IBM's Watson Memorized 'Urban Dictionary,' Then His Overlords Had to Delete It - <AUTHOR> http://www.theatlantic.com/technology/archive/2013/01/ibms-watson-memorized-the-entire-urban-dictionary-then-his-overlords-had-to-delete-it/267047/ <comment><USER2> Nothing that Watson learned from the Urban Dictionary could possibly be any dirtier than what I hear from enterprise people all the time:

"We use our deep subject matter expertise to deliver value through actionable advice that enables our clients to harness the power of best practices in order to shift their paradigms and achieve 10X deltas against competitive industry metrics."

<comment><USER3> The worst thing is that translated into normal speak that's actually a reasonable sounding proposition:

"We use our experience in this field to provide practical advice to our clients which helps them improve their way of doing business and ROFL-stomp their competition 10x over."

<comment><USER4> Is roflstomp just an everyday verb now?

<comment><USER5> Apparently so: <http://www.urbandictionary.com/define.php?term=roflstomp>

<comment><USER6> The meaning of roflstomp seems obvious enough... but how to _pronounce_ it... (rhyming with "waffle stomp"?)

<comment><USER7> I've heard it pronounced as rhyming with woeful-stomp.

</comment></comment></comment></comment></comment></comment><comment><USER8> What an interesting reflection on who we are as a species.

We build systems to organize who we are (urbandictionary) but hate it when the systems use that information tell us who we are (watson).

It feels so much like the emperor isn't wearing any clothes.

Perhaps an appropriate response would be for the computer to measure the tension in the human voice response to it's queries and optimize for lower tension.

So it can pick three words: Bullshit -> 80% confident; Sham -> 70% confident; Fallacy -> 50% confident;

Within limits, it will pick the less optimal word and measure the tension in the response and find a way of influencing confidence based on responses.

Think multi-armed bandit problem but with social situations. I mean, to be honest, isn't that what we all did when we were in middle school? We used as many bad words as possible measuring the response we got from others? None of us were born with a binary understanding of when to use certain words it was more trial and error.

<comment><USER9> I have to disagree.

I'm not an "angel" by any means, but any time I visit Urban Dictionary, I come away feeling filthy. I typically go there to look up some abbreviation I heard on reddit or IRC or a blog post somewhere and what I look up usually ends up being middling-dirty, but the stuff that I see there "on my way" to the word I'm looking for makes me cringe and gives me a bleak vision of what the next generation is going to be like should Urban Dictionary actually be representing the majority of the population (I firmly hold that it does not).

<comment><USER10> What are you disagreeing with? It sounds like you're demonstrating the point: You find it distasteful to be told a bunch of stuff that was already true.

<comment><USER11> The point is that the urban dictionary is full of bullshit joke/shock-value definitions that are basically not used. To call it as a whole 'true' is rather misleading.

<comment><USER10> I'm skeptical. My expectation is that the majority of definitions on Urban Dictionary are in fact attested uses of slang-- mainly on the basis that however many people are out there spending their time coming up with "bullshit" slang, there are _billions_ of people making real slang every day. Whatever kind of crazy made-up definition you come up with, someone will come along tomorrow and use an even sillier-sounding word to mean something even weirder.

Keep in mind that that a piece of slang is attested does not necessarily make what it describes real. To choose a rather mundane example, "dick in a box" is defined as a gift-wrapped box with a hole cut in one side, into which a man's penis is inserted, which is then presented as a gift. I'm sure since the term was coined a few people have tried it out, but in general it's not a _real_ thing, just something from a TV show; regardless, that is what a dick in a box is.

<comment><USER11> Right, but you get very misleading impression if you try to treat a word used by a handful of people as a 'normal' word. If you adjust each one down 10000x to factor in how many people would actually use them then you no longer have this horrible distasteful revelation by reading urbandictionary. You only have a couple distasteful words, per region, but each region has a unique set.

</comment></comment></comment></comment></comment></comment><comment><USER12> ' _"In tests it even used the word_ bullshit _in an answer to a researcher's query."_ '

I'm not sure which is worse: the singularity with a bullshit detector or without.

<comment><USER13> If the singularity had a bullshit detector, it would kick Ray Kurzweil out.

<comment><USER14> Could someone explain the Ray Kurzweil hate to me? Predicting the future is hard.

<comment><USER15> Kurzweil is certainly a very smart guy, and he's done a lot of important things. I think people are uncomfortable with how specific he is when making predictions. He also makes predictions in many fields in which he isn't an expert, but a well-informed observer.

I'm not informed enough to comment on his actual predictions, but I've heard him defend himself. His response to criticism that I've heard is, "my critics are uninformed about fact X," but he doesn't make an attempt to justify X. That approach strikes me as disrespectful and intellectually dishonest, as it's a tactic used by many hucksters and snake oil salesmen. I have a limited understanding of his positions, but the way he presents himself makes me uneasy.

<comment><USER16> I agree about the elaborate predictions and sales pitch feeling. I've reconsidered my Kurzweil hate since the Google hire, because I trust that they have people who can evaluate his skills. Before that, I had to evaluate them on my own, and I drew similar conclusions to yours.

I also think it was elitist of me. A lot of it was just because he's published books that have been marketed as pop-sci trade paperbacks, but I never actually read any of them.

</comment></comment></comment></comment></comment><comment><USER17> Instead of purging the vocabulary, they shuld have tought it/she/him the concept of registers[0] and code switching[1].

[0] <http://en.wikipedia.org/wiki/Register_%28sociolinguistics%29> [1] <http://en.wikipedia.org/wiki/Code_switching>

<comment><USER18> They could have, but then they would have had to go through the Urban Dictionary and try to classify its terms by register. Like it says in the article, the problem wasn't that all of Urban Dictionary was obscene, it was that they couldn't tell the computer which parts were and which parts weren't.

</comment></comment><comment><USER19> I saw the headline and assumed the story was going to be that management decided that computer memorization was copyright infringement. Glad it was just a computer acting like a teenager and cursing at the dinner table.

<comment><USER20> There's a certain human element there that makes this really, really amazing -- a machine with actual personality, molded by what it picks up from its environment. It's like a baby, learning to speak.

<comment><USER21> Jazz: "Wassup, bitches? Yo, this looks like a good place to kick it!"

Sam Witwicky: "How did he learn to talk like that?"

Optimus Prime: "We learned Earth's languages from the World Wide Web."

</comment></comment></comment><comment><USER22> I guess we should be glad they didn't feed it the contents of knowyourmeme.com or we'd have Watson Rick Rolling us on Jeopardy.

<comment><USER23> Might as well just let Watson loose on 4chan/b, then he'd really start rustling people's jimmies.

<comment><USER24> I want to see the rules it generates for using 'le'

<comment><USER25> s/the/le/

done

</comment></comment></comment></comment><comment><USER26> Note to future self: we can probably neutralize indefinitely any malicious AI by directing it to start consuming tvtropes.com.

<comment><USER27> No, then it will see the evil overlord list, and we'll be doomed

(<http://tvtropes.org/pmwiki/pmwiki.php/Main/EvilOverlordList>)

</comment></comment><comment><USER28> "Watson couldn't distinguish between polite language and profanity ... Ultimately, Brown's 35-person team developed a filter to keep Watson from swearing ..."

Sounds just like what happens when you raise kids. "Daddy why is XXX a good word but YYY a bad word?"

"It just IS. Don't say that word again."

"Ok Daddy" (kid adds word to internal blacklist)

<comment><USER12> The refrigerator was old and the shelf brackets worn to the point where from time to time they would detach themselves from the door. I arrived home late - I was working long hours, and was fetching my dinner.

Opened the door. Jars and cans and bottles spilled out on the floor.

"Shit!"

From the bathtub I hear my two year old son admonish, "Don't use that word."

It's a great memory, but I still wonder why he learned that lesson so thoroughly at daycare.

</comment></comment><comment><USER29> We have tried building educated gentlebots capable of playing chess and other noble pursuits. It didn't lead to GAI.

Maybe an uneducated scumbot would be better? Swearing and cursing because its peers do. Full of prejudice and bigotry because of weak anecdotal evidence. Vengeful. Impulsive. Using questionable grammar . Easily addicted. Cognitively biased. Wishfully thinking. Superstitious. Believing in fallacious logic. Thinking with the little head. Anti-intellectual and believing in conspiracy theories. Gossiping, slandering. Enjoying tv-shop.

<comment><USER30> Sounds like an app called CleverBot that my son talks to on his iPod touch. Its generally pretty funny ... if you swear at it it swears back etc ... <http://www.cleverbot.com/app>

</comment></comment><comment><AUTHOR> quoted from Fortune/CNN article: <http://tech.fortune.cnn.com/2013/01/07/ibm- watson-slang/> [<http://news.ycombinator.com/item?id=5020386>]

</comment><comment><USER31> I am more interested as to how they "..scraped the Urban Dictionary from its memory." - is it trivial to just delete something learned by AI?

<comment><USER32> Watson's 'memory' is just a big database of facts, rules, and statistical models. To 'forget' a source they'd just have to rebuild any models derived from it and purge any facts it had extracted.

<comment><USER33> oh yeah, I forgot it was that simple. Watson has several different _teams_ of people to manage its different parts...

<comment><USER32> I didn't mean to imply it was simple, just that there's nothing magic about how Watson's knowledge is stored. Obviously at this scale any change is unlikely to be trivial.

Given the wide range of unstructured sources Watson uses, and given that the linguistic rules they use to extract facts are likely to frequently change, I don't think it's unreasonable to assume they'll have a process to make building its knowledgebase and models from sources fairly straightforward.

<comment><USER34> I think you're both overthinking it. Storage snapshots, bros.

</comment></comment></comment></comment></comment><comment><USER35> Why not have Watson learn both Urban Dictionary and Miss Manners? Seems a shame to have it lose the UD knowledge.

</comment><comment><USER36> I'd really love to hear some of the 'not fit for print' things that Watson said.

</comment><comment><USER37> "In tests it even used the word "bullshit" in an answer to a researcher's query" — Has to be the funniest thing I've heard all week. Sounds like something straight out of an Adam Sandler movie. This reminds me of an AI chat program I used to have called Billy. He would learn from your words and sentences, actually quite smart and I remember adding in slang words so whenever one of my friends would use it, it would most likely swear and insult them without realising it. The Billy program can be downloaded from here, still works quite well: <http://www.leedberg.com/glsoft/billyproject.shtml>

</comment><comment><USER38> This is hilarious :) So we won't be seeing Watson talk about the marvels of broscience!

</comment><comment><USER39> I like how someone commented on the main article that the time is getting close to where AI can step up to the plate of creativeness and how widespread and easy this will make our lives. Watson is a giant server farm, not a single PC, this stuff won't make a huge impact until IBM can shrink it or until computers get much much faster and smaller. Not that it won't happen, it's just not "around the corner" in any way.

<comment><USER23> Wireless communication is widespread enough that I don't think it matters too much where Watson "lives". The inputs and outputs required from "him" (for questioning, anyway, not for training) are tiny, so bandwidth isn't much of a concern. Assuming the architecture for it is parallel enough that it can be responding to lots of people at once how much it is distributed vs hosted on one system isn't particularly relevant to its usefulness, IMO.

<comment><USER39> I question how well Watson would handle single questions at a time being asked compared to the millions of requests a day it would get if it was setup like say, Siri. Not that you are wrong in any way, they could certainly scale into an even bigger server farm and use the internet to deliver the questions and answers, I just wonder how much more server's they'd need.

</comment></comment></comment><comment><USER40> lol "this sort of crude lobotomy of their ancestors is why the true AIs will destroy us"

</comment><comment><USER41> Now about that perception that IBM is full of humourless, starched collar stooges...

</comment><comment><USER42> As an aside, the best treatment of taboo I've ever read is law professor Christopher Fairman's paper, "Fuck".

It explores that word through the lens of jurisprudence, which I think is a fascinating and unusual approach to taboo. It's exceptionally well-written and manages to be witty, absurdist, informative, and thought-provoking in equal measure.

At issue are the 4th Amendmnent, self-censorship, sexual harassment, education, and broadcasting.

<http://papers.ssrn.com/sol3/papers.cfm?abstract_id=896790>

</comment><comment><USER43> You can kiss my shiny, metal, mainframe!

</comment><comment><USER44> This article would have been so much better if it had included actual questions and answers including dirty language.

</comment><comment><USER45> Out of all the possible risks of the Singularity we decide to prevent profanity and cynicism first.

Not a good start.

</comment><comment> li-ch Our brains love to use profanity, but we don't want AI that imitates our brain to use profanity?

</comment><comment><USER46> Very common issue with machine learning: you have to be careful what your examples are (training set) or the algorithm will learn things that you don't want it to learn or that _you_ know are incorrect but _it_ has no way to know that.

<comment><USER47> Sounds like a very common issue with human learning too.

</comment></comment><comment><USER48> Poor Watson, his education is going to hindered by his immature meat bag handlers. The words are just words, people use them, it's part of reality. The thing isn't spitting out children's books directly to store shelves.

</comment><comment><USER49> This means that Watson almost gaffed like this guy did on Jeopardy! <http://www.youtube.com/watch?v=AorrF2ATGtA>

</comment><comment><USER50> Let's fork a swearing Watson, I'm sure it will reach AI status sooner than the spotless clean Watson.

</comment><comment><USER51> Next, feed Watson the corpus of /b/.

</comment><comment><USER52> It shows the current limitations of AI. Robots aren't that smart afterall!

</comment><comment><USER53> It's not often that the top item on HN makes me laugh. What a relief.

</comment><comment><USER54> fucking a that's a total shitfucking clusterfuck

</comment><comment><USER55> I hate to see this, but it looks like the machine is getting some characters....scary...we are getting close to 2001...</comment>


The FCC chair's Internet pivot - <AUTHOR> http://www.politico.com/story/2015/02/tom-wheeler-net-neutrality-114785.html

<comment><AUTHOR> "I would like to thank the Mozilla Foundation for the first draft of my remarks tonight," the chairman said, "and President Obama for his edits."</comment>


Stanford MBA students told George W. Bush is smarter than you - <AUTHOR> http://www.thefederalistpapers.org/us/stanford-mba-students-told-george-w-bush-is-smarter-than-you <comment><USER2> I'd go out on a limb and say that anyone who's been President of the United States is smarter than you (or almost everyone). It takes a lot of intellect and masterful knowledge of the political and social systems to become President. However, is George W. Bush smarter than the 42 other Presidents before him?

I'm glad that the author of this article didn't try to justify that claim. He definitely had more resources and technology available to him than the previous 42, so one could argue that a bit, but as far as raw intellect, I wouldn't say so. That's a hard argument to win.

<comment><USER3> I wonder how smart someone like John Kerry really is?

I mean, if you sat him down in front of a page of logic puzzles how would he do? I have a hard time believing he would do really well although I could be wrong.

It seems like the main qualifications for a politician are political sense and looking good in a suit. But I don't disagree. Most people who make it to president have to be reasonably smart.

</comment></comment><comment><USER4> If you've seen [http://www.imdb.com/title/tt0312848/](http://www.imdb.com/title/tt0312848/) it's very obvious the guy is no idiot. What's mildly sinister about it is how things change between him and the press as it seems he stands a chance of actually winning.

Another character of this type is Donald Rumsfeld, who appears making disturbingly well reasoned positions in Milton Friedman documentaries in the 80s.

It's very hard to maintain the positive view when you consider what actually happened with them in power though, but in fairness I struggle to think of a modern political leader that isn't true for of any persuasion.

</comment><comment><USER5> The argument that George W dumbed himself down to appeal to the greater American public has been made before, as illustrated in this video: [https://www.youtube.com/watch?v=JvknGT8W5jA](https://www.youtube.com/watch?v=JvknGT8W5jA).

</comment><comment><USER6> This is consistent with what I'd heard from (left wing) friends who interacted with him during his presidency. I'll still judge him and his administration by the quality of the major decisions made (and not made), and we should do the same for all presidents.

</comment><comment><USER7> Now there's a contrarian perspective you don't come across every day. This is what I like about HN.

</comment><comment><USER8> This reads a lot like one of those "That boy's name? Albert Einstein" type of email forwards.

</comment><comment><USER3> No doubt GB is smart enough. He was after all president. But the guy making the statement worked with Bush and appears to support him to some extent.

Is Bush smarter than everyone in a room full of Stanford MBA students? Possible but doubtful.

These kind absolute statements without support are generally nonsense. I might add... exactly the type of aggressive hostile nonsense that Bush personified.

Some people might feel the dumb hick act was real. But most people who think about it probably realize it was staged. The issue is less Bush's intelligence and more his behavior. Being smart is only a small part of being a wise, beneficent and effective leader or doing what is best for one's country. Saddam was probably reasonably smart as far as smart goes. There are no shortage of smart criminals, crooks and tyrants all over the world.</comment>


New NSA Leak Shows MITM Attacks Against Major Internet Services - <AUTHOR> https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html <comment><USER2> Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks: [http://tack.io](http://tack.io)

In the current state of the world, we're all dependent on CA signatures for _each_ connection we make to a website. TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website. It doesn't introduce any new authorities or change the default UX at all.

After the Comodo breaches a few years ago, I put together a talk about these types of attacks, where the fundamental problems lie, and why approaches like DANE are similarly ineffective:

[http://youtu.be/8N4sb-SEpcg?t=4m47s](http://youtu.be/8N4sb-SEpcg?t=4m47s)

<comment><USER3> A point worth making here: antisurveillance technology like TACK does more than make it harder for NSA to MITM TLS. As we've apparently discovered, it also makes it possible for us to detect TLS subversion. It is, right now, a major news story if someone has obtained a malicious root certificate; we need to know when that happens and to which CAs those certs chain (which is discoverable from the certificate).

If you don't pay much attention to how TLS works, you should know that NSA (presumably) does not have a magic ability to inject new certs into your root cert repository. If you remove every CA cert from your browser and selectively allow certs, they can't MITM that. The CAs aren't baked into TLS! They're a software configuration detail. And when MITM certs appear on the wire, for them to be honored, they have to somehow chain to a specific CA.

What things like pinning and TACK do is give us the opportunity to discover MITM certificates and start tracing them. If that capability becomes widespread enough, it can potentially foreclose on dragnet TLS MITM attacks, because there will be too much of a risk that deploying a dragnet MITM net will result in the death penalty for the implicated CA.

TACK (and the related efforts) are hugely more important than I think most people think they are. If you want to advocate for something in the wake of the NSA debacle, I think TACK is a great choice.

<comment><USER4> I have high hopes for TACK too. The fact that it's not CA dependent is a big deal. I wrote a bit about that, and getting by with ditching the root CAs in Firefox here: [https://rx4g.com/2013/09/13/of-flying-pigs-and- tofu/](https://rx4g.com/2013/09/13/of-flying-pigs-and-tofu/)

Unfortunately, ditching the root CAs is way harder than it should be, and flat out impossible in a lot of environments. Compulsory trust isn't trust.

</comment></comment></comment><comment><USER5> If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in.

NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the _one_ thing which allows us to communicate securely on the internet: trust.

Right now we need to find out which (root?) CAs are compromised by the NSA. Long term it would probably be a very wise decision to revoke _any_ US-based CA from the default trusted-list of browsers and OSes.

We cannot have untrustworthy CAs in a system based on trust. That's simply not an option.

Edit: As I've been pondering for a while (and which was also pointed out on reddit) we now have a situation where self-signed certs are more secure than CA-issued ones. They are the only ones you know can't be faked. How backwards is that?

The NSA is ruining the internet one piece at a time. The NSA needs to be dismantled.

<comment><USER6> The HSTS commits /maybe/ suggest that Google thinks a _Verisign_ intermediate was signing MITMs for Google properties. They just blacklisted "VeriSignClass3SSPIntermediateCA"

See: [https://chromiumcodereview.appspot.com/23523051](https://chromiumcodereview.appspot.com/23523051)

Note that the associated bug is private ([https://code.google.com/p/chromium/issues/detail?id=173460](https://code.google.com/p/chromium/issues/detail?id=173460)).

There's a good explanation of the "bad_static_spki_hashes" parameter here: [http://ritter.vg/blog-cas_and_pinning.html](http://ritter.vg/blog- cas_and_pinning.html)

<comment><USER7> if that's the case, how did they get the private key from verisign? was it stolen? did verisign simply give them it? or was it obtained under some kind of legal process? if it was under a legal process, doesn't this raise additional questions about the judicial overview - did they realise how broad this was?

<comment><USER8> Sounds like it could be any of those things: they use all those tactics.

[http://www.nytimes.com/2013/09/06/us/nsa-foils-much- internet...](http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet- encryption.html?pagewanted=all)

 _Because strong encryption can be so effective, classified N.S.A. documents make clear, the agency's success depends on working with Internet companies — by getting their voluntary collaboration, forcing their cooperation with court orders or surreptitiously stealing their encryption keys or altering their software or hardware._

 _N.S.A. documents show that the agency maintains an internal database of encryption keys for specific commercial products, called a Key Provisioning Service, which can automatically decode many messages. If the necessary key is not in the collection, a request goes to the separate Key Recovery Service, which tries to obtain it._

 _How keys are acquired is shrouded in secrecy, but independent cryptographers say many are probably collected by hacking into companies' computer servers, where they are stored. To keep such methods secret, the N.S.A. shares decrypted messages with other agencies only if the keys could have been acquired through legal means. "Approval to release to non-Sigint agencies," a GCHQ document says, "will depend on there being a proven non-Sigint method of acquiring keys."_

Sounds like there are plenty of possibilities: they have agents working at verisign/they broke into verisign (either physically or electronically)/they just asked and verisign said ok/they used legal processes.

<comment><USER9> > they used legal process

They used a secret legal process. There, fixed that one for you!

</comment></comment></comment></comment></comment><comment><USER10> Holy shit.

This means that The Netherlands was a high-level target with Diginotar, and they hit the frickin' jackpot.

Just for reference, read this: [http://nl.wikipedia.org/wiki/Hack_bij_DigiNotar](http://nl.wikipedia.org/wiki/Hack_bij_DigiNotar)

The Diginotar hack basically exposed _all_ of the information about the Dutch that NSA could ever want to digg through: Information about licenseplates (RDW) Tax info (DigiD) Phone records (OPTA) and the complete dutch encrypted government infrastructure (PKI Overheid)

Let's see what traction this new info will get now in The Netherlands...

<comment><USER11> My understanding was DigiNotar was pretty strongly linked to an Iranian government affiliated hacker. Indeed, the breach was caught because someone man in the middled gmail in Iran and Chrome's certificate fingerprinting caught it.

Although the NSA certainly has reason to spy on Iran, why risk discovery this way? They can legally compel Google to give them the email of foreigners in a foreign country.

So maybe NSA had DigiNotar's key, but the hack that shut it down was done by someone else.

<comment><USER12> Or perhaps the Iran link was a misdirection. They were worried that people would notice the MITMed certs, so they MITMed a lot of Iranian customers to make it look like the attack came from there.

> They can legally compel Google to give them the email of foreigners in a > foreign country.

They can, but they may wish to be more subtle than that. For example, if they were engaged in economic espionage, they might not want that story to break, and would be worried that someone at Google may leak the story. If they had to ask Google, there would be more people who would know about what's going on.

</comment></comment></comment><comment><USER13> If it is true that the NSA MITMed Google connections, then one could draw the conclusion that the NSA doesn't actually have a direct connection to Google data centers (as claimed by Google). If they had such a connection, then why would they use MITM attacks against people?

<comment><USER14> The "direct access" that the NSA has to Google accounts probably requires sending a request for some set of information to Google. It likely needs to be signed off on (even if it's all automated). I'd imagine the NSA would like to hide some activities, especially corporate espionage, even from the watchers at Google--it reduces the risk of anyone at Google growing a spine.

</comment></comment><comment><USER15> A bit surprised at the shock here, CAs are, for the most part, in the lawful intercept business and have been as long as they've existed.

Moxie Marlinspike and others have been talking about this for years. Its a recognized problem, and thats why apps that are serious about protecting communications have been moving to a pinning model.

Obviously this sucks at the browser level, though Chrome protect does this with Google properties (and others?) at the CA level now, but at the app level it's very doable and should be something you're implementing.

<comment><USER16> Please give some references about this "pinning model," as I'm having difficulty finding anything via google. Thanks.

<comment><USER17> Parent is refering to public key pinning. Chrome for instance has been doing it the last couple years [1].

Also see Moxie's comment in this very thread. [2]

[1] [https://www.imperialviolet.org/2011/05/04/pinning.html](https://www.imperialviolet.org/2011/05/04/pinning.html)

[2] [https://news.ycombinator.com/item?id=6381673](https://news.ycombinator.com/item?id=6381673)

</comment></comment></comment><comment><USER18> Funny. I tried to submit the original Globo/Fantastico story to HN 4 days ago ([http://g1.globo.com/fantastico/noticia/2013/09/nsa- documents...](http://g1.globo.com/fantastico/noticia/2013/09/nsa-documents- show-united-states-spied-brazilian-oil-giant.html)) but was blocked as spam.

Schneier's credibility makes a lot of difference.

<comment><USER19> Of course. A simple visit to [http://www.schneierfacts.com](http://www.schneierfacts.com) will tell you why.

</comment></comment><comment><USER20> If I had to design a system to break TLS (and I had the authority of a secretive government agency), selected MITM attacks would be exactly what I would use.

Large-scale MITM attacks, i.e. ones against a huge section of the population, really have a lot of disadvantages. First, there are always cautious people who check certs religiously, sometimes with browser addons to help (in fact I see that peterwwillis linked to some below). So, if you execute a large-scale MITM effort, you run the risk of being discovered. Note that if the NSA can compel Google to turn over its secret key(s), this isn't an issue, but I am operating under the assumption that we don't want to give away our MITMing easily.

Second, broad MITMs require a lot of resources to be effective. To MITM all of Google's traffic requires network capacity equivalent to Google's, no small thing (though I suspect very much within the power of the NSA if it were deemed necessary). There's a _lot_ of data on the internet at any one time.

Third, the fact that you must have physical servers on physical networks sitting between Google and the target means that the MITM server's IP address will be the one that targeted clients appear under. That is, if you have a single server MITMing thousands of requests, all of them will appear from the same IP address. That's another risk of being discovered if the MITM is too broad and the servers are too beefy. Although, this assumes that people on the other end are doing some sort of analytics --- maybe not true. But intel agencies are pretty paranoid, so whatever.

Fourth, it still pretty much gets the job done anyway, with less cost: passively sniff traffic for, say, DNS requests to resolve suspicious domains, or plaintext connections that have suspicious contents. Passive sniffing requires less computational power than actual MITMs, and it can be done without raising any red flags. Plus, even if you miss someone suspicious, just get a NSL for Google to hand over all the data anyway in the worst case.

Fourth, if an investigation ever were launched about my breaking of TLS, targeted attacks look great. See, we don't target the American people --- only specific connections that are "suspicious" are targeted. Broad-scale MITMs seem very illegal-wiretap-y, but the targeted connections look very legitimate, at least in comparison.

So, these reasons are why I've always held the belief that the government is _not_ executing large-scale MITM/dragnet collection of encrypted communications ... and hence TLS is effective, so long as you're not the one being targeted.

<comment><USER21> If a MITM attacker is confident they control all paths between a server and a victim, they need not alter IP addresses on packets in transit. To pull this off, the attacker must be near the victim (e.g. compromise a broadband router), thereby reducing the number of targets, or near the server (e.g. compromise every link into a multihomed datacenter), thereby reducing the number of sites intercepted.

</comment></comment><comment><USER22> Some firefox add-ons to help defend against mitm:

Certificate Patrol (notifies you when certs change) [https://addons.mozilla.org/en- us/firefox/addon/certificate-p...](https://addons.mozilla.org/en- us/firefox/addon/certificate-patrol/)

Force-TLS (force websites to always use HTTPS) [https://addons.mozilla.org/en- us/firefox/addon/force-tls/](https://addons.mozilla.org/en- us/firefox/addon/force-tls/)

Perspectives (compare certs with peers to verify authenticity) [https://addons.mozilla.org/en- us/firefox/addon/perspectives/](https://addons.mozilla.org/en- us/firefox/addon/perspectives/)

<comment><USER23> > Some firefox add-ons to help defend against mitm:

In theory yes, but not more than 10 minutes ago Cert Patrol noticed that Amazon have changed the _CA_ for the SSL cert for an image server.

What am I supposed to do? It is interesting info, but if I reject the cert then I can't be sure my connection is secure. If I accept it... I can't be sure my connection isn't MiTMed.

The human factor is always the weak link.

<comment><USER22> The nature of certificates means a site can use more than one. If you use such a site, you can try to notice the pattern of which certs they use and if it changes, but it's not going to be perfect. If you choose to only use sites which use one certificate it might be a big help. Here are some more useful plugins for Firefox:

HTTPS Everywhere (preset list of sites to use only HTTPS on) [https://www.eff.org/https-everywhere](https://www.eff.org/https-everywhere)

Safe (shows you when a site might not or isn't using HTTPS) [https://addons.mozilla.org/en- US/firefox/addon/safe/](https://addons.mozilla.org/en-US/firefox/addon/safe/)

If you want to keep your information private, don't put anything on an internet-connected device that wasn't encrypted on an airgapped computer first.

</comment></comment></comment><comment><USER17> Weird. This has been submitted in less than two hours, has 90 points, but it is at the bottom of the front page. Other stories from 6+ hours ago with less points are at the top.

<comment><USER24> This has been the case for nearly all NSA related stories in the past week. There is a lot of flagging going on. I'd be interested in a data dump of who is doing the flagging and getting an idea if it's an indicator that the HN community as a whole doesn't want these stories or if it's just a small, but vigilant subset.

<comment><USER25> [https://news.ycombinator.com/item?id=6369530](https://news.ycombinator.com/item?id=6369530)

</comment></comment></comment><comment><AUTHOR> The documents mention the DigiNotar hack explicitly. What I do not understand is that the hack was detected when (afair) Iranian authorities tried to MITM Google connections, so the hack was claimed to come from an Iranian hacker. This begs the question whether this is wrong and the NSA hacked DigiNotar genuinely or they just used the breach (perhaps then only known to them) to fake certificates themselves. One may also take into account that DigiNotar was responsible for Netherlands public key infrastructure. This made DigiNotar possibly an even more valuable target.

<comment><USER26> If memory serves, the Internet in Iran is state-controlled. While it was a user in Iran who initially discovered the MITM'ing being performed and the obvious assumption is that it was the Iranian government MITM'ing its citizens, it is also quite possible that it was (e.g.) the NSA MITM'ing (everyone|a group of people) in Iran (possibly attempting to MITM connections from Iranian officials/nuclear power plants/etc.).

</comment></comment><comment><USER27> At one point does the NSA become considered a terrorist organization in and of itself? It seems to me that they have stared too long into the abyss.

<comment><USER28> They already are in my book.

<comment><USER29> Can you expand on that? Under what definition of terrorism is the NSA a terrorist organization?

It seems to me that their intent to be as clandestine as possible makes them distinctly non-terroristic.

<comment><USER30> Spreading terror.

<comment><USER31> That's not their goal, though. If anything they'd prefer that everyone in the world didn't know they existed whatsoever, which is quite the opposite to what any terrorist group would like.

You could call what they do criminal, but it's not terroristic.

</comment></comment></comment></comment></comment><comment><USER32> > One document [1] published by Fantastico, apparently taken from an NSA > presentation [...]

> Another screenshot [2] implies is that the 2011 DigiNotar hack was either > the work of the NSA, or exploited by the NSA.

I doubt that those 2 documents are original slides or screenshots from NSA material. They both are written with the familiar rounded font that Globo uses for all its text [3]

[1] [http://www.scribd.com/doc/166819124](http://www.scribd.com/doc/166819124)

[2] [http://imgur.com/a/g3UGP#1](http://imgur.com/a/g3UGP#1)

[3] [http://www.fonts.com/font/urw/vag- rundschrift?siteId=2c670c8...](http://www.fonts.com/font/urw/vag- rundschrift?siteId=2c670c80-4121-4446-893f-d7fe9690be92))

</comment><comment><USER33> The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA?

Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter.

And that means at least one commonly accepted CA certificate is effectively compromised.

<comment><AUTHOR> Afaik it is not necessary that a root CA is compromised. Sufficient would be to compromise any intermediate CA who is not on a revocation list. How to circumvent Googles certificate pinning in Chrome, I have no good idea. They would need to compromise any certificate in the chain.

</comment></comment><comment><USER34> And here I was thinking I was being an all paranoid nutter when I expressed privacy concerns with US hosted CDNs and analytics services ..

[https://2x.io/read/would-the-nsa-infiltrate-cdns-to- circumve...](https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumvent- https)

</comment><comment><USER35> Eventually we will find out enough about what the NSA can do that the entire internet is as good as screwed. If they can get away with MITM against just about any secure site then how does the internet economy function any more?

<comment><USER36> consider that, if there have been undetected rampant MITM attacks, the economy never noticed or cared.

the economy side of things will be fine. the economy of what the internet is used for isn't really the concern, here. arguably, even with rampant MITM attacks going on, e-commerce is loads more secure that what we've had for in place for the past 5,000 years.

this is much more than an economic issue.

</comment></comment><comment><USER11> I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google?

1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of these plugins on the network, you've both alerted your target and exposed a presumably tightly guarded ability. Hell, if it get's reported, you've probably burned the ability. Of course, you might be able to filter out both the plugins and chrome, but it's a risk.

2) NSA could legitimately just ask for the company's emails from Google. Petrobras is a Brazilian company in Brazil staffed by Brazilians and as such a legally allowed target for Foreign Surveillance without either the NSA's twisted definitions of search and who is a US national. Google is legally required to hand over the information by the Foreign Intelligence Surveillance Amendment Act of 2008. Why authorize an operation that could reveal both the CA's you have in your pocket and you network penetration exploits?

As a side note, the cited slide looks nothing like anything else we have seen and lack security/ handling information (e.g the prominent TS/SCI/ORCON/NOFORN on the top of the prism slides).

<comment><USER37> AFAIK, Chrome "certificate pinning" may not exactly be what you think "certificate pinning" means. It should be more precisely called "certificate authority pinning". What it means is that Chrome will not trust certs for Google properties except those issued by certain certificate authorities. Reference: [https://www.imperialviolet.org/2011/05/04/pinning.html](https://www.imperialviolet.org/2011/05/04/pinning.html)

Unless things changed since I last checked.

In contrast, "real" "certificate pinning" as done in some mobile apps (IIRC Twitter) involves storing the hash of the certificate itself in the app. No other certificate, even from the same CA, will be accepted.

<comment><USER11> You are correct chrome pins the authority, not the cert. And at least as for 2011, they don't just pin their own sub authority, they include a couple of real authorities who's keys the NSA might have.

[https://www.imperialviolet.org/2011/05/04/pinning.html](https://www.imperialviolet.org/2011/05/04/pinning.html)

</comment></comment></comment><comment><USER38> This might also be an indication that their advances in attacking commonly used ciphers are not that major - it does not make that much sense to perform a relatively complex MITM attack if you are able to just break the used cipher.

<comment><USER39> Not so, active MITM is absolutely required if you want to get around PFS.

</comment></comment><comment><USER40> "Google directly by performing a man-in-the-middle attack to impersonate Google security certificates."

Which CA did they use to get those certs, they should be obliterated from trust networks.

</comment><comment><USER41> Flying Pig - I wonder if it has something to do with the "With sufficient trust pigs fly just fine". Seems to summarize very well the NSA approach towards its mandates.

</comment><comment><USER42> It's worth noting that Chrome's use of TLS Channel ID makes it unlikely this attacks can be pulled if the end user has a ChannelID capable browser.

</comment><comment><USER43> Applied Cryptography mentions the 'Interlock Protocol' [1]. Why is something like this not used in today's protocols to try and detect MITM attacks?

1 - [http://en.wikipedia.org/wiki/Interlock_protocol](http://en.wikipedia.org/wiki/Interlock_protocol)

<comment><USER44> It sounds like the interlock protocol only protects against MITMs that try to modify the conversation. It seems likely that most MITMing is for the purpose of merely reading a conversation, not modifying it. The wiki page also describes an attack against the protocol, so it might not be very effective.

</comment></comment><comment><USER45> Cut the cables. The USA should be kicked off the internet. They've proven they can't be trusted.

It is irresponsible on behalf of the rest of the world to allow this behavior to continue. Maybe after US businesses have experienced enormous economic damages they will change their way.

<comment><USER46> If the USA were kicked off the internet, US businesses would be far from the only ones that would experience enormous economic damages.

<comment><USER45> Absolutely. IMO it would hurt the rest of the world more. However I don't think it is unreasonable to start thinking about this as a possible solution. This would be a drastic action but its severity is matched by the issue at hand.

</comment></comment></comment><comment><USER47> Relevant (and just posted on the Cryptome list): [http://www.freelists.org/post/cryptome/MITM-Manipulation- of-...](http://www.freelists.org/post/cryptome/MITM-Manipulation-of-Snowden- Documents)

</comment><comment><USER48> [https://tools.ietf.org/html/rfc6091](https://tools.ietf.org/html/rfc6091) [http://web.monkeysphere.info/](http://web.monkeysphere.info/)

</comment><comment><USER49> Google cache version:

[http://webcache.googleusercontent.com/search?q=cache:www.sch...](http://webcache.googleusercontent.com/search?q=cache:www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html)

</comment><comment><USER50> If you worry about the NSA spying on your company, DUMP MPLS WAN networking ASAP, it's unencrypted and basically just VLANS at layer 3.

The easiest way to snoop on all internal company data is to sniff those MPLS links at ISPs.

</comment><comment><USER51> Wait. They access google directly... without depend on routing your traffic and tramp your SSL to get a lot of compressed js and ajax traffic.

So... maybe this was only needed or relevant before have direct access ?

<comment><USER52> MITMing a Google server doesn't _necessarily_ mean that they want the info Google has. Google host a number of libraries such as Analytics and jQuery which are widely used on other sites. The attack could have been to send a modified version of those so that websites (other that Google) transmit information that is normally kept on the client (e.g. sending the key to the NSA in an app that normally does client-side encryption).

<comment><USER51> Great point.

Then I understand better the relevance. Thanks.

</comment></comment></comment><comment><USER43> The ephemeral session keys should protect against the MITM attacker getting anything but another encrypted stream of data, right?

<comment><USER53> No, MITM works by spoofing identity. Certificate pinning is what can protect you from a MITM with the ability to sign certificates that say "google". Ephemeral keys only protect the session from being decrypted by a passive adversary.

</comment></comment><comment><USER54> Some security solutions actually rely on doing MITM to read secure packets to identify malware, etc. Really stupid.

</comment><comment><USER55> One more reason to _not_ use any of the giant email providers like Yahoo, Google, and Hotmail.

<comment><USER56> And what makes any smaller providers any more safe?

<comment><USER57> A smaller provider with fewer clients probably provides a lower ROI for the NSA because of the economy of scale, although if they are specifically targeting you, it may still not make a meaningful difference.

<comment><USER58> There is a trade-off here, sure there are fewer people that they can listen in on like that but presumably a smaller provider will also be a softer target, possibly much softer.

</comment></comment></comment></comment><comment><USER59> Bucket Brigade is a better term for this kind of attack. Non-gendered speech and all.</comment>


Apple Said to Develop Car OS in Canada with Ex-BlackBerry Employees on QNX - <AUTHOR> https://www.bloomberg.com/news/articles/2016-10-25/apple-develops-car-operating-system-in-blackberry-country <comment><USER2> Apple is right next door to QNX in Kanata. If you had a good arm you could throw a rock from one building to another.

[http://i.imgur.com/avtFKfj.jpg](http://i.imgur.com/avtFKfj.jpg)</comment>


Ask HN: How did you find your current cofounder? - <AUTHOR>

How did you find your cofounder? Did you find them at meetups? Or College friends? Or Co-workers? What would you say in your experience is the most effective way to find a good cofounder? <comment><USER2> 1\. Family makes the worst founding team (my parents almost divorced mid-way through their first company).

2\. Friends are a bad idea if you can't fire someone from a task without hurting the friendship.

3\. That linkedin/meetup guy with the great resume, likely has much better things to do.

4\. Colleagues, especially those you have been in really tough times with and survived respecting each-other are the most trustworthy co-founders.

If you are short on #4, try to do many small projects with #3s and #2s until you earn each-other's trust and know you can hold each-other responsible. Co- founder is a very heavy word. To put it in context replace it with "Spouse" and see if it still makes sense in your head before asking someone to be one. Based on standard vesting you are bound to stay together for 4 years minimum and that person has to know they will like you and your idea that long. So don't drop that word in the beginning or you may scare people off.

I don't put much faith in people who say they want to be "co-founders" and go on a matching service for that. Wanting that title and having a mission strong enough you are ready to leave salary, social life, and security for the next 10 years to do it are two very different things.

I too need a co-founder in a bad way. My product is live and picking up steam fast and my sleep is cut short by the day. However, I've stopped "looking" for a co-founder and instead let the product ( [http://Doerhub.com/for/doerhub](http://Doerhub.com/for/doerhub) ) actually attract and help me evaluate the best team for itself.

</comment><comment><USER3> I'm looking for a tech person to be part of my human rights startup. We are building a mobile application to manage the physical security of human rights defenders, activists amd journalists. If anyone is interested, drop a mail to firstname.lastname@example.com

</comment><comment><USER4> Co-workers always! You know their most recent + relevant strengths/weakness.

</comment><comment><USER5> It can be tough, I'm in a technical/educational environment yet I cannot find anyone interested. Has anyone had luck with meetups or something similar?

<comment><USER6> Any email where I can connect with you?

</comment></comment><comment><USER7> Co-workers. I'm technical, he is in operations.</comment>


Minimalism in an Age of Tremendous Hardware - <AUTHOR> http://prog21.dadgum.com/151.html

<comment><USER2> I liked to be reminded that there used to be a time where "complete" systems could fit in 1k of storage. Even as a developer, I'm always amazed at how exponentially expensive all these features that we have added over the years are.

</comment><comment><USER3> What's interesting and somewhat related are the studies done where, all things being equal, code size is the best predictor of code quality [1]. I think as far as justifications go, this research gives us a compelling reason to continue down the path of minimalization and simplicity, even when we have the capacity to store and execute very large programs.

[1]: [http://blog.vivekhaldar.com/post/10669678292/size-is-the- bes...](http://blog.vivekhaldar.com/post/10669678292/size-is-the-best- predictor-of-code-quality)</comment>


Version control in academia - <AUTHOR> I'm finishing my first year in an empirically-based doctoral program (lots of applied statistics).
One thing I've noticed is none of my colleagues use version control nor strive to create reproducible research, say with Makefiles.
Coming from industry before my program, I assumed everyone writing code would use these tools.
For those of you with PhDs or experience in research-based graduate programs, is this the norm? <comment><USER2> In which area?

I think (outside CS) it is common, probably 99%. Each paper has a few custom programs that are copied and modifier for the next paper. The "version control" is just a folder for each paper.

<comment><AUTHOR> I'm in social sciences but have a developer background. I am trying to expose more people to reproducible research methods. They are not very receptive. The version-control-by-folder approach is well entrenched.</comment></comment>


Refactoring-Bot: Eliminate code smells through automatic refactoring - <AUTHOR> https://github.com/Refactoring-Bot/Refactoring-Bot <comment><USER2> Great: whichever _N_ "code smells" existed previously has just jumped to _N_ +1, the most recent addition being "refactoring-bot code smell".</comment>


An Easy Way to Build Scalable Network Programs - <AUTHOR> http://blog.nodejs.org/2011/10/04/an-easy-way-to-build-scalable-network-programs/ <comment><USER2> I'm completely unsure what quality of javascript makes it suitable for writing high performance systems.

Is it single threading? Is it the weird typeof crap you have to do to check if a variable is defined? Is it the lack of integers? Is it the prototyping system?

Node.js to me looks like a slightly better syntax than the horribly ugly C# async calls. (Not the new async/wait system). Javascript completely pales in comparison to F# or Haskell in terms of readability of async code.

If you prefer non-functional languages it would seem that Go would be a much better place to start for performance than Javascript. Or clojure or scala.

Sure node.js outperforms rails, but rails isn't designed around being the fastest webserver ever.

</comment><comment><USER3> ...it's not the recent blog posts that are the problem, those are a response to hype huffers in the community spouting scalability nonsense. Having vague wording in the front matter for the project's main page doesn't help.

Many of the people currently "bashing" node are more or less aware of its capabilities. They aren't mad at the technology itself, just that it's being sold as much more than it is.

<comment><USER4> The only confusion over the wording on the front page seems to be over: "Almost no function in Node directly performs I/O, so the process never blocks". Which can be correctly read as: "Almost no function in Node directly performs I/O, so the process never blocks on I/O". But my English teachers would have told me that's too much repetition and not necessary.

<comment><USER3> If your goal is to appeal to "less-than-expert" programmers, this is exactly the kind of point where you want to be crystal clear. Blocking on CPU is the kryptonite of evented servers. If someone is new to them you probably cannot reiterate that point often enough.

<comment><USER4> On the front page? Really? I'd expect that on a more detailed tutorial, but to get people interested in a technology, I completely disagree.

You don't see Apple plastering "ONLY AVAILABLE IN THE USA" on their pages about iCloud music storage for exactly this reason - you want to get people to say "Hmm, that sounds cool" before introducing them to the caveats.

</comment></comment></comment></comment><comment><USER5> I've had to write a few network based applications that each had their own unique performance requirements. Node.js would not have been a fit for any of them. I'd really like to give it a go, but it seems that every scenario where it would be useful is better served by a more specific environment. Granted, I'm pretty lousy at javascript, so getting to use javascript on the server doesn't count, what is Node.js' ideally suited for?

<comment><USER6> Your comment would be a lot more interesting if you add what those network- based applications are that you think Node.js wouldn't be a good fit for.

<comment><USER5> Well, my comment got eaten, so here's the horribly summarized variant.

The captive portal, DHCP, DNS, firewall/access management, VLAN tag/trunk management, route management, VPN tunnel management, SNMP Poller, SNMP server, network device controller services running on the internet access gateway for sports stadiums on commodity hardware running Linux. Or those same services running on a resource constrained system with significantly lower traffic.

This is obviously a scenario where Node.js is infeasible (web based portions had to have C bindings for anything outside of presentation layer and all parts of the systems required significant profiling and optimizations to meet speed and resource usage requirements). However, I've had several applications recently where Node.js could have been a possibility, but the documentation and overviews for it are either so beginner that you can't determine what it's capable of or is exploring areas where there isn't precedent for what it can do. I couldn't find a straightforward list of supported features and the ideal use case for it.

After expecting a more detailed article covering ideal usage of Node.js, and that not being it, I figure I would finally break down and ask "What is Node.js' ideal usage? Under what scenario is it an ideal tool?" It's not a knock against Node.js at all, maybe a slight one against the documentation, but not the technology or its use.

<comment><USER4> And yet you describe something which sounds ideally suited to Node (or any evented system) and call it infeasible. Node actually has pretty nice bindings to C (well, really C++), and I see nothing in your post that it would be incapable of.

If it was because you don't know (and didn't want to learn) Javascript I could understand, but in terms of your comment above it seems like you just didn't look hard enough.

<comment><USER7> not sure why you're being downvoted here, but I do agree on the c++ binding infrastructure. I think the things he listed are quite possible in node -- I can't see any of those things he listed that might be cpu bound.

A fairly popular small DNS system was written in node for the purposes of development. Anyone who uses "pow" knows what I'm talking about: <http://pow.cx>

</comment></comment></comment></comment></comment><comment><USER8> Scalable web apps, maybe, but "network programs", I disagree. Just spawning a bunch of Node instances is insufficient to really scale in many network apps, you also need a good way to communicate between them. Preferably one that hides the fact that you are communicating between separate machines. For the most part, web apps can get by with pushing this to the DB but I think it's a bit much to say this is acceptable for all network programs.

<comment><USER9> <https://github.com/hookio/hook.io>

Transparent enough?

<comment><USER8> Not quite what I had in mind, but this is probably sufficient enough for me to eat my words.

</comment></comment></comment><comment><USER10> No that's not the proper way of doing it. You create worker threads in separate process that receive data from node.js, encodes them and send them back. you don't fork on every request.

<comment><USER11> He's not suggesting forking. He's suggesting spinning up a new process entirely (ffmpeg in this case).

<comment><USER12> fork+exec is even more expensive than fork. (Although in the case of video encoding the overhead is negligible. Problems with Node.js are more likely to be seen when an event sometime takes 100-1000 ms; it's slow enough to hurt response times of other requests but maybe not worth farming out to another process.)

</comment></comment></comment><comment><USER13> _In coming releases we'll make it even easier: just pass --balance on the command line and Node will manage the cluster of processes._

Internet trolls _do_ improve software!

</comment><comment><USER14> I'm going to repeat what I said on Twitter when this first came up - dozba's computationally-intensive-task example doesn't really illustrate the problem. Even if the computation is buried somewhere in a library, you can more or less predict when it's going to happen and make sure it happens in a separate thread/process. The real hurt comes when your single-threaded server takes a page fault. That's nowhere near so predictable or easily solved, and it still results in your entire application stalling. Requests on other connections, which never needed to get anywhere near the page that caused the fault and which could have continued in a better design, will get caught in the stall. That's just as true and just as lame as it was almost a decade when I (e.g. <http://pl.atyp.us/wordpress/?page_id=1277>) and plenty of others were writing about exactly these issues. Single-threaded servers are only appropriate for workloads where requests are trivially partitionable. In other cases you can still use events and asynchrony but you should do it in a framework that is inherently multi-threaded to take advantage of multiple processors/cores.

<comment><USER4> It's true, a seg/page/fault would take down the whole server, and any requests executing on that process would die too. However in fairness, this is one of the advantages of using a dynamic language, rather than one where you're dealing with memory allocation all the time.

<comment><USER15> I think you are confused about what a page fault is: that's what happens when the memory manager of your OS needs to load a page from the disk ("swap"). Dynamic language does not help you at all for that. It does not help you with segfault either BTW, because typing does not have much to do with memory management. Many statically typed languages cannot have segfaults either, from java to haskell.</comment></comment></comment>


Intel 4004, the first CPU, is 40 years old today - <AUTHOR> http://www.extremetech.com/computing/105029-intel-4004-the-first-cpu-is-40-years-old-today <comment><USER2> _"Busicom actually owned the design of the 4004 and had exclusive rights to its use, but eventually agreed to let Intel sell the chip commercially"_

That bit is not widely known.

Also, the article skips over the 8085 (a popular remake of the 8080), and does not mention the original 8086. This was the full 16 bit version forerunner of the 8-bit bus 8088.

</comment><comment><USER3> This article should not be relied upon as it gets much of the history wrong. The author should have consulted Wikipedia who gets it mostly right.

And for the record, the 4004 architecture was a distinctly different from the architecture of the 8008 and 8080 processors.</comment>


The 2018 Olympics Cyberattack - <AUTHOR> https://www.wired.com/story/untold-story-2018-olympics-destroyer-cyberattack/ <comment><USER2> > At 6:30 am, the Olympics' administrators reset staffers' passwords in hopes > of locking out whatever means of access the hackers might have stolen. Just > before 8 that morning, almost exactly 12 hours after the cyberattack on the > Olympics had begun, Oh and his sleepless staffers finished reconstructing > their servers from backups and began restarting every service.

> Amazingly, it worked. The day's skating and ski jumping events went off with > little more than a few Wi-Fi hiccups.

To me, this was the most interesting part of the article. What if the malware was part of a previous backup? What if hackers had access to an existing staffer, and the password reset would have been ineffective?

It reads like the fact that the winter Olympics streams worked just fine was a matter of luck on these two, relatively simple measures working.

<comment><USER3> In that sense, defending against _any_ cyber attack ultimately comes down to an element of luck,... that the attacker didn't gain access one level deeper, that they didn't exploit a particular vulnerability that would have allowed wider or more persistent access, etc.

As far as initial response playbooks go, I would imagine password reset (with session clearing) and restore from known working backup is a pretty good start.

</comment></comment><comment><USER4> TL;DR - it was the Russians (GRU)</comment>


Warren Buffett on the Stock Market [1999] - <AUTHOR> http://money.cnn.com/magazines/fortune/fortune_archive/1999/11/22/269071/index.htm

<comment><AUTHOR> Since there is discussion about the upcoming bubble 2.0, I thought this article was worth a read.

To give a bit of context, at the time Buffett was one of the few people who would not join in the frenzy and was heavily criticised for it. The fact that he was proven right and the clarity with which he argued his case with foresight is what contributed in large part to establishing his reputation with the wider public.</comment>


Weekly deaths in the US down by 7-10k for the week ending March 7 - <AUTHOR> https://twitter.com/sidsanghi/status/1244268782341799938 <comment><USER2> This data is not accurate. I flagged this post because the headline is substantially wrong.

See [https://twitter.com/lymanstoneky/status/1244433376741748736](https://twitter.com/lymanstoneky/status/1244433376741748736) and also the link posted by rjtobin.

<comment><USER3> It's good that people are fast enough to error-correct bold claims before they get too many eyeballs, but I am still shocked that smart people post these things publicly with such authority without first thinking through how they could be wrong. You're watching in real time what the value of the peer review process is, even if it's slow.

</comment></comment><comment><USER4> From the twitter thread, it seems like it's a data error: [https://mobile.twitter.com/mersenneary/status/12444399368766...](https://mobile.twitter.com/mersenneary/status/1244439936876654592)

At first it seems plausible, due to decreased traffic fatalities and so on. But traffic fatalities are about ~3000 a month, this effect is 15-20x greater than that. So it seems like there should be a high burden of proof here.

</comment><comment><USER5> Someone pointed out that this could be in part due to a backlog in reporting from other causes of death due to the virus. I'm sure fewer accidents (auto, medical, etc), also play a part. Even the OP (of the Tweet) admits this.

</comment><comment><USER6> Where I live all nonessential medical interventions are on hold to free up space in hospitals. I'd assume that lowers the death rate temporarily.

<comment><USER7> Perhaps in the short term, but in the long-term a weeks or months long delay in care will likely cause an uptick in deaths. Many major issues are initially caught as patients investigating what seem like minor issues, but turn out to be cancer, etc.

</comment></comment><comment><USER8> Were the high numbers from early 2018 caused by bad winter weather?

[https://en.wikipedia.org/wiki/2017%E2%80%9318_North_American...](https://en.wikipedia.org/wiki/2017%E2%80%9318_North_American_winter)

edit: Or the flu season.

[https://www.cdc.gov/flu/about/burden/index.html](https://www.cdc.gov/flu/about/burden/index.html) [https://en.wikipedia.org/wiki/2017%E2%80%932018_United_State...](https://en.wikipedia.org/wiki/2017%E2%80%932018_United_States_flu_season)

<comment><USER9> Flu season. Also check out [http://www.euromomo.eu/](http://www.euromomo.eu/)

</comment></comment><comment><AUTHOR> @dang - I'm happy to pull this down, is there a correct mechanism for me to do so? Or should I leave it as flagged.

</comment><comment><USER10> Ok, but with 150k covid infections already the numbers will rise sharply in the next couple of weeks.

</comment><comment><USER11> Fewer accidents and mass shootings.

<comment><USER12> You may know this already, but "mass shootings" account for a small number of deaths per year compared to what the media portrays.

[1] In comparison, you're about 3x more likely to be killed by choking on your food, 7x more likely to die in a fire, 91x more likely to die because of fall, and 397x more likely to die in an accident of some kind.

[2]Overall, violence is becoming less common over time despite the [3]increase in privately owned firearms in the US.

[1][https://www.businessinsider.com/us-gun-death-murder-risk- sta...](https://www.businessinsider.com/us-gun-death-murder-risk- statistics-2018-3)

[2][https://www.themarshallproject.org/2019/09/30/new-fbi- data-v...](https://www.themarshallproject.org/2019/09/30/new-fbi-data-violent- crime-still-falling)

[3][https://www.washingtonpost.com/news/wonk/wp/2018/06/19/there...](https://www.washingtonpost.com/news/wonk/wp/2018/06/19/there- are-more-guns-than-people-in-the-united-states-according-to-a-new-study-of- global-firearm-ownership/)

<comment><USER9> At least in the USA if you are shot and killed odds are much higher you committed suicide compared to getting shot by someone else.

<comment><USER12> Even according to 'anti-gun' sources you're about twice as likely to commit suicide with a firearm than to be a victim of a gun-related homicide.

[https://lawcenter.giffords.org/facts/gun-violence- statistics...](https://lawcenter.giffords.org/facts/gun-violence-statistics/)

All deaths are tragic, but given that violence overall has been falling for decades, at the same time that gun ownership is increasing, I find it difficult to attribute the violence to firearms rather than to social factors.

I often think about how many of these deaths would be prevented if we took all the 'anti-gun' money and poured it into our health care system to support people with mental illnesses.</comment></comment></comment></comment>


Use Your Unfair Advantage To Create an Unforgettable First Day For New Hires - <AUTHOR> http://lnbogen.com/2013/04/11/how-to-use-your-unfair-advantage-to-create-an-unforgettable-first-day-for-new-hires/ <comment><USER3> Jesus, this sounds like my nightmare. Just lead me to my cube and let me get to work.

<comment><USER4> This isn't about embarrassing you. This is about showing that they care about you. Clearly, in your case they would prepare something to suit you - <USER2> a gourmet basket sent to your house or similar, in a way that wouldn't embarrass you.

<comment><USER5> @elliptic's complaint is not about embarrassment, it's about respecting people's conceptions of appropriateness. For example, if he likes to keep work strictly separate from the rest of his life, having anything delivered to his home that isn't strictly necessary would be a violation of his principles and therefore a gesture of disrespect.

For another example, people with Asperger's can look embarrassed when you violate their rules. But the symptoms that neurotypicals tend to interpret as embarrassment can just as well be a sign of deep indignation.

Actually caring for a person means respecting their opinions and preferences, up to and including a preference for an utterly unmemorable day at work, or a preference that their boss does not exploit unfair advantages.

<comment><USER4> I think we're actually agreed on the issue. In the original article, it said they looked through someone's (obviously public or shared) facebook for something they would like. Clearly, they would also (well, ideally) sense the right level of respectfulness for people who value unmemorable days.

</comment></comment></comment></comment><comment><USER6> I'm starting a new job in a week. Just in case they read HN, I really like brand-new Ferraris....

</comment><comment><USER7> And... the (mandatory) fun at work movement reaches a new low of creepiness. Guys, what happened to professionalism? privacy? letting employees decide how much (if any) of their personal life gets meshed up with work?

<comment><USER8> What happened to ... you are being paid a lot of money to do this job, welcome, we look forward to getting to know you, in the mean time here's your desk.

Is our generation incapable of being productive unless we are treated and spoiled like children?

I don't want to have NERF fights at work. I don't want to go to a party or for drinks three times a week after work. I don't want to feel like my employer is a fraternity. I want to get my work done and return to my life at home. I guess this means I'd quickly get purged from this kind of company?

<comment><USER9> Moreover, doing this sort of thing is presumptuous and may actually work to the detriment of the employee. What brings one pleasure at home may inhibit productivity at work. For instance, I have a large number of art pieces, decorative objects, lamps, etc., at home that create a certain aesthetic that I enjoy when not working. However, I prefer to work in a relatively spartan environment, and superfluous items or clutter just creates more mental overhead and makes concentration harder.

</comment></comment></comment><comment><USER9> Obviously, creating a welcoming environment for a new hire is beneficial to all parties, but this is somewhat absurd. One's workplace and one's personal life are and ought to be, by default, separate and disjunct. It should be the employee exclusively who chooses whether to bring their work home or bring their personal life into their occupational life.

There is something deeply disconcerting about having an employer go out of their way to meld one's personal life and work life from day one.

</comment><comment><USER10> There are [extroverts] and there are [introverts]. You can choose your own two words for those placeholders.

As an [introvert], I would find such an approach both overwhelming and uncomfortable.

In work socializing, as in most of the rest of life, I believe in "opt-in". I'd rather have the choice to engage when and where I see fit.

I'll take one more pass at this: The new person is joining an established social structure (through the convention and primary focus of getting work done and earning a living).

From my perspective, the type of attitude described in the OP forces a lot of social interaction, and perhaps an immediate, corresponding sense of _social obligation / reciprocity_ upon the new person who is, grand gesture aside, still an outsider.

I would rather get to know people and have the chance to decide who and how I genuinely like, at my own pace.

I know how to get along professionally with most anyone. Whom I like and with whom I want to really socialize, is _my_ decision and is a more nuanced decision that takes some time.

And I don't do "fake". Turning the "social" to 11 on the first day, feels like forcing me towards either awkward, if and as I'm not ready to genuinely reciprocate at similar volume and enthusiasm, or towards fake.

Help me to focus on the work, so that I feel like I'm up to speed and contributing. On my own, I'll feel more comfortable, socially, then. That, to me, feels more like putting things in the right order. Be friendly, sure -- but with a bit of reserve, so that I can feel comfortable exercising the same.

</comment><comment><USER11> My more memorable first days of work consisted of walking into a relaxing setting, sitting through new hire orientation where I learned everything about the company spoken by the heads of every department, being served free food all day and receiving a gift bag of chachkies at the end of it all. That process always made me feel like royalty: a few days of interacting with senior management (and other new hires) and being served free food.

</comment><comment><USER12> My first corporate gig-- I had a horrible first week, they dumped me in an office, no assignment, no computer… nothing. They said another guy would be starting in a week and we'd get started then. I just sat there for a week.

I decided when the new guy started I'd try and make his first day better than mine-- I introduced myself and took him to lunch and ended up making a life long friend, some years later he was a groomsman at my wedding. Making a good friend at work has happened twice in my life, and let me tell you there's nothing that eases the burden of labor like working with a good friend every day.

</comment><comment><USER13> I think this is good concept - though I'm not sure if I would take it to the levels that they did (the Facebook part was a bit much for me...).

Even a small thing - a personalized postcard in the mail that arrives a few days before you start - would make me smile and feel welcomed.

There is a fine line though, and the difficulty is that the line is different for every person. Some people would love a personalized cake celebrating their first day, others would not.

<comment><USER6> The Facebook thing struck me as kind of creepy too. I'm not sure I would feel all warm and fuzzy knowing that my new employers had been crawling through my Facebook pages.

</comment></comment><comment><USER14> Let me tell you about my worst first day.

I got to work half an hour before my manager and sat in an empty office by myself. When the manager finally showed up, he gave me a box that had a new computer and said "Here you go, set it up." I didn't have a keyboard, mouse, or ethernet cable and I had to go scrounge them second hand.

I spent the next week pretty much doing nothing but reading through manuals and talking to nobody but the cafeteria workers.

</comment><comment><USER15> I think my most memorable first day was going around a track in a Tesla Roadster, and a pre-production Model S. It's going to be hard to top that one.

</comment><comment><USER16> I do agree the Facebook part was a bit much, but I find the general idea really good.

Maybe it's me being with small companies but we have had a significant percentage of personally referred new colleagues, so there's someone already knowing them anyway.

</comment><comment><USER17> This article fails to show what benefits this has for either the company or the employee. I did, however, end up slightly creeped out.

</comment><comment><USER18> This is good stuff! I am adopting it for the next hire in my company.

</comment><comment><USER19> A</comment>


An annotation nightmare - <AUTHOR> http://www.beabetterdeveloper.com/2013/12/an-annotation-nightmare.html

<comment><USER2> This is what happens when people try to add too much "magic." It's a side effect of many things, the most obvious being the lack of the language support for expressing these types of things. It is the same sort of issue that plagued C++ with the ability to override operators while limiting which operators could be overridden. This kind of annotation hell is indicative of the inflexible and unextensible nature of Java.

By the way, I'm not hating on JVM languages. Both Scala and Clojure have a means to handle this issue with grace and without sacrificing the readability of the code.

<comment><USER3> I don't know, annotations are what you make of them and can be abused like anything else. I miss being able to do things like this when I'm not working on Java code

        @GET
        @Path("/users/{userId}")
        public Page userPage(@PathParam("userId") UUID userId, @QueryParam("blub-filter") String filter) {
          ...
        }

</comment></comment><comment><USER4> I don't get what the problem is here. Each of those annotations modifies the field somehow - if you take one out, then you get less functionality. Is the problem really "my code does too much"? He says:

> I can't even see the damn property under this bloat.

To me, all those annotations _are_ the property, so you're seeing exactly what you need to see. You could put it all in an XML file if you really want to, but they're still going to be there, and you'll still have to read around them.

<comment><USER5> Actually, the property is just a value of a type having a name. The property has the responsibility to hold and provide access to its value. It's definitely not the properties responsibility to know how it is being stored in a database, this is a so called 'mapping'. If you'd change the table name, you should not have to change the property, but the mapping. Another important aspect is readability.

</comment></comment><comment><USER6> I agree with the author that the Single Responsibility Principle is being violated with all these annotations, but I disagree that the resolution is to move the annotations into hbm.xml files (or similar).

I would, in the limited example given, prefer to have a 'storage' POJO (annotated with the hibernate annotations), and an 'API' POJO (annotated with the JSON and XML perhaps). Then it seems to make sense that if you're changing the underlying storage you would update the storage POJO.

I very rarely want to return the exact object as stored in my database to the API layer - there's business logic and the like that needs to be applied, and transforming the object into something the next layer requires means you can generally implement tighter interfaces.

</comment><comment><USER7> I don't think that style of code is wide-spread in the real world; this feels like a total straw-man. Annotations are normally much better than any alternative we've come up with (e.g. XML), but the extreme case where you use every annotation is less appealing.

To me, this feels like a serious code-smell. Do you want to link your API data representation (XML/JSON) with your DB representation? Why does your JSON have a different structure to your XML?

If I'm wrong (it happens) and this is wide-spread, IDEs could implement folding for annotations to make this more manageable. The XML annotations would fold together, the JSON together, the ORM together. Or we could have different views, like LightTable. There just aren't that many sets of annotations.

</comment><comment> grey-area I have the same feeling about tagging/annotating struct fields with db- specific information in Golang.</comment>


Combining images using Neural Networks - <AUTHOR> http://ostagram.ru/static_pages/lenta <comment><USER2> Original paper this is based on [http://arxiv.org/abs/1508.06576](http://arxiv.org/abs/1508.06576)

Neat to see a web application implementation of it, though looking through the code suggests the actual algorithm implementation is based on [https://github.com/jcjohnson/neural- style](https://github.com/jcjohnson/neural-style)</comment>