Open-Source Projects Are Getting Ripped On Amazon - <AUTHOR> http://www.phoronix.com/scan.php?page=news_item&px=OTAyNg <comment><USER2> _Butterfly Media is also ripping off the popular Scribus layout/publishing program too. The company is reselling Scribus as "Desktop Publishing Studio" (link). They aren't just taking the programs and reselling it, but even their screenshots shown on the Amazon product page are ripped._

Silly phoronix.

 _Scribus Copyright 2001-2008 Franz Schmid and rest of the members of the Scribus Team. [...] This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version._

Brush up on the GPL there lads. You're perfectly welcome to sell a copy of a GPL program as long as you otherwise comply with the license.

Perhaps next phoronix will break the story of Redhat charging money for the Linux kernel.

<comment><USER3> While the code is usually GPL, for games the artwork is many times CC non- commercial (as it happens with "Dangers of the Deep", one of the games mentioned).

Trademarks can be involved as well: e.g. you cannot resell Firefox and still call it Firefox.

Even the screenshot for Inkscape is a ripoff of a tutorial: <http://howto.nicubunu.ro/inkscape_face_draw/> (and the license is breached because there is no attribution made).

So in case you want to sell open-source software, make sure you consult a lawyer ;)

<comment><USER4> > Trademarks can be involved as well: e.g. you cannot resell Firefox and still > call it Firefox.

This shouldn't be an issue here, as they've changed the names. They, e.g., sell Scribus as "Desktop Publishing Studio".

<comment><USER3> In case you weren't paying attention, the branding was only changed in the Amazon listing and maybe the physical packaging: I haven't bought any of those, but considering that they just blurred / cut the window names from those screenshots, I assume they didn't do anything else.

Branding an application with a different name (i.e. removing all references to the old name from the code-base) takes effort and it's not just a matter of changing the main window title. Just ask the Debian people that rebranded Firefox to IceWeasel.

<comment><USER5> _> Just ask the Debian people that rebranded Firefox to IceWeasel._

Or the people who rebrand redhat as centos for that matter. I bet it takes a little more than a find-and-replace-in-project.

<comment><USER6> If you don't modify anything, you can still sell it, right? Take firefox for example - i thought Mozilla was objecting to the additions & changes.

<comment><USER3> Depends on the trademark licensing available of course.

In case of Firefox: no, you cannot sell it without written permission while branded as "Firefox".

From <http://www.mozilla.org/foundation/trademarks/policy.html> ...

          You can't put the Mozilla Mark(s) on anything that you
          produce commercially (whether or not you make a profit) --
          at least not without receiving Mozilla's written permission.

But what you can do:

          distribute unchanged Mozilla product(s) (code + config) for
          each platform downloaded from www.mozilla.com
          or www.mozilla.org as long as you distribute them
          without charge

And the reasoning for this, as explained:

         In addition, on an all too frequent basis, we receive
         reports about websites selling the Mozilla Firefox browser,
         using the Mozilla Marks to promote other products and
         services, or using modified versions of the Mozilla Marks.
         The problem with these activities is that they may be
         deceptive, harm users, cause consumer confusion, and
         jeopardize the identity and meaning of the Mozilla Marks.

Of course, many open-source projects don't even have registered trademarks, but (I am not a layer so take this as an opinion) ... even unregistered trademarks are protected and I think you can still sue successfully somebody if it brings harm to the project's image.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> And innocent phrases are getting ripped on Phoronix: such as the words "free software", which on mouse over produce a popup that asks me to "Earn Cash Completing Surveys".

More on topic, to the people who are saying that GPL users had it coming: offering the binaries without the source code is a violation of the license (GPLv3 section 6, GPLv2 section 3). And even if they would somehow sneakily satisfy that clause, you've got to admit that renaming the software and selling it without so much as a nod to the original developers is sleazy to say the least.

</comment><comment><USER8> Technically, it's not illegal to sell a GPLed application. The GPL attempts to confer true freedom to whoever has the code. They may do anything with it... except one thing: they can't make it (or any derivative version of it) non GPL and take away the freedom from whoever else gets the code.

The question is, should people be prevented from charging money for something that is GPLed and someone else can get it for free? I guess the answer is no. After all, if these guys aren't violating the GPL, anyone can download the program and then offer it on Amazon for a dollar, undercutting them.

The real question is, can you make restrictive trademarks etc. around a fork of a GPLed product? I think you are legally allowed to. In this case, you can actually go after people who try to undercut you, on trademark grounds. And if that is the case, you will get a bunch of people who don't realize that there is a free version called something else. Business opportunity for unscrupulous people right there! Heh... they can claim to give "support" for their trademarked version of the program.

Of course, if the original software is licensed under MIT, BSD or something that doesn't enforce propagation of the license, then the person selling a fork of the program can do whatever they want. This happens all the time.

</comment><comment><USER9> For GPL code, as long as they provide the modified and complete source code along with their own versions, everything should be fine.

Artwork and other works not govered by GPL is of course another issue, however I believe that in most cases those are often licensed similarly to GPL (GNU Free Documentation License?).

Of course, it might be that they didn't include the source code or forgot to attribute the original authors. At least that would constitute ripping.

</comment><comment><USER10> Incredibly poor article from a journalistic perspective; it leaves me wondering if the author actually understands the topic for which he is commenting.

However, there is substance to this and almost certainly violations taking place. The community is all the better to know about.

</comment><comment><USER11> The remarks about commercial distribution of the Danger from the Deep CC By- Nc-Nd assets do make me wonder if the Non-Commercial clause can stand up in court.

Consider, by analogy, that I produce a product FOO, which I sell for $1 as a download. It includes a license prohibiting commercial distribution, but this license is not visible to the consumer before purchase and download. Supposing the purchaser simply stores the software, but does not run it nor agree to the terms of the license. They burn it to a CD, delete the original copy, and sell it for $10. They have never been exposed to the license, so Vernor v. Autodesk does not apply, and their redistribution is protected by the first sale doctrine.

Suppose instead that I distribute BAR freely under the same license and conditions. The reseller, having lawfully downloaded a copy of the work, burned it to CD, deleted the original work, but having never been exposed to the license, will also argue that they have a protected right to resell the work, under the first sale doctrine.

The question: Does the First Sale Doctrine distinguish between works that are sold, and those that are distributed freely?

<comment><USER8> I guess the answer is basically this: under case law and statutory law, the person can resell one copy of it for any price if they have never been exposed to the license. However, the judge/jury may not believe that is likely. They may invoke some tort or delict saying that you should at least look at a work's license before selling it to someone else.

In any case, you cannot make a copy of the product and must resell the original product which you bought, due to copyright law. Personally, I don't think copyright models reality really well, so there will be lots of these problems.

</comment></comment><comment><USER12> Thank you for giving me the opportunity to explain this to you: <http://diveintomark.org/archives/2009/10/19/the-point>

</comment><comment><USER13> Ah, I keep hearing from GPL advocates that anyone is "allowed" to sell GPL software.

And then when someone does it, like in this article, there is a big fuss.

<comment><USER14> obviously, gpl advocates don't want other people to make money on the work from the sweat of their brows.

<comment><USER15> Then the gpl is a bad choice for them as a license?

<comment><USER16> It does make it harder to make money from your work, and it's the closest you can get to that while still using a (well-known) open source license. I have no doubt that lots of people are indeed using the GPL for that purpose; look at pretty much any GPL-vs-BSD debate for further proof.

That said, yes, the GPL doesn't actually make it impossible to turn a profit.</comment></comment></comment></comment>


It's Left-wing prats who are defending our freedoms - <AUTHOR> http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/10263356/Its-Left-wing-prats-who-are-defending-our-freedoms.html

<comment><USER2> This is actually one of the best articles I've read on the subject. I hope it wakes the traditional conservative educated middle classes in the UK, who to- date have been scarily quiet.

</comment><comment><USER3> I don't think the libtards in the USA (our equivalent of left-wing prats in the UK) have been very active. If this stuff had become known during Bush's presidency, we would have:

1) incessant calls for impeachment 2) Nightline counting day xxx of the "constitutional crisis" 3) manufactured outrage on the evening news 4) daily apoplexy on the topic from all the talking heads

But we have very little of that from the mainstream media. Obama is their guy, so he pretty much gets a free pass. Nancy Pelosi doesn't have any problem with any of this.

There's at least some hope for the USA. HN has linked to innumerable articles about this, and most posters here do see the problem.

</comment><comment><USER4> _It 's Left-wing prats who are defending our freedoms_

(Published title).

<comment><AUTHOR> I hear what you say, and I half agree with you. It's probably that the moderators will agree with you and change it, but I'm quoting the final line, which seems a more accurate reflection of the apparent purpose of the piece, rather than the title, which seems less indicative.</comment></comment>


The Riddle of the Well-Paying, Pointless Job - <AUTHOR> https://humanparts.medium.com/the-riddle-of-the-well-paying-pointless-job-b7ae4d1d95d9 <comment><USER2> If you start from the presumption that jobs are "bullshit", then you end up creating these ludicrously contorted theories.

Or, you could start from the obvious: that the entity paying the money thinks it is buying something of value -- and then, you get sane, sensible theories of economics in which the world makes sense.</comment>


Telegram Messaging App Closes Channels Used by ISIS - <AUTHOR> http://www.nytimes.com/live/paris-attacks-live-updates/messaging-app-telegram-closes-isis-channels-after-russian-founders-rant-calling-french-socialists-responsible-for-attacks/ <comment><USER2> So in other words, Telegram is just another instance of cryptowashed snake oil.</comment>


Apple plans 'abuse spy' for your iPhone - <AUTHOR> http://www.newscientist.com/blogs/shortsharpscience/2009/08/apple-patents-phone-abuse-spy.html

<comment><USER2> This system could save Apple a lot of money. However, there is a tradeoff: the perceived quality of Apple's customer service will take a hit.

One of the reasons Costco became really popular was their return policy. You were able to return any consumer electronics device without any questions asked. If word spreads that Apple refused to accept faulty devices, they'll end up pissing off their existing customers and scaring away new customers, even if the fault was due to abuse.

Another issue: will they count jailbreaking as "abuse"? What about using an unofficial app store like Cydia? (<http://news.ycombinator.com/item?id=746198>)

<comment><USER3> If you jailbreak your iPhone, you're obviously a terrorist interrupting critical systems like e911 -- this will set off a small explosive charge that will fragment the metal casing and internal components to disable the enemy combatant.

</comment></comment><comment><USER4> Interesting concept - reminds me of the black box on airplanes...

From a privacy perspective, there shouldn't be any automatic upload of this information to apple's servers-only when you go in and ask for a replacement. We'll have to wait and watch though.

I also wonder if this requires them to add a few sensors to the phone that are not present in the 3G or 3GS versions - which would mean this would only be applicable from the next version

<comment><USER5> I venture most of these are already present. Eg I've read elsewhere about "indicator strips" on the casing which divulge water exposure, the accelerometer ICs these days usually can be programmed to generate an interrupt on high-g, and there may already be a temp sense in there (eg some accelerometers carry these on board for temp compensation).

<comment><USER6> There is a thermometer in there already.

[http://heyinternet.com/imgdump/hot- iphone-20090130-175515.jp...](http://heyinternet.com/imgdump/hot- iphone-20090130-175515.jpg)

</comment></comment></comment><comment><USER7> I've broken three ipods in the last two years. All in the course of doing what I'd consider normal things to do with a portable music player. One from getting too much sweat on it, one from a waist level drop, and one from condensation from a water bottle. I won't buy another iPod again. I'm not sure if they're much more vulnerable than other brands, but they're sure more expensive, and too expensive to break that easily.</comment>


What Dwarf Fortress Taught Me About Startups - <AUTHOR> https://blog.opsee.com/what-dwarf-fortress-taught-me-about-startups-30800ea98324?gi=6684b391fd0e#.x0ivmty7e <comment><USER2> Duplicate [https://news.ycombinator.com/item?id=11520407](https://news.ycombinator.com/item?id=11520407)

<comment><AUTHOR> Whoops.</comment></comment>


Archos to give away 200k devices in Europe to create PicoWAN network for IoT - <AUTHOR> http://www.archos.com/us/picowan/ <comment><AUTHOR> They are supporting the LoraWAN "standard" (one of many in that field). They use different public frequencies in different countries (9xx Mhz in the US, 8xx in China and Europe, also 43x Mhz in Europe).

The cost for a producer of IoT devices is 50 cents per year per device to use the network. People hooking up one of these routers in their homes can earn 50% or the profits made through their uplink.

Another competitor in that field The Things Network ([http://thethingsnetwork.org/](http://thethingsnetwork.org/)) who are based in Amsterdam. I think Archos is making a clever move here, for device makers it'll only be interesting if the network size is substantial, ideally covering parts most of a country.

LoraWAN claims a range of several kilometers per hub, even if they are located inside buildings.

<comment><USER2> Any idea what the electricity cost is?

43x MHz should penetrate quite far, but the antennae will be twice the size for the same amount of gain as the 9xx MHz units.

Would the latency/bandwidth/cost be reasonable enough for voice communications?

What happens when someone tunnels their uplink over TOR?

<comment><AUTHOR> You can request the specification for LoraWAN for free at [https://www.lora- alliance.org/For-Developers/LoRaWANDevelope...](https://www.lora- alliance.org/For-Developers/LoRaWANDevelopers).

From what I've seen, voice traffic is completely out of the question because of the duty cycle requirement. Devices are only allowed to send 1% or 0.1% of the time, so after transmitting for a second or so (at a maximum of 50kbps), they are supposed to be quiet for 100 or 1000 seconds.

This is really designed for low bandwidth messages such as "switch X in device Y has been triggered" or "device Z has moved to position a,b".

</comment></comment></comment><comment><USER3> It's sad there's no "Out-Of-Band" WiFi (say 1kB/s unauthenticated WiFi), or is there such a thing in the standard already? Think SMS for WiFi, cheap and very lightweight, yet an immense benefit.

It would be easier to upgrade WiFi routers firmware than start a new network...

<comment><AUTHOR> One of the benefits of this new network is the range of the base stations.

A Wifi router in a house will have a range of tens of meters. They are claiming several kilometers of range for the unlicensed ISM bands they are using.

<comment><USER3> Sure, I understand that, yet "everyone" has wifi already, and even in the streets you receive a decent number of wifi signals...

There might be a need for longer range IoT comms (in cars, etc) but for urban use, WiFi would be fine if only it had OOB. We're not using the full potential of WiFi I think

</comment></comment></comment><comment><USER4> Seems like a pretty clever way to bootstrap Metcalfe's Law.</comment>


Complete MSL Curiosity Descent - Full Quality Enhanced 1080p - <AUTHOR> http://www.youtube.com/watch?feature=player_embedded&v=gZX5GRPnd4U

<comment><AUTHOR> Found this over on Fark and thought the guys here would like it. This has to be one of the most amazing feets of engineering in our lifetimes.

(Speaking of the rover landing of course ;)</comment>


Who Needs Flash on the iPhone More: Adobe or Apple? - <AUTHOR> http://www.readwriteweb.com/archives/who_needs_flash_on_the_iphone.php <comment><USER2> Easily apple. Flash would add a layer of functionality alone that they cant duplicate with other mobile aspects. Very small games for instance. Flash isnt gaining a new audience with the iphone. All of those folks have a computer with a web browser ---> thus flash installed.

<comment><USER3> I have to entirely disagree with you; Apple could have Flash on the iPhone trivially if they wanted it- Adobe has begged to port it, and is trying to find legal ways to do it once the 2.0 firmware ships. There is no obviously legal way, however, as Apple bans all code which can run or compile other code.

It would be irrational for Apple to support Flash on the iPhone, for several reasons. While performance and drain on battery life are certainly factors, I believe that the stronger element is that Apple wants to own the development environment.

Currently, if you want to develop for the iPhone, you need to use Apple's APIs, and Apple's runtime.. You can choose either Web development (Safari Touch), or Native Development (Cocoa Touch), but either way, Apple owns the process.

Adobe wants Flash on the platform for the same reason that Sun wants desperately to port Java- Controlling the Dev environment gives you tremendous control over the future of the platform.</comment></comment>


Changing Date to January 19, 2038 disables Android devices (2011) - <AUTHOR> https://code.google.com/p/android/issues/detail?id=16899 <comment><USER2> In my understanding this problem is related to the definition of time_t type in C/C++. It is defined by UNIX/Linux OS system libraries on 32 bit systems as a 32 bit varable. Thus whatever software that relies on it has the 2038 problem.</comment>


Simple Alerting for the ELK Stack - <AUTHOR> https://github.com/Yelp/elastalert <comment><USER2> We're using this. We're not running the full ELK stack; rather, we've replaced Logstash with fluentd. Our devs have two choices for acting on their logs: they can use elastalert (running in Kubernetes) to alert on events that are recorded in Elasticsearch. We've provided a sample elastalert template that can be easily customized to a developers needs.

They can also deploy a custom fluentd parser/transformer in Kubernetes. To make this work, they apply a special label in their Kubernetes replication controller that specifies the name of the custom fluentd parser service. The primary fluentd service pulls the logs from Docker and when it detects this label for a particular log entry, it routes that entry to the custom parser service. This allows us to have a standard log pipeline that works out-of-the- box for most projects but also _self-serve_ custom parsing for the apps that need it.

</comment><comment><USER3> Stack Exchange's monitoring system, Bosun ([https://bosun.org/](https://bosun.org/)), also has support for alerting on the results on Elasticsearch queries.

</comment><comment><USER4> It sounds like they're using a search engine as a substitute for a proper CEP/ESP like Apache Flink. Was the latter considered? I'm rather curious as to why they chose a search engine instead.

<comment><USER5> ELK is a very standard stack for collecting and disseminating logs. It's a fairly natural, and i think sensible, step to build a pattern-based alerting tool as a bag on the side of ELK.

If you were going to do it more properly, the first choice would probably be Riemann, which has already seen some adoption in this role. There are already plugins on both sides to forward events to the other:

[https://www.elastic.co/guide/en/logstash/current/plugins- out...](https://www.elastic.co/guide/en/logstash/current/plugins-outputs- riemann.html)

[http://riemann.io/api/riemann.logstash.html](http://riemann.io/api/riemann.logstash.html)

<comment><USER4> With all respect to the very smart author of Riemann, as a practical matter, its use of Clojure is simply not a hurdle most SRE types are going to overcome to use it.

ElasticSearch is a great search engine. It's not a CEP or SEP. I don't mean to discourage its use, but for this purpose it's not a good fit. It does make sense to tee incoming logs to both as they suit different purposes, but I'd delegate pattern analysis to the latter.

<comment><USER6> Using Clojure, especially to slap together Riemann configs, is really not an insurmountable obstacle, especially when something as useful as Riemann is on the line. The more the self-defeating attitude that "Clojure's too hard" propagates the less likely people will be to even try. Most SRE's are pretty smart, I believe in them.

<comment><USER4> There are some great commercial options in this space like SignalFX and Sumo Logic. The cost of Riemann's learning and implementation challenges would have to be made significantly less for entire teams to make it a viable alternative to those, in my experience.

If anyone runs a team of 25 or more SREs and effectively uses Riemann (and there's more than 3 domain experts), and is not otherwise a Clojure shop, I'd love to hear from you.

</comment></comment></comment></comment></comment><comment><AUTHOR> Is anyone running this in production and care to share their experiences? This seems to be a pretty good replacement for Splunk's alerting mechanisms in the ELK stack, which has always been one of the parts I miss the most.

<comment><USER7> I am using it right now in production. It's worst trait is that it is not clustered and does not share state about what alerts have been sent already. This means you can have no more than one agent running without having duplication of alerts. This also complicates high-availability for obvious reasons.

<comment><USER7> (Correction/Public Shaming: Its)

</comment></comment></comment><comment><USER8> It's a nice product, just be aware that it is purely event driven. So if you are trying to alert on no event then things get messy

<comment><USER9> Unless I'm misunderstanding your comment, isn't that a flatline type of alert, which is supported by Elastalert?

<comment><USER8> No that is just if a value drops off, but that rule will never fire unless an event occurs in elasticsearch matching that query. I found this out the hard way

</comment></comment></comment><comment><USER10> How does this compare with the log stash alerting plugin that's available? Does it work without log stash (i.e., just elastic search)?

<comment><AUTHOR> It works against elasticsearch and is somewhat agnostic as to how those documents got there in the first place. I've been playing with it as part of an EFK (fluentd instead of logstash) install.</comment></comment>


Lua historical source code converted to Git - <AUTHOR> daurnimator did an archeology to find all the original Lua source code development history and convert it into a Git repository for easier viewing.
Main source: https://github.com/lua/lua Tests: https://github.com/lua/tests luac: https://github.com/lua/luac manual: https://github.com/lua/manual
His talk: https://www.lua.org/wshop16/Daurnimator.pdf <comment><USER2> Swagbag! Oh man, this is so cool. I've always wondered what Lua's development looked like, but I remember Ierusalimschy mentioning that developing Lua out in the open would end up being too noisy.

I really enjoy his stance on development practices, and although this is cool to view, I hope he doesn't change his stance.</comment>


Ask HN: advise on starting up a web-development company - <AUTHOR>

I've been thinking on an idea of starting up a web-development company. The main area would be providing websites development, design and support services for a reasonable cost (e.g. 10-15 $ per hour).
I saved up some money that can cover 2-3 developer-month work and am currently saving up more to cover other expenses (buying or renting server hardware, running ad campaigns).
Where do I find customers that are interested in our services on a regular basis? Sites like elance/odesk are overwhelmed with crappy "clone a facebook in 3 days for 500$" projects, so they're not a good place :( How can I make customers interested in long-term relationships?
As the company doesn't have a portfolio of finished projects in the beginning, does it make sense to offer a special low-cost program to make us more attractive than competitors? It looks pretty much like the first time I have a job interview when I have no experience and when I can attract employers only by being smart and asking for little money.
Where can I find out more on topics concerning these issues? Any books/resources/advise you can give to a wanna-be entrepreneur?
Thanks! <comment><USER2> You don't need to buy server hardware: Use something like Slicehost. You don't need to run an ad campaign.

The way to get a customer interested in a long-term relationship is to do a tiny short-term project for them, and do it well. Web sites are like engines for generating work. They will have more work for you sooner or later.

Don't compete on price unless you absolutely have to. That's a sucker bet. Your pricing sends a signal. Charging $10 tells me that you're either absolutely desperate, that you're located someplace very far away from my time zone -- possibly an uncharted backwater with pigeon-based internet connections and a really low cost of living -- that you're a student who has almost no time to spare and no business experience, or that you are such a neophyte that you can't be trusted to touch my website without breaking it. Possibly all four.

Undercharging your competitors will bring you business, all right -- you'll get deluged by offers from the kind of delusional people who think that Youtube should cost a couple thousand dollars to design and build. If you hate bottom-feeders, why are you aiming at the bottom of the market? Learn enough skills to justify a higher rate, and sell your quality, not your low cost.

Yes, if you charge $40 an hour or more (top developers with experience charge rather more than that) you'll have to actually convince people that you know what you're doing. To do that, you let them sign you up for a very tiny project that only takes 1 hour, then demonstrate competence on that. And you build a portfolio. Setting up a single website doesn't take long. You should build _some_ site for yourself right away just to demonstrate that you know the basics -- or as a way to learn the basics.

Read: [http://eikonoklastes.org/articles/2007/09/26/how-i-can- charg...](http://eikonoklastes.org/articles/2007/09/26/how-i-can-charge-so- much)</comment>


What Really Happened in that Double-Blind Violin Sound Test - <AUTHOR> http://www.violinist.com/blog/laurie/20121/13039/

<comment><USER2> From the study's abstract: _Differences in taste among individual players, along with differences in playing qualities among individual instruments, appear more important than any general differences between new and old violins._

Another case of science reporting failing miserably at understanding and conveying the results of studies. The three articles all come up short at even reading the abstract:

Daily Mail _" Concert violinists can't identify the sound of a multi-million- pound Stradivarius"_

Phys.org _" Study shows even professional musicians can't tell old master violins from new"_

Npr.org - Doesn't even come close to the same universe as the study in the submitted article to the point I wonder if the npr article covered something else entirely?

<comment><USER3> It's the Daily Mail; we should be just happy they aren't claiming playing a Stradivarius causes cancer.

<comment><USER4> Have you seen [http://kill-or-cure.herokuapp.com/](http://kill-or- cure.herokuapp.com/) ?

I think you might get a kick out of it.

<comment><USER5> It is awesome. At least they don't claim that vaccines are causing cancer.

<comment><USER6> Some other people do!

</comment></comment></comment></comment></comment><comment><USER7> Because the violinists were only allowed to try the violins for one minute, this study has the same flaw that the Pepsi Challenge had in 1975:

"In his book, Blink, author Malcolm Gladwell presents evidence that suggests Pepsi's success over Coca-Cola in the "Pepsi Challenge" is a result of the flawed nature of the "sip test" method. His research shows that tasters will generally prefer the sweeter of two beverages based on a single sip, even if they prefer a less sweet beverage over the course of an entire can."

In other words, a saturated sound could initially be more attractive but not as good for an actual concert.

[http://en.wikipedia.org/wiki/Pepsi_Challenge#Criticism](http://en.wikipedia.org/wiki/Pepsi_Challenge#Criticism)

<comment><USER8> That's a serious issue. I play a stringed instrument, and purchased a "professional" model a few years ago. Among the instruments that I was trying out, some of the physical differences were sufficient that there would have been little expectation of identical sound, so the game was to discover the differences and then make a choice.

There were instruments that I rejected within seconds, but others that took me upwards of 1/2 hour to figure out how to adapt my playing to the characteristics of the instrument. There were issues that might have been unnoticeable to an audience member, but that would have affected my ability to play with good technique over the duration of a performance. Some of the instruments, including the one I ended up buying, changed my opinion of how I wanted to develop my tone and playing style.

Granted, I was always faced with a slight doubt about whether any of it was real, but without any good way of settling that issue. Also, a virtuoso might have been able to make all of the instruments sound the same with much less effort.

Oh, and don't get me started about bows.

<comment><USER9> They also mention in the post that the old violins were shipped, and no adjustments made, which means bridges could be improperly positioned, sound posts in poor positions... having these properly adjusted can make the difference between a great sounding instrument and a screech.

</comment></comment></comment><comment><USER10> I'm not a violin player, but to me the allure of hearing a violinist play on a 300 year old violin isn't that it's the best sounding violin on the planet. It's an opportunity to witness a small part of the history of an incredible piece of craftsmanship.

I mean, how cool is it to hear music come out of an instrument that spanned the lives of Bach, Mozart, Haydn, and Paganini?

</comment><comment><USER11> Wait a minute. She claims:

"Now a lot of you found it easy to pick the Strad... But it wasn't actually our task to pick the Italian in this study -- it was to pick our preference."

But NPR directly quotes the guy who ran the study:

"JOYCE: Curtin says of the 17 players who were asked to choose which were the old Italians...

CURTIN: Seven said they couldn't. Seven got it wrong, and only three got it right." [1]

Maybe she wasn't one of the 17 asked, but it definitely was studied.

[1] [http://www.npr.org/templates/transcript/transcript.php?story...](http://www.npr.org/templates/transcript/transcript.php?storyId=144482863)

<comment><USER12> The abstract [1] says:

"We asked 21 experienced violinists to compare violins by Stradivari and Guarneri del Gesu with high-quality new instruments. The resulting preferences were …"

It then goes on about preferences and says nothing about identifying them.

So it's the abstract of the study, written (I assume) by the researchers, and one of the participants vs a journalist "quoting" one of the researchers.

[1] [http://www.pnas.org/content/early/2012/01/02/1114999109.abst...](http://www.pnas.org/content/early/2012/01/02/1114999109.abstract)

<comment><USER13> The abstract you linked _does_ say something about identifying them: "most players seemed unable to tell whether their most-preferred instrument was new or old."

And in the full text of the study: "Asked about the making-school of their take-home instruments, 17 subjects responded: 7 said they had no idea, 7 guessed wrongly (i.e., that a new violin was old or vice-versa), and just 3 guessed correctly"

edit: the link to the full study is [http://www.pnas.org/content/109/3/760.full](http://www.pnas.org/content/109/3/760.full) in case anyone was having trouble finding it from the abstract.

<comment><USER11> Yup. Maybe what happened is, since only 17 of 21 responded to that question, perhaps she was one of the 4 that didn't.

It is a pretty damning study: Few could identify the old, expensive violins AND most preferred newer, cheaper violins. It means that the tradition of loaning Strats to top violinists may actually make for (slightly) worse performances.

I love blind studies.

<comment><USER13> Most of the criticisms of the study are inaccurate, but I would like to see this redone with the old violins receiving the same tuning/treatment as the new ones. Depending on the condition the old violins were received in, not being allowed to tune them could have had a big impact on preference. I know I'd rather play a $50 guitar that's in tune than a $5000 one that's out of tune.

</comment></comment></comment></comment></comment><comment><USER14> This post was regarding a test conducted in 2012. I'm not saying it isn't relevant or that the reporting around the new one is good, but the study she was a part of is a different one from the study making the rounds today:

[http://www.pnas.org/content/early/2014/04/03/1323367111.abst...](http://www.pnas.org/content/early/2014/04/03/1323367111.abstract)

<comment><USER15> Yep, the one she was part of was basically a "pre-run", which allowed the run of a new, better and extended study.

Here's Ed Yong's reporting on the new one, gives most of the meat and introduces the old one (and criticisms to it): [http://phenomena.nationalgeographic.com/2014/04/07/stradivar...](http://phenomena.nationalgeographic.com/2014/04/07/stradivarius- violins-arent-better-than-new-ones-round-two/)

</comment></comment><comment><USER16> The objective of this tests seems to be more to prove a point than to be fair, I'm not surprised.

And the test looks like it's blind, but not double blind.

It seems all rigour goes out of the window in order for the researchers to prove their point

And of course taste is subjective, but a misadjusted violin will not sound great even if it's a good violin. (Same with a bad violin, modern or old)

> "professional violinists can't tell the difference between modern violinist > and old Italians," then I think we need a

> different study in which violinists are actually asked to identify that

Of course.

<comment><USER17> I'm not convinced there is much interference from the conductors to warrant a double-blind study. Either way, I believe the original paper never claimed that "professional violinists can't tell the difference", that's the media twist. It proved beyond reasonable doubt that professional musicians _do not prefer_ the antique models based on any objective qualities.

<comment><USER18> I wouldn't even say the study proved that point. The fact that the older fiddles couldn't be adjusted for sound optimizations while the new ones could makes a huge impact on the study - it invariably unlevels the playing field.

<comment><USER17> I believe rare instruments like those are always kept in pristine conditions, and nowhere it is mentioned that the new ones had adjustments done, you can assume they all were received in 'normal playing condition' from their owners.

<comment><USER19> You believe wrong. Also, even if they are, traveling with an instrument, especially and old finicky one (and they do get finicky when they get old) can throw it out of adjustment, a seam can pop open, a string can go false, etc.

The new ones, on the other hand, since they were actually new, were probably being maintained by their makers, who undoubtedly made sure they were in top condition when they went into competition with a strad.

</comment></comment></comment></comment></comment><comment><USER20> tl;dr: Study seeks to determine if Old Master violins actually sound "better", media reports misleading headlines (shocker), musicians are angryface.

I remember when this study was first concluded and reported on. The CBC had a woman who participated in the study (maybe this very woman) on the program and it was so extremely obvious that her professional pride was wounded, and she really wanted to make herself feel better by telling the world that she really could pick out the Stradivarius.

I have no reason to doubt her; she's a professional violinist.

But it seems to me that the study was actually very effective at showing that masterwork violins do not necessarily sound better than modern violins, contrary to the regurgitated opinions of hundreds of thousands of novice violinists out there.

<comment><USER21> 'I have no reason to doubt her; she's a professional violinist.'

You know that claiming to be a professional violinist is an appeal to authority rather than a logical argument, right?

That said the study does seem to be massively misreported.

<comment><USER14> It may not logically follow, but in the real world it is not a strange thing to trust an actual expert on these topics over, say, a writer at the Daily Mail. Why object?

<comment><USER21> It's even better to examine their argument sans credentials.

<comment><USER22> It's even better to do both, and embrace a complete and holistic argument.

</comment></comment></comment></comment></comment><comment><USER11> I would love to see a study like this done with vinyl vs. digital.

1\. Put some vinyl-loving DJs in a hotel room.

2\. To factor out identifying pops & scratches, pre-record a vinyl song onto digital. Record it several times and use each digital recording only once.

3\. Cover their eyes and randomly switch between vinyl & digital.

See if they can tell the difference.

<comment><USER23> _To factor out identifying pops & scratches, pre-record a vinyl song onto digital..._

This would simply be a digital reproduction of a vinyl recording. (Something I quite like BTW). Vinyl is a "thing" because the process plays a part in _creating_ that sound people love and not just reproducing it.

<comment><USER11> Which is fine, but that nobody admits to that. How many vinyl enthusiasts would be just as ok consciously listening to a digital creation of the pop and scratch filter they enjoy? PVC is as awful, environmentally bad material and heavy to lug around. Why wouldn't DJs rip their vinyl to digital or just apply a filter to digital sources?

Most enthusiasts believe vinyl is actually better (quite adamantly) and that's what this experiment would test.

<comment><USER23> I don't know about a pop and scratch filter but I like some of the recordings of my old records I've captured more than the clean digital versions available now. I don't want random pops and scratches, I think maybe I want _my_ pops and scratches.

</comment></comment></comment></comment><comment><USER24> This reminds me very much of some studies where audiophiles did double blind tests of various solid state amps against tube amps. Some audiophiles say that the tube amps sound "warmer", maybe they like 60hz hum. Whatever. Tube amps look cool and that is what is really important to them I think much in the same way that it is a huge status symbol to have an old violin. Same thing I think. Not that there is anything wrong with that, you get your inspiration in whatever way works I think.

<comment><USER25> The "warmer" effect is not the hum. I have read it's how the amps process harmonics (odd ones vs even ones) and that this effect is actually measurable through testing equipment.

<comment><USER26> It's the fifth harmonic isn't it? I would disagree with zw123456's "whatever" with regard to analogue systems.

(It isn't just the look of valves - they keep your room warm too!)

<comment><USER25> Well, uh, it seems much more complicated than I remembered: [http://en.m.wikipedia.org/wiki/Tube_sound#Harmonic_content_a...](http://en.m.wikipedia.org/wiki/Tube_sound#Harmonic_content_and_distortion)

</comment></comment></comment></comment><comment><USER27> What would have been really interesting is if they had also conducted the test with another group of participants who were all informed about what each violin was. Then we could see how much influence lore and history have on what people like, by comparing the scores between groups.

</comment><comment><USER28> Perhaps not with violins, but blind wine tasting is very hard to tell differences... [http://www.liquidasset.com/WEILVDQS.PDF](http://www.liquidasset.com/WEILVDQS.PDF)

</comment><comment><USER29> They couldn't even tune the old ones or change the strings, looks like a useless study.

</comment><comment><USER30> TLDR: "Im an audiophool. I know whats great by the price stick^^^I could totally pick Strad blindfolded, I just didnt feel like it that day."

<comment><USER31> read again.

<comment><USER32> He did a rather poor job of expressing himself in a sensible manner but I must admit I had the same takeaway from the article.

<comment><USER31> pick best does not mean pick oldest, news articles said study was identification, study subject says study was preference, study says study was preference. How you could possible reach the grand parents takeaway is seriously concerning.

explain.

<comment><USER30> Yes. Im sure this is why she herself uses 200 year old violin instead of the modern one.

> for the last five years, a mid-1800s Italian.

Whole article is a result of authors cognitive dissonance.

I dont see much difference between her and people arguing for $1K speaker cables and later failing to distinguish them from coat hangars.

<comment><USER19> Her mid-1800s Italian has completely different characteristics from a 17th century Italian. A string player spends months or years trying many instruments before deciding on one. I've never known a professional musician who cares whether they're playing on a modern or an older instrument, they care whether they have the right instrument for them. You have no idea what you're talking about. Please just stop.

</comment></comment></comment></comment></comment></comment><comment><USER33> > _This study certainly doesn 't tell us what happens between a player and a > fiddle over a long-term relationship, and this is an important factor._

No, it's not, because the same long-term relationship can happen between a player and a modern violin as well.

<comment><USER34> The article explained how the long-term relationship with an older violin, which is more 'broken in' but temperamental day-to-day, might be different than with a modern violin, which is more 'dependable' day-to-day but can experience significant shifts in tone as it ages.

<comment><USER35> Wood also seems to change depending upon how it is used. Conventional wisdom is that a guitar gets "used to" how it is being played. I do like the comments about finding the unique characteristics because every instrument has a personality.

Conventional wisdom in classical guitars _ALSO_ says the guitars have a lifetime. The wood is tight, then it opens up, and then it breaks down gradually over time--roughly 15-20 years for cedar tops and 40 years for spruce tops.

If that is actually true, I suspect that feeds into this study. The Stradivaris, while phenomenal, are long past their peak and are now at the point where they are breaking down from playing and are likely only being preserved by the rarity with which they are being played.

I wonder if the "moderns" used in the study actually had some mileage on them. It would be interesting to see if a 20 years old "modern" with heavy use actually scores better than a 5 year old "modern".

Overall, it's actually good news. I suspect that this is like modern classical musicians, the geniuses are as rare as ever, but the average level of achievement across all classical musicians is _WAY_ higher now than it was even 100 years ago, and certainly moreso than 200-300 years ago.

It means that those of us who can't afford Stradvaris can still get excellent instruments.

<comment><USER36> I forget the guitarists name, but as a joke his band mates went to a pawn shop and bought him a used guitar. That gig he played so well it became a tradition. Every new gig he demanded a used guitar. The name will come to me. I do know there are a few horrid guitars out there though--the one at costco-- the Yamaha, I can't keep it from buzzing though.</comment></comment></comment></comment>


Anatomy of a pseudorandom number generator – visualising Cryptocat's buggy PRNG - <AUTHOR> http://nakedsecurity.sophos.com/2013/07/09/anatomy-of-a-pseudorandom-number-generator-visualising-cryptocats-buggy-prng/ <comment><USER3>
      Cryptocat's hacktivist credibility was cemented in 2012 when
      its Canadian developer, Nadim Kobeissi, was stopped at the
      US border and interviewed about his Cryptocat-related
      programming activities.

s/was/claimed to be/. This software clearly is not Ft. Knox, and its becoming less and less believable that US intelligence would ever feel the need to interrogate the author of an _open source_ project, and with such brittle security, about the cryptography techniques used therein.

I find it far more believable that the young developer with a penchant for dramatics and a reply for everything has a talent for PR. And a shallow understanding of the grave consequences of faulty crypto software.

<comment><USER4> I believe Nadim is being truthful in that someone at the border asked him about Cryptocat.

I think they probably saw his tweets "I'M CROSSING THE BORDER NOW OMG I HOPE THEY DON'T GIVE ME TROUBLE FOR BEING A BIGTIME HACKER ACTIVIST", they Googled him, and asked him about his website.

</comment></comment><comment><USER5> As the lead developer for Cryptocat, I must say this is really a great example of how to write a post-mortem for a security bug. Sophos bloggers are always worth reading.

<comment><USER6> Just remember that your software is not you. Have a tick skin, learn and start again. Probably a name-change will help too...

<comment><USER7> I don't understand this. Why would anyone have to change their alias just because they wrote buggy software? Mistakes happen, people move forward, but they don't have to recreate themselves just because they mess up. That seems radically unhealthy.

</comment></comment></comment><comment><USER8> First, this is a great article showing the bias in Cryptocat's very awkward PRNG code.

However, the off-by-one bias was actually the _least_ of the problems with Cryptocat's random numbers...

From reading Steve's write-up, the problem was that their keys were ridiculous undersized, because they called their own function wrong:

May 7, 2012 (switched from DH to ECC):

      myPrivateKey = Cryptocat.randomString(32, 0, 0, 1);

April 19, 2013:

      rand = Cryptocat.randomString(32, 0, 0, 1);
      myPrivateKey = BigInt.str2bigInt(rand, 10);

June 3, 2013:

      rand = Cryptocat.randomString(64, 0, 0, 1, 0);
      myPrivateKey = BigInt.str2bigInt(rand, 16);

> The bug that lasted 347 days was the confusion between a string and an array > of integers. This made the ECC private keys ridiculously small because they > passed a string of decimal digits into a function expecting an array of 17, > 15 bit integers. Each character was considered an element in the array. So > each of those "15 bit integers" were only the values 0 to 9 (3.32 bits). > Also the least significant 3 bits are zeroed giving you a key space of > 2*10^16 (2^54.15). -- > [http://tobtu.com/decryptocat.php](http://tobtu.com/decryptocat.php)

See for yourself here: [https://github.com/cryptocat/cryptocat/commit/a17bb1599463e0...](https://github.com/cryptocat/cryptocat/commit/a17bb1599463e0c079137d8200eb32002ac1afc7#src- core-js-lib-multiparty-js-P4)

Even now looking at this code, for me it just doesn't pass the 'WTFs per minute' test... It still looks fucking wrong to me... Cryptocat.randomString(64, 0, 0, 1, 0) returns a 64 character string of 0-9, why are they calling str2bigInt with a hex radix? Did they add the last '0' in the wrong place? Or maybe I'm looking at the wrong check in...

EDIT: Ok, it WAS still wrong as of June 4th... It wasn't until July 4th until it finally became:

      var rand = Cryptocat.randomString(64, 0, 0, 0, 1)

See: [https://github.com/cryptocat/cryptocat/commit/8fb7f4b8e59c76...](https://github.com/cryptocat/cryptocat/commit/8fb7f4b8e59c76c78c06bd16f87d3e5fa9defc7a#L1L91)

EDIT EDIT: So just to be clear... v2.1.11 which was supposed to fix this problem has this 'incorrect radix' bug in it? Please tell me I'm wrong, or do we need another CVE and another release?

<comment><USER4> Maddening isn't it?

<comment><AUTHOR> I am totally, completely in the dark as to which coding errors (there have been several in the past few months) attach to which CVEs and which versions, and about when these vulnerabilities were reported to the project and when they were subsequently disclosed. I can't be the only one confused, and I do wonder whether that confusion is strategic.

Pointing this out would be be gratuitous, except that Cryptocat's project leader has very high standards when it comes to the disclosure behavior of that project's competitors:

[https://github.com/SilentCircle/silent-phone- base/issues/5](https://github.com/SilentCircle/silent-phone-base/issues/5)

(Cryptocat is "kaepora" in that thread; the context there is that Mark Dowd had reviewed ZRTPCPP, an open source implementation of the ZRTP protocol that Silent Circle funds and relies on, and found several memory corruption vulnerabilities. Mark had gone public with those vulnerabilities quickly as a result of a miscommunication with the Silent Circle team, but then redacted his disclosure and agreed to embargo the findings while Silent Circle coordinated fixes with all of the Silent Circle competitors that relied on that library; what you see in that thread is, apparently, the lead developer of Cryptocat, which doesn't use ZRTPCPP, repeatedly criticizing Silent Circle's handling of the incident.)

The project should meet the standards that it has loudly set for others, and I don't think it has. I'd be happy to be corrected on this.

<comment><USER9> [edited to keep this thread constructive]

<comment><AUTHOR> My concern is substantive:

In the process of handling an embargoed disclosure, Silent Circle groomed (perhaps aggressively) a Github pull request thread. Handling a coordinated disclosure on a Github pull request is tricky under the best of circumstances, but the Silent Circle team was dealing with an unplanned partial disclosure and was, with Dowd's cooperation, trying to get the genie back into the bottle long enough for (from what I can tell) their competitors to get patched.

This was, as is evident from the thread, a problem for Cryptocat's uninvolved, un-implicated lead developer.

Meanwhile: I cannot immediately tell from the record which of the _independently discovered_ vulnerabilities in Cryptocat correspond to which CVEs or which advisories and which severity descriptions.

The problem isn't one of demeanor; it's that I can't tell what's going on with this project. Does this sound fiddly? Let's make it more concrete: did an exploitable vulnerability get reported to the Cryptocat project, mitigated in a public Github commit, and sit there for months without any acknowledgement from the project?

Cryptocat's project leader is an HN commenter, and if this confusion is my own doing --- totally possible --- I'd be happy for some clarification; not about Silent Circle, but on how someone would get a record of what vulnerabilities were disclosed in Cryptocat, when, and what the timeline was for each from discovery to public disclosure. It's plausible that there's a clear record somewhere and I just missed it.

</comment></comment></comment></comment></comment><comment><USER10> I don't understand much of crypto...

But I am game developer, and game developers (specially RPG fans) love random numbers.

Some games of mine, I suspected something was off with the PRNG, and did something like they did on the ending, I used the random number generator to draw pictures.

Biased generators were quite obvious, because they made obvious patterns (one of the worst offenders was C default random function on the mingw that came with Dev-Cpp, instead of drawing noise, or weird noise, it drew diagonal lines... yes, LINES, it became clear to me that it was terrible...)

In the end I choose Mersenne Twister, it is a very good PRNG... For games that is, although the Mersenne Twister does generate random looking numbers, its author claim it is bad for crypto, Mersenne Twister, I don't remember why, can be predictable enough for anti-crypto.

<comment><USER11> MT is not suitable for crypto because after observing 637 values you can predict all further values. 637 is the size of MTs internal state vector and the output of MT are basically just values from that state vector run through a tempering function. That tempering function is invertible, thus by looking at 637 values you get the full state vector, at which point you can generate the next values as usual.

<comment><USER12> That's a great answer, thanks for that!

<comment><AUTHOR> You should definitely actually try to clone an MT instance sometime. It's illuminating, and just tricky enough to be fun without being frustrating.

</comment></comment></comment></comment><comment><USER13> I'm a complete noob when it comes to cryptography. I understand that having a PRNG that doesn't return numbers with even distribution across a range is bad. Extreme example would be something like [http://xkcd.com/221/](http://xkcd.com/221/).

But could someone explain how an attacker can take advantage of the fact that 0 is returned ~1% more often than other digits? It this flaw alone sufficient to break cryptocat? Or does it simply make brute forcing easier when combined with other crypto flaws?

<comment><USER14> At a high level of abstraction: If one runs a nuclear power plant, one does not make a practice of tolerating small oil spills. Small oil spills are almost harmless. So are small quantities of sparks. The combination of small oil spills and small quantities of sparks, however, is a severe problem and gets worse _in a hurry_ if it compounds with certain other usually benign properties of nuclear power plants.

Unfortunately, the sort of nuclear power plant operators which tolerate oil spills are often sufficiently not on their A game to tolerate sparks.

This is a very handwavy explanation. In particular, God doesn't hate nuclear powerplants and try to introduce sparks into them at inopportune moments just to see if they happen to find an oil spill, but The Adversary often can and will do this to your cryptosystem.

</comment></comment><comment><USER15> Nice article, I can certainly vouch for creating a visualization to clue you in that there may be a problem.

One of the things I built out of Java when I was hanging out on the cypherpunks list was a 'Noise Sphere' applet. Basically this is a way of testing a PRNG visually. It was fun to put various ideas through it to see how they panned out (most really sucked) One of the cool things was using the alpha emitter RNG from a smart card and finding out that it too was slightly biased in the presence of foil on one side (never did find out why that was, but it did stick out)

<comment><USER9> H-Online have a nice article about an external enclosure that offered "hardware data encryption with 128-bit AES, access control via an RFID chip".

The visualization (of the encrypted data, not of any PRNG used) showed that the encrypted data had strong patterns. The data wasn't encrypted using RSA, it used XOR with a non-changing cipher block. (This is trivially easy to crack. Even I could do it.)

The error arose because the manufacturer of the controller chip was using confusing terminology.

> The IM7206 merely uses AES encryption when saving the RFID chip's ID in the > controller's flash memory. The company explained that actual data encryption > is based on a proprietary algorithm.

([http://www.h-online.com/security/features/Enclosed-but- not-e...](http://www.h-online.com/security/features/Enclosed-but-not- encrypted-746199.html))

Other people interested in testing PRNGs might be interested in the DIEHARD tests ([http://en.wikipedia.org/wiki/Diehard_tests](http://en.wikipedia.org/wiki/Diehard_tests)), but read all the cautions too.

</comment></comment><comment><USER16> Really drives home what many people were saying about the authors not merely being bad at cryptography but programming in general...

<comment><AUTHOR> I upvoted this because, of course, it confirms my own biases, but kind of wish I hadn't, because we're not helping with comments like these.

<comment><USER17> Sure but the author(s) of Cryptocat have been so uniquely resistant to help/input, over a fairly long period of time. Maybe your euphemism 'unserious' is worth adopting for every time one wants to say 'bad' or 'incompetent', in cases like this.

<comment><AUTHOR> I think the project is worth criticizing, but that the concerns are serious enough to deserve better than snark.

<comment><USER17> Maybe at some point a project exhausts whatever potential goodwill/snarklessness is available and just becomes an object of snark - <USER2> at that point and beyond, perhaps the benefits of the project having a reputation of being a snarkmagnet outweigh negatives of the inevitable snark it generates.

Makes it a lousy, toxic topic for message boards but that seems a comparatively small price for a defense against the notion that Cryptocat is (or likely, ever will be) secure.

</comment></comment></comment></comment></comment><comment><USER18> While we're at it, did anyone review Salsa20 implementation or willing to review it?

[https://github.com/cryptocat/cryptocat/blob/master/src/core/...](https://github.com/cryptocat/cryptocat/blob/master/src/core/js/lib/salsa20.js)

</comment><comment><USER19> This reminds me of the IBM RANDU PRNG on which I gave an undergrad presentation (w/ visualization). RANDU was legendarily bad; all you had to do was plot triples in a 3-D volume to see that _all_ of the generated points would fall within one of 15 (Edit: 15, not 11) planes.

</comment><comment><USER20> >The code above is certainly an inelegant solution, since it is, in theory, at least, a potentially infinite loop.

As far as I know, it is the _only_ solution for generating unbiased random numbers in a range that does not divide the native range of the PRNG you're using.

What I _don 't_ understand is why they're working in decimal in the first place. The obvious solution is to generate a random integer in the range [0, 2^53) (which does not require an unbounded-time loop, since 2^53 divides 2^64) and then divide by 2^53. I am open to the possibility that there's some quirk of floating point arithmetic that means that won't work [edit: less so now that I see it's how Java implements it¹], but I can hardly imagine that it's worse than this crazy business of generating 16 decimal digits because, hey, log₁₀(2^53) is pretty close to 16.

¹[http://docs.oracle.com/javase/7/docs/api/java/util/Random.ht...](http://docs.oracle.com/javase/7/docs/api/java/util/Random.html#nextDouble\(\))

<comment><USER4> You could accumulate numbers until you reached the least common multiple of the source and desired ranges.

<comment><USER21> How is that any different, am I missing something?

<comment><USER4> Never mind. I'm confused. Not the first time :-)

</comment></comment></comment></comment><comment><USER22> I think the criticism of the loop is a bit unfair. If your random number generator returns >250 a thousand times in a row, you have bigger problems than slowness.

<comment><USER23> Purely mathematically, you cannot assert that a certain value will appear in a certain timeframe - it's random!

<comment><USER22> True, but purely mathematically every cipher is vulnerable to the "get lucky and guess the key right the first time" attack (OTP excepted of course).

Almost all crypto operates in the realm of absurdly close to certain.

</comment></comment></comment><comment><USER24> Seems like at a minimum, if you are doing your own random number generator, you should have a test harness that runs the chi squared test and compare against a known good random number source. I wonder how many other automated tests one could stack up against a crypto codebase to do that kind of basic checking.

<comment><USER25> You are running the chi-square against the claimed distribution of the RNG, not against another RNG. Which is just about enough to use the RNG for simulating dice rolls ( sometimes, if the players are not too passionate). RNG can have a lot more subtile flaws, for example the RNGs from the ANSI C rand() with the suggested parameters lie in just a few thousand planes, if you construct points in some vector space out of the random numbers. ( That is bad, if you want to run Monte Carlo integration, because your error estimate improves, but not the accuracy of the result.)

So even for simulation you can have rather subtle effects, even though there you get bitten just by bad luck. The task for cryptographically secure random number generators is actually quite a bit harder, because a attacker tries to exploit any weakness in your RNG, but your tests do only tell you which specific attacks do not work.

<comment><USER26> The ANSI C rand() doesn't actually specify any particular algorithm. The complete set of requirements for rand() is just that: rand() computes a sequence of pseudo-random integers in the range 0 to RAND_MAX; RAND_MAX must be at least 32767; if srand() is called with the same seed value, the same sequence of values will be produced; calling rand() before calling srand() acts as if srand() had been called with a seed of 1; and no library function can peturb the pseudo-random sequence.

Historical C standard library implementations _did_ tend to use the same or similar LCRNGs, but that was never a requirement, and is no longer the case.

</comment></comment></comment><comment><USER27> I thought cryptocat was independently audited. Who audited it and why didn't they find these problems?

<comment><USER28> Cryptocat was audited by Veracode but it is my understanding that they just audited the functionality of it (IE: the interface and all that is related) but not the cryptography, as it was out of scope.

</comment></comment><comment><USER29> Interesting though this is, all it really shows is that there is a bias in the random number generation.

I would be more interested to know if this is sufficient to break Cryptocat. Would this really make a brute force attempt much easier?

<comment><AUTHOR> This isn't a disclosure of a new vulnerability; it's a followup on an earlier article which documented a much more significant problem with key management in Cryptocat.

</comment></comment><comment><USER30> I can mostly grok the scope of the error and the theory behind it...what's more interesting to me is to hear, preferably from the Cryptocat developers, what led to this error? An accidental regression? A deliberate decision? Cryptocat and what it aims to do is respectable, but I think what concerns people outside of the project is the prospect of unknown unknowns in the rest of the code: are the recent bug revelations indicative of endemic blind spots?

<comment><USER31> Off-by-one errors are very common (and they have a long history). My best guess is "an honest mistake."

As for the "endemic blind spots," any crypto software needs professional reviews and a good deal of time before it can be used in critical situations.

<comment><AUTHOR> Yes. A pro friend of mine is fond of saying: budget 10x to design, 1x to implementation, and 10x to verification.

</comment></comment></comment><comment><USER32> I don't know if the name is supposed to be a joke, but it's a bit weird that the NSA uses it internally:

[http://blogs.marketwatch.com/thetell/2013/06/06/nsa- targets-...](http://blogs.marketwatch.com/thetell/2013/06/06/nsa-targets-kids- with-crypto-cat-decipher-dog-and-other-cartoon-characters/)

</comment><comment><USER33> Very interesting article, thank you.

</comment><comment><USER34> This should be possible to test automatically. And if that's not possible/easy to do, it should be standard procedure to generate colour maps that can be checked by humans.

</comment><comment><USER35> We talk about how JavaScript delivered from a webserver can never be a secure crypto platform, but of course in reality the problems are far more mundane.

<comment><USER33> s/mundane/interesting/

</comment></comment><comment><USER36> Why doesn't the article include updated graphs with the bug fixed?

</comment><comment><USER21> Wow, someone used <= instead of < and they wrote 5 page report with all those images and charts. The bug is obvious and simple, what is with all those explanations?

<comment><USER37> this is crypto. there were 'less serious' bugs like initializing arrays to zeros (see debian) that led to catastrophic results, which is what the explanation is about.

<comment><USER21> I am not saying if bug is critical or not. It is just pages of explanations, charts and stuff. I was expecting a video explanation by the end.

If they are targeting non-crypto people (which includes me), explaining how a bad random algorithm affects cryptology would be better instead of showing that algorithm is bad in 5 different ways.

Also any link to articles about that Debian bug?

<comment><USER9> Random numbers are used for different things, but mostly generating keys. An attacker that knows everything about your system (all the hardware, and the software, all the sourcecode, everything) should not be able to predict the next bit output by a prng.

Errors include:

i) using a source that is not random. As mentioned elsewhere some hardware devices provide skewed numbers, and even de-skewing doesn't help too much.

ii) using a poor seed.

The Debian bug is an example of ii -

> _This vulnerability was caused by the removal of two lines of code from the > original version of the OpenSSL library. These lines were used to gather > some entropy data by the library, needed to seed the PRNG used to create > private keys, on which the secure connections are based. Without this > entropy, the only dynamic data used was the PID of the software. Under Linux > the PID can be a number between 1 and 32,768, that is a too small range of > values if used to seed the PRNG and will cause the generation of predictable > numbers. Therefore any key generated can be predictable, with only 32,767 > possible keys for a given architecture and key length, and the secrecy of > the network connections created with those keys is fully compromised._

([http://en.wikinews.org/wiki/Predictable_random_number_genera...](http://en.wikinews.org/wiki/Predictable_random_number_generator_discovered_in_the_Debian_version_of_OpenSSL))

(www.schneier.com/blog/archives/2008/05/random_number_b.html)

</comment></comment></comment></comment><comment><USER38> I wonder - if you took in aggregate the time people spent complaining about Cryptocat could a more secure alternative have already been built? :-)

Anyway, I really enjoyed this article. Informative, interesting, and free of snark.

<comment><USER39> No, stop trivializing cryptography software.</comment></comment>


New antibiotic family discovered in dirt - <AUTHOR> http://www.bbc.co.uk/news/health-43032602 <comment><USER3> As a lay person, it's not clear to me whether these malacidins were found in mycelium (fungi). I'm inclined to think this is likely. If so, finding them in dirt is not really surprising (30% of dirt is comprised of mycelium - <USER2> and dead). It seems like the obvious place to look for new antibiotics.

For anyone that's interested in fungi I can't recommend listening to Paul Stamets talk on the subject more highly. Like a lot of people here on HN I take in _a lot_ of information and his recent interview with Joe Rogan[0] was one of the most fascinating things I've come across in years.

[0] [https://www.youtube.com/watch?v=mPqWstVnRjQ](https://www.youtube.com/watch?v=mPqWstVnRjQ)

<comment><USER4> There was a reason all of the indigenous cultures got out in the woods and got to know their plant neighbors -very- well. 4 billion years of evolution produced copious treasures for those humble enough to root around in the woods and swamps. (Favorite example: aspirin)</comment></comment>


Robert Graves' Mythologies - <AUTHOR> https://lareviewofbooks.org/article/the-keys-to-robert-gravess-mythologies/ <comment><USER2> "I, Claudius" was one of the most amusing and interesting books I've read.

<comment><USER3> One of the greatest audiobooks, too. Narrated by Derek Jacobi, so you know it's top-notch.

<comment><USER2> Absolutely.

</comment></comment></comment><comment><USER4> [https://www.youtube.com/watch?v=qzLuG3tM84I](https://www.youtube.com/watch?v=qzLuG3tM84I) Interview from 1965.

</comment><comment><USER5> Graves's translation of _The Twelve Caesars_ was a formative work in my teenage years and (along with _Das Glasperlenspiel_ ) defined my view of humanity for some considerable time and still rings true many decades hence.

</comment><comment><USER6> His "Goodbye to All That" is a good memoir of the First World War. Though his Mythologies are the most readable or engaging one. I prefer Thomas Bullfinch for Mythology.

<comment><USER6> I meant aren't the most readable

</comment></comment><comment><USER7> This is quite a cantankerous view of Graves.

<comment><USER8> How so? Please expand.

They sum up as follows: "Aside from a few devotees of the White Goddess, no one rates Graves as a prophet these days, but his books, some of them at least, are too good to be left "lying about." The best of them should be picked up and read. We should be grateful that it's easier than ever to rediscover Graves and grant his work the attention it deserves."

<comment><USER7> Is hard to take this last paragraph seriously when most of what the reviewer has said up to that point sounds grumpy and reluctant:

"...risking his reputation on cranky ideas, for revising masterpieces and making them worse, for alienating friends and abandoning family."

"...self-destructive impulses led Graves to think he could safely inhabit a household comprising himself, his wife Nancy, his lover Laura Riding, his wife's lover Geoffrey Taylor, and several children. Their "quadrilateral" ended poorly, with Graves hurling himself from a third-story window in pursuit and imitation of Riding, who had just thrown herself from the fourth floor."

"Perhaps he expected that someone, someday would do for him what he had once done for the Roman emperor Claudius..."

"...a few on the esoteric and occult fringes still agree with him."

"... Graves, never humble, characterized the "inspiration" that descended upon him..."

"Can we read Graves without looking to the moon?"

"When writing fiction, he almost invariably constructs so sturdy a framework of fact, theory, conjecture, and supposition that the conventional pleasures of fiction are elided."

"Perhaps Nausicaa is Graves's self-portrait as ruthless artist."

"Graves is a great accumulator of incidental detail and memorable anecdotes but, as ever, he's an indifferent analyst of character."

"Dozens of Graves's books have little hope of emerging from the lead casket of obscurity."</comment></comment></comment>


Tell HN: Stories showing up multiple times - <AUTHOR>

Just noticed this on the Ask page. The same story/submission is listed three times in a row. Identical number of comments, but each listing has one more point than the last.<p>http://imgur.com/g4fGl.jpg <comment><USER2> Weird. All three have the same item id. Note: their comment counts are now all zero.

<http://dl.dropbox.com/u/142733/dupes.png>

</comment><comment><USER3> It's a bug. I'll fix it when I'm done reading applications.

</comment><comment><USER4> I reported this in a submission 71 days ago and it ended up [dead] :(</comment>


Annotated explanation of "We'll be Circling Back" email - <AUTHOR> http://rapgenius.com/Harj-taggar-well-be-circling-back-lyrics

<comment><USER2> So I think this is an example of RapGenius trying to break away from the 'lyrics' website image and moving in to the 'annotate everything' domain, but I just don't get what's going on here.

This happened before with the whole Heroku(?) thing -- I literally cannot figure out:

\- Who is talking in the first person?

\- Is it PG? Is it Harj? If Harj is the one who annotated it, does that mean he's not the one who wrote it?

\- Are we supposed to be familiar with this email?

\- Was it a mistake that it was sent as boilerplate, and not fleshed out?

There is literally -zero- context to go off of here, and I don't think RapGenius' site currently has the interface necessary to provide the context to begin with. I really wish I could better understand what's going on here.

<comment><USER3> >> Who is talking in the first person? Click on a annotation to see who wrote it. Most of these have been written by Harj.

>> Is it PG? Is it Harj? If Harj is the one who annotated it, does that mean he's not the one who wrote it? Harj wrote it and is now explaining it.

>>Are we supposed to be familiar with this email? It was the subject of: <https://news.ycombinator.com/item?id=5370427>

>> There is literally -zero- context to go off of here, and I don't think RapGenius' site currently has the interface necessary to provide the context to begin with. Ctrl+f "description" will give you a box in the top-right corner: "Harj Taggar is a Y Combinator partner. He wrote this email as satire of normal VC boilerplate."</comment></comment>