would be akin to learning about Relativity the first weekend you learn Mechanics. I actually think it's detrimental to suggest beginners learn Redux alongside React because it unnecessarily steepens the learning curve.

Not that Redux is too complicated (it actually has a super simple API). Redux is a (fantastic!) tool you should use once your project is at a large enough scale that you need it. You can go a long way in vanilla React before you feel the pains that Redux (or Relay) solves. The React part of my current codebase is over 25k LoC and I still don't feel the need to throw Redux into the mix.

Take a peep at [http://djcordhose.github.io/hh-react-conf-2016/redux-vs- rela...](http://djcordhose.github.io/hh-react-conf-2016/redux-vs-relay.png)

If you're just starting out then first spend several weeks/months in vanilla React. Unless you need to learn Redux to work on a bigger codebase at a new job or something...

Qualification: I used to work on React Native at Facebook.

<comment><USER3> What stacks would you recommend for starting a React Native application of low complexity (like single man operation) and low-to-moderate complexity (like a several man seed-funded company)?

<comment><USER2> If you don't need a server then React Native should basically be your entire stack. :)

Since you do probably need a server, I don't have an incredibly educated answer for you but I use Node + Mongo on AWS because it's cheap, easy, entirely JS, and seems like it'll scale reasonably well (to some point).

<comment><USER3> I mean does an application being React Native change your opinion on using Redux or Relay?

<comment><USER2> It's really up to you. It's a tradeoff between spending additional effort on dev ops now (rather than product) versus building the technical debt that will be converting your app over later. If everyone on your team knows Redux then sure, start the app's architecture to scale to a huge team. If it'll significantly slow down product development then have everyone learn + convert later.

I'd err on the side of the latter (vanilla RN, Redux when you need it) to move fast on your product.

</comment></comment></comment></comment></comment><comment><USER4> Question for people who learn by video rather than text based guides - why do you find it more effective?

I have trouble following someone else's pace in a video (or audio for that matter). I also like to be able to copy and paste code into my editor. Navigation to particular sub sections is easier too.

<comment><USER5> I get different things from videos than I do text. From a video, I get a "why" and a "how" most often, whereas from text I get a "what". Obviously text can represent why and how, but I feel there's something lost going from screencap to screencap that is perfectly captured in video about the process of getting from point A to point B. Additionally, most blog posts don't publish the mistakes (let's try this thing! crap it didn't work, here's why. This is especially true as a result of a question.) but you can very easily convey that type of information in video by just showing it not working. The pacing thing is totally a valid concern and I find myself watching youtube videos at 1.5 or 2x speed to consume the content.

</comment></comment><comment><USER6> For me the thing I'm finding most annoying is how many errors I get just setting up this stuff, whether it's Angular or React or something else.

I'm on Windows though so I assume a lot of my issues stem from the tutorial authors assuming they are talking to a purely *nix crowd.

</comment><comment><USER7> Something about react life cycles, in a daily sharing video: [https://www.youtube.com/watch?v=vEf8c1-WBBs](https://www.youtube.com/watch?v=vEf8c1-WBBs)

</comment><comment><USER8> Is this all paid content?

<comment><AUTHOR> Nope! Everything is free except the first link!

</comment></comment><comment><USER9> How about: RTFM [https://facebook.github.io/react/docs/getting- started.html](https://facebook.github.io/react/docs/getting-started.html)

I don't get the react hype anyways. Writing inline HTML in JavaScript seems so weird to me (JSX).

<comment><USER10> The argument (among others) is that if you're going to be using if/else, for loops, and all that in a templating language you might as well use a full- featured language like JavaScript... (youtube timestamp: [https://www.youtube.com/watch?v=x7cQ3mrcKaY&t=4m13s](https://www.youtube.com/watch?v=x7cQ3mrcKaY&t=4m13s))

<comment><USER11> or, you know, just write the app in pure javascript and still reap the benefits of [2-3x faster than React] virtual dom. though i'm a bit biased [1] ;)

[1] [https://github.com/leeoniya/domvm](https://github.com/leeoniya/domvm)

[2] [http://mithril.js.org/](http://mithril.js.org/)

<comment><USER2> Meh since when is computational performance really a bottleneck? Do you find your site is loading seconds too slowly because JS is executing? I sure don't.

On today's machines the much larger bottleneck is how fast and easily you can iterate on product at scale which is a problem that React is a fantastic solution for.

<comment><USER11> > Meh since when is computational performance really a bottleneck?

Ever used a phone that wasn't < 6 months old to browse the modern web?

> at scale

React is a front-end framework. The only "scale" that exists in its world is the fat DOM you generate and how fast it can mutate it. From that perspective, it sucks at scale (take a look at Preact and Inferno). Your iteration speed depends on good app architecture, not a specific framework. React Native does sound like a good perk, but likely isnt useful enough to make anything you cannot do anyway in HTML5.

<comment><USER2> Scale in terms of number of engineers and app size, not users

<comment><USER11> > number of engineers

can't this be said about any popular framework? "it scales because everyone knows it"

> app size

what specifically makes React scale better with app size than any other properly componentized architecture?

<comment><USER2> It doesn't scale because everyone knows it. It scales because React by nature isolates business logic into components so that for the most part 100 engineers can simultaneously work on the same product and be confident they aren't breaking stuff. (Or realize they are through merge conflicts)

> "properly componentized"

With React, 100 engineers don't have to know how to "properly componentize" things because it's already baked into the framework. You can't really write React code without proper componentization.

<comment><USER11> > React by nature isolates business logic into components

The essence is simply this:

        function MyView(model) {
          return template;
        }

...which can work with any view layer and the same 100 engineers. Especially if the model is an API with business logic around some immutable stream/state. The concept is simple enough to be described in one sentance :)

> don't have to know how to "properly componentize" things

I think you're overstating how difficult this problem is or forgetting that React's API must still be learned from documentation and examples.

<comment><USER2> What about state within a component? How do you encapsulate that state so that other components can't muck with it? What about passing data to that component? What about type checking that data passed in in debug mode? What about a formal API for components to talk to one another? What about knowing the explicit amount of the view tree that needs to be re-rendered based on what data changed?

React has answers to all these questions and so much more. Answers that very smart people have spent years coming up with.

Sure you could reinvent the wheel and build all that into your custom component framework, but then you may as well just use React.

<comment><USER11> I will address these with respect to domvm [1]

> What about state within a component? How do you encapsulate that state so > that other components can't muck with it?

Solved.

> What about passing data to that component?

Solved.

> What about type checking that data passed in in debug mode?

Could be solved if i rewrote in TypeScript. But this has never been a problematic issue in 10k+ LOC apps.

> What about a formal API for components to talk to one another?

Yep.

> What about knowing the explicit amount of the view tree that needs to be re- > rendered based on what data changed?

Obviously, that's what virtual dom is.

In addition to all of this and much more, materialized views are independently refreshable, can be composed between disjoint components. There are async lifecycle hooks, a router, mutation observers, ajax sugar.

All of it is 17k min, requires no special tooling or IDE to write, is isomorphic and is 2-3x faster than React.

I have no doubt that React brings a lot to the table, but I hesitate to treat it as the final word in frontend frameworks for all the above reasons.

[1] [https://github.com/leeoniya/domvm](https://github.com/leeoniya/domvm)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> React is 1 hr at the most to fully learn and get a good grasp...</comment>


Who's Responsible When a Driverless Car Crashes? Tesla's Got an Idea - <AUTHOR> http://www.wsj.com/articles/tesla-electric-cars-soon-to-sport-autopilot-functions-such-as-passing-other-vehicles-1431532720 <comment><USER2> There was a solution to this problem that was tried and failed: no fault insurance. Why did it fail? Because lawyers and insurance companies could make more money if fault were reintroduced to the system, and so fault crept back in. The only place in the American tort system where you have true no-fault is worker's comp: if you are injured at the workplace, you are entitled to compensation. Period. It wasn't always that way: workers had to prove that the employer or someone else was at fault to recover. So why not, "if you are injured while driving an automobile, you are entitled to compensation"? Insurance costs would be much, much lower and you would not need technical kludges like this one. Law and tech rarely mix coherently. You can't force me to give up the password to my phone, but you can force me to use my fingerprint to unlock the phone. The way forward is more general application of the principles used to make worker's comp universal. And by the way, other countries do not have this problem.</comment>


"Tap the spacebar with your phone." - Bump unveils new photo uploader - <AUTHOR> http://photos.bu.mp <comment><USER2> Whoever designed this page: this is a clever idea, the ideal goal (I assume) is for it to be spread around ("hey, did you see this neat photo uploader thing?") in which case why doesn't it link me to the app for download? I don't have bump, I want to try this idea... so I have to work out what the site url is and then go and find the app myself. Why not a "don't have bump? download here!" link?

<comment><USER3> Yeah, clever viral marketing (which is clearly working as we're talking about it here). I was a bit suspicious that they wanted to captured my geo location on that page too.

<comment><USER4> Bump works by correlating the time the "bump" occurs and the location of the bumps. Of course, tracking your location is an added benefit for someone that might care about that sort of thing.

<comment><USER3> I get that now after reading this thread. The problem is my first instinct was "why the hell does this website want my location?" when there was nothing on the page to explain why it was requesting this.

</comment></comment></comment></comment><comment><USER5> Want to build magic like this into your own iOS or Android app? Try out our brand new, super fast APIs:

<https://github.com/bumptech/bump-api-ios>

<https://github.com/bumptech/bump-api-android>

Email me if you have any questions: firstname.lastname@example.com

<comment><USER6> Some feedback: I just filled out my virtual card with my contact info, and suddenly got an email from you guys in my inbox. I didn't sign up for an account or anything.

IMO this is pretty shitty - I put this information into the app to send to other people, not so Bump can email me. And now I feel iffy putting other data into the app - Bump is not strictly the data exchange platform I thought it was.

This is a violation of user trust - if you want to store/act on any information users put into the app you need to let them know first.

This really, really rubbed me the wrong way - this is the first time any app of mine has ever intercepted a form field, sent it to the mothership without my consent, and used the data in a way that was never stated nor implied. App deleted.

[edit] Oh hey look, the email addressed me by the name I put into the vCard. I guess now you have my phone number too.

<comment><USER5> We are a cloud based solution that takes privacy very seriously. We do not share your personal information with people or services you don't want. Our privacy policy is available both in the app and online: <http://bu.mp/privacy>

<comment><USER7> >We do not share your personal information with people or services you don't want.

Clearly that's incorrect, because the complainer didn't want you to have his personal information.

Also the statement "We may use your Personal Information as we believe to be necessary or appropriate in any manner permitted under applicable law, including laws outside your country of residence" clearly gives you the right to sell his personal information to anyone.

<comment><USER8> Isn't it kind of a given that when you give your email address to a service, that you are allowing that service to contact you?

Otherwise what's the point of having the address?

<comment><USER9> I haven't used this app but I think the parent had expected that the data he entered would be confined to the application, not sent to the app developer. Simple analogy: Would you expect Microsoft to harvest every e-mail address you enter into Outlook?

<comment><USER8> Outlook is an application, not a web connected service, though. If I enter my email address when signing up for, say, Office Live, I'd expect to see a Microsoft email in my inbox every now and then.

<comment><USER10> Would you expect Google to send emails to people whose addresses have been entered into Gmail?

<comment><USER8> No, but that's not what happened here. You filled out your personal card which will be shared out with everyone you "bump" with. I haven't used the app, but I'd assume this fills some kind of registration function.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> This just very cool in a very nerdy sort of way. I kinda wish it was less gimmicky, on the other hand I assume bump uses the time stamps of the shake and the key down to figure out which two devices are trying to talk. I wonder what the threshold for collision is?

Anyway, very cool and I could actually see a use for this, sending photos of whiteboards to colleagues that don't run Mac/have an iPhone. Would have to compete with email/dropbox for ease of use, but it does seem very simple on the receiving end, just surfing to a web page.

<comment><USER12> Bump is known for their ingenious methods of relating lots of data to figure out which two phones were being bumped at the same time (there's a really cool answer on Quora about how they do it). I would assume this is their tech team figuring out how to apply the same techniques across two devices (browser/pc -> phone). I bet there is some really cool stuff at play here.

<comment><USER13> Is this it?

<http://www.quora.com/How-does-Bump-work>

<comment><USER12> I think that may be the one I read.

</comment></comment></comment></comment><comment><USER14> What does this do? I know because I saw the headline here on HN, but if I went to the site without context, I'd have very little idea, and I'd have to do some detective work or deductive reasoning to find out. It's mostly obvious, but I think it'd really help to have a super-brief explanation of the function - like maybe instead of "Tap the spacebar with your phone," it could say "Tap the spacebar with your phone to upload photos."

<comment><USER15> What is the benefit of this vs just pressing "upload photos" button on the phone itself? Why do I have to find a computer?

I get the mobile-to-mobile bump application, but can someone illuminate me on this one.

</comment></comment><comment><USER16> From what I have read it seems you need to have geolocation turned on in your browser and iphone.

Have I been hiding under a tinfoil hat for so long that I am completely out of touch with the world? Do most HN readers have these on by default?

<comment><USER17> Firefox gives me a prompt like [1] on every site that uses HTML5 Geolocation APIs. My iPhone and Windows Phone do the same.

[1] <http://dl.dropbox.com/u/9061771/Screenshots/yebr_5sj_2ik.png>

<comment><USER18> so do chrome and safari

<comment><USER19> And Opera and probably any other browser supporting geolocation.

<comment><USER16> except for the browsers that have been instructed to never make the info available.

</comment></comment></comment></comment></comment><comment><USER20> A few months ago, I ran into the Bump team on Castro street in Mountain View. They were grabbing random people walking by their table, testing the user flow of this product with a demo.

Two lessons from that:

1) Gather user feedback all the time, at any stage. Meet customers, send out surveys, interview users, whatever it takes to get the data.

2) Simplify! Your product needs to be as frictionless as possible (I think I repeated this like 7 times when I tried the demo). It's two steps to use the new Bump photo app -- that's easy for a user to understand.

</comment><comment><USER16> If I have already selected the photos I want to upload on my phone why would I want to use another device to complete the process?

NB: This is not trollfood and I am not a hater. I don't use an iphone so I may be missing something obvious.

<comment><USER21> This makes it easy to see what is on your iPhone on your computer.

It lets you authenticate without having to enter a username/password (less typing!) or having credential information already saved on that computer (which is a typical case if using someone else's computer.)

<comment><USER4> Why not just show a QR code on the screen and have the phone scan that. If it's been taking pictures, it can take one more :)

<comment><USER22> Because almost every single use of QR codes I've seen has been a terrible UX mistake. They're unwieldy, slow and annoying.

<comment><USER23> And shaking your phone to whack your keyboard is great UX?

<comment><USER22> Yeah actually, it is. It's devilishly simple and has a physical action to represent the virtual action taking place.

</comment></comment></comment></comment></comment></comment><comment><USER24> This isn't remotely brilliant. This seems completely unnecessary and gimmicky.

<comment><USER25> Yup

1) I don't get it, so I'm unlikely to think it's brilliant without trying. (So now I need a laptop to upload photos from my mobile?...)

2) I wouldn't download this to try Bump without some better explanation, especially given implicit data protection reputation of just about every big consumer-facing company these days (especially one that trades in contact details.)

3) The title is full of gratuitous editorialization, which is against HN guidelines.

<comment><USER26> Gratuitous editorialization? It's a pretty simple description of the site.

</comment></comment></comment><comment><USER27> Whoa! Just "bumped" into somebody else while testing this out. <http://twitpic.com/98efxf>

Gimmick?

<comment><USER28> Slightly disturbing that you don't get any confirmation to share on the mobile side, it just sends your data off to whoever it matched with immediately :-/

Generally very cool experience but I wonder how well the matching algorithm will scale though. You can't be getting all that many bits of uniqueness out of a single key press and a vague bit of browser location data right?

<comment><USER19> I think it can scale by bumping more times (1-3 is ok for people and it will triple your space). But even with this, the non-geo-located (or poorly located) browser will become unusable by oh-so-many conflicts when you have certain amount of users using it.

<comment><USER27> If you think about it, it's a paradox. For this to be vaguely useful, lot of people must use it. When a lot of people start using it, the system breaks.

NFC to the rescue?

</comment></comment></comment></comment><comment><USER29> This is brilliant! I guess the next step of photo sharing is to it more FUN. I assume that when I tab on my phone, the client feels the shake and uploads the photo to Bump, and at the same time the browser gets the space keystroke from the keyboard so it would send the location and time to server, which would then match the photo that was uploaded with the best location and time. Matching/guessing the timestamp here is more important than location here I guess.

</comment><comment><USER30> Since the topic has come up, one way to reduce collisions with all geolocation turned _off_ would be to request the user tap a certain key (or even two keys in succession) with the phone instead of just the space bar.

<comment><USER31> Or presumably tap the spacebar twice (or more) - giving an interval for matching - which would avoid having to consider key positions and mishits and alternate keyboards and such.

</comment></comment><comment><USER32> This is cool. Something about the UX felt like magic- maybe it was the instantaneous response and the way my phone vibrated.

Anyway, can the devs make this more shareable? I wanted to share on Facebook but the FB-markup link looks very nondescript (bad title, no description text, crappy icon). So, I'm not going to share it. Some Twitter / FB links on the webpage would be great.

</comment><comment><USER33> Wow! Are you patenting this idea? I just thought of, like, one hundred uses for this same idea. So fast. Wow. Mind blown.

<comment><USER16> Is this a joke / commentary on patent law or are you genuinely enthused?

<comment><USER33> It's my genuine reaction. I really thought this is super cool and innovative.

<comment><USER19> I was about to write that there was an app for sharing between phones that used "bumping" but when I searched for the name... it's the same app :)

<comment><USER9> While I have not previously seen an app that uses key input and accelerometer data like this one, there have been some academic publications that discuss pairing using similar accelerometer readings:

Hinckley, 2003: [http://depts.washington.edu/dmgftp/publications/uist04/uist_...](http://depts.washington.edu/dmgftp/publications/uist04/uist_papers/Synchronous%20Gestures%20for%20Multiple%20Persons%20and%20Computers.pdf)

Mayrhofer, 2007: [http://comp.eprints.lancs.ac.uk/2230/1/TMC-2008-07-0279-3.pd...](http://comp.eprints.lancs.ac.uk/2230/1/TMC-2008-07-0279-3.pdf)

</comment></comment></comment></comment></comment><comment><USER34> I don't get why this is a good idea (or how it works*). Anyone care to explain?

Edit: I'm wondering how it works in a technical sense.

<comment><USER35> Accurate-enough (sub-second in my case) timing of events + physical proximity (both your browser and the app ask for your location) = a near guarantee that your browser session + your phone is a unique pair. It also asks for confirmation on both the phone and browser to pair the first time.

There's no real chance of this being man-in-the-middled since you have to confirm on both devices. And they're being intelligent about it - I just tried it with two laptops at once, and you get "someone's device" instead of the name of your iThing, and your iThing says "please try again" like this: <http://cl.ly/1O33430M0i2c0i2T0z2U>

Once you've approved, they have a browser + app pair of cookies for future pairings (not really exploitable, as it runs over https), which strengthens the single-pair guarantee to the point where it's about as good as it gets in any security model.

<comment><USER36> _There's no real chance of this being man-in-the-middled_

I'll need more convincing.

 _Once you've approved, they have a browser + app pair of cookies_

Exactly what's keeping the cookie on the browser and the phone from being copied?

You must be leaving out some details. This doesn't strike me as "good as it gets."

<comment><USER35> >* Exactly what's keeping the cookie on the browser and the phone from being copied?*

SSL. Either you trust it or you don't. Similarly, either you trust the CAs to work (preventing a real MITM on https traffic) or you don't. Which makes this as secure as your banking site, except for the initial pairing, which I dare say they do _more safely_ than any bank I've seen.

</comment></comment></comment></comment><comment><USER37> I think this could be a cool hook to expand past photo uploads and be a full ios management tool. Give me a web interface to manage my bookmarks, sms messages, contacts, photos, notes, app third party data, etc.. - You could essentially create a web based ios/android manager. Something like <http://www.ecamm.com/mac/phoneview/> but from the browser.

Keep in mind, all of the above exists already. Its just the elegant method of not having to put a PIN on both the phone + browser doesnt. Cool logon method.

<comment><USER36> _Cool logon method._

An insecure login method does not a cool one make.

</comment></comment><comment><USER21> Totally irrelevant, but if you click on the Bump logo, it changes the background image.

<comment><USER38> They need to fire their UI team.

Wasting time on dumb features like that when the mobile app UI and constant nagging is like dragging your nails over sandpaper.

</comment></comment><comment><USER39> What is Bump's business model? The app is free. These services are free.

<comment><USER40> Same as Fb or Twitter, collect user data and eventually have some great monatization idea. If nobody has a good idea, you can always put AdMob or something on it "this bump was sponsored by ..." something.

The idea is good, the best way so far to say "Bluetooth sucks".

<comment><USER39> Perhaps. I considered this, but Bump data isn't exactly social.

Apparently they licensed their technology to Paypal to build their money- exchanging app. Maybe that's the plan.

</comment></comment></comment><comment><USER41> It just works..

It's been good to seeing Bump innovate again over the past few months.

<comment><USER42> Heh--wait 'till you see what we've got up next. :-)

And, of course, we're hiring. Come help us do this crazy stuff. Email me at firstname.lastname@example.com

<comment><USER19> Their job openings if anyone is interested (as I was):

<http://bump.theresumator.com/apply/jobs/>

</comment></comment></comment><comment><USER43> Might be less than optimal compared to something like iCloud, but it's a pretty awesome example of technology that looks like magic.

I'm thinking they're using both your phone and computer's location + timing of accelerometer activation and spacebar hit to identify the phone and computer being bumped together.

Very neat.

<comment><USER2> You're half right, it's sockets + accelerometer. If you try hitting your phone against any hard surface and hitting the space bar at the same time it triggers the effect too. You can find the socket js in <https://photos.bu.mp/static/js/bump.min.js>

Space bar triggers POST (content:{"category":"Bump","action":"NoMatch","time":1334124838.48,"client_id":"a7g47710-e991-721f-8bb6-ea4013a22fb6","session_id":"1509c654180344aea5660a0349b0caaf"}).

</comment></comment><comment><USER44> If I'm going to chance onto a page with a list of steps, it should be like:

(1) Do this

(2) Do that

And then this happens!

However, the ultra simple two step instruction set on this page is neither preceded nor followed by a statement of _what outcome is meant to occur_. I mean, I figured it out, but it should be dead clear without thinking.

</comment><comment><USER45> Make it a platform and instantly solve one of the biggest hurdles in user- content sites.

</comment><comment><USER46> Why is the Bump Android app 2.74 megabytes large? That seems excessive.

Huh, that doesn't seem to be a welcome comment. I'm not sure why. Bump doesn't strike me as an app that ought to require large media files. Does it contain any? If so, why? Is the binary itself that big? If so, why? Large dependencies? Either way, the size stopped me from checking it out: it takes up space on my device, it takes work to move it to the SD card and if it updates regularly that means more relatively large downloads.

<comment><USER47> If you download it and get it in iTunes on your computer (either via syncing or downloading it there in the first place), then you can inspect the package yourself pretty easily.

But in my experience, 2.74mb is not a large iOS app.

</comment></comment><comment><USER48> been using this since it hit its very early stage beta a few months ago ... all I can say is it is awesome ... truly wonderful when I need to pull a ton of pics off my phone

</comment><comment><USER49> The idea seems novel, but I can't bring myself to download the thing in the off chance I might want to upload photos but I'm nowhere near my computer, or any computer for that matter. Besides that, the page lacks any kind of "Download here" link. I'm sure I could find it on the app store, but I appreciate the added convenience.

</comment><comment><USER50> So what stops me from feeding Bump false data and effectively hold the space bar down to steal ALL the photos?

<comment><USER51> I'd imagine they'll block your IP quickly if you're sending a spacebar event for dozens of different location points every second.

</comment></comment><comment><USER52> I have been waiting all this time for Bump to be useful. It is finally useful, and I am happy.

<comment><USER53> Had bump on my phone for nearly three years now. Have used it exactly three times. This time being the third one. It was impressive, and I'll likely show someone this tomorrow.

</comment></comment><comment><USER54> I can see how this would work well in isolated environments (at home or maybe work), but how would it perform if I was in a crowded area with lots of others using bump. My guess is experience would be miserable.

</comment><comment><USER55> Who needs NFC when you could do this instead? Tap your smartphone on the iPad register, and you're done.

</comment><comment><USER56> Am I the only one who doesn't understand what this is about? The site doesn't give me much information.

</comment><comment><USER57> I've been getting this for a while:

> Uh oh!

> Sorry, there was an error connecting to the Bump service. Please try again > later.

<comment><USER58> 3 hours after your attempts I got the same error. Looks like they aren't ready for this rush.

</comment></comment><comment><USER59> And yet I can't read the page on this iPhone. Probably a negative margin/overflow hidden thing.

</comment><comment><USER60> I can do this faster with the Dropbox App by uploading to my public dropbox folder.

</comment><comment><USER61> And to where does it upload the photos? I have no idea what I am even looking at.

</comment><comment><USER62> Would I have to own an iPhone to understand what this is offering?

Why is there a step 2?

</comment><comment><USER63> Now, make it go the other way! Info off pc to mobile..

</comment><comment><USER64> anyone have a video of how this works ?

</comment><comment><USER65> Brilliant? I thought such words were not to be used on HN titles.

</comment><comment><USER66> I like the idea a lot. It's brilliant. Regarding the removal of the app- and music sharing feature, I noticed that it was the number one complaint and reason for a 1-star review in the app store, and then I saw this on their website:

 _Q. What happened to the music bumping feature?

Listening to you and reviewing our usage data, it became clear that sharing music links wasn't a great experience for you, our users. We have removed it for now to make the app simpler and easier to use.

Q. Why can't I bump apps anymore?

Similar to music bumping, you made it clear that this was not a great feature and therefore, we have removed it to make the app simpler and easier to use._

Marketing tip: don't lie to your users in order to smoothen out the folds and creases, because that _always_ rubs people the wrong way and _always_ makes a company and its product look suspicious. Just say it like it is, "Sorry, guys. Copyright and anti piracy laws forced us to remove these features."

<comment><USER67> It's more complicated than that though. A few months back when they removed those features, they used that spin to turn it into some free publicity that made it sound like they were unconventionally responding to their users. Now they're stuck with that lie, which I'm sure rubs a lot of people the wrong way, but I'll bet it was worth it just to have their name in some memorable headlines.

<comment><USER36> _Now they're stuck with that lie, which I'm sure rubs a lot of people the wrong way, but I'll bet it was worth it just to have their name in some memorable headlines._

Not only are they playing fast and loose with insecure passing of private data, they also tell their users lies? Maybe deleting their app was the right choice for me.

<comment><USER68> That's not a lie. I've read through several hundred bump reviews and their app had very poor ratings from users who expected full app/music sharing. It was misleading in the first place to not give indications of limitations on those features, though. Edit: I had looked after Bump 3.0 and they had tons of 1 star reviews for removing the features, but now they're up to 4.5 stars, whereas they had ~2.5 on Bump 2.0

</comment></comment></comment></comment><comment><USER38> Wonderful idea.

HORRIBLE APP:

Nasty and painfully slow custom UI, I sent a photo then it asked me to rate it 5 stars on the app store. Then I browsed to send another photo and it asked me again to rate it after dismissing that it asked me a 3rd time with a fancy graphical popup.

NO THANKS BUMP, deleted. Someone please feel free to implement this idea succinctly.

</comment><comment><USER69> This is a gimmick and there's no way around it. NFC, once widely supported, will make this obsolete.

</comment><comment><USER70> This is a gimmick. On the other hand the whole app is a workaround for the neutered iPhone communication stack.

Uploading something to a server just to share it with someone standing near you is ridiculous.

<comment><USER71> You mean like chat or email?

<comment><USER16> You /msg or email people standing next to you?

<comment><USER72> ever work in an office?

<comment><USER16> I have but I had a door so maybe that's what is different. But still I don't know why I would stand next to someone and chat / email them...</comment></comment></comment></comment></comment>


How do you keep track of your job applications/interviews? - <AUTHOR>

When applying to jobs, do you use any websites or software to keep track of when you applied for a job, did an interview, and when to follow up?<p>Thanks! <comment><USER2> I usually use a text file or excel spreadsheet to keep track of these things. I've never applied to so many that I couldn't keep track of them in my head.</comment>


A Personal History of Modeless Text Editing and Cut/Copy-Paste (2012) [pdf] - <AUTHOR> http://worrydream.com/refs/Tesler%20-%20A%20Personal%20History%20of%20Modeless%20Text%20Editing%20and%20Cut-Copy-Paste.pdf <comment><USER2> Brad Myer's 1990 video "All The Widgets" demonstrates various implementations of selecting text [1], including Xerox PARC Bravo, Xerox PARC Smalltalk, Symbolics Dynamic Windows, Xerox STAR, Xerox Interlisp-D, Apple Macintosh, Xerox PARC Cedar, Xerox PARC Alternate Reality Kit, Xerox Viewpoint (multi- direction Arabic and Hebrew text), Microsoft Presentation Manager, Sun OPEN LOOK, NeXT NeXtStep, Open Software Foundation Motif, Digital Equipment Corporation DECWindows.

[1] All The Widgets - Selecting Text: [https://www.youtube.com/watch?v=9qtd8Hc90Hw&t=1h1m50s](https://www.youtube.com/watch?v=9qtd8Hc90Hw&t=1h1m50s)

It also covers text entry [2], including SRI International NLS, Xerox XDE, Xerox Star, Apple Macintosh, Xerox PARC Cedar, Sun OPEN LOOK, Open Software Foundation Motif, Digital Equipment Corporation DECWindows.

[2] All The Widgets - Basic Text Editing: [https://www.youtube.com/watch?v=9qtd8Hc90Hw&t=1h13m33s](https://www.youtube.com/watch?v=9qtd8Hc90Hw&t=1h13m33s)

</comment><comment><USER3> So here is an interesting question... why do I (and many others) like vi so much?

Maybe modes are bad for beginners, but really good for experts.

<comment><USER4> I've never been a vi expert, but I've gone for long enough periods using vi keybindings to have been fluent with them. I think there is some kind of emotional/flow/mastery element - it just feels good to acquire these kinds of skills.

I don't use vi keybindings now for a number of reasons. Not using them hasn't slowed me down (which may not mean much either way). But I do see the appeal.

<comment><AUTHOR> The article mentions one facet of this: once you've mastered a modal interface, it can _feel_ really fast. It may or may not actually _be_ fast, but it _feels_ fast, and that is a pleasant feeling.

<comment><USER5> I can definitely see that. Whereas doing something in vim requires multiple keybinds which may take a while to trigger, using mouse and some menu shortcut may take exactly the same amount of time. The shortcut version of vi just feels shorter because you're doing something the whole time.

<comment><USER6> _> because you're doing something the whole time."_

Exactly, while the elapsed time might not be much different there is less context switching so it's easier to stay in flow state.

</comment></comment></comment></comment></comment><comment><USER7> The paper is interesting but I also learned an amazing number of fascinating things about Tesler's career as well!

</comment><comment><USER8> Wow, what a fantastic article jam-packed with history!

Here is a collection of my notes and responses.

Line breaks indicate separate ideas.

\---

\- Ted Nelson would point out that word processor copy and paste misses the analogy to the real world cutting and pasting for posters that Tesler cites in this article in that the copy buffer can only contain one item and whenever another selection is made it silently loses the previous content. (The physical world cut and paste has the cut items still existing).

This is addressed in the box: "Objections to Modeless Editing and Cut/Copy- Paste" but the response is not satisfying.

> Objection 1. User mistakes. After performing a cut, the user might forget > that important text was in what we now call the clipboard. She could lose it > by cutting or copying something else without an intervening paste or undo.

> Response: The ability to do other things between cut and paste entails more > benefits than risks.

> Response: A suitable undoing or versioning facility will allow recovery of > accidentally deleted data.

The first response is too general, certainly there is a way to design separate cut/copy and paste functionality without this risk.

I have yet to use a word processor that has a "suitable undoing or versioning facility". This problem plagues each word processor I have ever seen used. It looks like Tesler overestimated the developers behind word processor applications that came after his on modern PCs. We have more still yet to learn from Gypsy than is represented in Microsoft Word (or google docs or apple word).

\---

\- Early text editors seemed to be a mess of keyboard playing, likely a result of the lack of screens when most were designed and so it makes sense that there needed to be a first invention of the cursor and interactive word processing that we now have thanks to Tesler and others. The cause doesn't matter, but it seems there is room for another transition as they have obsoleted their greatest pain points.

In the box "How Modes Degrade Usability" bullet 2:

> If unmodified letter keys are typed in command mode but the user things the > system is in text mode, unintended and sometimes disastrous results ensue.

It seems that these mode errors should and have been obsoleted by interactive displays as your editor or application can maintain a visual indicator of the mode a user is in. It also seems that this issue would only effect novice users of a software and so shouldn't encourage us to avoid the use of modes when they might overall simplify the user experience.

Once taught about vim's command and insert mode, do users with a visual mode indicator make mode errors? That seems hard to believe.

I also see some other holes in the "NOMODES" philosophy in the dialog box as presented in this article:

> The typical dialog prevented the user from continuing work while it was > open. That made it modal. But the widgets within the dialog could be > operated in any order, making it locally modeless. And the mode escape was > performed in a consistent way...

\---

\- It's fascinating to read the anecdote that:

> Jef Raskin, who was beginning work on a concept he called Macintosh, was > skeptical about the mouse but generously offered suggestions and support.

because Jef Raskin went on to develop the Cannon Cat, and mouseless office and personal secretary computer which was unique for its "Leap" key functionality which allowed the user a press of a button to enable file wide text search to move its cursor.

\---

\- Doug Engelbart would contest the value of the idea that NLS was "hard". That powerful software should be full of features and becoming situated with them shouldn't "need" to be a simple task. Tesler gets into the fine points of number of key presses and the mental models behind having a copy paste buffer, but I don't think that Tesler's advances in this area should indicate a failure of NLS as a whole. It seems the two could have been reconciled, simplifying Engelbart's NLS control system by adopting Tesler's improvements and the methodology of his user studies.

\---

A last mention: Tesler developed the Smalltalk Browser, and I cannot find the source now but there does exist some record of conversations within PARC about that development that are not what we might expect if we just think of this Browser as a code editor. The browser was (as stated in the article) a precursor to modern IDEs and was intended and used to edit code and text within Smalltalk, but it's origin story is more than that, including thought as to how non-programmers would access information in a computer system. The Smalltalk browser was designed as the browser for all text, not just code, within the personal computer.

There is so much more to go into here, this history is so very rich and still full of insights for us to learn from today.

<comment><AUTHOR> _> Once taught about vim's command and insert mode, do users with a visual mode indicator make mode errors? That seems hard to believe._

I do it all the time. When you're deep in flow, it's easy to miss the mode indicator and accidentally trigger an unexpected result.

 _> because Jef Raskin went on to develop the Cannon Cat, and mouseless office and personal secretary computer which was unique for its "Leap" key functionality which allowed the user a press of a button to enable file wide text search to move its cursor._

Everything I've read about Raskin's original vision for the Macintosh makes it sound much closer to the Cat than to the Mac the world eventually got: no GUI, keyboard-centric navigation, etc. The Mac turned out the way it did because Steve Jobs, after leading the failed Lisa project, ousted Raskin and turned the Mac into a kind of Lisa Jr.

<comment><USER8> > I do it all the time. When you're deep in flow, it's easy to miss the mode > indicator and accidentally trigger an unexpected result.

Good point, I suppose I do as well. But I feel that my mode errors in vim have to do with anti-patterns (such as failing to hit esc after every insertion to make it easy, I should always be in Normal mode).

That's interesting to read about Raskin, I have forgotten some of his history, thank you for sharing. I wonder how many better usability ideas were lost in search of performance or the politics of appearance, it seems the list is endless.</comment></comment></comment>


Breaking Into Android Phones with a 3D-Printed Head - <AUTHOR> https://www.forbes.com/sites/thomasbrewster/2018/12/13/we-broke-into-a-bunch-of-android-phones-with-a-3d-printed-head/#305e5c2f1330 <comment><USER3> Hmm. When I had a skin cancer excised by a surgeon, in a followup visit a woman with no ID came in and made a point of taking closeup photos of full- face and profile. When I asked she said this was standard (for minor skin cancer removal). (Same place, where I walked into the room for the procedure, they had Carole King singing "it's too late" at loud volume on a portable stereo sitting on the ground.)

<comment><USER4> I was considering doing a startup addressing skin cancer and a number of Mohs surgeons were happy to have me come in and observe the entire process. To the patients they'd just say "he's observing today" and not even introduce me or ask the patient (or me) to sign anything.

I have a friend whose startup cared was doing a surgical product; after I told him my story he called up a bunch of plastic surgeons and went and observed a bunch of them.

Both of us were interested in workflow; the actual science we had done on animals of course, but our research was aimed at seeing if the product would be viable (could be medically wonderful but if the doctors don't care they won't use it on the patients, even if it improves outcome).

I don't think we could have done this at a hospital, but given that it was surgery (surgeons have a lot of freedom) perhaps we could have.

</comment></comment><comment><USER5> Biometrics will never be a password. It's got to be a combo of something you have and something you know.

<comment><USER6> Agreed. Biometrics doesn't even quality as something you have. It's something that you _are._ If your physical key gets compromised in some way, you can generally have a new one issued. But you can't just re-issue your face.

<comment><USER7> You _can_ , it's just risky and expensive and probably not something you want to do.

</comment></comment></comment><comment><USER8> The article is unfortunately unclear on this, but I believe they succeeded only on the Android phones, not with the iPhone X they also tried it on.

To wit: "[..] four Android models and an iPhone X.

Bad news if you're an Android user: all four phones unlocked with the 3D printed head."

</comment><comment><USER9> Considering I don't use face unlock on anything I care about (most financial apps, for instance, are protected by strong passwords and/or fingerprints) and the sheer fiddlyness of 3d printing, if they can get a scan and print of my head off, they earned what they find. Have fun looking through a bunch of porn and reddit shitposting, I guess.

</comment><comment><USER10> Does anyone know if there's anything about the unlocking method that requires the model to be 3D-printed?

It seems like you could render the 3D model of the head on a monitor and point the phone's camera at the monitor. If the phone needs to see some sort of parallax change relative to its own motion (from internal sensors), then one could put a 6-DOF tracker onto the phone and use it to update the rendered viewpoint of the head (a form of user perspective rendering).

Such an approach would be quite useful for law enforcement to gain access with much less time waiting for printing.

<comment><USER11> The iPhone uses lasers so it's not just imagining but depth measurement. I don't think could be faked with only a monitor.

<comment><USER12> In this example, though, the iPhone did not fall for the 3D printed head, so this attack would likely be just as effective with a picture.

<comment><USER13> Just as _ineffective_

<comment><USER12> I meant against the Android phones, which are just using a 2D camera for face detection.

</comment></comment></comment></comment></comment><comment><USER14> So the iPhone was not fooled? They seem to conveniently ignore this for the remainder of the article - more clickbait power.

<comment><USER15> No such luck with the iPhone X, though. Apple's investment in its tech - <USER2> saw the company work with a Hollywood studio to create realistic masks to test Face ID - has clearly paid off. It was impossible to break in with the model.

<comment><USER16> I imagine this is because the printed head isn't anything but one-color under IR, it's all the same temperature, right?

Seems like an interesting challenge to create a heated fake head.

<comment><USER17> The IR camera and the dot projector they use it with are in the near IR range (as in wavelengths near the visible part of the spectrum). It's mostly only used to get depth data, and it's near-IR so that you don't get a bunch of visible dots projected onto your face every time you use it.

I guess you could see temperatures, but you'd have to point it at something almost hot enough to emit visible light. For normal face temperatures you'd need something sensitive to far IR.

<comment><USER16> If it's just 3D without heat mapping, why don't masks work?

<comment><USER17> I mean... A quick search would show you that masks can work. But I'll bite.

It's really precise 3D with a greyscale non-thermal IR image. Could be inaccurate masks? Missing details around the eyes and mouth and other important areas? Do masks have eyes with a discernable gaze direction? Do they have microexpressions or natural facial deformation? Do the eyes move?

There's a buttload of stuff they could be measuring that is insanely hard to replicate with a mask. Besides, a thermal map would be pretty much useless even if the hardware was capable of thermal imaging. Skin temperature varies a lot (and not always uniformly) based on ambient conditions, physical exertion, being sick, sitting in direct sunlight, etc, etc.

<comment><USER18> Hmm I wonder if it is gaze detection. Seems like if you can detect gaze direction fast enough you could use the presence or absence of saccades to tell if it's a real live person or not. Doing that in a mask/bust would be fairly difficult.

It could also be looking at small changes like the periodic flushing that happens (see [0]). Though I'm not sure how well that would work on a moving phone but it could work I think just at a broader scale. FaceID is really fast though so not certain there's enough time to gather the data for that either.

[0] [http://people.csail.mit.edu/mrub/vidmag/](http://people.csail.mit.edu/mrub/vidmag/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Reminds me of old Mission Impossible episodes where they prepped rubber masks.

<comment><USER20> Mythbusters did an episode about those masks. They only fooled humans at a distance, and then not well.

Grant does a heck of a double-take, though, at one point. It is a fun episode so I won't spoil it.

</comment></comment><comment><USER21> Excuse me while I (covertly) laser scan your face to create a 3d model so I can print it and unlock your phone.

<comment><USER10> For now, at least.

Some companies have massive annotated databases of people's faces from different angles, and the ability to do plausible 3D reconstruction of the faces.

<comment><USER21> Yes, like some DMV's do facial scanning now, and some cities/counties are hooking it up to Amazons Rekognition with cameras mounted in public as well as Palintir software, among others. The FBI tends to use those DB's too. I'll stick to my password, which is actually constitutionally protected, unlike a face, which can be seen from public.

</comment></comment></comment><comment><USER22> I've watched the video and it ends terribly bad.

No, the passcode might be in your head, but if someone sees you in a CCTV entering the passcode, it's not only there anymore.

</comment><comment><USER23> What level of detail do airport security body scanners have? Enough to print a head good enough to unlock a phone?

</comment><comment><USER24> I wish there were an option to make the successful face scan my username, not my password.

<comment><USER25> how many usernames do you need in your phone?

<comment><USER26> Android supports multiple "profiles", so it's convenient when you have a shared device such as a family tablet.

</comment></comment></comment><comment><USER27> Would be interested to see how well Windows hello stacks up on proper hardware.

</comment><comment><USER28> Do any Android users actually use face unlock? It always seemed like a gimmicky feature from the early days of smartphones when everyone was just trying to build up their patent portfolios.

<comment><USER29> I use a OnePlus phone (don't know if HN users have heard of it), and OP users rarely use the fingerprint unlock.

Although the user is definitely compromising on security, the speed of face unlock is such that it is near-instantaneous. Double tap the display, and you don't even have to blink - the phone unlocks.

It may be a gimmick in the early days of Android (think Nougat or even Oreo), but it's definitely not a gimmick now, for me at least. It's fast enough to have proved its worth.

</comment></comment><comment><USER30> This repeats the contents of another, IMHO better-worded article: [https://www.forbes.com/sites/thomasbrewster/2018/12/13/we- br...](https://www.forbes.com/sites/thomasbrewster/2018/12/13/we-broke-into-a- bunch-of-android-phones-with-a-3d-printed-head/)

Please submit the original source to HN!

<comment><USER4> The Forbes link is indeed better.

Forbes links seem to have a poor rep on HN because they are mostly poor blog entires that could have been on medium. The one you posted was an exception.

</comment></comment><comment><USER31> Why didn't Apple consider to unlock phones using a smartwatch instead?

That might have been a compelling reason to actually buy one.

<comment><USER32> You can use an Apple Watch to unlock a Macbook!

<comment><USER33> I really wish they didn't have to be on the same iCloud account though. It would be nice to register my watch to unlock my work computer, but I can't.</comment></comment></comment>


Badass JS is back - <AUTHOR> http://badassjs.com/post/11867989702/badass-js-is-back-with-a-new-look-heres-a-little

<comment><USER2> "...implementing an entire MP3 decoder in JavaScript allowing Firefox to play MP3s without any Flash. Now I'm looking for an H.264 decoder in JS."

Out of curiosity, where does one learn about writing a video codec? Is there a canonical resource for codec implementation?

<comment><USER3> <http://en.wikipedia.org/wiki/Mpeg-2#ISO.2FIEC_13818>

There's quite a verbose spec for all of the major codecs people talk about, but sadly it's 10k(? number I heard tossed around). ffmpeg is a great place to look, but checking out some stuff on fft is a good way to get some background knowledge.

</comment></comment><comment><USER4> Had I not read this I would not be aware of some of these very interesting projects. Thanks!

</comment><comment><USER5> Very impressive! I love it. Thank you for sharing</comment>


YouCompleteMe - A code-completion engine for Vim - <AUTHOR> http://valloric.github.io/YouCompleteMe/ <comment><USER2> How the hell is that a "super-quick installation" for Mac OS?

Can anyone figure out an actually quick way to install it with Pathogen?

PS: the plugin looks great - I'm just bitching about the installation docs because I'm in the middle of 10 different things at the moment and don't have the time to engage in a potential yak shaving expedition...

<comment><USER3> 1\. brew install vim cmake

2\. git clone [https://github.com/Valloric/YouCompleteMe.git](https://github.com/Valloric/YouCompleteMe.git) ~/.vim/bundle/YouCompleteMe

3\. cd ~/.vim/bundle/YouCompleteMe

4\. ./install.sh --clang-completer

<comment><USER4> I just had to rename vim in /usr/bin so it'd pick up the /usr/local/bin homebrewed version instead, but yeah, this.

<comment><USER5> That likely means your PATH is out of order, if ordered correctly /usr/local/bin should override /usr/bin. Can save you needing to do that in the future.

<comment><USER4> Hey, thanks!

</comment></comment></comment></comment></comment><comment><USER6> This takes "super-quick installation" to a new level...

* compile Vim from source

* install and understand Vundle

* depending on some library issues maybe recompile ycm

* Install development tools and CMake

* Make sure you have Python headers installed

How is the usual "unzip it to ~/.vim" installation called these days?

<comment><USER7> YouCompleteMe has an unusually complex installation. These days most vim plugins allow you to simply:

      cd ~/.vim/bundle
      git clone ....

and you are good to go. YouCompleteMe isn't this nice, and suffers for it I think. The _" unzip it to ~/.vim"_ is usually called _" a real pain in the ass to keep up to date and disabled or uninstall."_

<comment><USER8> what!! no dude

</comment></comment></comment><comment><USER9> YouCompleteMe is included with subvim[0], which I have found to be a great flavor of vim. I just forked subvim and tweaked it how I liked from there. Which gets around the painful install of YCM.

[0] [https://github.com/fatih/subvim](https://github.com/fatih/subvim)

</comment><comment><USER10> I'm the main YCM developer.

Most complaints here are about the installation procedure. I tried to make it as easy as possible, but the root of the problem is that you _have to_ compile the ycm_core module so that completion is fast. There's no going around it. The compiled module is the main reason why YCM is so fast when you get it configured.

Other than complicated/rare configurations, installing YCM is IMO not that difficult. The _only_ difference between installing any "average" plugin with Vundle/Pathogen and YCM is running ./install.sh from the YCM directory after you pull it in. That's it. The script will download dependencies for you (libclang), run cmake, make and all the other tools so that everything is installed correctly. It will clean up after itself too. It's pretty hand-holdy so it will tell you if you need to install something (like CMake).

The docs are pretty extensive so you should not get stuck anywhere even if you encounter problems.

I'm happy to hear suggestions on how to further improve the installation procedure. As always, pull requests are welcome too.

YCM too goes out of its way to inform you if you missed something you needed to do, like create a ycm_extra_conf.py file with your build flags (if you want the C-family semantic completion to work) because YCM can't conjure out of the air all the include paths and such needed to compile your project. There's no going around this, a real compiler is used to build the AST so we need the compiler flags.

All in all, if the installation procedure is the main complaint, I'm happy (not really, but you get the point) because that means that actually _using_ the plugin is a good experience (I hope). The installation you go through once and forget about; you use the plugin every day.

Here are excerpts from the FAQ about some of the other things people have brought up:

# Why isn't YCM just written in plain VimScript, FFS?

Because of the identifier completion engine and subsequence-based filtering. Let's say you have many dozens of files open in a single Vim instance (I often do); the identifier-based engine then needs to store thousands (if not tens of thousands) of identifiers in its internal data-structures. When the user types, YCM needs to perform subsequence-based filtering on all of those identifiers (every single one!) in less than 10 milliseconds.

I'm sorry, but that level of performance is just plain impossible to achieve with VimScript. I've tried, and the language is just too slow. No, you can't get acceptable performance even if you limit yourself to just the identifiers in the current file and simple prefix-based fitering.

# Why does YCM demand such a recent version of Vim?

During YCM's development several show-stopper bugs were encountered in Vim. Those needed to be fixed upstream (and were). A few months after those bugs were fixed, Vim trunk landed the pyeval() function which improved YCM performance even more since less time was spent serializing and deserializing data between Vim and the embedded Python interpreter. A few critical bugfixes for pyeval() landed in Vim 7.3.584 (and a few commits before that).

<comment><USER11> > you _have to_ compile the ycm_core

Couldn't you ship a several already compiled binaries for major OSes? What do you do during compilation (and do you have to do this during compilation instead of on runtime) that makes it impossible?

I'm not using VIM anymore, so the question is just at out of curiosity :)

<comment><USER2> Indeed, and if it's about saving on duplicating libraries, that's less important to me than saving on installation time. I don't care if it loads up 20 megs of duplicated libraries because you had to hard-link them in. I have loads of RAM, very little time to set things up.

<comment><USER12> Yet lots of time to comment on HackerNews... ;-)

<comment><USER2> Writing a comment on HN takes me 30s-2m tops. Going on a yak shaving expedition can swallow up hours.

</comment></comment></comment></comment></comment><comment><USER13> So I cloned the repo, ran install.sh and got prompted to run the git submodule checkout for jedi the first time I opened a python file.

Seems like a pretty excellent installation process (on linux anyway) despite the "hackers" complaining in other comment threads.

But the important part is that I'm really impressed by the completion ability, I've only played with it a bit but I'm leaving the rest of my plugins for that turned off and staying with ycm for now. Excellent plugin, thank you!

<comment><USER10> > So I cloned the repo, ran install.sh and got prompted to run the git > submodule checkout for jedi the first time I opened a python file.

Yep, I added that check to better support the use case of people checking out the repo themselves instead of using Vundle (which will checkout the git submodules for you automatically).

I'm happy you enjoy the plugin!

</comment></comment><comment><USER14> I found that other solutions for Vim completion tend tomake Vim slowish when they index a lot of data, for medium~large codebases.

How does your pluggin scale?

<comment><USER15> it's "kinda" async. and it very much depends on the language of your choice.

</comment></comment><comment><USER16> I've been using this for Python development for a few months now and it's by far the best completion solution I've found in vim and I've tried most. Jedi by itself is great but the actual interface to it was always lacking and YCM's fuzzy matching makes it breeze.

</comment><comment><USER17> Sadly, it is still not working too well with Objective-C, which is currently my main language (1). Luckily, unofficial VIM plugins for XCode like XVim (2) or VIEmu (3) are getting better and better, so at least I can use vim bindings for objective-c now, too. Nevertheless, good clang support in Vim would still be great, so that I could tap into the huge amount of vim plugins during objc development.

[1] [https://github.com/Valloric/YouCompleteMe/issues/84](https://github.com/Valloric/YouCompleteMe/issues/84)

[2] [https://github.com/JugglerShu/XVim](https://github.com/JugglerShu/XVim)

[3] [http://www.viemu.com/](http://www.viemu.com/)

<comment><USER18> Thanks, that's good to know. I have been using XVim for a while now. It can be quirky, but it's amazing what JugglerShu has been able to pull off.

Have you used both Xvim and ViEmu? How does ViEmu compare?

</comment></comment><comment><USER19> Hate the name. I can't help picturing Tom Cruise and Renee Zellweger's crying faces.

</comment><comment><USER20> Had latest vim installed from source already on Mac with +python support.

I already use Pathogen so I didn't use the suggested Vundle.

Just placed YouCompleteMe in ~/.vim/bundle/

ran the ./install.sh in the YouCompleteMe bundle directory and it worked.

Thank you guys, this seems awesome so far! :)

</comment><comment><USER21> Works pretty nice but is there anyway I can get it to display function parameters as I type?

</comment><comment><USER22> I've been using YCM for a few months now and I love it. It's a big part of my coding experience now. It's a bit of a pain to get a supported vim version up and running, but completely worth it.

</comment><comment><USER23> If you are a ruby or javascript developer, just use Supertab, because you will waste more time installing it than getting any substantial benefits over default vim completion.

<comment><USER24> How do you achieve completion in Ruby with vim? I'd be interested cause the only things doing completion I've seen for vim so far are always extremely limited (completion on stuff you have in your buffer).

<comment><USER23>
      autocmd FileType ruby,eruby set omnifunc=rubycomplete#Complete
      autocmd FileType ruby,eruby let g:rubycomplete_buffer_loading = 1
      autocmd FileType ruby,eruby let g:rubycomplete_rails = 1
      autocmd FileType ruby,eruby let g:rubycomplete_classes_in_global = 1

and for Supertab

      let g:SuperTabDefaultCompletionType = "<c-x><c-o>"

or

      autocmd FileType ruby let g:SuperTabDefaultCompletionType = "context"

That way you will get omni completion with supertab.

I compiled this from [http://www.cuberick.com/2008/10/ruby-autocomplete-in- vim.htm...](http://www.cuberick.com/2008/10/ruby-autocomplete-in-vim.html) and some SO answers.

</comment></comment></comment><comment><USER25> I could not install it in my work machine as the OS is windows. As a replacement I use neocomplete.vim[1]. It is very fast, responsive, has fuzzy auto-complete. But it requires vim version greater than 7.3.885 and vim compiled with lua bindings. Still it is small annoyance compared to YCM installation procedure.

[1][https://github.com/Shougo/neocomplete.vim](https://github.com/Shougo/neocomplete.vim)

<comment><USER26> neocomplete is also my preferred autocomplete plugin. it integrates very well with all of shougo's other plugins, and it works on windows. YCM officially does not support windows and it's not uncommon for it to be broken for a week or two.

</comment></comment><comment><USER27> This is an absolutely fantastic plugin. The minor installation pain is paid back easily after a few hours of use. Fast, fuzzy matching autocomplete people!!

</comment><comment><USER28> I love YCM.

My only issue with installation was that I would prefer to actually upgrade my systems clang, instead of just installing it in my home dir, and there aren't step by step instructions for doing so.

Once it is installed it is great for C lang stuff and python. It makes me wish other languages had equally good support you could integrate. Perl omni complete is super slow for example. But I know that isn't you.

</comment><comment><USER29> Could not get it to install on Debian. Depends on newer libs than found on conservative Wheezy. Mac was easier but still somewhat arduous. It's necessary complex to install because he's using C++ to get the speed boost. VimScript was too slow.

Once you get it working. It's amazing with Go :)

</comment><comment><USER30> I highly recommend this plugin! I find it really snappy on my projects.

I haven't had the opportunity to try it on any gigantic projects, but I have found configuration files for YCM in the Chromium source tree which suggests that it scales nicely (assuming it's usable on the Chromium tree).

<comment><USER31> I haven't tried it on anything but rather small projects in C: 10-15 source files/modules, but I prefer vim and ycm to XCode for coding. As a matter of fact, all other code completion thingy's I use seem a bit crappy in comparision, with the excempt of bbautocomplete.

Time to install the new beta of vim, and check out ycm! :)

</comment></comment><comment><USER32> Easy to install actually. Worked pretty much out of the box for me. Does anyone know how to change the autocompletion popup background color? A black popup window on black background make things a little harder to read.

<comment><USER32> Answered, Pmenu color

</comment></comment><comment><USER33> Can't wait until this is resolved. [https://github.com/Valloric/YouCompleteMe/issues/84](https://github.com/Valloric/YouCompleteMe/issues/84)

</comment><comment><USER34> I use this with Eclim to enhance java writing. The Vrapper plugin for Eclipse is getting very good, but sometimes it's nice to work directly in vim.

<comment><USER35> I've never gotten eclim to fully work before. I don't do a lot of java nowadays but I just got back into a project where parts of the codebase are in java. So I might try it once again. What has your experience been so far?

</comment></comment><comment><USER36> I think this thread is a perfect example of why cloud apps are all the rage these days. The installation hassle is a big turn off.

</comment><comment><USER37> Just one question. Where do I give money?

</comment><comment><USER38> What colour scheme is he using?

<comment><USER39> Most probably author's custom scheme: [https://github.com/Valloric/vim- valloric-colorscheme/blob/ma...](https://github.com/Valloric/vim-valloric- colorscheme/blob/master/colors/valloric.vim)

</comment></comment><comment><USER40> Love the name!

<comment><USER41> Haha, yea it's pretty great.

</comment></comment><comment><USER42> So, after building vim from source, python from source, and cmake from source (damn old repos...), I'm finally getting stuff to build. and I hit this: Linking CXX static library libBoostParts.a [ 89%] Built target BoostParts Scanning dependencies of target ycm_core [ 90%] [ 92%] Building CXX object ycm/CMakeFiles/ycm_core.dir/LetterNode.cpp.o Building CXX object ycm/CMakeFiles/ycm_core.dir/Utils.cpp.o [ 93%] Building CXX object ycm/CMakeFiles/ycm_core.dir/ycm_core.cpp.o [ 93%] Building CXX object ycm/CMakeFiles/ycm_core.dir/Candidate.cpp.o [ 94%] Building CXX object ycm/CMakeFiles/ycm_core.dir/PythonSupport.cpp.o cc1plus: warnings being treated as errors /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/BoostParts/boost/python/converter/pyobject_type.hpp: In static member function 'static bool boost::python::converter::pyobject_type<Object, pytype>::check(PyObject _) [with Object = boost::python::list, PyTypeObject_ pytype = (& PyList_Type)]': /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/BoostParts/boost/python/converter/obj_mgr_arg_from_python.hpp:101: instantiated from 'bool boost::python::converter::detail::object_manager_ref_check(const T&) [with T = boost::python::list]' /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/BoostParts/boost/python/converter/obj_mgr_arg_from_python.hpp:109: instantiated from 'bool boost::python::converter::object_manager_ref_arg_from_python<Ref>::convertible() const [with Ref = const boost::python::list&]' /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/BoostParts/boost/preprocessor/iteration/detail/local.hpp:34: instantiated from 'PyObject* boost::python::detail::caller_arity<3u>::impl<F, Policies, Sig>::operator()(PyObject _, PyObject_ ) [with F = boost::python::list ( _)(const boost::python::list &, const std::string&, const std::string&), Policies = boost::python::default_call_policies, Sig = boost::mpl::vector4<boost::python::list, const boost::python::list&, const std::string&, const std::string&>]' /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/BoostParts/boost/python/object/py_function.hpp:38: instantiated from 'PyObject_ boost::python::objects::caller_py_function_impl<Caller>::operator()(PyObject _, PyObject_ ) [with Caller = boost::python::detail::caller<boost::python::list ( _)(const boost::python::list &, const std::string&, const std::string&), boost::python::default_call_policies, boost::mpl::vector4<boost::python::list, const boost::python::list&, const std::string&, const std::string&> >]' /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/ycm/ycm_core.cpp:186: instantiated from here /home/zdrillings/.vim/bundle/YouCompleteMe/cpp/BoostParts/boost/python/converter/pyobject_type.hpp:21: warning: dereferencing type-punned pointer will break strict-aliasing rules make[3]: ___[ycm /CMakeFiles/ycm_core.dir/ycm_core.cpp.o] Error 1 make[3]: __* Waiting for unfinished jobs.... make[2]: __* [ycm /CMakeFiles/ycm_core.dir/all] Error 2 make[1]: __* [ycm /CMakeFiles/ycm_core.dir/rule] Error 2 make: __* [ycm_core] Error 2

Now, I went in and removed the -Werror flag from the makefiles and that got around it, but I get a ton of errors when i start vim, doing that:

Error detected while processing function youcompleteme#Enable: line 11: Traceback (most recent call last): Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 11: File "<string>", line 1, in ? Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 11: File "/home/zdrillings/.vim/bundle/YouCompleteMe/autoload/../python/ycm/base.py", line 28 Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 11: except ImportError as e: Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 11: ^ Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 11: SyntaxError: invalid syntax Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 13: Traceback (most recent call last): Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 13: File "<string>", line 0, in ? Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 13: NameError: name 'base' is not defined Press ENTER or type command to continue Error detected while processing function youcompleteme#Enable: line 13: E858: Eval did not return a valid python object Press ENTER or type command to continue YouCompleteMe unavailable: ycm_core too old, PLEASE RECOMPILE ycm_core

I'm guessing it's related. Does anyone have any advice on fixing some of this, so I can try this plugin? it sounds fantastic.

thanks in advance.

</comment><comment><USER43> Great name</comment>


Princeton math prof challenges admins 'systemic racism' narrative - <AUTHOR> https://campusreform.org/?id=15658 <comment><USER2> _Klainerman said that "to promote excellence in research and teaching, major American universities have to develop policies that are blind to considerations of race, ethnicity, religion, sex, socio-economic class and any other factor not relevant to intellectual achievement."_

Here is the problem with that logic. To say now in 2020 that the school should be colorblind does nothing to address the systemic racism that existed for hundreds of years. Princeton did not accept black students until after WWII[1], so several generations of blacks were denied entrance, despite being academically qualified. Their children and grandchildren are therefore denied the benefits of legacy admission (which currently runs at about 30% acceptance vs 5.8% for regular applicants[2]). In this example being colorblind still hurts some students (or helps others, if you see it that way) solely based on the color of their skin.

1\. [https://blogs.princeton.edu/reelmudd/2010/10/black-alumni- lo...](https://blogs.princeton.edu/reelmudd/2010/10/black-alumni-looking- back-1996/) 2\. [https://www.collegetransitions.com/blog/college- legacy/#:~:t...](https://www.collegetransitions.com/blog/college- legacy/#:~:text=Princeton%2C%20with%20its%20minuscule%205.8,grant%20favor%20to%20legacy%20applicants).

<comment><USER3> And yet Black students are better represented than non-Jewish White students. Princeton vs US demographics (in %), from most to least represented:

              Princeton  US    ratio
      Asian   20.9       5.3    3.94
      Jewish   8.0       2.15   3.72
      Black    7.7      12.7    0.61
      White   34.7      59.3    0.58
      Latino   9.5      17.6    0.54

Sources:

[https://en.wikipedia.org/wiki/Demographics_of_the_United_Sta...](https://en.wikipedia.org/wiki/Demographics_of_the_United_States)

[https://en.wikipedia.org/wiki/American_Jews](https://en.wikipedia.org/wiki/American_Jews) (using average of 2.15%)

[https://hillel.org/college-guide/list/record/princeton- unive...](https://hillel.org/college-guide/list/record/princeton-university)

[https://www.collegefactual.com/colleges/princeton- university...](https://www.collegefactual.com/colleges/princeton- university/student-life/diversity/#secEthnic)

<comment><USER2> _And yet Black students are better represented than non-Jewish White students._

Google "Princeton Basketball Team" or "Princeton Football Team" and you will see that Blacks are over-represented on these teams (27% to 30%). I suspect many other sports are similar. You can see how colleges boost the number of Black students in areas where it serves the interests of the school.

[https://goprincetontigers.com/sports/mens- basketball/roster](https://goprincetontigers.com/sports/mens- basketball/roster) [https://goprincetontigers.com/sports/football/roster/2019](https://goprincetontigers.com/sports/football/roster/2019)

<comment><USER4> Would you be in favor of restricting access of black students to ensure others are represented more fairly?

I hope not.</comment></comment></comment></comment>


2006 Google versus 2010 Google on Net Neutrality. - <AUTHOR> http://vooglewireless.com/

<comment><USER2> Company does company do. What's new? It's only when people started to believe the "Do No Evil" propaganda that disappointment follows.

</comment><comment><USER3> Awesome domain name.

</comment><comment><USER4> Striking! Not the same company anymore.

</comment><comment><USER5> Eric Schmidt in 2006: "Today the Internet is an information highway where anybody – no matter how large or small, how traditional or unconventional – has equal access. But the phone and cable monopolies, who control almost all Internet access, want the power to choose who gets access to high-speed lanes and whose content gets seen first and fastest. They want to build a two-tiered system and block the on-ramps for those who can't pay."

Eric even suggested we call our representative to let our voice be heard on net neutrality.

Eric, here's a suggestion. Stop pretending you care about us. For some reason you think what's best for Google is best for everyone. It's not.

</comment><comment><USER6> this was done to preempt a deal between apple and verizon...</comment>


Sound Effects Library - <AUTHOR> http://www.soundsnap.com/

<comment><USER2> I don't like that they don't state their payment terms up front...I have lots of stuff that'd qualify quality wise but I'm bit put off by their offering pay but not actually putting any details of that in the FAQ.

</comment><comment><USER3> Pretty cool. I've used SoundDogs up until this point for SFX for various projects, this might be a good replacement.

</comment><comment><USER4> The guy in the picture forgot to take off the hat before wearing the earphones.

<comment><USER5> No, it's an audiophile thing. You need the hat to get that warm yet crisp yarn sound that no digital effect can replace.</comment></comment>