Semicolon: A language of semicolons - <AUTHOR> http://pksunkara.github.com/semicolon

<comment><USER2> Hi guys, just wanted to tag along with this thread, because I'm a huge fan of Semicolon! One thing I've always found aggravating though... Those darn semicolons! So I'm creating CoffeeColon, because all these semi-colons are such a hassle. It's probably easiest if I just show you the language in action, rather than going through a long diatribe. So here's my hello world!:

" "

^ Pretty elegant, right?

let's try something a little more complex:

" "

^ As you can see, the goal of this new language is to take the best of Semicolon and just make it more succinct, and to round out some of the minor historical abnormalities that have been dragged along in the language spec for a while now.

So my hope is that you all enjoy CoffeeColon as much as I do. It's just like Semicolon, maintaining it's expressiveness and dynamic nature, with just a little bit of smoothing out of the kinks.

Thanks!

<comment><USER3> Additionally, I've created a linter that I've named ColonCleaner. I think it'll be a real hit. Just relax and let it do its thing.

</comment></comment><comment><USER4> I'm disappointed that the designer of this language has limited himself to just the semicolon (";", U+003B) and the reversed semicolon ("⁏", U+204F). What about the Arabic semicolon ("؛", U+061B) and the Greek question mark (";", U+037E)? They're both perfectly valid options.

(I can understand avoiding the turned semicolon ("⸵", U+2E35), given that it doesn't seem to display properly. Can't be having unrenderable codes in one's language; it could severely reduce readability!)

To remedy this lack, I present to you my own semicolon-derived metalanguage, Hemidemisemicolon. A sample Hello World program follows:

        ⁏
        ؛;⁏⁏;;؛; ؛;⁏;

        ⁏;;;

As you can see, the dramatically increased lexical vocabulary leads to conciseness of expression. This program code compares favourably with the original Semicolon code, and as an added bonus it is also a quine and prints out "FizzBuzz" every three or five years on Douglas Crockford's birthday.

An implementation note: the final semicolons on each line are optional. I was wondering if that was a good idea or not, but I'm sure it won't cause any trouble down the track.

</comment><comment><USER5> I had this exact thought when the semicolon drama started days ago.

I'm a fan of removing ambiguity in code. I parenthesize when not necessary so that intent is clear (someone in the future _will_ hire a complete newbie to read and "fix" this code.) I want the statement to end here --> ";" and anything else is an error - now the compiler can inform me when a mistake is made. I ask what appear to be the most asinine questions because when you say "smooth ass ride" there's a difference between a "smooth-ass ride" and a "smooth ass-ride."

And as I type all this, I begin to create a connection between all those txtspk hooligans and semicolon haters. Anyway, I'm happy that Semicolon now exists.

</comment><comment><USER6> Like this kind of thing? The rabbit hole is frighteningly deep. Try the esoteric programming language wiki[1] or Chris Pressey's site[2]. That ought to get you started.

[1] <http://esolangs.org/wiki/Main_Page>

[2] <http://catseye.tc/cpressey/>

</comment><comment><USER7> Now you can take all the semi-colons from your javascript and re-use them elsewhere! Genius!

<comment><USER8> I believe this will revitalize the semicolon industry. There were serious sales shortages in the last few years with the rise of languages like ruby, python and even haskell, not needing this resource. In fact several major semicolon foundries were mothballed since the housing crash - the legalese markets were just not there any more, and lack of derivative generation really hurt the suppliers. The latest round of ASI abuse in javascript was hailed by some pundits as the nail in the coffin for the flagging industry, sending it to a niche role for legacy code and industrial/embedded systems support. With the release of this language, some analysts are suggesting a surge in semicolon production, and the commodities markets show q4 semicolon futures at the best they've been in 14 months. Expect to see a large push from advertisers in the form of articles like "why I like semicolon" and "can your language do this with only 5 characters?". Pessimists however are speculating that it is too little to late, and are advising shorts on semicolons in 6-10 hours, after the initial news leaves the front page. One pessimist says "This is just a pathetic showboat effort from a dying industry". Other suggest rumors of lobbyists pushing hard for the DoD to adopt this as the new standard language. More on this story as it develops.

</comment></comment><comment><USER9> This community is generally fairly dry and to the point, which is a great way to maintain high quality discussions, but I'm enjoying all these fun comments! :)

<comment><USER10> An astonishingly comprehensible comment from a regular expression.

<comment><USER9> A remarkably sincere comment from a politician.

<comment><USER11> _So a politician and a RegEx walk into a bar..._

</comment></comment></comment></comment><comment><USER8> So when do you plan on implementing ASI?

</comment><comment><USER12> There are lots of joke languages that are simply isomorphic to Brainfuck - Ook, Fuckfuck and so on - so congratulations on not just taking the easy way out (changing their eight keywords instantly gives you an interpreter, compiler, sample code, ...)

<comment><USER13> brainfuck itself is simply a minor variation of P", created back in 1964.

</comment></comment><comment><USER14> And I thought Reddit had a problem with tired memes..

</comment><comment><USER15> Shouldn't this language be white-space insensitive in order to be truly pure as a semicolon language?

<comment><USER16> Clearly, practicality was chosen over purity; I find the added readability gained by the space separators to be much more pragmatic.

</comment></comment><comment><USER17> My first reaction was fear of death: <http://nethack.wikia.com/wiki/Electric_eel>

</comment><comment><USER18> I'm somewhat disappointed - I expected the implementation to be written using ASI keeping semicolons to a minimum.

</comment><comment><USER19> I like Brainfuck better: <http://www.muppetlabs.com/~breadbox/bf/>

I don't know if anyone has made a DCPU-16 interpreter for it yet!

</comment><comment><USER20> While mildly amusing, this whole semicolon obsession that's sprung to the fore this past week is ridiculous. It was silly and inconsequential when it started and it's even sillier now.

<comment><USER21> Which makes this idea rather snarky in my opinion. All the hating on Crockford who takes the time to sit on the committee rubs me a bit the wrong way. I've been where he is and seen the weird constraints/politics/effort it takes to do standards work, and so I respect that.

In any other context, building what is essentially a Turing machine with a few symbols, might qualify as a clever hack which helps folks step outside their ISO-latin1 mindset, but coming as it does on the heels of this controversy it just feels mean.

<comment><USER22> Was there that much hating on Crockford? Most of the posts I saw were in support of his position, if not his (probably justified) grouchy attitude.

I find it hard to disagree with him. Eichs has admitted ASI was a mistake, every half-decent JS tutorial states unequivocally "use semicolons"... if you don't want semi-colons, don't use JS.

I find semicolon hilarious. We need to lighten up!

</comment></comment></comment><comment><USER23> Seems like a nice companion to Whitespace:

[http://en.wikipedia.org/wiki/Whitespace_(programming_languag...](http://en.wikipedia.org/wiki/Whitespace_\(programming_language\))

<comment><USER8> Whitespace is too slow for big systems. The non-implicit nature of semicolon will really allow for prime-time server stacks. I do think though that whitespace will retain its market share on the front end.

<comment><USER24> So what I hear you saying is that Semicolon is webscale.

</comment></comment></comment><comment><USER25> My right pinky is gonna get so huge.

</comment><comment><USER26> This Semicolon language bears more than a passing resemblance to POP-11, the famous AI programming language for popping things on/off a stack!

To this day POP-11 holds the unsurpassed distinction of being the language for writing the most useless programs in the most intriquing way (after machine code, of course).

</comment><comment><USER27> I'm already way ahead of the curve. I've started writing my scripts without semicolons and I'm getting 100% code compression using even the most rudimentary minifiers. Get with the times, already!

</comment><comment> jack-r-abbit and I'm expecting there should be a post about how this is still better than PHP in 5... 4... 3... 2...

:)

<comment><USER28> This would only be better than PHP if it also had goto statements.

<comment><USER29> it seems to have goto.

<comment><USER28> Indeed it does. Knowing this, re-read my statement ;)

</comment></comment></comment></comment><comment><USER30> This is the PERFECT place to give a link to my poem, O...](http://www.tonynoland.com/2009/09/ode-to- semicolon.htm>Ode) to the Semicolon"</b. The semicolon is my favorite punctuation mark.

At that page, you can hear me read the poem, too; be sure to stop by and comment!

<comment><USER31> better link, <http://www.tonynoland.com/2009/09/ode-to-semicolon.html> no need for the html and it's .html apparently not .htm

</comment></comment><comment><USER32> I don't even know how to type an inversed semicolon.

<comment><USER8> In vim just do (copy and paste it if you don't know how to get the initial ⁏):

       :imap <buffer> l ⁏

and whenever you want an inverted semi, type l. For best effects put that line in your ftplugin directory, in semi.vim (or whatever your autodetect filetype name for semicolon is).

some people like to map j to ⁏ and k to ;, other like to map f to ⁏ and j to ;, but this is all just homerow keeping. I'm a purist, i like to keep the mappings minimal.

</comment></comment><comment><USER33> So when will Objective-Semicolon and Semicolon.NET be available?

</comment><comment><USER34> ;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;! ;;;;;;;;;;;;;;. ;;;? ;;;;;;;;!?

</comment><comment><USER35> Can't wait for the Light Table IDE to support this language :P Debugging will be so much easier.

</comment><comment><USER36> Now we just need an LLVM backend.

</comment><comment><USER37> It's nearly a rudimentary FORTH.

<comment><USER38> Silly as may be, could be interesting to replace the goofy ; stuff with sensible keywords and have a nice, simple language to work with.

</comment></comment><comment><USER39> @fat and @douglascrockford, the HN community is now satirizing both of you. It's time for you both to do the right thing; add the semicolon to the bootstrap-dropdown.js code and change JSMin to support the original edge case.

<comment><USER40> Surely, that should be add all the semicolons to bootstrap-dropdown.js?

<comment><USER39> No. Twitter has every right to implement their Bootstrap code as they see fit.

But it is just common courtesy to make small accommodations for people who are having difficulty using the code that Twitter has so generously released as open source.

</comment></comment></comment><comment><USER41> This certainly takes things further than my simple SemicolonScript idea, nicely done. <http://rodhowarth.com/semicolonscript/>

</comment><comment><USER42> I'd like to point out that it's theoretically possible to define a program without semicolons. Which major Semicolon library will be the first to ditch semicolons?

</comment><comment><USER43> Don't forget in vim to

         :set list
         :set lischars=eol:;

.. Now all newlines will be semicolon'd

</comment><comment><USER44> How do you type a reversed semicolon on a Mac?

<comment><USER45> Press the ⁏ key

</comment></comment><comment><USER46> hey guys! I think I'm going to start on a semicolon meta-language using this new semicolon IDE I'm writing. ;

</comment><comment><USER47> My first thought when I saw the site was 'Someone has way too much free time on their hands.'

</comment><comment><AUTHOR> Now the reversed semicolon renders with perfect reversion of normal semicolon.

<http://pksunkara.github.com/semicolon>

</comment><comment><USER48> It'd be better if this were just semicolons and reverse semicolons.

</comment><comment><USER49> The reversed semicolon appears as a square here (Windows/Chrome).

<comment><USER50> It depends on your font to support the character.

<comment><USER10> I hear the author is adding support for rectangular boxes using SVG.

</comment></comment></comment><comment><USER51> Cool, why interpret it? Right a compiler for it now :-)

</comment><comment><USER52> DCPU-16 port anyone?

</comment><comment><USER24> A path exists from the Semicolon language to Robert Klein's aphorism that "a sigmoidoscopy is just a semicolonoscopy". Someone please do that.

</comment><comment><USER53> Gives new meaning to "insanely stupid code."

</comment><comment><USER54> Can you please make this configurable? Instead of ;, we can use : @ * etc or something like language of smiley's :)

</comment><comment><USER55> Surely someone will implement an asynchronous framework on top of this and we'll have next year's Node.js :P

</comment><comment><USER56> Does this mean; that when I context switch mind sentence; using semi-colons; I'm also programming? Sweet!

</comment><comment><USER57> Upvoted because there is no such thing as too many semicolon-related threads :sigh:

</comment><comment><USER58> would be a joy to code with this drunk

</comment><comment><USER59> Does it have a working minimizer?

</comment><comment><USER60> now i'll wait for the logging evaluator. ps: does it compatible with uterus.js?

</comment><comment><USER61> that's just too much like Python to be funny

</comment><comment><USER62> looking forward to node;

</comment><comment><USER63> you'd think a program consisting of "only semicolons" would be easier to type. (no pun intended). reverse semicolon? Not only does my keyboard not have one, but Google doesn't even know what it is (other than a unicode character). apparently it was invented by the unicode group.

next time go back to the definition of semicolon, and you will see why it is made of the glyphs , and .

Then you can make a true semicolon language, by mixing ; and ., (horizontal, if you will).

the first line given as an example program would go from ;;;;⁏;;⁏;;; (which doesnt even render in this browser text box for me atm) to ;;;;.,;;.,;;;

<comment><AUTHOR> I added a special glyph for the reversed semicolon and used it in @font-face for the website. Can you reload the page and try again?

<comment><USER63> I meant here on hackernews. Your site looks fine!

</comment></comment></comment><comment><USER64> I <3 you so hard, Internet.

<comment><USER65> I feel like it's April Fools day but only in this comment thread.</comment></comment>


An in-depth security review of the Intel Management Engine - <AUTHOR> https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr <comment><USER2> Wow all 6th, 7th and 8th gen are all vulnerable along with a bunch of Xeon processors. Even the laptop I am typing this on is vulnerable, this is going to be messy. Plus all the fun vulnerabilities like arbitrary code execution, unauthorized access to privileged content. These must be related to the blackhat talk coming up in December about hacking a turned-off computer and running unsigned code on ME [0]. Yep and the two researches doing the talk are the two people credited in this announcement, Mark Ermolov and Maxim Goryachy. Great work by them finding these vulnerabilities and disclosing them, these are the kind of vulnerabilities that the NSA would salivate over.

I wonder if this will at all dissuade either Intel or AMD into continuing to make these super privileged processors whose functions are completely hidden. The cynic in me thinks that this will change absolutely nothing.

There is a great website called The Bad Thing [1] that has compiled the known information about Intel ME.

I just ran the detection tool on my laptop and I am running a vulnerable version of Intel ME, but I can't even do anything about it until my system manufacturer provides a patch for it. I feel like this is going to be one of those situations that ends up leaving millions of devices unpatched and vulnerable a few years down the road.

[0]: [https://www.blackhat.com/eu-17/briefings/schedule/#how-to- ha...](https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a- turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668) [1]: [https://www.cs.cmu.edu/~davide/bad_thing.html](https://www.cs.cmu.edu/~davide/bad_thing.html)

<comment> white-flame > _I wonder if this will at all dissuade either Intel or AMD into continuing > to make these super privileged processors whose functions are completely > hidden._

I think many discussions miss the nuance here. The problem is that the functionality is hidden, not necessarily that the function is there.

In corporate use, these tools can be incredibly useful. If they were more transparent, then they could be used by normal users for remote administration as well.

But it needs to be secure, and it needs to exist without secrecy. If this portion were free for the user to configure, or if they allowed complete disabling via motherboard jumper, or simply open sourced it, that would be a better step.

However, the NSA's activities have destroyed all trust in these sorts of features coming from an American company, so even if it were completely open sourced, there's no guarantee that there isn't other hardcoded ROM also executing in tandem with the open source components.

<comment><USER3> > or if they allowed complete disabling via motherboard jumper

That wouldn't really work; the ME is essentially "the CPU" of the Platform Controller Hub. Disabling it would be disabling your computer (e.g. your IOMMU, your DRAM refresh, your ACPI command routing, etc.)

All the stuff that used to be done "manually" by the CPU itself back in the 8086 days—using configured IRQs and PITs and whatever else—is done autonomously by the PCH these days, with the CPU just asking the PCH to "get it done." And the logic that runs in the PCH to interpret those requests and decides _when and how_ to apply them, is executed by the ME.

The ME only managed to not exist previously, because mainboards were previously both "simpler" (every bus spoke exactly one protocol and the controller chip for that bus did the protocol signalling) and more complex (tons of single-purpose controller chips.) The PCH boils all that down to one chip, and it needs a CPU to do it, and that CPU is the ME. Getting rid of it would mean going back ~15 years in computer capabilities.

(Another way to think of the PCH is that it's basically an SoC chip, with the "heavy lifting" of application execution moved out to a separate, upgradable CPU socket. But, like any SoC, it still does need _some_ sort of internal CPU. The ME is that CPU.)

<comment><USER4> >> or if they allowed complete disabling via motherboard jumper

> That wouldn't really work; the ME is essentially "the CPU" of the Platform > Controller Hub. Disabling it would be disabling your computer (e.g. your > IOMMU, your DRAM refresh, your ACPI command routing, etc.)

Then how does Intel disable it for governmental customers (high-assurance)?

<comment><USER5> The GP is simply wrong on many/most of its technical claims. ACPI implementations were common for 4+ years before the ME existed. The ME is not involved in DRAM refresh or initialization at all (other than waiting for it to complete..). DRAM refresh is hardened into the IMC, and the initialization SW runs on the x86_64 cores - typically it's a UEFI binary blob provided by Intel. Once the OS is running, it manages the IOMMU, and the IOMMU itself is a hardened function; the translations that it performs for the OS do not involve the ME. And so on.

Though the ME currently performs some complex early initialization tasks, the notion that a modern x86_64 platform simply cannot work, or cannot work efficiently, without the ME running indefinitely/alongside the OS is plainly wrong.

<comment><USER6> > The GP is simply wrong on many/most of its technical claims

I concur. Also regarding: ACPI, there often is an auxiliary microcontroller used to do power management and keyboard interfacing called "embedded controller" (sometimes there's also a mysterious ASIC, part numbers for them include Rohm BU77700KVT Toshiba TB62D515FG,TB62501F) that lives on some SMBus and with which the ACPI implementation, running on the main processor, talks with.

<comment> TD-Linux On newer Thinkpads, the firmware for the EC is on the same SPI Flash as the ME firmware, but on a different partition. The EC is an entirely separate chip (labeled ThinkEngine) and by virtue of being only on SMBus is a lot less dangerous.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I prefer the wording in Lenovo's security advisory [0]:

> _" Potential Impact: An attacker could load and execute arbitrary code > outside the visibility of the user, operating system, and > hypervisor/virtualization platform; resulting in exfiltration of secrets, > subtle manipulation of system operation, or denial of service."_

[0]: [https://support.lenovo.com/us/en/product_security/len-17297](https://support.lenovo.com/us/en/product_security/len-17297)

<comment><USER8> It is nice to know lenovo already has the updates, but sadly I'm gonna have to install windows for that :(

<comment><USER7> Go for the "bootable CD" option, if it's available. You don't need Windows for that. My ThinkPads all run Linux and I have no problems updating them.

<comment><USER9> I think that's only for BIOS updates, not ME. ME uses an Intel provided flash EXE. It would probably run on PE or definitely Windows to Go though.

<comment><USER10> I figured out how to install it using Windows PE. First, get a Windows installer image or WADK and mount it. Microsoft provides these, but hides the download link well. Then get the ME firmware update installer and the AMT/ME software installer from Lenovo and execute the unpackers with wine. From ~/.wine/drive_c/DRIVERS/WIN/AMT, do "cabextract SetupME.exe". You can discard everything but the "HECI_REL" directory from this, including SetupME.exe.

Now you need wimlib to create the WinPE image: _" mkwinpeimg --windows- dir=/mnt winpe.img --overlay=$HOME/.wine/drive_c/DRIVERS"_

The resulting winpe.img can be dd'ed to a USB thumb drive. Boot into it, and execute "cd /WIN/AMT/HECI_REL/win10", "drvload HECI.inf" (to load the MEI driver) and then "cd /WIN/ME/", "MEUpdate.cmd" to update the ME firmware.

</comment></comment></comment></comment></comment><comment><USER11> Does anyone have an idea to what extent macbooks are affected? Intel ME is baked in every CPU but according to The Register [0] the AMT part is not running on Apple hardware.

[0]: [https://www.theregister.co.uk/2017/05/01/intel_amt_me_vulner...](https://www.theregister.co.uk/2017/05/01/intel_amt_me_vulnerability/)

<comment><USER12> Most reports I've read, including the one you have just linked, state Apple hardware as unaffected by this.

<comment><USER13> Is there a official position/statement from Apple on this?

<comment><USER14> No, not yet. I went into my local Apple store and brought it up to one of the genius's and they haven't heard anything at all about the exploit from HQ. But, I can confirm that Intel's ME is present in all Apple macs. The physical hardware is completely unchanged according to the Apple genius bar employee.

It's unclear to me whether or not Apple uses Intel firmware for the non AMT portions of ME. I will report back to you when I find out. However, the evidence I've seen so far isn't looking too good, and it definitely looks like the vast majority of macs made in the last 5 years are all vulnerable, many appearing to run outdated Intel firmware to boot -- not good for Apple.

The evidence can be seen here,

[https://apple.stackexchange.com/questions/306959/intel- manag...](https://apple.stackexchange.com/questions/306959/intel-management- engine-is-macos-vulnerable)

where some people run a python program to check the version of their ME firmware (which works and returns numbers completely consistent with Intel firmware numbering). I wonder if Apple just isn't aware of the hack yet?

</comment></comment></comment></comment><comment> tpearson-raptor Yet another reason owner-controlled machines like the Talos™ II [0] are so important. Yes, it may cost a bit more up front, but what's the cost again of having your data stolen and then, especially with the older machines here, having to replace all of your hardware to boot?

Plus, purchasing machines like that one not only sends a clear signal that we want backdoor-free computing, but also allows the further development of more libre computing options. Wouldn't you rather have Linux and BSD as first-class citizens on new hardware, instead of always needing to play catch-up from behind?

[0] [https://raptorcs.com/TALOSII/](https://raptorcs.com/TALOSII/)

<comment><USER15> From their FAQ:

Q: Why preorders? Why can't I evaluate a production machine right now?

A: Although we have Talos™ II hardware in our labs, IBM has not yet released the POWER9 CPU to the general public. The POWER9 launch is scheduled for Q4 this year; we intend to make Talos™ II available to everyone shortly after POWER9 launch via our pre-order model. This model allows us to manage supply of the Talos™ II systems for Q4 shipment, and we intend to transition to a more standard ordering model once the POWER9 processor has reached general availablility (GA). Orders placed after our pre-order cutoff will not ship until 2018, and you would be missing out on the benefits of early market access to the POWER9 processor, so we strongly recommend that you place your pre-order as quickly as possible!

</comment></comment><comment><USER16> Don't rush to apply the Intel ME patch!

Several HN users here (beefhash, jlgaddis, joe_the_user) have raised the possibility that applying the patch might make it impossible to get rid of the Intel ME entirely.

If you don't apply the patch, someone may come up with a nice new exploit (using the security bugs) to completely remove the Intel ME.

If you do apply the patch, it might close off possible exploits and you'll be left with an Intel ME that's impossible to remove.

<comment><USER17> While we're on the topic -- is there some IRC channel or something dedicated to Intel ME research?

<comment><USER18> Well I just created ##intelme on freenode. Though, I'm just a nobody whos managed to get his laptop me_cleanered.

Feel free to join.

</comment></comment></comment><comment><USER19> Anyone able to explain why Intel's severity rating for this is "important" and not "critical"; meaning of the terms per Intel's own words:

"Critical: A vulnerability, which if exploited, would allow remote execution of malicious code without user action."

"Important: A vulnerability, which if exploited, would directly impact the confidentiality, integrity or availability of user's data or processing resources."

<comment><USER20> This doesn't allow remote access, just privilege escalation. So you'd already have to have some degree of access to the system to be able to use this vulnerability.

</comment></comment><comment><USER21> So, will Intel be patching both the vulnerabilities and the kludges people have found to remove ME? Thus making some customers safer while maintaining systemic risk for everyone?

"Asking for a friend"

<comment><USER22> Intel provides patches to vendors. Vendors provide patches to you eventually or never.

<comment><USER23> Who is my vendor if I assembled my computer myself?

<comment><USER24> The company who built your motherboard

<comment><USER23> I'll take your word for it I guess, but I don't see the logic. Why would my motherboard manufacturer be involved in this process?

edit: maximum downvotes for a legitimate question, thanks all

<comment><USER25> The motherboard manufacturer integrated the chipset into their board. They worked with Intel, or Intel's spec/API directly. They are responsible for your machine's interaction with the CPU.

The same is true of all the devices directly integrated into your motherboard. Broadcom/Intel wireless chipset, Ethernet, audio, etc.

</comment></comment></comment></comment></comment></comment><comment><USER17> Good times when kernel privilege escalation was the worst you had to fear.

I'm not familiar enough with the Intel ME to tell, but could this possibly be exploited with the arbitrary code execution in the ME being used to set the HAP bit without requiring hardware intervention?

<comment><USER7> That'd be pretty sweet, wouldn't it?

Maybe I'll hold off on patching for a bit.

<comment><USER26> > _Maybe I 'll hold off on patching for a bit._

I think you're suggesting extremely interesting but I'm not totally clear on it. So someone[1] has come up with some code to either disable (kill switch) or remove the Intel ME. (Setting the HAP bit is the kill switch.)

Now Intel and its vendors are going to issue a patch for the Intel ME. Are you saying that as a result of applying this patch we might not be able disable or remove the Intel ME? In other words, we'll end up with a slightly more secure Intel ME, but be worse off since we can't exploit any bugs to get rid of it?

If I'm understanding you correctly, this sounds like the iPhone situation: upgrade to a newer iOS and lose the ability to jailbreak.

[1] [https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable- bi...](https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit)

<comment><USER7> Basically, yeah.

Hold off on patching this vulnerability so that it can be exploited later in order to disable ME entirely. Their firmware updates could very well close off these existing "known holes", making them impossible to exploit.

If we can take advantage of them to kill the ME entirely, that's even better than Intel releasing this fix.

</comment></comment></comment></comment><comment><USER7> In my case, their Linux detection tool is less than useless:

      $ sudo ./intel_sa00086.py
      ...
      *** Risk Assessment ***
      Detection Error: This system may be vulnerable, please install the Intel(R) MEI/TXEI driver (available from your system manufacturer).
      ...

Thanks, Intel!

If you have a Lenovo machine, check Lenovo's security advisory [0] to see if it is affected. Intel has the wrong URL in their link.

 _Edit:_ FWIW, the (Linux) tool creates a .log (and .xml) file in the current directory that was _slightly_ more helpful:

      $ tail -n 4 SA-00086-cluefire-2017-11-20-21-09-36.log
      HECI error: No device with MKHI found[2]
      Can't find SPS version in the tool output
      Status: HECI_NOT_INSTALLED
      Tool Stopped

This workstation doesn't have an "HECI" [1], apparently. It _does_ have SPS, but "spsInfoLinux64" throws an error too:

      Error 9460: Unknown or unsupported hardware platform

This box has 2 x E5-2620 v4 CPUs so it is reportedly "not affected" but I thought I'd double-check anyways. Oh well, I won't miss out on all the excitement -- I'll still get to have some fun updating my other machines and all of $work's servers in the datacenters. :/

[0]: [https://support.lenovo.com/us/en/product_security/len-17297](https://support.lenovo.com/us/en/product_security/len-17297)

[1]: [https://en.wikipedia.org/wiki/Host_Embedded_Controller_Inter...](https://en.wikipedia.org/wiki/Host_Embedded_Controller_Interface)

<comment><USER2> I get the exact same thing, I might be wrong but I don't think that the windows version does anything different. According to the website it seems that the vendor needs to provide software to patch the firmware.

</comment></comment><comment><USER27> I'd have preferred to hear something along the lines of "We'll be stopping implementing this technology in future CPUs"

<comment><USER28> Or at least a jumper-select to disable it.

</comment></comment><comment><USER29> Unreal. Kept scrolling and the vulnerabilities kept coming.

Most annoying thing is that there isn't even a real alternative. If I understand it right then AMD chips have pretty much the same thing?

<comment><USER30> Well, maybe AMD does at least _some_ security reviewing on their own? /s

ARM could be a affordable alternative to x86 if that works for you.

<comment><USER31> > ARM could be a affordable alternative to x86 if that works for you.

Even the open source friendly Raspberry Pi relies on proprietary blobs and proprietary firmware, with vast parts of the documentation only being available to system integrators (meaning: not you) under an NDA.

Theirs is a Broadcom chip, but my understanding is that the scenario is pretty much the same for other ARM vendors. If the chip is anything more complicated than your average 8-bit micro-controller, expect it to be running some kind of "system" which is, of course, closed source.

<comment><USER32> The stuff running on the ARM itself is all open, but the firmware blob runs on a separate CPU with a different instruction set, which has a view of the entire memory map of the device and ultimate control over the device's behavior (sound familiar?).

I may be wrong, but my impression is that a lot of the other ARM boards out there have the ARM chip as the main CPU, and without a management chip watching it. In any case, a board like that, or a Pi with a reverse-engineered firmware blob (currently in development) would be better than the Raspberry Pi as it is now.

</comment></comment></comment></comment><comment><USER33> Helpful thread from Matthew Garrett at Google:

[https://twitter.com/mjg59/status/932730696614813696](https://twitter.com/mjg59/status/932730696614813696)

</comment><comment><USER34> It's bad enough Intel have created the ultimate trojan, but their detection tool can't even fix the problem!

The tool rightly points out that my desktop consumer system is vulnerable (from the list, no Intel CPU manufactured in the last 5 years isn't), then suggests I contact the manufacturer for an update. Here is what the tool says my system manufacturer is:

        Manufacturer: To Be Filled By O.E.M.
        Model: To Be Filled By O.E.M.

I will get right on that and bug "To Be Filled By O.E.M." for an update! It's an ASRock motherboard, by the way. But with this approach they are not going to patch even 5% of personal computers out there..

<comment><USER35> This isn't uncommon. You're not wrong to expect that, if they did not do their job when configuring these data, they will not do anything to support you postsale. Their lifecycles are so short maybe your product is several generations old now.

Some of the board vendors do a better job, but usually still not as good as "namebrand computers." There is a lot of engineering work that goes into integration. It's not readily visible to endusers/consumers and therefore difficult for us to appreciate it or evaluate it for completeness or accuracy.

I hope that someone does a survey of computer and board vendors' support for this problem. I would like to see who abandons products last.

</comment></comment><comment><USER36> They still haven't publicly documented and supported the HAP bit.

If Intel actually cared about your security they would document that. It says so right in the security advisory that the external researchers are the reason for the security review, and not due to customer concerns.

</comment><comment><USER37> How does this affect Apple products? I've looked around for discussion of Intel ME with regards to Apple and the silence out there is deafening. [edit] I guess I also want to know is, does Apple provide Intel firmware patches bundled with their own software update?

<comment><USER38> I suspect they'll be patching this one, but I don't know if they have updated the ME firmware in the past.

However, Intel's own platform tools (MEInfo and MEManuf running in a UEFI shell) can't even communicate with the ME on my 2015 Macbook Pro, so I would be quite interested to know what exactly they have done differently with regard to configuring the platform.

People have been archiving every version of the ME firmware for each chipset, and it would appear there are some versions that may be specific to Apple hardware. I'm not sure _what_ is different, if anything, but you can see (and download) the particular firmware versions here: [https://www.win- raid.com/t596f39-Intel-Management-Engine-Dri...](https://www.win- raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System- Tools.html)

<comment><USER37> Very interesting! Thanks for the link. I'm curious if Apple has done something to disable it either themselves or via a special deal with Intel. It's also interestingly timed with the announcement of the new iMac apparently having an A10 coprocessor.[0]

[0]: [https://www.macrumors.com/2017/11/19/imac-pro-a10-chip- hey-s...](https://www.macrumors.com/2017/11/19/imac-pro-a10-chip-hey-siri/)

</comment></comment></comment><comment><USER39> Wow, just imagine what this means to cloud, you get to own not one server of an org... but several orgs at the same time!

</comment><comment><USER40> It looks like they specifically label CVEs that require local access as such. Does anyone know if "via unspecified vector" means network access?

<comment><USER41> Surely in that case it would say something like "attacker with access to the lan connected to the machine's NIC" ?

</comment></comment><comment><USER42> This will be trying to close off the holes used to get at the ME OS I reckon.

<comment><USER43> Technically speaking, that is a security vulnerability. So it wouldn't surprise me.

</comment></comment><comment><USER44> The detection tool for Linux is a Python 2 script. It contains ~15 print statements. If you change them to print functions, the script works fine on Python 3.

The Intel dudes could have added "from future import print_function" and made it version-independent.

</comment><comment><USER45> This time it's only 6th Generation Core processors and up? I thought even the older ones had pretty much the same version of ME installed, which had the previous vulnerability.

<comment><USER46> 6th gen and later ME are fully different. They are Minix and x86-based, while earlier ME is ARCCompact with the ThreadX RTOS

</comment></comment><comment><USER47> So after it is exposed, after 3 generations of products, do they admit it is not a "feature". I can't imagine why they thought this kind of escalation couldn't be cracked by a 3rd party, or how it would bring brand value. This is "clipper" and yes, the hacker can control it. Dangit. Sell-outs.

I'm just waiting for the ransomware that lives on AME, and is burned to the various dies instead of on hard-drives. Isn't that what this open door means?

</comment><comment><USER48> The question then becomes which of any of these can be exploited by a non administrator local user or remotely via LAN (which might include the local machine depending on handling of loop back). Personally I can already see a bunch of on site upgrades I'm probably going to have to do for small clients.

I almost wish it covered 3rd-5th generation, just to help me push some folks to upgrade.

</comment><comment><USER29> Could someone explain what Management Engine is actually used for?

It's still not really clear to me why it needs to exist at all.

Serious question.

<comment><USER49> Remote administration. Installing a new OS remotely, for example. There is legit demand for that. Imagine manually re-imaging 1000 workstations or servers.

<comment><USER50> That is AMT, which is just one application on the ME. More in general it aims to handle things the system should do independently of the OS, even when powered down.

That _can_ include advanced power management, secure computing stuff, watchdog functions and stuff like that.

</comment></comment></comment><comment><USER26> When I run the detection tool, I get:

 _Based on the analysis performed by this tool: Detection Error: This system may be vulnerable, please install the Intel(R) MEI /TXEI driver (available from your system manufacturer)._

Does that mean that the Intel ME is disabled, so I don't have to worry about it? I certainly don't want to install anything that might enable the Intel ME if it's already disabled!

What a quandary. This reminds me of all the information I was asked to give to get a detailed credit report. If I didn't give it, they weren't going to give me the report. If I gave it, they would add to my credit file even if they never had it before.

<comment><USER51> That's what you get if the tool can't identify the ME version. (I get "not vulnerable" if I run the script with sudo -- ME version too old for these vulns, though likely has other, undisclosed vulns -- but without sudo, I get "may be vulnerable", since it can't talk to the kernel driver.)

</comment></comment><comment><USER52> So while us technonerds wait and see whether our OEMs will bother to push out firmware updates sometime in the next 6 months, remember that 99% of users will go unpatched anyway because grandma never upgrades her BIOS.

</comment><comment><USER53> Original title: "Security vulnerabilities discovered in Intel ME"

<comment><USER18> The original title was more accurate.

</comment></comment><comment><USER54> This reminded me of the famous lecture by Ken Thompson, Reflections on Trusting Trust:

[https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...](https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

Basically you have to trust the compiler because it compiles all code on your system, including itself. Not entirely the same, and I think the Intel trick is more nefarious.

</comment><comment><USER55> So does this mean 5th gen and below ones are not vulnerable or Intel just couldn't be bothered to review the ME version on those? Unclear from the article.

</comment><comment><USER41> Does "attacker with local access to the system" mean "physical access to the system"?? Initially I thought it meant "attacker able to run an unprivileged process on the system" but then I see other wording that seems to imply that case, so does "local access" mean physical access? (e.g. connect a USB drive, boot the box off their own media?)

<comment><USER56> The examples I've heard about are plugging a usb drive in and that's the ballgame. The big one, that I have not heard of, would be accessing the ME and privilege elevation over network.

<comment><USER57> Network is a problem.

As I understand it, the ME subsystem is an overseer, and is running even if your main PC is powered off. It has control over the network, unobservable from the downstream CPU/OS. It could therefore receive commands/input from the network and update itself while "off", or transmit data outbound. So unless the system is unplugged from the wall, the ME subsystem could be doing God- knows-what.

</comment></comment></comment><comment><USER41> I don't see any remote exploits here (other than "attacker with remote admin access..."). Is that correct? Presumably an attacker with remote admin access is already all powerful? Or is the concern that they can backdoor the hardware in an undetectable way, remotely?

<comment><USER58> A vulnerability where someone can remote control your machine is bad.

A vulnerability where someone can remote control your machine even after you swap out all local storage and install a new OS is another thing entirely.

<comment><USER41> True but I'd still like the nature of access required to exercise these vulnerabilities clearly defined. e.g. if I have a box that I've maintained strict physical control over, and not allowed admin access to an attacker, does that mean said box can't have been subverted via these vulnerabilities?

</comment></comment></comment><comment><USER59> So, what's the best ARM based laptop that runs without binary blobs?

</comment><comment><USER60> Would you upgrade the firmware or leave it in?

Who knows what benefits this defect can give you down the line. Maybe it will be possible to take over the entire Management Engine. That would be neat.

</comment><comment><USER61> What was wrong with IPMI for out of band management? What problem was ME actually solving?

<comment><USER62> The question I think people should be asking is not "what problem was it solving?", but rather "why was it implemented directly into the processors hardware/firmware?"

</comment></comment><comment><USER63> Can this vulnerability be used to take over public cloud?

<comment><USER46> MEI is only exposed to the VM host, not to the guests thankfully.

</comment></comment><comment><USER64> The ME should not even exist. Best way to secure it is to remove it. Problem solved.

They will of course not let go because it's a backdoor. It's an overprivileged computer within your computer.

<comment><USER65> The NSA has an NSL and threats of jail to anyone at Intel who pushes back against this. Inslaw and Promis was always leading to this, and that's why they killed Danny Casalero.

</comment></comment><comment><USER66> Hackings back baby, whose ready for Hackers 2?

</comment><comment><USER67> what i don't get is how would the consumer benefit of having these features? it all looks like a nonsense to me and I'd rather live without it. i think it's time to say goodbye to Intel and opt for another vendor.

<comment><USER68> That's the problem. There are no REAL alternatives.

<comment><USER67> I'd be glad to switch to raspberry pie or AMD, but I don't know whether or not those chips have similar crap in them. is the Intel alone with this? do others do it too?

</comment></comment></comment><comment><USER69> Ah, the smell of a billion dollar class action lawsuit in the morning!

</comment><comment><USER70> So does this updated firmware remove the backdoor or just re-secure it so it can't be removed?

<comment><USER56> Best I can tell, the are re-locking the door and hoping no one else picks the lock.

</comment></comment><comment><USER71> I would be curious to know what the attack scenario is exactly? I assume this is local, not remote, but the article is not very specific. Furthermore, has any kind of PoC been published?</comment>


Google Under the Hood: One Google Account for Everything Google - <AUTHOR> http://blog.onyxbits.de/google-under-the-hood-one-google-account-for-everything-google-342/ <comment><USER2> So, do they not even notify you that you've agreed to some new ToS by logging in into a new service?</comment>


MakerBot lays off 20% of its staff for the second time this year - <AUTHOR> http://www.theverge.com/2015/10/8/9477999/makerbot-layoffs-employees-lawsuit <comment><USER2> this isn't really surprising, the number of printer makers is too large for the market to support, certainly if you arent super lean in operations. this is a thinning of the herd and time for M&A in that space.</comment>


Gödel's Incompleteness Theorems (2015) - <AUTHOR> https://plato.stanford.edu/entries/goedel-incompleteness/ <comment><USER2> I took a full semester course on Godel's Incompleteness Theorems in college and found it rewarding. It was one of those experiences that convinced me that hand-wavy familiarity with stuff sometimes pales by contrast to a deep dive.

One of the professors also had a very old newspaper clipping taped up (it was brown then and that was quite a while ago), about several mathematicians committing suicide in the wake of those proofs. I've looked for corroboration of this and have never found it. A bit difficult to comprehend from a modern perspective, but more plausible with an appreciation of the 19th Century faith in rationalism / logical positivism that Godel helped overturn.

Not many people are aware that Godel spent much of his life secretly working on a modern update of an ontological argument for God's existence, and didn't reveal this until late in life -- [https://en.wikipedia.org/wiki/G%C3%B6del%27s_ontological_pro...](https://en.wikipedia.org/wiki/G%C3%B6del%27s_ontological_proof)

<comment> qwert-e As far as I know it's not like the proofs caused a wave of suicides, but mathematicians studying this topic often became mentally unstable, including Godel (who starved himself in a sanatorium) and others like Georg Cantor.

I'm curious where you studied; I also took a semester course on "logic and computability" where the main text we read was 'Godel, Escher, Bach'

<comment><USER3> I studied at UCLA and also took several logic and metalogic classes (it was my AOF). For one of the metalogic classes, this was our text: [http://www.math.ucla.edu/~dam/135.07w/135notes.pdf](http://www.math.ucla.edu/~dam/135.07w/135notes.pdf)

We briefly talked about Godel's proofs, but they are nontrivial. Henkin's proof of completeness is hard enough[1]. I don't mean to sound dismissive, but a class where _Godel, Escher, Bach_ is the text does not seem very rigorous. Logic is very tricky stuff. And once you get into infinities, it's not even intuitive.

[1] [https://www.cs.nmsu.edu/historical- projects/Projects/complet...](https://www.cs.nmsu.edu/historical- projects/Projects/completeness.pdf)

</comment></comment></comment><comment><USER4> Here's a nice way to make peace with Godel's theorems.

Let's say your beliefs about the integers can be summarized by some formal theory T. ("Every number has a successor", and so on, until your intuition runs out of things to say.) Now Godel jumps out of the bushes and says aha, your T doesn't include Con(T), so you aren't the math genius that you thought you were!

But let's stop for a moment and consider what it would take for T to include Con(T). First of all, compared to other sentences about integers that you believe, Con(T) is an absolutely huge sentence. It must contain an arithmetization of all of T (encoding the axioms, inference rules, etc. into integer arithmetic).

Second of all, if Con(T) is included in T while speaking about T, it might need to include an arithmetization of Con(T) itself! That uses a diagonal construction ("quine" in computer science terms), making the sentence even bigger. Now you're looking at some kind of hundred-kilobyte Diophantine equation, with no intuitive reason to believe it at all.

And third of all, it's easy to see that an inconsistent theory T would easily prove Con(T) (because it proves any sentence), so having Con(T) inside T doesn't even give you any positive evidence for trusting T. In fact, we're lucky to live in a world where Godel's theorems are true, and having Con(T) inside T is negative evidence instead of none at all!

<comment><USER5> To some degree Chaitlin's equations [1] make the issue less abstract than that though.

"We outline our construction of a single equation involving only addition, multiplication, and exponentiation of non-negative integer constants and variables with the following remarkable property. One of the variables is considered to be a parameter. Take the parameter to be 0, 1, 2, ... obtaining an infinite series of equations from the original one. Consider the question of whether each of the derived equations has finitely or infinitely many non- negative integer solutions. The original equation is constructed in such a manner that the answers to these questions about the derived equations are independent mathematical facts that cannot be compressed into any finite set of axioms."

So there are finite (though several hundred pages long) equations for which the finiteness of the solution set is independent of every finite axiomatization of arithmetic. So suddenly, even though the formula is enormous, the type of sentence is perfectly normal. Does f(x) have finitely many solutions, where f(x) is built from addition, multiplication and exponentiation.

Much more so than Gödel's incompleteness this deeply violates my intuition about what type of statements should be decidable.

[1] [https://www.cs.auckland.ac.nz/~chaitin/berlin.pdf](https://www.cs.auckland.ac.nz/~chaitin/berlin.pdf)

<comment><USER4> There's no single f(x) for which finiteness of the solution set is independent from all axiom systems. (We can always just add an axiom saying f(x) has finitely many solutions.) Chaitin shows something different, an f(x,y) for which finiteness of solution set in x for a given y becomes independent from more and more axiom systems as y grows (because it encodes larger and larger instances of the halting problem). That doesn't disagree with my intuition at all, in fact it seems obvious.

<comment><USER5> Well given that it was considered a surprising and highly non-trivial result when it came out less than thirty years ago, I'll say that it's obvious only in the sense that all statements that have been proven are obvious after the fact.

And yes, I worded that ambiguously. Let me rephrase, to see if I got it correct: Pick any finite axiomatization. Then there is a concrete f(x) that we can write down in about 200 pages, for which finiteness of the solution set is not decidable.

The fact that there are diphantine equations for which finiteness is undecidable is really surprising to start with to me.

</comment></comment></comment></comment><comment><USER6> If you're interested in this and you haven't read Logicomix,

[https://en.wikipedia.org/wiki/Logicomix](https://en.wikipedia.org/wiki/Logicomix)

get it at your library now.

[http://www.worldcat.org/title/logicomix/oclc/708346776&refer...](http://www.worldcat.org/title/logicomix/oclc/708346776&referer=brief_results)

<comment><USER7> Great comic book treatment of the Frege - Russell - Godel story. Strongly recommended.

<comment><USER8> They do mention this in the book, but it does take artistic license with some of the history.

</comment></comment></comment><comment><USER9> Carl Hewitt (of Actor model fame) has this thing where he claims that contradiction alone allows you to defeat Godel Incompleteness, so he shops it around places and everyone's like, "man, wtf, this isn't how that works". I saw him shop it to D. Hofstadter and Hofstadter basically smiled and took the little piece of paper and threw it away when Carl wasn't looking.

This doesn't have anything to do with anything, just a thing that happened

<comment><USER10> I know that the above was written in jest anyway :) but just for completeness (har), a contradiction would help you defeat _many_ things (i.e., it's not specific to incompleteness theorems, so to speak), because given it, (at least in traditional logic) you can prove _anything_. This is trivial and known, but to spell it out, if we have a contradiction formalized by _p_ and _not p_ (given), we can prove that _q_ :

1\. _p_ and _not p_ (given).

2\. _p_ (from 1).

3\. _not p_ (from 1).

4\. _p_ or _q_ (from 2 (disjunction introduction)).

5\. _q_ (from 3 and 4).

So obviously this would _upset_ quite a few things around :) that said, the interesting stuff is with Graham Priest's (et al.) paraconsistent logic systems wherein your system can tolerate a contradiction without exploding in whole. And (so the story goes) _those_ systems may offer an actual insight into handling incompleteness (while still being usable). If anyone has looked into this more, would be interesting to hear about it!

<comment><USER11> That behaviour was desribed by the old masters as 'ex falso quodlibet': from falsity whatever (when else am i having the chance to be this pedantic). In the uni I was taught that hippie-era AI dealt with that with things called non-monotonic reasoning, abduction, truth maintenance systems.

<comment><USER3> Also known as the (much cooler-sounding) Principle of Explosion :)

</comment></comment></comment></comment><comment><USER12> I recommend Torkel Franzén's Gödel's Theorem: An Incomplete Guide to Its Use and Abuse. It is readable without sacrificing rigor.

It is especially good at ensuring the reader doesn't come away infected with the pseudo-profound BS that plagues many discussions of the Gödel's Theorems.

<comment><USER13> That, and Nagel's book on the proof, have been recommended on HN before (very recently!). And Rebecca Goldstein's book has been dismissed as too hand-wavy.

For important, wiki-friendly topics like this one, HN is frustratingly not great for building a readily checkable/cumulative knowledge base, rather than encouraging a forgetful herd discussion that goes around in circles. It is as I say frustrating for anyone who wants long-term knowledge rather than flimsy "news".

<comment><USER14> Very apt obeservation! I was thinking on how to address that for some time. Any ideas? Would you like to collaborate on this?

</comment></comment></comment><comment><USER15> This isn't really about Gödel, but I always wish that people had a little bit _less_ of a natural instinct towards bastardized Gödelian thinking. So that there would be fewer infuriating people arguing things like "Infringing on my right to infringe on the rights of others infringes on my rights." Or, "You can't be against criticism, because then you'd be criticizing criticism." I've been rolling my eyes at these arguments for decades, and I wish fewer people thought they were clever.

</comment><comment><USER16> I recently read 'Incompleteness: The Proof and Paradox of Kurt Gödel' by Rebecca Goldstein [1], I highly recommend it for those interested in learning more about his life and the proof itself.

1.[https://smile.amazon.com/Incompleteness-Proof- Paradox-G%C3%B...](https://smile.amazon.com/Incompleteness-Proof- Paradox-G%C3%B6del-Discoveries/dp/0393327604/)

</comment><comment><USER17> A non-mathematical interpretation of Gödels Theorems and their implications

[http://rationalwiki.org/wiki/G%C3%B6del's_incompleteness_the...](http://rationalwiki.org/wiki/G%C3%B6del's_incompleteness_theorems)

</comment><comment><USER18> I always was wondering: Godel proved his theorem regarding formal systems described in Principia Mathematics. In my understanding this is some higher level logic with recursive functions.

But how this can be extended to the whole universe of all possible formal systems? Who guarantee that there will be no some new system with quantum- oracle-operator, which will not be affected by incompleteness theorem, and can self-proof self-consistency?

Even well known m-recursive functions (which are essentially Turing machines) are wider class than primitive recursive functions used in the proof..

<comment><USER19> Godel's technique is a constructive proof that depends on two things to work. One, the logic needs to be at least strong enough to express the Peano axioms. Two, it needs a finite formalism of the logic to construct the proof out of.

If you have those two things, Godel's technique works. The details vary greatly based on the formal logic in use, but part of the process is encoding the formalism in Peano arithmetic.

So no, adding more things doesn't break it, because the construction takes those additional things into account.

Unless you want your logic to be infinite, of course. In that case, the method would break down. But it has to be infinite in the sense of having no finite representation, rather than the much weaker sense of having some infinite representation.

<comment><USER18> See my comment about what do I mean: [https://news.ycombinator.com/item?id=14039104](https://news.ycombinator.com/item?id=14039104)

> Unless you want your logic to be infinite, of course. In that case, the > method would break down.

Godel numbering is infinite, because it is just natural numbers. Nothing prevents you to build the same proof for infinite number of axioms, rules, functions, variables..

<comment><USER19> > Godel numbering is infinite, because it is just natural numbers. Nothing > prevents you to build the same proof for infinite number of axioms, rules, > functions, variables..

That's kind of a non-sequitor. Second-order logic, the logic required to express Peano arithmetic, consists of a finite number of axioms and inference rules. The number of statements that can be generated with those rules is irrelevant. The logic is finite.

Godel numbering requires assigning a number to each logical axiom and inference rule. The mechanism of Godel's numbering implies that every derivation has a unique number as well, but that number is derived, not assigned. The difference is important. It means that the information required to construct the system is finite. If the supply of axioms and inference rules was infinite, with no finite alternate encoding, it would mean Godel numbering would fail because the process of assigning numbers to each axiom and rule would never complete.

But that's all a bit of an aside. To get back to your original question...

Godel's proof provides a mechanism to construct a statement that refers to itself in any logic that can express Peano arithmetic. Once you can make a statement refer to itself, the game is over. You've lost.

But Godel's approach is even more clever. Not only can a statement refer to itself, it can refer to proofs in its own formal system.

So it constructs "This statement has no proof within the formal system it's expressed in."

That's far more subtle of a statement than you give it credit for. It makes no claim about other formal systems. But once you start addressing it from a different formal system (or an informal metalogic) the statement no longer refers to the logic system in which you are examining it.

So sure, you can say that Godel statement G0 constructed in formal system L0 is provable (or disprovable!) in formal system L1. But that doesn't prove anything about the completeness or consistency of L1, because G0 is a statement about L0. And if L1 happens to be strong enough to encode Peano arithmetic, you can construct a statement a Godel statement G1 which refers to logic L1.

This is always applicable. Whatever your G0 and L1 are, G0 says nothing about L1, but the existence of L1 is irrelevant to the statement G0, and very probably also allows the existence of G1. (I've spent lots of time discussing when it doesn't, and won't belabor the point further.)

<comment><USER18> > If the supply of axioms and inference rules was infinite, with no finite > alternate encoding, it would mean Godel numbering would fail because the > process of assigning numbers to each axiom and rule would never complete.

I strongly disagree with that. There is no evidence of that.

> And if L1 happens to be strong enough to encode Peano arithmetic, you can > construct a statement a Godel statement G1 which refers to logic L1.

As I said before, Godel proved that your G1 is unprovable in specific framework of Principia Mathematics, which is first/second/higher theory/logic (consist on quantors, functions, predicate, variables, rules).

I don't see evidence that there can be no other framework even with Peano arithmetic inside which can't deliver consistent theory. You started speculating about framework with infinite set of axiom, and I disagreed with that, but there can be other type of infinite framework, say when you allow proofs of infinite length, then Godel numbering may be impossible, and it can be example of such framework.

</comment></comment></comment></comment></comment><comment><USER20> Just chipping in with my interesting reading about the implications of Godel's incompleteness theorems.

This piece about what the theorem means for developing "deep AI" and the human mind, was a fascinating eye opener for me, about the far stretching implications of the theorem.

"The Lucas-Penrose Argument about Gödel's Theorem" \- [http://www.iep.utm.edu/lp-argue/](http://www.iep.utm.edu/lp-argue/)

<comment><USER21> penrose wrote a whole book walking through his argument around deep AI (and providing a gentle explanation of gödel's incompleteness theorem in the process): [https://en.wikipedia.org/wiki/The_Emperor%27s_New_Mind](https://en.wikipedia.org/wiki/The_Emperor%27s_New_Mind)

</comment></comment><comment><USER22> Goedel's results imply some surprising and counterintuitive things about our formal models of computability: [https://johncarlosbaez.wordpress.com/2016/04/02/computing- th...](https://johncarlosbaez.wordpress.com/2016/04/02/computing-the- uncomputable/)

<comment><USER23> Enjoyed rereading this, thanks

</comment></comment><comment><USER24> "A common misunderstanding is to interpret Gödel's first theorem as showing that there are truths that cannot be proved." I've heard it stated that confusing way so many times in popular media. And then often follows quantum mechanics, and geniuses going mad, and the world is just your imagination... forever.

<comment><USER25> Agreed it has been abused. On the other hand, if you adhere to a computational theory of mind and see the mind as computation over a formal system, then it is saying something about the mind and the fact that some (true) sentences cannot be proven in that system, isn't it? It is a big if though.

(though maybe in a completely irrelevant sense of truth).

<comment><USER24> Just poking fun at the way these things are presented in pop.sci. media. Anyway, talking over my head, I'm not shure formal systems are a good way of modelling the mind itself. Formal systems are (usually) considered consistent. The mind is not. Neither are neural nets. And it's interesting how neural nets, and other statistical models/algorithms that drop the requirement of always beeing right, seems more much more capable in certain practical matters.

</comment></comment></comment><comment><USER26> When I rant about it, I claim his theorem says "any system that reference parts of itself is either incomplete or inconsistent," and that the universe is such a system, as we're a part of it, and refer to parts of it.

So therefore, the universe is either full of magic (in a system with inconsistency, anything can happen), or mystery (there are true things that we can never prove).

My belief is that the quest to find a unified physics that describes everything is provably impossible due to Godel's theorem.

And on the rare occasions when I look for evidence of God, the fact that one of the things we can know for sure - is that we can't know everything - provides about as much comfort as I need.

<comment><USER27> This sort of application is wildly out of bounds of the true scope of the theory. The relationship between physics (unified or otherwise) can't be resolved with reference to Godel's theorems.

<comment><USER26> Why? I honestly don't see how it's out of scope at all (majored in mathematics, minored in physics)

<comment><USER28> Well, you're actually making metaphysical claims more than mathematical or physical ones. One of two assumptions, depending on how literally the sentiment that the universe is a formal system is intended, is being elided here:

1\. That the universe _is_ a formal system, rather than being describable in the language of some formal system. It's not evident what the universe being a formal system even means, or how it squares with basic intuition regarding e.g. the fact that physical systems have state.

2\. That, dropping the physical system <=> formal system equivalence and given some real system R consisting of some fundamental entities whose behaviors can be described in full in the language of some formal system S, (borrowing a useful construct from Lucas' anti-mechanism argument, even though I don't buy that argument) no machine can be constructed in R which computes theorems of some formal system S' in which all true statements of S are provable, meaning that no state of the system R can be said to contain a description of S', and that S' is therefore not describable by any arrangement of the entities in R (assuming some reasonable predicate over states of R that is true for a state when some arrangement of a subset of the entities in that state describes S'). Intuitively, this doesn't seem to hold up: by analogy, I can describe a universal Turing machine with a computer equipped with only finite memory. You could then attempt to go down the road of claiming that, even if a description of S' is possible in R, that a mind within R would not be capable of formulating that description, but then you're heaping on an even larger tangle of assumptions, unknowns, and things you have to define if you're going to argue the case rigorously.

The point being that confidence about _any_ hypothesis about the nature of reality made on the basis of Gödel's incompleteness theorems is not epistemologically warranted.

</comment></comment></comment></comment><comment><USER29> I am halfway through reading Raymond Smullyan: A puzzle guide to Gödel, after finding out about his recent death here: [https://news.ycombinator.com/item?id=13626221](https://news.ycombinator.com/item?id=13626221) . It explains Godel's incompleteness Theorems accurately to a layperson through a set of logical puzzles.

</comment><comment><USER30> Wittgenstein bitches!</comment>


Danger of Repeat Head Injuries: Brain's Inability to Tap Energy Source (2014) - <AUTHOR> https://news.osu.edu/news/2014/11/16/%E2%80%8Bdanger-of-repeat-head-injuries-brain%E2%80%99s-inability-to-tap-energy-source/ <comment><USER2> >>> Two or more serious hits to the head within days of each other can interfere with the brain's ability to use sugar......

>>> In animal studies, Ohio State University scientists have shown that brain cells ramp up their energy use six days after a concussion to recover from the damage....

Hope the studies were done in a humane way..

<comment><USER3> I have no problems with the inhumane treatment animals in the name of keeping humans alive longer and in better health.</comment></comment>


Ask HN: Best resources to learn Python and Git? - <AUTHOR> I'm looking for books that would teach me about how Python and Git work behind the scene and then how to efficiently use them.<p>Any good recommendations? <comment><USER2> For Python you can just read the tutorial and skim standard library docs, they're pretty good.

For Git: [https://git-scm.com/book/en/v2](https://git-scm.com/book/en/v2) \- chapter 10 in particular covers internals.

</comment><comment><USER3> My React/Redux links list has a page pointing to a number of useful Git tutorials and resources, including several that dig into Git's internals: [https://github.com/markerikson/react-redux- links/blob/master...](https://github.com/markerikson/react-redux- links/blob/master/git-resources.md) .</comment>


ISPs lose Dallas Buyers Club piracy case - <AUTHOR> http://www.theage.com.au/digital-life/digital-life-news/dallas-buyers-club-slays-iinet-in-landmark-piracy-case-20150405-1mey38.html

<comment><USER2> Online piracy has been common for many years, and this legal action seems an obvious action by the copyright holders. So why hasn't this been tested in an Australian court before now?

<comment><USER3> My understanding is that statutory damages in Australia can't (don't?) reach the stratospheric "$5000 per song" amounts that legislation in the US allows for, which makes the endeavour less profitable.

I'm not sure what's changed from (say) 3-4 years ago on that front.

<comment><AUTHOR> $5,000 per song plus a sound public thrashing and ownership of your firstborn. That's the only appropriate penalty per song.

</comment></comment></comment><comment><USER4> I might feel differently about alleged piracy if they could prove pirates are lost sales. But they lost that argument long ago.</comment>


"The Imitation Game" and Alan Turing's Real Contribution to Computing - <AUTHOR> http://www.charlespetzold.com/blog/2014/12/The-Imitation-Game-and-Alan-Turings-Real-Contribution-to-Computing.html <comment><USER2> I once read a proof of Gödel's first incompleteness theorem that used a version of Turing's undecidability proof, which have had great impact on me. That being said, I find the point of this article, if not nitpicking, then asking too much of a Hollywood movie. I may be a bit cynical in suspecting Petzold sees an oppurtunity here to Google rank his book.

With his famous paper, Turing (1) formalized the concept of the computation and (2) showed, analogously to Gödel, that there are some facts about computing that aren't reachable by computational means. He also did things like _saving the world by decrypting the German Enigma machine_. Yet he was a socially marginalized individual who died tragically because of it. I haven't seen the movie, don't know what it's about. But I know it's not made for computer scientists, and we should be glad that Turing is finally getting the recognition he desereves.

<comment><USER3> _saving the world by decrypting the German Enigma machine_ this is often repeated but mostly incorrect statement. Marian Rejewski, Jerzy Różycki and Henryk Zygalski cracked v1 of the enigma in theory. So, Brittan was provided with full pictures of the insides plus an approach to crack it by some polish mathematicians, but they needed to build some actual physical devices. Also, the enigma design continued to be improved upon over time, but the basic approach more or less continued to work. [http://en.wikipedia.org/wiki/Marian_Rejewski](http://en.wikipedia.org/wiki/Marian_Rejewski)

PS: Remember home grown heroes get all the credit whatever their actual contributions.

<comment><USER4> The four rotor enigma change the Germany Navy adopted though was a significant change - and the decryption of that was something Turing was heavily involved in.

In 1942 the Battle of the Atlantic was far from undecided and without cracking the naval Enigma it is entirely possible that Britain would not have been able to effectively stay in the war, or send convoys to Russia.

<comment><USER5> _> was a significant change - and the decryption of that was something Turing was heavily involved in._

It was still much more of a team effort than usually presented though. It does irritate slightly the way that people concentrate on the code cracking and Turing as it seems unfair in to directions: it forgets the other people who also contributed significantly, and pretty much ignores the significant work that Turning _did_ do largely solo.

<comment><USER6> It might be because Turing's groundbreaking theoretical work is beyond the realm of comprehension for the vast majority of people.

There's only one person who became famous on the grounds that he's so great, almost nobody even understands what he's done - and that's Einstein.

<comment><USER7> He did a lot. Everybody understands the simple stuff - matter and energy are the same thing - e=mc2

</comment></comment></comment></comment></comment></comment><comment><USER8> This is why I think non-documentary movie making of the lives of historical people is a fool's errand. Of course Hollywood had to sex up Turing. He's a pretty boring guy by Hollywood hero standards. There was no big breakthrough with the Enigma. Well, there was, but it was a Polish team that figured it out. Obviously, his sexuality is a dramatic point in his life, but that's not much to build a movie on. I really wonder if a decent documentary team was granted 1/10th the budget of this movie, what would their output be? Probably a decent and educational flick.

Its also a weird production. I'm not even sure who made this movie. It seems that it was produced by a near non-entity called Black Bear Pictures out of NYC, which shows only this movie and three others on their webpage. It was directed by a nobody with 3 other mediocre films under his belt and written by a novice writer. It really has "pet indie project of a wealthy person or two" written all over it. Shame really, a more mature and historically serious team probably would have punched out a better film.

There's a great Turing/Enigma/WWII film to be made, and this just isn't it. Considering its poor box office response (only 1m so far), I imagine this will be the only one, ever for Turing. I really feel his story is Spielberg or Scorsese worthy, but now alas, Turing is established as box office poison.

<comment><USER9> It looks like the movie is playing in only 8 theaters in the United States. I saw it in NYC where it was only playing in 1 theater.

[http://www.boxofficemojo.com/daily/chart/?view=1day&sortdate...](http://www.boxofficemojo.com/daily/chart/?view=1day&sortdate=2014-12-09&p=.htm)

Sort by average and it wins. It was a very entertaining movie. It would do well in a wider release.

<comment><USER10> It is being released more widely. From Wikipedia: "The film will expand into additional markets in 12 December and will be released nationwide on Christmas day".

</comment></comment></comment><comment><USER11> To me,

> any conceivable mathematical calculation can be done by a single device > shuffling 1's and 0's back and forth

seems right. It does not say that Turing's machine solves every problem. It says it does every conceivable calculation.

That was Turing's contribution (anyway, one of them). The controversy at the time (1930's) was that there were a number of proposed definitions for what are conceivable mathematical computations (Kleene, Post, Herbrand ..). All of them gave schemes that the authors claimed were exhaustive. Turing's paper convinces a reader, as it convinced Godel, that his definition does indeed do everything mechanically possible (and everyone else's definitions, since they all prove to be equi-powerfull).

Of course Godel knew there were unsolvable problems. The question was whether there was a single maximally-powerful device.

<comment><USER12> A Turing machine can compute anything that can be mechanically calculated, but the key point here, which Godel proved, is that there are exist problems that _cannot_ be mechanically calculated.

<comment><USER6> If the brain is a computer, the implications are staggering. Basically, there can be no Theory Of Everything. Instead, all we can hope for is a loosely- coupled federation of local theories.

</comment></comment></comment><comment><USER13> "On Computable Numbers, with an Application to the Entscheidungsproblem" is a hugely important work, and Petzold's book "The Annotated Turing" makes it very accessible. I highly recommend anyone who is interested pick up a copy. High school education is all that's really needed.

Turing was decades ahead of the rest of us. It's a shame that we're portraying him so inaccurately (though really, not nearly as shameful as how we treated him when he lived).

<comment><USER14> "Turing was decades ahead of the rest of us."

That seems unfair to Alonzo Church.

<comment><USER15> And Emil Post.

</comment></comment></comment><comment><USER16> This is true, but there are so many other things horribly wrong with that film that it hardly seems worth mentioning that they screwed up the description of the Turing Machine's capabilities.

<comment><USER17> What other things do you find wrong with that film? Do you think that the film detracts from the story of Turing's life, overall, or are the things wrong just Hollywood repackaging of a story that is still told in a meaningful way in the film? I'd like to support a movie that represents Turing's life fairly, but the film hasn't opened here yet, so I haven't had a chance to see it.

<comment><USER16> 1\. Turing did not write by himself to Churchill and get himself put in charge. He wrote with others and asked for more resources.

2\. Pretty much all sequences with the Bombe are a cringe because they appear to be building a machine but not know what it is for. It's implied that it's a Turing Machine.

3\. They apparently hadn't thought of using a crib resulting in a dramatic run back to Bletchley from the pub sequence to get the Bombe working.

4\. John Cairncross didn't work in Turing's group. So the whole plot with Cairncross and Turing and blackmail is nonsense.

5\. Gordon Welchman doesn't appear in the film and Hugh Alexander is instead credited with coming up with the Bombe diagonal board.

6\. Turing is shown building a computer in his home in the early 1950s. Not likely.

7\. Turing never told a Manchester police officer his entire life story revealing all of Bletchley's secrets. Also, he didn't try to stop the police investigation. He's the one that reported the burglary.

8\. Joan Clarke wasn't recruited through a crossword competition, she was already known to be a bright mathematician.

I could go on.

Of course, none of this had to happen. I met the director and offered (for free) to help them get stuff right.

<comment><USER18> This is why we can't have nice things.

These kinds of criticisms seem little more than trying to jump on an SEO bandwagon. It's important that the true accomplishments, history and acknowledgements are understood by the writers and others working on a production like this, but it does _not_ matter so much that the film portrays exactly these. Just like SciFi writers should understand what is and is not possible, but are free to relax those limits in their stories.

Firstly, it is not a documentary, it is a work of fiction which is "based on a true story". Secondly, we're not watching presenters telling us what's going on; we're watching actors playing characters. With that in mind, when I watched the film I not only enjoyed it immensely, but I also found it completely clear that the writers had their facts straight. I didn't once cringe at the presentation, which I often do when non-experts describe something technical which I understand.

As for your individual points:

1) The intention of having Turing write to Churchill was to establish the (partially subconscious) arrogance of the Turing character, and his logical approach to solving problems. Mentioning Churchill's involvement at all gives the audience a clue to the importance of the work, which might otherwise be seen as conscription-dodging. This was more important for the film than making a realistic portrayal of the process of resource aquisition in wartime Britain.

2) There was definitely the feeling that nobody understood Turing's exact approach when he was _designing_ the Bombe, but during the construction phase the only sense of confusion I got was whether their time was better spent on Turing's unproven machine or on their known, but inefficient manual approaches.

The character of Joan _guesses_ at one point that Turing is _trying_ to build a Universal Turing Machine. There is no mention whether the Bombe itself is or is not such a machine, but as the film progresses, we see post-war Turing working on another machine which is most likely universal (presumably the Manchester Mark 1 or one of its successors). The Bombe was clearly a stepping- stone to get to this later machine, just as Turing hints that this machine is just a stepping-stone to some later, "smarter" machine. There is a strong implication that Turing's character doesn't regard these machines as distinct devices, but as the continual "upgrade" of the same core concept. That his first iteration wasn't universal doesn't matter.

3) Artistic license. The audience mustn't be bombarded by too many encryption concepts early on, but the story much march ahead, so why not use each one as a plot device?

4) It makes the film more interesting though. Again, it's not a documentary. It does give a sense of the paranoia of the period, and the double/triple/quadruple bluffs work very well to portray the intelligence of the characters, especially that Turing can't just think his way out of his problems (which is important, given how much Turing's intelligence had been put across earlier). This changes the character of the film from superhero Turing saving the day with his super brain, to a dangerous and intricate game between _very_ capable people.

5) The fact it was mentioned at all shows that the history was known. The theatrical intension is clear: Turing's character needed the help of his team, even if he would not admit it. This minor plot point could be established without bringing in a new character for the audience to keep track of, so the attribution was shifted on to an existing character. Again, not a documentary.

6) That scene works well in his home, and benefits from the presence of the machine. It would be awkward to interrupt the conversation while they pop down the road to the University where it would have been in reality.

7) How else could it be told to the audience? Should Turing have been talking to himself while out on a run? The police interrogation provides a context for telling the story in the first place, as well as an impending darkness that it's not all going to end well (else he wouldn't be getting investigated). Having a bunch of eminent historians and scientists doing talking-head sequences interspersed with CGI infographics only works for documentaries.

8) The crosswords are a useful plot point, can be related to by the audience (using competitions to recruit secret spies would be especially effective at inspiring children) and are a nice little piece of trivia. The fact that they weren't very useful kind of ruins it though; hence they invented a use by recruiting the Joan character that way. Also, this allowed the contemporary marginalisation of women in computing to be projected into the film; she is forced to prove herself to the doubtful men.

I think it is an excellent film, and it spreads knowledge of the nature and importance of the work done by early computer scientists, and hopefully gives some people the inspiration to carry on that work (Computer Science, not GCHQ!). It is not a reference book; very few will even remember the kind of minutiae pointed out here. It's better to bring a lot of people most of the way to the truth, in a way that they enjoy; than to squabble over the last few mm, alienate almost everyone, present the field as toxic and jaded and make those few who stick around miserable.

<comment><USER19> >> These kinds of criticisms seem little more than trying to jump on an SEO bandwagon.

Wtf? Do you realise this is the jgrahamc who successfully campaigned for the Prime Minister of the UK to finally apologise for Turing's treatment? Frankly if anyone's entitled to adjudicate here, he is. I note that jgrahamc isn't criticising the film or its aims, rather questioning why single out one aspect when so many others have been given similar manipulation, and responding to a _direct request_ for expansion on said "tweaks". I for one say thank you jgrahamc.

</comment></comment></comment></comment></comment><comment><USER20> This is a good essay, and I am hesitant to see the film because I am worried that I will cringe every few minutes. But, I disagree with this sentence:

"Everyone agrees that Alan Turing is a seminal figure in the computer revolution, so it's puzzling why these movies deliberately misrepresent his work."

I sincerely doubt the movies _deliberately_ misrepresent his work. Rather, I assume they _honestly_ misrepresent his work, meaning that they tried to get it right, but they don't understand it well enough to do so.

<comment><USER21> _I sincerely doubt the movies deliberately misrepresent his work. Rather, I assume they honestly misrepresent his work, meaning that they tried to get it right, but they don 't understand it well enough to do so._

Well, movies _deliberately misrepresent everything_ , all the time --it's called artistic license! Accuracy (scientific or otherwise) is always a distant second to cinematic flair, or whatever is it studios are trying to optimize.

<comment><USER22> Yup. That's why R'as al Ghul dies.

</comment></comment></comment><comment><USER23> Odd that an article so nit-pickily concerned with the accuracy of the mathematics of Turing's work would over-generalize the actual computation he proved to be impossible, which was deciding if an arbitrary algorithm terminates on all possible inputs (i.e. there are no infinite loops), to "there are no bugs".

The Annotated Turing is a great book though, I highly reccomend it (Turing's original paper is _very_ dense).

<comment><USER24> What do you mean by over-generalization? If you could solve the problem of determining if a program has a bug, you could solve the Halting problem. So it's just a generalization. Maybe it could be formalized more technically, but that makes it imprecise, not inaccurate.

<comment><USER25> Halting has nothing to do with being bug-free -- lots of buggy programs halt, and some obviously bug-free programs may not halt (e.g. a brute force search to determine Goldbach's conjecture)

<comment><USER24> Of course it does: checking for halting _reduces_ to checking for bug- freeness. See the other comment in this thread.

</comment></comment></comment></comment><comment><USER24> Considering the budget for these kinds of things, I'm shocked they don't just pay some theoretical computer scientists to read the script and provide feedback on the mathematical correctness of the lines. You don't even need to find _great_ computer scientists; you'd root out this bug with graduate students.

<comment><USER26> Many productions _do_ hire expert advisors. Various iterations of Star Trek had a real scientist at hand to ensure accuracy. Tons of bad science slipped through anyway.

The monetary cost is small, but the time cost can be big. Writer time and attention is a scarce resource and time spent rewriting scripts for accuracy is time not spent polishing them for other things. And the simple fact is that scientific accuracy doesn't really sell. A movie with an otherwise good script that contains bad science will do far better than a movie with an otherwise bad script that contains good science. There isn't even much reason to think that improved science improves viewership _at all_. As far as I can tell, those productions that made attempts to portray accurate science did so because the people involved genuinely wanted to.

Nerds flock to Star Trek and Star Wars and Gravity and other such movies even though they're full of problems. And if we're really being cynical, every "the problems with the science in Movie X" article written is just more free publicity for it.

</comment></comment><comment><USER27> The New Yorker had a pretty good review of this movie: [http://www.newyorker.com/magazine/2014/12/01/keeping- secrets...](http://www.newyorker.com/magazine/2014/12/01/keeping-secrets-2)</comment>


Ask HN: How to navigate large code bases? - <AUTHOR> Are there any good tools out there designed for navigating large code bases? I'm thinking something that can generate class and caller/callee diagrams... Thanks! <comment><USER2> Depends on the language of the codebase, but there are various tools that can help you, like doxygen if things are setup well.

My two cents, I always do a manual mapping for the modules and key classes, even in large code bases because it forces me to learn the codebase and create documentation at the same time. I do this by literally starting at main() and tracing the code to what is called first etc. So when I am done I have a high level overview of the path through the code and what modules are what and what they do.

Usually takes a few days to do a larger code base, largest one took me 2 weeks. It isn't the most fun work, but it lets you build documentation to save yourself and others later too.

</comment><comment><USER3> My experience is that debugging is more effective than looking at static code. To find callers, I set break points. Other than that, grep, opengrok, doxygen or a decent ide are good helpers.

<comment><AUTHOR> Thanks. I'm looking at doxygen right now. Looks like it has support for generating dependency graphs.</comment></comment>


Show HN: A Smarter Approach to Commits Browsing in Bitbucket Server - <AUTHOR> https://gitsense.com/blog/commits-browsing.html <comment><AUTHOR> If you want to play around with the GitSense add-on for Bitbucket Server, you can do so at

[http://bitbucket-server-demo.gitsense.com](http://bitbucket-server- demo.gitsense.com)

The add-on is free, and it makes it possible for you to browse multiple commits as a single entity (changes tree) in Bitbucket Server. The tree is designed to provide an alternative, to how commits browsing is currently done in Bitbucket, GitHub, GitLab and other related Git hosting solutions.</comment>


Ask HN: Jobs page for Apptimize - <AUTHOR>

Is it just me or does opening text like turn everyone off from applying to the "hot" new startups?<p>"Every day, billion dollar companies use Apptimize to improve the mobile experience for millions of users. Our team of 14 includes 6 MIT alumni, 3 ex-Googlers, 1 Wharton MBA, 1 MIT Masters in CS, 1 CMU CS alum, and 1 "20 under 20" Thiel fellow. Candidates often remark we're the strongest team they've ever seen.<p>We're not for everyone. We're an enterprise SaaS company your mom will probably never hear of. We work really hard 6 days a week because we believe in the future of mobile and we want to win. We are in Menlo Park, California." <comment><USER2> Yes. For me it was the "Apptimize is hiring HPMOR readers" headline for their YC jobs post.

I loved HPMOR but putting that in a headline for a job ad, combined with such heavy-handed emphasis on the team's academic credentials, just reeks of rationalist elitism.

I know next to nothing about the company or why I'd want to work there from reading their job post. What I do know is that they really think highly of themselves and work six days a week.

Pass. YC job ads are getting progressively more cringe-worthy. It's not hard - just write a sane job ad with realistic requirements and don't be intimidating. Your hiring funnel is something you really want to optimize, and many of these companies don't seem to be paying much attention to doing that at all.

</comment><comment><USER3> I'd guess that it serves as a useful filter: Candidtes who find this sort of copy off-putting

> NOPE NOPE NOPE NOPE

will immediately turn away, and a candidate who is wholeheartedly excited by it will feel encouraged to apply. I can't imagine a lot of middle ground.

<comment><USER4> I remember reading an interview of Apptimize's CEO [0] and got the impression that she must be someone very energetic but also tough and demanding from her employees. Somehow this job post confirms my impression, and it seems she wants to work with people like her.

[0] [http://www.femalefounderstories.com/nancy- hua.html](http://www.femalefounderstories.com/nancy-hua.html)

</comment></comment><comment><USER5> I got sucked into reading another YC startup job page over the weekend and that got me looking at even more (these are not something I would normally read). Over all I am shocked that any of these unprofessional tactics work at all. The one that caught my eye over the weekend had the following as an application and interview process:

\-- 90 minute at home development challenge.

\-- 3 day on site hackathon with other potential job candidates working on this organizations own API.

\-- 2 day "Team Pairing" work on site at this companies office, on real production code. If, of course, you pass the hackathon.

This and the OPs example are certainly not the only startups in these YC batches who show a lack of professionalism when trying to hire. Most companies tout their teams, their environments, their benefits, and their perks. I enjoy working with startups almost as much as I enjoy starting them. But how is it that we have stooped to this unprofessional low when trying to hire new engineers into our startups? Who would respond to these or jump through these types of hoops?

<comment><AUTHOR> To be fair, I do think that a small project is a better indicator of a potential candidate's success, but doing that much work for free is a big red flag as well.

</comment></comment><comment><USER6> My first thought when I saw this was "NOPE NOPE NOPE NOPE".

</comment><comment><AUTHOR> From [http://apptimize.com/company/jobs](http://apptimize.com/company/jobs)</comment>


Ask HN: Do you think the world is really overpopulated? - <AUTHOR>

I'm watching YouTube in Google Maps, and I conclude that the kindergarten rhyme is correct. "it's a small world after all."
Which kept me thinking, are we overpopulated enough? Because
- I see places that needs improving, and the earth definitely needs our technology, to manage and improve it's resources, in areas of farming, biology, food, distribution, livelihood and even on the common streets.
If we are overpopulated, then we need to improve people's education, in a manner that they are provoked to improve things, using technology, etc.. Then if they are distributed on different areas, they can do their thing, use technology and systems to improve the earth.
This we're just some thoughts I have, some puzzle, etc.. anything goes, but if you have some comments, feel free to say, it matters a lot to me... <comment><AUTHOR> If there's anything needs to be improve on the earth, it's the design and usability of the environment.

Like we don't see the synthesis between structures and plants, we don't see systems that improve the life of the plants synthesized on human structures, thus we can't sustain them on the penthouses of our buildings because as simple as giving them water systematically is not designed, thus people water the plants manually, which is not sustainable..

</comment><comment><USER2> In my opinion, the world is not over populated - that in itself is just wrong. I say this because we're screwing up the planet in all sorts of ways, the population size itself, only increases the speed at which we accomplish that.

That said, we don't have any real form of population control besides natural disasters. Which isn't really effective in the long run.</comment>


The Strange Grief of Losing My Sense of Taste - <AUTHOR> https://www.nytimes.com/2020/09/06/opinion/coronavirus-covid-symptoms-taste.html <comment><USER2> "By August, we were sick."

I realize doom and gloom is the new black, but could we at least wait a few months before declaring an end to the universe?

Grant Achatz was ready to end it all over a decade ago, and it's a few million X more likely I will get Covid than face what he did.

People are terrified enough. Thx.

</comment><comment><USER3> I might welcome losing sense of taste. Would help with weight control I think.

<comment><USER4> Euler remarked on his loss of vision, "Now I will have fewer distractions."</comment></comment>


Twitter discloses bug that cached private files sent or received via DM - <AUTHOR> https://www.zdnet.com/article/twitter-discloses-firefox-bug-that-cached-private-files-sent-or-received-via-dms <comment><AUTHOR> > Private files sent via DMs were cached inside Firefox browsers for as long > as a week, even after users logged off.

Note that it was Firefox only. I use Twitter on mobile Firefox (iOS) and was informed with this page:

[https://i.imgur.com/41NbgeO.png](https://i.imgur.com/41NbgeO.png)</comment>