Single Line CSS - <AUTHOR> http://orderedlist.com/our-writing/resources/html-css/single-line-css/

<comment><USER2> There's something to be said for both methods.

Multi-line CSS is easier to read/edit when you're actively building something because you are constantly moving properties within and across selectors. You're not likely to need to search for a selector because you probably have most of it in your head since it's all been written recently. In other words, inserts have greater importance than reads.

When you're maintaining a site, single-line CSS may be best. You may have forgotten the lay of the CSS, so the structure of it should be understandable at a glance. This is enhanced by the readability of comments, which have more impact when you can see all the CSS they are referring to at once.

<comment><USER3> This almost calls for some kind of plugin/script that converts this. It'd be insane to have a keyboard shortcut that will take the current selector and single-line/multi-line it.

<comment><USER4> css-tidy does a few different formats. You could alias a couple of different sets of options to e.g. `css-compress` and `css-expand` and just pipe your buffer through them.

</comment></comment></comment><comment><USER5> Another benefit of this layout is that you can stack similar rules to make their relationships clearer. For example:

        div.red   { background: #f00; border: 3px solid #c00; }
        div.green { background: #0f0; border: 4px solid #0c0; }
        div.blue  { background: #00f; border: 5px solid #00c; }

In multiline mode, it might not be so clear that they are related. We are experimenting with lessCSS here, in theory it might make this go away, in practice lessCSS seems quite buggy, so we are not using it for much yet.

<comment><USER6> May I self-promote and suggest Sass (<http://sass-lang.org>)? It's much older and less buggy than Less, and the currently-in-beta Sass 3 supports a CSS- style syntax (<http://nex-3.com/posts/96-scss-sass-is-a-css-extension>).

<comment><USER7> +1 for Sass. Sass allows me to apply the same modularity and reuse principles to my CSS that I do to my code, so writing it is much faster and editing it is much easier.

I played with a few other CSS processors over the last few years (Less, Moonfall, one or two others) but Sass is clearly in the lead. Thanks nex3 for a very useful tool.

(Oh, and FWIW, I use it on a Perl website. You don't need to be on Rails to use Sass.)

</comment></comment></comment><comment><USER8> No No No. This completely screws up diffs and code revision tools.

<comment><USER2> While I agree with you, don't you think it's a little screwy to change your writing practice for the benefit of your tools? You should be able to write any way you want, your tools work for you.

<comment><USER9> Doesn't that cut both ways? I write the way I want by spreading the css over multiple lines, _and_ the tools that I use provide a symbol view that lets me find selectors quickly and without fuss....even ignoring the 'Find' panel.

Im fascinated by the idea that I should break something as important as effective source control to fix a problem as simple as finding a specific selector in a file.

<comment><USER2> Right, I agree that the trade-off of pretty CSS over good source control is a bad deal, but it's the fault of the source control tools for requiring you to write in a certain way.

Edit: In my original comment (can't edit it now), I should have said "isn't it screwy to _need_ to change your writing practice..."

</comment></comment></comment></comment><comment><USER10> I like to indent my CSS to resemble the structure of the DOM it's styling: <http://addepar.com/style/style.css>

<comment><USER11> <http://sass-lang.com/> is YAML-style and uses pure indentation, but is overly sugared.

<http://github.com/cloudhead/less> is a purer subset of CSS where you just nest rules inside the curly braces.

<comment><USER6> Sass 3 will support a desugared syntax: <http://nex-3.com/posts/96-scss-sass- is-a-css-extension>

</comment></comment></comment><comment><USER12> I've tried this method and have three observations:

* Navigating to a given style attribute for editing was slower than standard format, presumably because instead of browsing to attributes via up/down arrows, I was now using left/right. The home and end keys also became less useful. Likewise, mouse movements were slower because not all the attributes were left aligned. I also use a 16+ size font, so narrow left-aligned CSS suits me well.

* I wasted too much time trying to correctly align/indent my code

* I wasn't quickly able to recognize patterns in the CSS. So my id:class ratio was higher than normal because I didn't have that consolidation.

</comment><comment><USER13> I don't mind compressing css after you have written it but if your only reasoning is finding selectors I must disagree.

C-s is for navigating and the more traditional styling leads to easier editing as it is easier to move across lines than across words.

-a keyboard editor

</comment><comment><USER14> I think this is something which you should let your IDE handle. Most decent IDEs have code folding and quick search.

Also keep in mind that many elements in your website can have an average of 4-6 attributes. If you are using browser specific enhancements or hacks you can easily have more than 10 attributes for some of the elements. Now think about performing that dreaded horizontal scroll in your editor to find some of the attributes.

Let the IDE take care of abstracting away the actual file structure. Let your build process take care of minifying the css files.

Conventions are good in programming, but single-line css looks like a bit too extreme trade-off.

</comment><comment><USER15> I don't see a point to this. Textmate can collapse all of the blocks, so you get the same effect, without losing the readability if you want it. Also, who visually searches a css file? I just use CTRL-S in Textmate or Emacs.

<comment><USER16> Makes it easier to sort in Vim; 'ggVG!sort' will sort your css alphabetically:

.bar .apple {...}

.foo .apple {...}

.foo .banana {...}

.foo .cherry {...}

(I also have a wee script that sorts the declarations alphabetically too.)

I prefer the style, I find it much easier to write, edit and maintain.

<comment><USER17> Would you mind sharing this script with HN'ers?

<comment><USER16>
      #!/usr/bin/perl -w
      use strict;

      # from selected block in vim: !scriptname.pl
      while (defined(my $line = <STDIN>)) {
        $line      =~ m/^(.*)\{(.*)\}/;
        my $element = $1;
        my @list    = split /;/, $2;
        @list       = join ';', sort { $a cmp $b } @list;
        print STDOUT "$element" . "{@list}\n";
      }

</comment></comment></comment></comment><comment><USER18> Or just see if your favorite editor has a folding mode.

<comment><USER19> would a folding mode turn a CSS dec like:

       .selected {
       color:white;
       }

into .selected{}

or .selected { color:white; }?

Most folding modes that I've seen makes the block hidden, which is nothing like what single line CSS is.

<comment><USER20> His main complaint was finding selectors ... so, if we're going by the article that shouldn't work fine.

But really, if you plan your CSS instead of applying edge-case band-aid over edge-case band-aid, this becomes a complete non-issue.

</comment></comment></comment><comment><USER21> I've used single line CSS for 2+ years now. I find it better at both reading and inserting/edit (I find it weird to read/write Multi-line ones). I used to sort by layout-appearance (important layout first, than appearance), but have now switched to A-Z sort of properties for maintainability (if others have to look at your code, you have to think about them).

However ocharles is right about the fact that it screws diffs (as long as they are per-line oriented).

</comment><comment><USER22> I love sass, a different approach.

</comment><comment><USER23> I blogged about this a while back at <http://devgrow.com/best-bet-css- practices/>

For practicality I find myself using multi-line CSS during development and use a CSS optimizer before going live, which makes the code look a bit cleaner and reduces overall file size (albeit not by much).

</comment><comment><USER24> decent IDEs like Aptana will make browsing stylesheets much easier. like methods in an object, it lists all definitions and allows for alphabetizing and clicking to jump to that specific definition.

...not that there isn't a use for organizing a certain way (like this article describes) in the first place.

<comment><USER11> You don't need an IDE, just a damn browser with a web inspector.

You have two independent compatible implementations of hypermedia lisp machines, both open source and installed on hundreds of millions of end-user machines. You can click any live object to inspect it, with tracing debuggers, REPLs, I/O analyzers, multiple domain-specific object browsers, etc.

There's not really room for anything between that and a text editor.

</comment></comment><comment><USER25> Have used single-line since 199x when we saved bytes by writing compressed css, and switched to expanded several years ago just because it is easier to read and modern debuggers/editors use that style. Don't see any reason to revive 'oldskool' practices which are worse in readability.

</comment><comment><USER26> Will try that.

I still find myself using Ctrl+F a lot when editing CSS. Sometimes even growing it further than needed as Ctrl+F becomes mundane.

Should CSS be approached more like code rather than like markup? Haven't tried that yet.

</comment><comment><USER27> Love it, I've been using the single line technique for about 6 months now (I used multi-line for years prior). It's definitely easier to scan.

</comment><comment><USER28> How about using a hybrid method? Use single lines for selectors that have at most 2-3 attributes and use multiline for >3 attributes.

</comment><comment><USER29> I'm doing it exactly this way as long as I can remember for compactness.</comment>


Ask HN: I own a large adult business and am moving to the Bay Area soon - <AUTHOR> Hi folks,
Long time HN member here. Using throwaway account for obvious reasons.
I am a serial entrepreneur with multiple exits in different industries. Right now I operate an adult business with millions of daily users.
I am moving to the bay area soon and trying to understand how I should present and market myself there. I have heard mixed things about adult industry reputation in the bay area. Some say that the environment is very liberal and people actually have a good reaction to this industry, others say that VCs don't do business with anyone who has touched adult.
Please keep in mind that I am going to sell this business in a few years and will start something non-adult related after. So it is important for me to not let reputation from being part of the adult industry hurt my chances for getting investments and talents for my next idea.
Thanks in advance for your insights!
Cheers! <comment><USER2> With a successful enough exit, you don't particularly _need_ VC money for future businesses. And your business name should have the standard discreet naming system - something generic for putting on resumes, rather than something explicit like "titties-r-us LLC".

Past that, the conversation is about a generic video site, and you can talk about content and bandwidth and getting traffic etc without ever mentioning that it's porn. Don't lie if asked outright, of course, but competent people should be able to read through the lines and notice that you have the good sense to keep the porn involvement discreet.

Like, people don't punish you for being involved in porn unless they're super Puritan. They punish you for not having the good sense to shut up about it and the related risk of you embarrassing them by association. Demonstrate that you can talk about your business activities without being crude and they'll be more willing to play ball.

<comment><AUTHOR> This is a great advice, thank you! This is more and less how I have been approaching this industry so far.

<comment><USER3> Well, his username might be relevant... :)

<comment><USER2> Not unless you're _really_ into airplanes and mechanical engineering.

[https://en.wikipedia.org/wiki/Thrust_vectoring](https://en.wikipedia.org/wiki/Thrust_vectoring)

<comment><USER3> Kidding aside, I was thinking rockets.

</comment></comment></comment></comment></comment><comment><USER4> Well, Kink.com just moved to Nevada. But that was because California OSHA started requiring condoms for porn. Also, because the once-abandoned SF Armory was now too valuable a piece of real estate for that use.

The only other porn producer I knew in SF gave it up around 2007 when she moved to Texas. SF used to have a film scene, but it relied on cheap large spaces being available, and those are all gone.

<comment><USER5> Did they sell the Armoury?

<comment><USER4> No, they're leasing space in it. I once read that Peter Ackworth owns the Armory personally, and just leased it to his company, Kink.com.

</comment></comment></comment><comment><USER6> I'm not a super networker or anything, but I've never met anyone involved with adult entertainment that admitted it, or VCs that openly invest in it. I always thought of it more as an LA thing.

I honestly don't think we're so liberal you won't have reputation problems later on, but with multiple exits you have a track record to offset.

<comment><USER5> I got chatting to the camera person before my talk at a JavaScript event once, just about AV stuff. I assumed he was a programmer who also shot events, but when I started talking tech he mentioned he wasn't a programmer, and was down from LA and normally shoots adult on some well known sites.

<comment><USER7> When I was working for a pro audio company out of LA, I ran into a product manager there who had been a sound engineer for porn. Good person.

</comment></comment></comment><comment><USER8> I will suggest you read the book _Mayflower Madame._ She discreetly ran a call girl service in New York while hobnobbing with refined, elite people. That might give you some sense of how to handle yourself.

</comment><comment><USER9> I think it's highly likely that you're going to run into problems if you don't know in advance which people are probably cool with it.

The Bay Area is incredibly fucking square. Square square square. An outspoken contingent of people here like to talk a good talk about their openness, but it's a facade that belongs to a constellation of myths people like to believe about themselves.

I would avoid run-of-the-mill hoi polloi "startup founders" and all associated professional/networking events like the plague. Some of them have their heads so far up their assess that they will take zero interest in what you do for a living and never even ask, but a lot of them are nosy as fuck and will make it really hard for you to cleanly maintain the veneer of whatever you've decided you're going to say about what you do. A lot of the nosiness is driven by egoic insecurity and class politics.

Every person I know who I could _guarantee_ would be cool with it is super wealthy-- most of them 8 figures+ net worth. Your priority should be meeting them. They can help you navigate the square waters and figure out where, and with whom, it's safe to be real. If you want an intro to some of those people I could probably help you out. As a last resort-- and I hate to say this-- join The Battery but avoid everyone under the age of 40 or so.

Edit to add: wealth managers will be helpful for making connections to the right people. Networking with them is an easy "in." Most will want to know you even if they don't think you'll let them manage your money.

</comment><comment><USER10> There is one thing people definitely aren't liberal about... sexual harassment, especially by people in power. Let's assume that you aren't that person, and perhaps even took a training seminar to make sure you are thinking about such things. Good, but it's your employees too. I'd encourage you to think about things like a senior engineer misbehaving, and how your response as CEO could effect your reputation. Also some people may try to join your company thinking they will get a pass.

Frankly if I was running any business in the bay area, but especially an adult one, I'd want someone working for me helping to both build a professional culture of appropriate behavior (with regular mandatory seminars for both new and continuing employees), and building mechanisms for reporting and dealing with issues responsibly (IE not just covering your ass) should that culture fail to prevent problem behavior.

Be proactive about it, to the extent you can.

</comment><comment><USER11> Hey Mate, Just be yourself and own being yourself. In my opinion people if your a good person, enjoyable to work with, and mean well you will rise to the top no matter what. Some people use excuses as crutch for being shitty people. You got this. Good Luck.

</comment><comment><USER12> What's the driver to relocate prior to selling the adult business?

<comment><AUTHOR> The reason is out of my control and family related.

</comment></comment><comment><USER13> Considering how very little sex happens in and how many surplus males there are in the Bay Area, it's probably not such a bad move.

</comment><comment><USER14> Do you own production or just distribution? You might just need a generic name. Lookup Manwin/MindGeek

</comment><comment><USER15> Does he/she mean porn when saying Adult business?

<comment><AUTHOR> Yes it is a pornography website.

</comment></comment><comment><USER16> Why was this flagged?

<comment><AUTHOR> I have no idea why they have flagged my post! I am asking a honest question about the bay area culture. It seems even mentioning adult industry gets you flagged there!

<comment><USER17> HN users are overwhelmingly not in the Bay Area. Perhaps 10% are. It's been a while since I looked at the numbers.

<comment><USER18> 10% seems like a pretty large share for a single locale. Are there any geographic regions that are of a similar size with as large a HN viewership?

Also, the original question seems broad enough to be applicable to people outside of the Bay Area. In essence the OP was asking how to soften the stigma of an adult business background to future investors.

</comment></comment></comment></comment><comment><USER19> Why would you move someplace with hyperexpensive real-estate and overpriced dev talent?

<comment><USER20> Why other IT people do it? Probably same reason: to launch some cool new project and raise funding for it.

OP asks if he can prove himself as worthy to VCs by bragging about his successes in the porn area.

With 0 first hand experience with Valley VCs, i'd say that i absolutely respect everyone who makes money in the porn business. Because it is damn hard. I tried and failed miserably and i don't consider myself a dumb guy. This is an ultra-competitive field.</comment></comment>


Something Special Is Happening in Rural America - <AUTHOR> https://www.nytimes.com/2019/09/17/opinion/rural-america.html <comment><USER2> I think encouraging deurbanization is a mistake. Urban areas are more efficient for almost all resources. What we need is making urban areas more attractive. Some people will of course always choose a lifestyle that prefers a big house, which we can't provide in an urban area, but we can address other benefits people see in a rural setting by smarter city planning. Sound insulation, so that neighbors are not a problem, green spaces in the city, train connections to recreational areas outside the city, walkability, neighborhood communities, all these things can be achieved with proper city planning without sacrificing the efficiency benefits of the urban area.

<comment><USER3> > Urban areas are more efficient for almost all resources.

People say this all the time. If it's true, why is the cost of living in an urban area almost always higher than in a rural area?

<comment><USER4> Because efficient is not the same concept as cheap.

Worse, you are likely looking at the costs of single family home purchasing, without considering cost of upkeep and transportation. Not to mention efficiency of getting work done.

That is all to say, because it is complicated. Scale fundamentally makes things hard to reason about. And cost discussions typically micro optimize a single factor.

<comment><USER5> _Because efficient is not the same concept as cheap._

It is not precisely the same concept as cheap, but I think you are mistaken about efficiency. Economic efficiency means that goods are produced at the lowest possible average total cost.

[https://en.wikipedia.org/wiki/Economic_efficiency](https://en.wikipedia.org/wiki/Economic_efficiency) [https://en.wikipedia.org/wiki/Average_cost](https://en.wikipedia.org/wiki/Average_cost)

A wide range of economic goods have a lower average cost in rural areas. Anything from a 5 bedroom house to a case of Bud Light.

Urban areas are _inefficient_ for most goods. They are popular not because of their general efficiency, but because they have better-paying jobs.

<comment><USER4> They have a lower unit cost per item to the individual. Sometimes. But typically only if you ignore transportation and storage costs. And often infrastructure costs are effectively billed to society.

Consider, I can literally walk to the grocery to buy beer. I suppose I have to replace my shoes from wear, but no upkeep or gas on my car. No miles of road that need maintenance to subsidize my trip to the store.

Now, yes, there are miles of road to subsidize getting the store supplied. But that is shared for all people supplied by the store. Same is true, of course, for the trips to the store, but again, my side of that equation is zero. Which is all part of what makes me argue it is more efficient.

And again, complicated with general scale making most observations necessarily simplistic.

</comment></comment></comment></comment></comment><comment><USER6> Kinda weird they chose Ouray, Colorado for the illustrative photo. That place's economy is nearly 100% based on tourism for mountain sports and ice climbing in the canyon south of the city.

<comment><USER7> It's showing Sabetha, Kansas as the top photo for me.

<comment><USER6> Huh, looks like they changed it.

</comment></comment></comment><comment><USER8> I don't care how much longing I might have for the small town I grew up in, I will never go back, and will never consider moving back. It was a bigoted, closed-minded place growing up and it's still that way today. Rural America has very little to offer anyone except cheap housing, and cheap food. Despite the crime, high taxes, high cost of living, and the abundance of traffic, the city is safer.

<comment><USER9> Until you get older and realize that you could cash out and benefit from a change of pace.

Get a nice sized house, with money in the bank, grow a garden, listen to the quiet, cut your own lawn, and share the experience with other people, who like you, eventually migrated back to give that small town feel another chance, later in life.

And now that small town has an art gallery. A Starbucks. Some nice restaurants. And town councillors that like you, moved back from the city and have a desire to fix some of what you remember being broken.

Many of the small towns I remember growing up in that were bigoted close minded places, have gradually changed. Not all. But it's happening.

<comment><USER10> Sadly still too few opportunities and especially faltering health care and education.

</comment></comment></comment><comment><USER11> I grew up in rural Pennsylvania and moved to Pittsburgh for Uni about a decade ago. My wife and I are making plans to move to the country, for me returning, but for her living there for the first time.

When in the city we both feel low levels of chronic stress. This is alleviated when in rural areas.

Right now our worries are finding a place for the right price, sufficiently removed from other people, close to enough places that we care about, access to fast internet.

I have heard from real estate agents that this desire to move to the country is becoming increasingly common. I don't know really why that is, but I have to imagine that the ability to work remotely has something to do with it.

<comment><USER12> Good public schools (or good private schools, for that matter) can be hard to come by out in the sticks, for those to whom that's important. Hard in the city, too—there's a reason so many families, even those of us who would prefer either the city or the country, end up in the 'burbs.

<comment><USER13> In a big city, your kid won't fit into the kindergarten. In the sticks, there is no kindergarten.

Things suck for young middle-class families.

<comment><USER12> Between the money-based fight to get your kids in better schools (public or private, it's money either way, just a matter of whether the money's in tuition or housing) and health care it _does_ kind of seem like the system's designed to eat every last dollar a normal to well-off-but-not-actually-rich family can get their hands on.

<comment><USER11> of course, these people pay a lot of the taxes. the rich don't, and poor just don't have the money to pay.

</comment></comment></comment></comment></comment><comment><USER14> We moved to Houston, Texas, to pursue a job offer. We left less than two years later to a suburb of Oklahoma City, Oklahoma. Smaller cities or at least smaller-town lifestyles are more our style. "Making it" in a big city seems like it requires losing what is important [edit: for people like me].

<comment><USER15> >"Making it" in a big city seems like it requires losing what is important.

I also hate city life, but I find it depressing that this is just another instance of everything absolutely having to be an us-vs-them scenario. Why can't people just enjoy the qualities of city life or suburban life or rural life without needing to broadly label the other options as somehow awful?

<comment><USER14> You're right, it doesn't apply to everyone. I wasn't meaning to speak for anyone but me.

</comment></comment></comment><comment><USER16> I've lived (nearly) my entire life in a small town in West Virginia. Like most kids from rural areas, I was looking for my first ticket out of here. I joined the Marines, explored the world and busy city life... and promptly returned to my small hometown.

I see no appeal in living in restrictive spaces for the chance at having something "special" to do in the rare moment where I have free time. There's more than enough for me in my surroundings and if needs be, I'm an hour drive from Pittsburgh, PA for some "culture" outings.

<comment><USER11> We are considering WV. My father lives in Uniontown, so it would be convenient in that way. I also have a lot of family that live in the general OH/WV panhandle area.

<comment><USER16> There are tech jobs in the northern part of the state. Lots of government contractor shops around. Pay is... well... government pay, but the cost of living is ridiculously cheap. My girlfriend is from Moundsville, and she thinks of the Morgantown area as urban... so I guess we could be more rural.

</comment></comment></comment><comment><USER17> Sucks* that for a lot of us the choice is between making $100k in the suburbs or $200k in the city. I'd MUCH rather live in the burbs or country, but at the end of the day you just make so much more money living in an urban environment even after accounting for cost of living.

*Sucks being relative. I know I don't have it that bad.

</comment><comment><USER18> The problem with small towns is, and will always be, the lack of opportunity for most people.

Most jobs in these places tend towards service jobs. You can't just move to Columbia. MO and expect to find a professional job. The best way to earn a good living in these areas is to own a business, which is not really feasible for most people. Once these rural towns have a critical mass of businesses to support an influx of professionals, they begin to evolve from small town to suburbia.

I say this as someone who was raised in a town of 515 people, 45-minutes from the closest Walmart. There was nothing there when I left, and that fact has remained over the past 20 years. Why would anyone move to that small town over the hundreds of identical ones all over the state?

</comment><comment><USER19> Since this was an op-ed with a half-assed mix of anecdote and cherry-picked stats, I'll add my own from one of the more rural Canadian provinces.

The small towns and smaller farms that are doing well are those that are within reasonable commuting range of the bigger centers. The ones that aren't, aren't, and are still undergoing rapid depopulation and farm consolidation into very-large commodity crop growers (canola, wheat, pulses, beef/pork).

The success of rural-heavy jurisdictions of North America are those that will give up on the losing fight to keep every small town alive and start investing in the job-creating urban areas. However, the Conservative/Republican parties that are often in power in these areas know they depend on their rural base and often do the opposite, spending money on highways and crop subsidies rather than transit and education.

</comment><comment><USER20> Having left Los Angeles to move to a very rural area in 1988 because quality of life is far more important than yearly income and that really is pretty sucky no matter where you live in LA or NY City, I think it's time Hollywood did a remake of "Deliverance" to squash this trending idea.

I actually had friends in LA tell me "they'll make you squeal like a pig there!" before I left. I'm not sure how many here will get those old references, but it really was a thing when I told my friends in LA I was leaving.

The area where I moved to has grown fast over the past 30 years. Still pretty nice though, and I'm glad I've spent those years here. No amount of money would've been worth spending them in LA.

<comment><USER21> To be fair, Deliverance was a bit more recent of a movie when you left, so one could see why they made such references, unfair as they were and still are (that said, I know for a fact that characters as depicted in the movie do exist, we just don't run into 'em often - good thing - nor really discuss them - bad thing).

</comment></comment><comment><USER22> The situations seem dire, speculation of properties means you either participate or lose , there's no escape and no other choice, you can avoid it but you can't avoid the inflation and wealth gap that come with it, the people joining the frenzy are richer and richer while you are poorer and poorer.

</comment><comment><USER23> What's "special" is that urban house prices doubled or tripled in ten years. I wonder what it would take to flip some of these states to Democratic.

<comment><USER24> Wonder how that correlates to homelessness.</comment></comment>


A new fascinating Linux kernel vulnerability - <AUTHOR> http://isc.sans.org/diary.html?storyid=6820

<comment><USER2> Everyone is focused on this removal of the null check by the compiler, but to me that's a red herring. The real bug is the fact that SELinux allows you to map memory to address 0! Fix that and this is much less serious.

<comment><USER3> Apparently that's a deliberate design decision to allow root to map 0, which is why the attack vector goes through pulseaudio.

Now why I haven't seen anybody screaming "WTF is a setuid program loading and running arbitrary code for?" is still a mystery.

</comment></comment><comment><USER4> I'm confused by the assertion that a source code audit would catch nothing. Even if the auditors didn't know that the check would be optimised away, the code is very unnatural. Normally you check if a pointer is NULL and then deference it. In a code review, every time I see a pointer dereference I'm thinking: "how do we know that's not NULL?". So a check afterwards should not keep this code from being caught by auditors.

</comment><comment><USER5> It's worth noting that this is a pathological NULL deference case, but that over the last couple years researchers have begun to make an art out of finding straightforwardly-exploitable NULL dereferences, particularly in the kernel; on some platforms, +0h is natively dereferenceable, and some dereferences are done with near-arbitrary offsets.

<comment><USER6> If I recall, AIX is one system which always returns 0 if NULL is dereferenced - the word at address 0 is guaranteed to a) be addressable, and b) contain a 0. These days I guess it's a security vulnerability, but the original intention was to allow wizards to optimize away the need for certain null checks. IBM actually has a number of patents related to techniques such as array boundary checking under this system.

<comment><USER7> I'm all for making the 0 page non-existent and to make it a processor feature rather than an os feature that the 0th address being referenced in any way will generate a hardware exception no matter what.

Otherwise we'll be playing null pointer dereference cat&mouse for ever.

<comment><USER5> It doesn't matter what you do with the zero page if the address is getting offset with an attacker-controlled caddr_t. I'm skeptical about NULL pointer countermeasures.

<comment><USER7> That's true. That would defeat such a check because the 0th location would never be hit.

</comment></comment></comment></comment></comment><comment><USER8> Hah I guess you can get the habit of first dereferencing and then testing for null only when writing kernel code!

</comment><comment><USER9> Wow, gcc generates code that's incorrect unless memory protection is being enforced? I didn't even realize it would be possible to build a kernel that way.

<comment><USER2> GCC's code isn't incorrect. As per the C standard, after you've dereferenced a NULL pointer then all behavior is undefined. If GCC emitted code that launched ICBMs after a NULL pointer dereference, that wouldn't violate the spec either.

The real WTF here is that people are still building "secure" software in a language where programmer mistakes cause undefined behavior...

<comment><USER10> So why isn't gcc throwing big warnings and errors about dead code paths?

<comment><USER2> My guess is that GCC's dead code warning is produced in a pass that runs before the optimizer and isn't smart enough to prove the code is dead.

</comment></comment></comment></comment><comment><USER10> So what us the reason that mapping om 0 is allowed anyways ?

</comment><comment><USER11> Why don't we hear such exceptional bugs in Windows kernel?</comment>


Let Amazon know we're boycotting them because of Wikileaks - <AUTHOR> http://www.thepoint.com/campaigns/campaign-0-1505

<comment><USER2> Where do I click to let Amazon know that I'm not boycotting them?

I mean really, Amazon is my favorite Big Company right now. They have all sorts of really cool services to make it easy for small businesses to do their thing. And every month or so they send me an email telling me that they just made one of those services _cheaper_.

They also manage to stock every single item of anything that I've needed to buy online in the last several years, and are capable of getting it to me in 2 days without any hassle whatsoever. They do all the creepy user-tracking stuff that every other big company does, but somehow manage to pull it off in a way that is not only not creepy, but actually makes me happy. Hey, Amazon just told me about the new Black Keys album. That's something I might actually consider buying. Thanks Amazon!

So yeah, no. I'm not planning to boycott them over some silly internet controversy that they didn't want anything to do with. Pick a better company like PayPal or eBay or Microsoft or Facebook or pretty much _anybody_ and I'm with you. But lay off Amazon. They're cool.

<comment><USER3> Right on the "Buy Now" button.

</comment></comment><comment><USER4> You're free to boycott Amazon if you wish, but I think your expectations of Amazon are ridiculously high if you expect them to martyr their business prospects to make a political stand. What were they threatened with? More sales taxes? IRS audits?

Yes, Amazon's response to this was really weak and cowardly, but let's not lose sight of who is the real villain in this case — Joe Lieberman and whatever other elements of the government are complicit in trying to shut down free speech.

I'd rather boycott Washington D.C. than Amazon.

<comment><USER5> It's not that I expected them to behave differently, I just prefer to give my money elsewhere where possible now. For instance, I am moving my wedding registry elsewhere, simply because I prefer not to give them the profit off of it since it can just as easily be given to other companies.

<comment><USER6> How do you know your new company wouldn't do the same thing in the same situation?

<comment><USER5> Well, they are generally in the making pottery or weaving sheets business, so I doubt it would come up.

</comment></comment></comment></comment><comment><USER7> Dear Amazon.com,

WikiLeaks offered the government a chance to review the cables before they went online. They made the offer to ensure that the leaked documents would not jeopardize lives. The government declined. To date, no leaked documents by WikiLeaks have resulted in any harm coming to any individual. While the past cannot be used as a measure of the future, it does support the notion that such releases will likely cause intractable harm in reputation rather than flesh.

Although WikiLeaks does not own the content, the scope of the content reveals a problem with the United States: that people in power are more corrupt than could otherwise have been known. If exposing truth and honesty while holding governments and corporations accountable to moral lessons of right and wrong is insufficient cause for Amazon.com to overlook its self-imposed terms of service, then the owners of Amazon.com have taken the moral low-ground. And I shall have nothing to do with them.

This a complex issue, with many arguments on both sides, yet one fact remains: WikiLeaks has published Truth. And if Truth stirs trouble, then we, as a society, have failed. We have failed our peers. We have failed our governing. And we have failed our children.

And now? I shall tell hundreds of friends.

<comment><USER8> The matter at hand transcends into international politics of the highest order. It is not some website that someone created to opine on their dissatisfaction with the government and hence were ordered to take it down. Its a website that hosted classified documents that don't belong to them, and were obtained illegally. No cognizant web-host in the US would want to host such content, if they want to remain in the business without an agenda. Amazon does not have to subscribe to some social contract that obligates them to submit to an organization like Wikileaks. As crass as it may sound, Amazon's in it for the money, not international politics.

Your expectations from Amazon, while noble, unfortunately do not translate into what is practically tactical for Amazon from a business' point of view. Any other US host would have yanked wikileaks out too. It is unfair to only subject Amazon to such high morality.

<comment><USER9> "Its a website that hosted classified documents that don't belong to them, and were obtained illegally. No cognizant web-host in the US would want to host such content"

Of course they would, and you know they will. Or do you really believe that Amazon will refuse to carry any product, over the coming years, that quotes from the leaked documents that are already in the public domain?

"As crass as it may sound, Amazon's in it for the money, not international politics."

Of course, and that's why a boycott is an appropriate response from people who feel negatively towards their decision; to submit to political pressure, and selectively apply their terms of use rules.

"Any other US host would have yanked wikileaks out too. It is unfair to only subject Amazon to such high morality."

I disagree. Whichever US host dropped wikileaks under these circumstances would have been a legitimate target for a boycott.

Amazon faced a difficult decision for sure, but handled it exceptionally badly wrt maintaining customer trust. Had there been even a hint of contrition in their statement, I (and I'm guessing others) may have felt less animosity towards them.

</comment></comment></comment><comment><USER10> I actually think they did hurt themselves here: I now have to say to clients who I'd otherwise push towards their cloud services:

"If you get a national politician unhappy with your product, they do have a history of pulling the plug on people, see wikileaks".

While that's not a boycott, that is a move from a strong buy to a "consider other options if you have any chance of pissing someone off".

I do think Joe Liberman single handedly handed cloud computing to non-american countries though with his stunt. Why base your cloud here when your company gets better data protection in :insert jurisdiction which doesn't give a crap about Joe Liberman's threats:

<comment><USER6> They probably would have hurt themselves more by keeping wikileaks and becoming the center of attention during the Christmas period, receiving the fury of conservative America, and losing major government contracts.

<comment><USER10> Amazon was screwed either way. This way however, they have compromised their cloud service's future (instead of their online retailer's present). It's not their fault they had to choose whom to piss off. They did however turn themselves from a whitebox solutions provider to a curated whitebox solutions provider though with this decision.

<comment><AUTHOR> What do you think would happen if Amazon didn't shut down Wikileaks?

<comment><USER10> A call on FoxNews to boycott them most likely.

</comment></comment></comment></comment></comment><comment><USER11> Amazon's choice: (1) host Wikileaks and risk getting shut down, or (2) drop Wikileaks, get boycotted. If choice (2) is as bad as choice (1), something I guess the boycotters hope for, then Amazon's choice is a Morton's fork: two equally bad outcomes. Why don't the boycotters stick their Morton's fork where it belongs: into those who wrote and enforce the laws they object to?

<comment><USER12> Because Amazon does not appear to have been compelled by law, so there's no law to change - just a vague sense of not wanting to be on the wrong side of powerful people. This is how the mafia works. It shouldn't be how the government works.

<comment><USER13> The people at Amazon might not actually like Wikileaks or the PR it brings. The government might not have anything to do with it.

<comment><USER12> Except that we know that the government did contact Amazon and ask them to stop hosting wikileaks.

</comment></comment></comment></comment><comment><USER14> HN readers might be interested to know that this site, The Point, is the basis for Groupon.

<http://www.groupon.com/about>

</comment><comment><USER15> Put yourself in Bezos' shoes. If hosting WikiLeaks could potentially make you the victim of DDOS attacks, cause you bad PR, open you to lawsuits, give you trouble with the government, etc, etc, would you really put your company, its employees, everything you have worked for at risk to support this political activism, even if you did believe in it? It's easy enough to say what you think Amazon should do, but if you were the one making the decision it might be more difficult than you imagine.

</comment><comment><USER16> The holiday season is here. Boycotting amazon isn't going to do a damn thing.

The average consumer has no clue that amazon has anything to do with the tech industry. To most people it's just an online store.

<comment><USER17> The holiday season is the best possible time for a boycott of any retailer. Last-minute shopping hasn't happened yet, and for most people, there are good alternatives for most of what Amazon carries.

More on why a boycott could have a big impact at <http://www.talesfromthe.net/jon/?p=2201>

<comment><USER16> Agreed.

But I'm saying that the vast majority of Amazon's customers are not software developers. They're soccer moms, busy middle class honest workers who don't know a damn thing about AWS or even that Amazon had anything to do with wikileaks.

They don't care. They'll buy from wherever is cheapest/most convenient.

<comment><USER17> Well, it's not just software developers who are fired up about free speech but putting that aside more a moment...

The soccer moms, teachers, honest workers, etc. in my and my SO's family would almost certainly honor our requests to "please don't get us anything via Amazon" -- especially if we give them alternative sources. Some of them would be interested enough in it that we'd discuss it and probably convince at least a few that this is a serious problem and they want to get involved. Most people have at least a few friends who are sympathetic; as people start posting about it on Facebook, others will see and at least a few will decide to get involved. Plus there are some family mailing lists (mostly used to exchange bad jokes) and people there tend to defer to my expertise on computer stuff. So we'll probably pick up a few more there ...

And internationally, my guess is that feelings are a lot stronger. It's fascinating watching the discussion on Twitter -- there's so much in other languages. Initial momentum for a boycott seem strongest in Spain right now ... and no surprise, given the revelations in the cables. From abroad, it looks like an American company trying to censor the world's access to information, so I could imagine a boycott having a bit impact there.

</comment></comment></comment></comment><comment><USER18> I must admit, while I thought it a pity that Amazon took that step, I think their strong point is selling books and stuff, not politics. I can understand why hosting Wikileaks might have seemed too risky.

<comment><AUTHOR> They also sell books about politics, but it's about the AWS and Amazon selectively shutting down it's services towards clients.

<comment><USER16> Businesses toss clients and customers all the time when they become unmanageable or too costly (or a drain on them).

</comment></comment></comment><comment><USER19> Like most hosting services, AWS has rules in there terms about what can be hosted. Agree with wikileaks or not, I think there is little debate that the documents were obtained illegally. Therefore, AWS was right to take them down from a business standpoint.

I'll probably get downvoted for saying 'obtained illegally', but I'm talking about the guy who downloaded the docs, not the guy who posted them. I think the worst Wikileaks could be charged with would be purchasing stolen property.

</comment><comment><USER6> I'm not. If I objected to every company that ever did something morally questionable in the interest of their business I'd be naked, homeless and starve to death.

</comment><comment><USER20> The moral of this story: if you want to publish something embarrassing to politicians, do it somewhere were they can't abuse their power/influence.

<comment><USER12> Where do you suggest?

</comment></comment><comment><USER21> From the site, as I write this (an hour or so after this link was posted and hit the front page of HN):

> Amazon should be made aware of the scale of public opposition to what > they've done.

> If we reach at least 1,000 people, then We will each mail Amazon letting > them know why we won't be buying from them anymore.

> 1%, 989 people to go

If that's not irony, I don't know what is.

In any case, I don't see the objection here. A lot of Internet warriors seem to be almost zealous in their support of Wikileaks and their belief that the various large-scale releases they have made recently are somehow changing the nature of society and making governments fundamentally more transparent.

Wikileaks are quick to say that governments have not identified specific people hurt or killed because of the leaks. However, looking at things from a slightly more neutral point of view, it seems equally true that Wikileaks haven't really told us anything big we didn't already know, or at least suspect. They have created a lot of hype, disruption and embarrassment, but where's the huge smoking gun? I'm in the UK, and so far there has been commentary on our politicians as with many other places, but there's no evidence that our government ordered a hit on Dr David Kelly, or that Tony Blair had more information than we already knew from the public inquiries about whether Iraq really had WMDs, or that our then-government's support for the US action against a lot of popular opinion was a result of some corrupt deal for personal gain by the politicians calling the shots. Frankly, the leaks have so far been rather anti-climactic.

Also, just as an aside, the whole "we offered to let the government help us vet the material" argument is just transparent politics. We are talking about hundreds of thousands of documents. To even _try_ to vet that data in any useful depth, the time needed from security-cleared and fully informed officials, and the amount of taxpayers' money it would cost would be staggering. Please don't tell me Wikileaks weren't well aware of that. And that's without even getting into the "we don't negotiate with enemies" ethics.

Given this sort of mess, I don't blame Amazon for not wanting any part of it. The fact that Wikileaks and various embarrassed government officials are having a very public pissing match is not a reason for independent businesses to start taking sides. More pragmatically, given the aforementioned lack of any real substance in the leaks, it is highly likely that the governments are going to win this one, and no business on the scale of Amazon wants to be out of favour with major national governments. There just isn't anything in it for them.

<comment><AUTHOR> 'not a reason for independent businesses to start taking sides' That's the whole point, they did.

'it seems equally true that Wikileaks haven't really told us anything big we didn't already know, or at least suspect' I disagree on this and they aren't done yet. So you don't know what is next. Besides, why would you shut something down that isn't a real threat(yet)?

<comment><USER21> Well, OK, Amazon removing themselves from the whole situation is passively taking the side of the governments, but it's rather different to actively hosting anti-Wikileaks propaganda or telling the CIA that they know where Julian Assange is this afternoon.

As for the rest of it, we've been hearing that Wikileaks are not done yet for a long time. If they are genuinely interested in transparency rather than raising their profile and/or causing extended embarrassment to people they don't like, then why haven't they just published everything on their web site for all to see? Transparency theatre is becoming as tedious (and unconstructive) as security theatre, and it's time for Wikileaks to s@#t or get off the pot.

<comment><USER12> I suspect this reaction is exactly why Wikileaks is metering out the information - each time they reveal some wrongdoing, it will be _new_ wrongdoing and hence newsworthy, whereas each time people scream for Wikileaks's head it will be the same shrill cry.

I think Wikileaks is hoping that over time, the repetitive anger at them becomes boring, whilst the corruption they uncover becomes the more interesting part of the story.

I suspect they are deliberately releasing only mildly embarrassing information at first as a form of innoculation so that when they get to the really damaging stuff Wikileaks itself will be old news and people will focus on the more unpleasant truths.

<comment><USER21> > I think Wikileaks is hoping that over time, the repetitive anger at them > becomes boring, whilst the corruption they uncover becomes the more > interesting part of the story.

I appreciate that you probably hadn't seen it when you wrote the parent post, but it appears that the big Wikileaks story for today is a list of facilities that are considered critical to US security.

I'm not sure I see any corruption exposed, or any other public interest for that matter, in publishing such information openly. How can this possibly do anything except make it easier for the bad guys to cause significant damage?

If they carry on in this direction, releasing ever more sensitive information that really might have national security implications, then I can only see any public support they have deteriorating and the arguments of governments that some information must be kept secret for national security reasons being strengthened.

The end result will probably be a terrible disappointment for conspiracy theorists, reassurance to many people that most of our governments are not in fact secretly planning world domination and merely make mistakes from time to time, and a new era of locking down anything that might be considered even remotely sensitive within governments to the extent that we might even see changes in the laws that currently protect whistle-blowing that is genuinely in the public interest.

It would be an ironic, and unwelcome, legacy for Wikileaks if its big campaign ultimately resulted in more people believing in arbitrary government secrecy and tighter controls on free speech just in case anyone else as irresponsible comes along in future.

<comment><USER12> Agreed. I personally think wikileaks only possible value is if it exposes actual corruption. Simply revealing sensitive information that weakens the US but doesn't reveal wrongdoing seems like a terrible mistake.

</comment></comment></comment></comment></comment></comment><comment><USER22> i would reject everyone and everything of the official sites that go against wikileaks. like the icann will possibly at some point or paypal for cutting of donations or twitter if they ever kill the wikileaks account but amazon is a hoster that was getting ddos'ed. every normal hoster wouldve dropped your page if you harm their business others pay a lot of money for in some cases.</comment>


Ask HN: Does Open-Source matter? - <AUTHOR>

Does the tech industry take care of it own? More specifically, does more open-source projects mean a karmic increase in successes and good outcomes, whether it be financial or personal?
I have been wondering this for a while. Of all the stories and articles I've read on HN and other such sites, I've noticed that a lot of people thanking all their open-source work for the jobs they've been offered. Now, despite this, my mind is stuck on whether open-source really matters. I know for the users and I suppose for some coders, open-source projects are very significant. They allow free, and usually solid new features for the users and more code for hackers to read through and learn from. But does open-source actually benefit its creators?
I mean that open-source is usually free, so most are working for free to get out some new, interesting feature that could have made them millions but won't.
So does giving away your time to the industry through open-source mean that you will be rewarded in some later success? <comment><USER2> Open-source matters because it's free to play. Anybody anywhere in the world can open up a browser and get access to the best thinking / practices of projects in esoteric languages all the way through common place languages.

For people who open source systems/ideas/etc (think DHH and ruby on rails for the current hotness, they get thousands of people to play with their framework and make it better. This benefits DHH and colleagues while benefiting everybody else).

For those who contribute, it allows them to show off their knowledge and/or skills. By contributing you get to meet and chat with all kinds of intelligent people as well as learn best practices.</comment>


How to Save Time by Watching Videos at Higher Playback Speeds - <AUTHOR> http://www.catonmat.net/blog/how-to-save-time-by-watching-videos-at-higher-playback-speeds/

<comment><USER2> I've read about a few listener comprehension studies, and it's been found that people generally comprehend higher pitched, slightly faster than average, voices better, and female voices are better than male for comprehension and retention.

I don't know how that applies to this particular trick, but this is something I've had a vague wish for, for years. Though I just wanted a button on YouTube for, "Talking too slow!" that would speed them up some.

<comment><USER3> > _comprehend higher pitched, slightly faster than average, voices better_

That's definitely true. _Not_ comprehending them takes years of married life and continuous practice.

</comment></comment><comment><USER3> How come no pitch correction in sample videos ? I assume AviSynth is capable of doing that.

<comment><USER4> Myth TV can run playback at faster (or slower) than real time, and does pitch correction.

My sweet spot seems to be 1.5x-3x depending on content. Movies tend to lose nothing no matter how fast you watch them, while technical stuff gets hard to follow really fast.

</comment></comment><comment><USER5> Reclock is a much better option IMO <http://www.videohelp.com/tools/ReClock_Directshow_Filter>

AviSynth isn't the best audio processor. It's much better with the visual side of frame rate conversion. Its other strong points are: dealing with interlacing correctly, resizing, pseudo HDR, and improving how the clip looks (denoise, deblock, dehalo, sharpen, ect...). It's something I play around/code for with in my spare time. Check it out, you might like it :) <http://avisynth.org/>

</comment><comment><USER6> I do this pretty often when listening to books on tape, I thin it's a natural to do this when listening to long-form video.

</comment><comment><USER7> I believe I read once that advertisers have software that reduces the length of the pauses between words/sounds in a video to speed it up, without it seeming as sped up.

<comment><USER8> I would like to see and try that, since my perception is that unless one deliberately adds them, there are no pauses between words. (Try to listen to a foreign language radio station and identify where the words are, for instance).

</comment></comment><comment><USER9> First time I read that, it sounded like the title of another useless, obvious patent.

"A method for faster performance through accelerated playback"

</comment><comment><USER10> Man, I thought this was going to be a parody of speed reading.

</comment><comment><USER11> Up next:

How to Save Time by Removing Consonants from Your Vocabulary</comment>


Have a scientific problem? Steal an answer from nature - <AUTHOR> http://arstechnica.com/science/2015/01/have-a-scientific-problem-steal-an-answer-from-nature/

<comment><USER2> This reminds me of the scene in The Wind Rises where Jiro says in passing "Hrm, looks like the Americans are looking at herring bones too." Many of the constraints on biological systems over evolutionary time are purely mathematical, and even when the constraint is not, selection can push a phenotype into local minima whose definition are ultimately mathematical. If you can identify cases in nature that match what you need in engineering then you can take some very nice shortcuts.</comment>


Why a Data-Security Expert Fears U.S. Voting Will Be Hacked - <AUTHOR> https://www.wsj.com/articles/why-a-data-security-expert-fears-u-s-voting-will-be-hacked-11587747159 <comment><USER2> Paper ballots have this wonderful property where basically any voter can reasonably understand what is going on and even be a precinct observer and be reasonably sure relying on first hand evidence that the election was fair.

No other system has this property. Even if you had a formally verified election system, it and the proofs of it could perhaps only be understood by less than 100 people in the world.

<comment><USER3> But the fraud in paper voting happens at another place - often when the results are transmitted to a centralized place.

<comment><USER4> Here in Germany, you're allowed to stick around and watch the counting up close. I've done so, and was able to count along the votes for the two major parties.

Six hours later, I checked the spreadsheet on the official website, scrolled to the row for my polling location, and verified these two numbers were identical to my count.

Sure, I can only check 1/3rd or so in one of 50,000 polling places. But get just 20 people you trust to do the same, and it becomes statistically unlikely that there is widespread fraud.

You can hang out in the polling location for the whole day if you want. If you get there before any voters, you can also check that the ballot box is empty. Each location serves less than 1,000 voters with three volunteer workers, so you'll always be able to know everything that's going on. Oh, and the longest wait I've ever had to endure myself was less than 5 minutes

The only possible problem (aside from Republicans) in the US would be the large number of individual races and ballot initiatives. It works well with five or so. But if you're voting for ten deputy dog-catchers of the peace, it might get tricky.

<comment><USER3> Good that you did that! But for most locations that is not done. See the last NRW elections where it was later discovered that votes of the voldemord party have been zeroed in many locations. Or the endless stories of tampered mail votes.

I'm not against paper voting at all, just saying that they aren't automatic tamper proof.

<comment><USER4> There are exactly zero stories of tampered mail-in ballots. Which, I guess, does make them "endless".

</comment></comment></comment></comment></comment><comment><USER5> Paper ballots, privately filled out and scanned, seems the sweet spot between keeping elections secret and reporting promptly, with suitable audit.

I serve as an election officer in my county and have yet to hear of a compelling alternative.

<comment><USER6> it's 2020

paper ballots, really?

when I can apply for a mortgage, car loan, credit card, and all kinds of other financial legally binding contracts online in _complete_ security?

I enter my SSN, my credit report is pulled.

Why can't I enter my SSN, it gets validated in a database on whether I'm alive/have already voted/am currently a legal citizen eligible to vote, and vote?

We have achieved problems way, way, way harder than "securely identify a person based on their SSN and allow them to vote A, B, or C on a subject"

<comment><USER7> > when I can apply for a mortgage, car loan, credit card, and all kinds of > other financial legally binding contracts online in complete security? I > enter my SSN, my credit report is pulled. Why can't I enter my SSN, it gets > validated in a database on whether I'm alive/have already voted/am currently > a legal citizen eligible to vote, and vote?

Come back once _only_ _you_ can do all those things on your behalf, and not anyone else having your SSN or other PII.

<comment><USER8> But that's a standard that even paper ballots don't meet.

In my state you walk into the polling place, give them your name and address, sign your name, and that's it. Your polling place is even listed publicly online for anyone who knows your name.

</comment></comment></comment></comment><comment><USER9> I highly recommend HBO's new documentary on election security. It's called 'Kill Chain: The Cyber War on America's Elections' - really opened my eyes to the low level details of how bad our system is. Scary stuff

</comment><comment><USER10> Like clockwork. Literally every US voting season, ever since Diebold machines became fixtures. I tire of seeing these problems make headlines yet again when a technical solution exists.

<comment><USER11> Yes, but if they did it right they couldn't bill the government to fix it multiple times over.

</comment></comment><comment><USER12> Most likely we will need mail in ballots and there has already been issues with that. [https://www.realclearpolitics.com/articles/2020/04/24/28_mil...](https://www.realclearpolitics.com/articles/2020/04/24/28_million_mail- in_ballots_went_missing_in_last_four_elections_143033.html)

<comment><USER13> That is an absurd article. Yeah, turnout isn't 100% when voting by mail either... so what?

I'd be a lot more concerned if large numbers of ballots _didn 't_ "go missing".

</comment></comment><comment><USER14> One party is fixated on voter id fraud and ignores the cyber security, the other party i fixated on cyber security and ignores voter id fraud. Both are significant issues which we should be addressing. An accurate election results should be in everyone's interest.

<comment><USER15> Get real. Any credible research on the topic of "voter fraud" suggests it's not a significant issue and efforts to combat "voter fraud" are really just disguised efforts to suppress voting by low income and minority voters.

<comment><USER16> There is no evidence that voting machines have been hacked, either.

Why is the standard of evidence for one different than the other?

And more to the point, since when does patching a vulnerability require evidence of exploitation. We wouldn't accept Microsoft saying "There's no evidence of this Outlook vulnerability being exploited in the wild, we're not going to fix it". We certainly shouldn't accept that reasoning for our elections.

<comment><USER17> >Why is the standard of evidence for one different than the other?

Because hacking one voting machine potentially allows one person or a small group of people to alter thousands of votes.

That person (or persons) has no way to alter anyway near that many votes through in person voter fraud. The amount of effort it would take to alter the results of an election through in person voter fraud makes it extremely difficult to pull off--particularly without detection.

Additionally there are downsides to voter id laws. The most troubling is demonstrably lower minority turn out. There are no similar downsides to methods like requiring paper receipts for voting machines.

Basically the cost benefit analysis is in favor of hardening electronic voting, but not in favor of voter id laws.

<comment><USER18> Detection is much more gnarly than you give it credit. A pretty likely scenario is that one side will claim that fraud was detected, and the other side will deny it. And both side will try to suppress and deplatform each other.

Youtube, twitter, facebook will pick a side. And whoever loses will fume with resentment. Maybe they pick up weapons. If they are right that the election was stolen and that fact is suppressed, they will certainly be justified. If they are right - which is a big hypothetical. Because the detection will be drowned in noise.

<comment><USER17> You're talking a coordinated conspiracy involving thousands of people. The FBI would have hard evidence during the recruiting phase.

You can't involve that many people in something and keep it secret.

Even in the best case were we don't find out until elections day, an enormous increase in double votes will be all over the news the same day, and arrests will start happening shortly after.

<comment><USER18> What about an uncoordinated conspiracy involving thousands of people? Just a single troll with a large audience urging them to cheat?

<comment><USER17> It's a felony. A felony that requires you to commit it in person at a precinct is a pretty high bar for an internet troll to get people to jump.

Assuming some people decide to take them up on it, they have to coordinate or they'll end up voting as people who have already voted. Double voting is very easy to spot and many of them will be arrested at the precinct.

Plus you'd need an accurate list of close to 100k dead voters who haven't already been purged (more in a less tight election), and thousands of people willing to drive to the right precincts to match the list.

And we didn't know which states would tip the election until election night in 2016, so you'd need to duplicate your efforts several fold.

This idea is pure fantasy.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Somewhat joking, but surprised nobody has brought it up yet: [https://xkcd.com/2030/](https://xkcd.com/2030/)

<comment> jagged-chisel Mobile-friendly, with accessible alt-text: [https://m.xkcd.com/2030/](https://m.xkcd.com/2030/)</comment></comment>


PPK: "Apple is not evil. iPhone developers are stupid." - <AUTHOR> http://www.quirksmode.org/blog/archives/2009/11/apple_is_not_ev.html <comment><USER3> _Fuck [iPhone developers] those condescending, ignorant, self-important, stupid, blind, fearful pricks. Fuck them real hard. Where it hurts.

And fucking them real hard where it hurts is exactly what Apple is doing right now._

We choose the world we want to live in, and I don't want to live in a world where writing like this is unremarkable. It adds nothing to the overall argument and coarsens us to no purpose.

I am sympathetic to the general gist of "developers would be better off working without a gatekeeper", and have said much the same myself this weekend, but those who Apple chooses to win _do benefit_ enormously from a built-in, captive audience who is exposed to Apple's annointed developers. There is no comparable method of exposure for mobile web application developers.

There is also the non-trivial benefit of _actually getting paid money_ to consider. You can certainly make money on the wide-open Internet, but the tactics you use for it and the apps you make are wholly different from what works on the iPhone. (What I wouldn't give for my customers being able to buy my software in two clicks, but alas...)

<comment><USER4> Your attribution is wrong.

He's not talking about iPhone developers, he's talking about the people in the sentence before it:

 _After ten years I am fucking tired of the "Web development is not real programming" bullshit that the arrogant bastards in "real programming" are spouting because they're too frightened to learn something new._

Now, the Venn diagram may have some overlap, but still.

<comment><USER5> The author seems to be suffering from a lot of insecurity and anger issues - and I mean that in the most non-judgmental way possible. I think it's pretty clear that most of HN works on web technologies, and personally I haven't really seen this condescending divide between 'web programming' and 'real programming' - which at the end of the day seems to be about the same thing really.

I do however object to his calling the entire iPhone developer community out as stupid and arrogant. How arrogant is it to presume that everyone of the _many_ iPhone developers who have complaints about the current approval system is, in his words, stupid? If anything the author is the arrogant, misinformed, and dare I say, stupid one here.

I'm torn about whether or not to flag this. While this has generated some good discussion on HN, I don't think we should really cater to troll material like this. If you cannot communicate your opinions in an intelligent, civil way, and cannot deal with your fellow developers with some decorum, then please don't say anything at all.

<comment><USER4> I've certainly seen "web programming" vs "real programming" thing before. Must just be different scenes.

</comment></comment></comment></comment><comment><USER6> While he basically raises some valid points, he ignores two critical ones:

1) With the appstore being the one authority to get apps on your iPhone, you will automatically get much less traction using the web

2) The appstore makes it VERY easy for the devs to actually get paid. If you launch your app web-only, you have to incorporate the whole payment process yourself, which sucks.

Catch 22...

<comment><USER7> Your first point is so valid. Having created a webapp for the iPhone myself there really are few places I can go to put my webapp on a stage that anyone cares about. If someone knows of any I honestly would love to know where they are.

<comment><USER8> Why not create an iPhone app, which is simply a WebKit view dedicated to your web app?

The client see's it as a "iPhone app" you can host/sell it in the store, but it's really just a web app.

(Maybe there's a restriction on this, but I can't see why there would be...)

<comment><USER9> Same restrictions apply: the web view has a limited set of functionality and there is no way to communicate between the native cocoa part of the app and the javascript part running in the web view.

<comment><USER10> simply untrue - its easy to communicate between javascript and native cocoa code. Take a look at the UIWebView and UIWebViewDelegate documentations here - [http://developer.apple.com/iphone/library/documentation/UIKi...](http://developer.apple.com/iphone/library/documentation/UIKit/Reference/UIWebView_Class/Reference/Reference.html) and here [http://developer.apple.com/iphone/library/documentation/UIKi...](http://developer.apple.com/iphone/library/documentation/UIKit/Reference/UIWebViewDelegate_Protocol/Reference/Reference.html#//apple_ref/occ/intf/UIWebViewDelegate)

</comment></comment></comment></comment></comment><comment><USER11> I know this is really only applicable for a few cities, but speaking for myself: as a consumer, I don't want webapps right now. AT&T's network sucks hard in NYC, and even if it didn't, a very large portion of the time I spend with apps on my phone is when I'm killing time on the subway. Offline is important, and while we're starting to solve that with some of the browser tech he pointed to, it really isn't there yet in a form that's competitive with native apps.

<comment><USER12> Offline works perfectly on Mobile Safari.

[http://developer.apple.com/safari/library/documentation/iPho...](http://developer.apple.com/safari/library/documentation/iPhone/Conceptual/SafariJSDatabaseGuide/OfflineApplicationCache/OfflineApplicationCache.html)

<comment><USER11> I mean offline as an experience, not as a caching problem, which in my case means games and other apps that rely on the full capabilities of the hardware. I thought that would be obvious from the context as a native app that needs online access isn't much better on the subway than a webapp.

</comment></comment></comment><comment><USER13> PPK is an idealist. Applications need to make money. Web applications on the iPhone are slow and have less functionality so they make less money.

</comment><comment><USER14> The essence of the AppStore hovers around marketing & distribution, not technology. Apple set up a great distribution channel, making it super-easy for developers to get paid & they are throwing in some free promotion to boot. In the end, it's about money: can you afford the opportunity cost of _not_ being present on the AppStore & make money _right now_? What's the cost of promoting your WebKit app going to be? Apple convinced people that it is ok to pay a little money for simple apps that run on their mobile phone. _That_ was Apple's genius move, not the technology that makes iPhone apps tick. If you simply follow the money the whole AppStore debacle becomes a lot clearer.

</comment><comment><USER15> _But instead, iPhone developers are eagerly bending over begging Apple for more because of their myopic obsession with bad APIs, the twin geekgasms of both objecty stuff and C, bloated SDKs, impossible layout mechanisms, and all the rest of the archaic nonsense we're going to have to rid the mobile Web of in the next few years._

It's pretty clear he's never developed with Objective-C, Cocoa/UIKit, etc. if he's calling it a bloated and bad API. UIKit in particular is fresh, clean, and very nice overall, IMO. (I spent years in Javascript/HTML/CSS, moved to the iPhone for awhile and worked on some major projects, and recently started developing an app on Cocoa for OSX - which is a lot more crusty than the iPhone.)

I also find it somewhat ironic that he talks about "impossible layout mechanisms" whereas almost every time I've been involved with a webapp I've hit upon some tricky layout requirement that is a pain in the ass because of CSS' builtin assumptions.

This part reads like satire...

</comment><comment><USER16> Worthless linkbait, and misses the point entirely. Namely: how many iPhone developers are making decent revenue from a web app?

Mobile Safari could be the most powerful web experience in the world, but without a simple, trusted payment mechanism, it'll be largely ignored by "stupid" iPhone developers.

</comment><comment><USER17> > developers could just use Web technologies and create Web apps instead of > native apps

Audio. QED

(Not to mention the iPod Touch, often used out of wireless range.)

</comment><comment><USER18> This article could be written much less offensively as, "The appcache in iPhone OS > 2.1 means web apps don't have to be second-class citizens." As it is, it makes some strong assertions but fails to actually educate developers.

That said, I agree with most of the points in this article, but I think the biggest reason why the App Store will continue to be the authority for iPhone apps is simple: it's a total pain to enter credit card payment information on your phone.

Until someone changes that, nobody will want to pay $0.99 for even a spectacularly good web app. Perhaps the solution is to use a more common payment system, like Amazon or Paypal credentials.

</comment><comment><USER19> Summary: "Webapps are almost as good as Native Apps in many ways."

The author reveals no advantages of webapps over a good AppStore that allows 3rd-party software sources. He is simply angry that he doesn't get enough attention as a web developer, not especially different from the complaint of a three year old child, though with the language of a nine year old.

<comment><USER20> We can criticize the delivery.. but given the popularity of the thread, I think the OP is making a valid point.

I have written location-aware iPhone native apps, and if I had an open-source alternative to Big5 then, I probably would have used that.

In my case it would have saved me quite a lot of overhead in terms of moving from Linux to a full mac development platform. Not having to learn a new syntax and api for iPhone might have been handy... and then I would have avoided having to jump through the code-signing hoops that tend to break when you upgrade software versions.

So.. that's quite a bit of overhead for an app which only uses the geo- location feature of the hardware.

I do enjoy the Mac platform, XCode etc. I'm not apple bashing here, but making a comparison.

</comment></comment><comment><USER21> What a ridiculous article. The downsides of web apps on the iPhone are painfully obvious and have been pointed out by the other commenters. Anyone who has tried to use web apps on the iPhone knows they are not ideal.

<comment><USER22> Yeah, obvious trolling. Had this come from someone unknown it wouldn't had gotten any attention.

</comment></comment><comment><USER23> _"It also supports JavaScript geolocation, which is (I hope) only the first step towards true device APIs that will give JavaScript developers access to phone functionality such as the camera, text messaging, the address book, and more. I'm assuming Apple is working on all that because it's the next logical step."_

One could also argue that Apple benefits most in the short term by crippling web apps, since the App Store represents a revenue stream and is the main selling point of all their recent advertising.

<comment><USER24> I'm gonna call bullshit on the general conspiracy theory, here. Mobile Safari is the best mobile browser, period. And WebKit is the engine for the next best.

Adding camera, accelerometer, address-book integration etc. needs to wait for W3C standards to emerge and stabilize before they can be put into Mobile Safari.

What might prove interesting is if a standard for payment mechanisms emerges, so that a web app can take payments mediated through the iTMS.

</comment></comment><comment><USER25> The app store is a huge distribution channel for developers. Making a web app solves the technical aspects of distribution, but then it's up to you to put your app under the nose of several million people.

</comment><comment><USER24> iPhone developers are part of the problem: specifically the ones who create a zillion "shovelware" apps, some so pointless that Apple has got to the point of banning entire developers.

Apple intended the review process to be basic third-party QA--something that the commercial software industry needs in general--but the noisy, trivial slush like "Dial Girlfriend" and apps that show a few P.D. pictures lifted off Google Images are tying up Apple's resources and making it a chore for users to find anything good.

<comment><USER26> That's the inevitable result of the approval process. Make a sophisticated app with lots of functionality, and there's a greatly increased chance that Apple will find something wrong with it. On the other hand a one button fart app will go right through.

</comment></comment><comment><USER27> Sounds like there is an incredible market opportunity here for someone to create the "App Store Platform" for the Web.

</comment><comment><USER28> A native app with a web UI can present content even when there is no network connection...

My respect for quirksmode just fell, a lot. The willful ignorance he shows in his article is staggering.

And the rude delivery doesn't help either.

<comment><USER12> Wilful ignorance indeed!

You don't need a native web app to present content without a network connection. You just need to use the HTML 5 offline application cache thats been in Mobile Safari since iPhone OS 2.1

<comment><USER28> Heh, thanks for the well-deserved and well-delivered smackdown. I'll concede that point, but obviously there are others that have been mentioned.

</comment></comment></comment><comment><USER29> > After ten years I am f*ing tired of the "Web development is not real > programming" bullshit that the arrogant bastards in "real programming" are > spouting because they're too frightened to learn something new.

As someone who tinkered with browser-specific Javascript in the ugly, pre- jQuery early days of DHTML and failed to see where Javascript and HTML and CSS were headed (retreating into the safe world of Java for years - <USER2> missing the ascendance of XHTML/jQuery/CSS - rendering my web skills of the Netscape 4.x era), I agree.

</comment><comment><USER30> At least the correct way to refer to Steve Jobs is "He", not "he".

</comment><comment><USER31> We're almost there, one step removed and we'll have it.

Let's replace 'stupid' for 'greedy'.

Then --> more fool the iPhone users that are paying billions of dollars for average/poor applications that could be replaced by FREE, high quality web apps.

Apple have found a way to make a forture selling what is already freely available - a neat trick.

Isn't it incredible that anybody would pay for a 'dictionary application' these days - whatever the platform?

</comment><comment><USER32> Payment should be easily taken care of, paypalx, etc...

The only shortcoming is just the speed compared to native apps and of course the missing features that you can't really access through safari.

</comment><comment><USER33> Let's say that I want to implement a swipe-to-delete feature like the one in the Mail app. What JavaScript event should I listen for?

<comment><USER34> touchmove, apparently: [http://www.sitepen.com/blog/2008/07/10/touching-and- gesturin...](http://www.sitepen.com/blog/2008/07/10/touching-and-gesturing-on- the-iphone/)

</comment></comment><comment><USER35> _It also supports JavaScript geolocation, which is (I hope) only the first step towards true device APIs that will give JavaScript developers access to phone functionality such as the camera, text messaging, the address book, and more. I'm assuming Apple is working on all that because it's the next logical step._

I was sympathetic to Apple's original line about iPhone apps -- that web apps _were_ iPhone apps -- under this same assumption, that over time MobileSafari would get all these capabilities and more.

But those have been slow to materialize, and now Apple is making a bunch of money via the App Store. Why add things to MobileSafari that remove Apple's cut of sales? Or otherwise splinter the billing/in-app-purchasing system? Or confusingly 'duplicate functionality'? The assumption that Apple is a "true believer" in web apps becoming as capable as App Store apps may no longer be safe.

Going strictly by Apple's self-interest, it would be equally valid to predict that Apple may, over time, add various kinds of policy or remote-driven cripple-switches to MobileSafari -- so the web isn't a back-door offering 'inappropriate content' or otherwise competing with the App Store.

Of course Google is a "true believer" in web apps. Any bets on when we'll see a Chrome browser for the iPhone?

</comment><comment><USER36> Wow,

It seems like _everyone_ looks stupid now. Apple for the annoying process of the app store and developers for wanting 99 cents/each for a "silly puzzle game that would have to be free on the web".

Now, what would happen if you had a big walled-garden where each user paid a fixed-fee for unlimited access to everything and each developer was paid per- use and by rating?

Sooner or later, this model (all-you can eat content for a fixed fee with some of the fee going to content developers) will replace the "free" web and app- store models. The web is close to this already but the fees aren't shunted quite enough to content developers.

<comment><USER24> And this worked so well for music subscriptions too, didn't it?

</comment></comment><comment><USER37> I flagged this without even looking at the article. Is that bad?

<comment><USER38> Not really, the title was pretty linkbait.</comment></comment>


Trackers and bank accounts - <AUTHOR> http://www.windytan.com/2015/04/trackers-and-bank-accounts.html <comment><USER2> This "just SHA1 it" approach to _data anonymization_ is getting really old.

Previous: [http://dataabinitio.com/?p=442](http://dataabinitio.com/?p=442)

</comment><comment><USER3> Windytan is one of the coolest hackers I've ever met.

<comment><USER4> i came to say the same thing. her ccc talks are actually worth watching, was really fun to watch her play around with radio.

[https://media.ccc.de/browse/congress/2013/30C3_-_5588_-_en_-...](https://media.ccc.de/browse/congress/2013/30C3_-_5588_-_en_- _saal_g_-_201312281600_-_my_journey_into_fm-rds_-_oona_raisanen.html#video)

<comment><USER5> This is great fun. Very accessible.

</comment></comment></comment><comment><USER6> _" In the case of the taxi data, one way to improve on the hashing would be to substitute a random number for each license ID, then hash the random numbers. Not only does this make the hashed values harder to re-identify (because the input has no consistent format), but even if the data are re-identified, the random values are not personally identifiable."_

What is the point of re-hashing the random numbers? Once you have replaced the actual values with random numbers I don't know what you get from then hashing those.

</comment><comment><USER7> Interestingly, the same bank rolled out a new website last year, with no notification of it being updated to the customers. Just found myself staring at an unknown site one day.

</comment><comment><USER8> Note that it is against the Google Analytics terms of service to record personally identifying data. So even if someone wanted to do this, reporting it to Google would get their GA account suspended.

</comment><comment><USER9> This is probably actionable. As in lawsuit. But, that's probably too American of me to bring up. Regardless, this really sucks. Thank you for pointing it out and bringing attention to it.

</comment><comment><USER10> I'm not sure if censoring "google" out of the tag is even worth it, considering how recognizable that url is :)

</comment><comment><USER11> Awesome. In the US, just discovering that script would probably get you a visit from Federal marshals, much less reverse-engineering the hash to discover your own account number.

<comment><USER12> I don't think so. This isn't like the AT&T case involving manipulation of a URLs query paramaters to discover other users details.

This is just analysis of data describing the current user (you) that your browser is already sending to a remote site. No manipulation of the traffic takes place. As I understand it, there is (can be) no law against using view- source: or the browser debug tools to see what other URLs are accessed when a page loads.

</comment></comment><comment><USER13> Would it have worked if it just provided a sessionID to each request that could be matched on the backend to account number and such for their analytics?

<comment><USER14> They could also have used a real encryption method like AES.

<comment><USER15> Not useful for tracking unless used in ECB mode, and if they're encrypting anything larger than 120 bits (AES block size) then AES in ECB mode would itself leak information about the encrypted information.

The real thing to do if they wanted _pseudonymous_ values ( __none __of this is anonymous in any way) is either just associate a fresh random value with every account, or if you don 't want to have to store any additional information, HMAC the account number with a reasonably long secret key.

<comment><USER16> It's sad to see so many applications use SHA1/SHA256 when they really need to be using HMAC-SHA1/HMAC-SHA256.

<comment><USER17> Why would they care that someone tempers with the analytics if it is meant to be anonymous

</comment></comment></comment></comment></comment><comment><USER18> I am reminded of Scheiner's adage that we live in an age of data pollution, like Victorian smogs and it takes real pea-soupers like this to make us think there might be better ways.

I mean - that is dumb by anyone's standards.

</comment><comment><USER19> Fun hack, but - yet another stupid large bank/corporation, probably underpaying their devs and not reviewing code _ever_. Any other ideas on why this happens so often?

<comment><USER20> People who don't know much about programming, let alone computer security, doing the hiring. They can't write an attractive job description. They probably don't offer enough money. And, they probably are unable to identify the good candidates reliably even if they do show up. This is a cost centre for the business, not a revenue centre, so it probably will never get the attention it deserves.

<comment><USER21> If Finland is anything like Denmark, not enough money is probably not the issue. Bank IT is a pretty well-paid job here, near the top of the scale for programmers. But nonetheless has a reputation for being poorly run and just somewhat boring, with a workplace dominated by "suits". In fact you might have to actually wear a suit to work yourself. So it attracts people who want a stable job with no overtime and a large paycheck, and are willing to put up with high management overhead and banking-sector culture.

</comment></comment></comment><comment><USER22> Please note that an IBAN is not enough to set up direct debit. So giving out users' bank accounts it's not as bad as it would be using ACH.

<comment><USER23> In a bad case the IBAN may tell you the branch they are at and roughly when they opened their account. Direct debit is a US thing, mostly.

<comment><USER24> You're talking nonsense:

[http://en.wikipedia.org/wiki/Direct_debit](http://en.wikipedia.org/wiki/Direct_debit)

Even scanning that page there's a lot of major economies that work on DDs.

<comment><USER23> I was discussing usage, not theoretical existence for some subset of cases. Direct debit is rare in Australia/New Zealand (most people prefer to perform transactions themselves on a one-off basis), I've never seen it in Asia in 15 years, and according to my US bank the American implementation is often fundamentally broken and based on some kind of print-and-mail-a-check system, though widely used.

<comment><USER25> > _I 've never seen it in Asia in 15 years_

Direct debit is very common in Japan and South Korea, although credit cards are also used for recurring payments. My phone bill is paid via direct debit. My parents' utility bill is paid via direct debit. A client of mine collects membership fees via direct debit.

It's ridiculously easy to set up. It's also easy for fraudsters to abuse. But then again, a fraudster would need to register his business with the appropriate authorities in order to start making debits, and many payment processors require additional details such as the account holder's date of birth. So nobody seems to be particularly worried. People here hand out their bank account #'s like they hand out business cards. A lot of small businesses even have their bank account #'s posted online. Heck, even I have my bank account # posted online, to collect donations for an open-source project.

So, direct debit is everywhere, fraud is everywhere as well, but for some reason, Americans seem to be the only ones who freak out when someone else figures out their bank account #.

<comment><USER21> One thing a few countries do (at least Denmark, not sure where else) to cut out most instances of direct-debit fraud is requiring that the first debit from a new merchant is approved by the account owner. This might not technically be a _direct_ debit, though, but is the electronic adaptation of the old "giro" system to function mostly through the direct-debit machinery. When a merchant wants to set up a new client's payments, they send a "giro" request, which is basically a bill with some codes. The client could pay this in the old-fashioned way by taking it to a post office and paying it there in cash; the post office then transfers the payment to the merchant. But what most people do nowadays is log into their online banking, enter the giro #, and say they want to pay it with direct debit. That authorizes all subsequent bills in the same series (i.e. for the same product or recurring subscription) to get direct-debited automatically. But merchants can't normally just pull directly without this initial authorization.

</comment></comment></comment></comment></comment></comment><comment><USER18> Weirdly, IBAN numbers do not have an agreed international standard beyond the country code and checksum. I guess Finish IBANs are slightly more amenable to brute forcing than UK - but only by 26 digits.

[http://en.m.wikipedia.org/wiki/International_Bank_Account_Nu...](http://en.m.wikipedia.org/wiki/International_Bank_Account_Number)

<comment><USER26> This makes the switch to IBAN very simple - it's just the country code, a checksum and whatever numbers were in use before the switch. Local businesses can still ask for the old numbers and then transform them to IBAN.

</comment></comment><comment><USER27> People want the banks to have better and more usable netbanking pages. Improving the UX without tracking the users behaviour is pretty hard.

If some lawyers then say that SHA1 is enough, it is enough, the people implementing it might not even be involved in that discussion.

The real problem I see here is that the tracking data is forwarded to Google servers outside of the EU. This might be against EU laws.

</comment><comment><USER28> They thought they ended the debate with that Twitter post, but they were merely joining it... on the wrong side!</comment>


8hrs Hacking A Clojure 3d Game Compressed Into 1min - <AUTHOR> http://www.youtube.com/watch?v=DHARNkMi5Lg

<comment><USER2> Cool! What's the link to the tutorial?

<comment><USER3> I open sourced the code here: <https://github.com/jasonjckn/snake3d>

I don't have a tutorial for Snake3D, but there's quite a bit out there for Clojure + OpenGL:

1) <https://github.com/ztellman/penumbra/wiki/Applications>

2) <https://github.com/swannodette/clj-nehe></comment></comment>


Mpengine X86 Emulator Heap Corruption in VFS API - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1282&desc=2# <comment><AUTHOR> _" I wrote a fuzzer for the unsandboxed x86 emulator in Windows Defender and found arbitrary read/write"_ [https://twitter.com/taviso/status/878314575149506561](https://twitter.com/taviso/status/878314575149506561)

Also, here's a recent HN discussion about the last major Windows Defender RCE: [https://news.ycombinator.com/item?id=14296959](https://news.ycombinator.com/item?id=14296959)</comment>


Russian hackers hold medical centre to ransom after encrypting patient records - <AUTHOR> http://www.abc.net.au/news/2012-12-10/hackers-target-gold-coast-medical-centre/4418676

<comment><USER2> "We've got all the antivirus stuff in place - there's no sign of a virus. They literally got in, hijacked the server and then ran their encryption software," he said.

A pretty telling example of a regular person's idea of security. If you have your antivirus installed, there can't be any security risk, your ass is covered.

I am sure that this is the same level of understanding held by people who are gatekeepers to databases containing tens or hundreds of millions of people's records in government agencies, hospitals, and other places.

Laws need to be made in this area which treat the theft of these records as a serious crime akin to a bank owner losing all of his customers' cash on the stock market.

</comment><comment><USER3> This is not at all a new practice. Theres an entire field dedicated to stuff like this. [0]

[0]: <https://en.wikipedia.org/wiki/Cryptovirology></comment>


All Yandex resources are down. - <AUTHOR>

All Yandex resources have been down since 14:13 GMT. As you know, it is a biggest search engine in Russia, (yes, it is more popular, than Google in Russia) including search, mail, money, video, photo, free hosting, you name it. The reason is yet unknown. <comment><AUTHOR> Half an hour ago they twitted that network failure accrued and they are fixing it. <http://twitter.com/#!/yandex/status/104552393110323201>

</comment><comment><USER2> Maybe it is from all of them web masters Rick-rolling their wayward search bot.</comment>