To Keep Passwords Safe from Hackers, Just Break Them into Bits - <AUTHOR> http://www.technologyreview.com/news/429498/to-keep-passwords-safe-from-hackers-just-break/ <comment><USER2> Mozilla also uses a 2 server approach for passwords on their web apps but instead of splitting the password, they introduce an initial HMAC hash stage using a salt that is stored on a web app machine and then rehash that with Bcrypt for storage in a database on a separate machine.

"If an attacker steals one of our password databases, they would need to also separately attack one of our web servers to get file access in order to discover this local salt value. If they don't manage to pull off two successful attacks, their stolen data is largely useless."

[http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about- pa...](http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-password- storage/)

They have an implementation for Django (ignore the project name, it's a legacy name): <https://github.com/fwenzel/django-sha2>

Their implementation makes it trivially easy to expire HMAC keys and silently upgrade users to new HMAC keys.

</comment><comment><USER3> The number one problem with passwords is that most websites are not storing them using current state-of-the-art methods that are freely available. Whether or not this is an improvement, it doesn't solve the actual problem - developers aren't going to suddenly start using this if their current method is md5(password).

That said, it does sound quite interesting from a crypto geek perspective.

<comment><USER4> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. That is how the web actually is already, and it is unlikely to change any time soon.

<comment><USER5> >> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites.

I don't follow you. In the first sentence, the "we" is developers of web sites, right?

Who is the "we" in the second half? Who are you suggesting should assume developers will make mistakes, and what can/should be done to mitigate that?

One possible interpretation is that the second "we" is users, and as a user, yes, I do assume that sites will make mistakes. One reaction is not re-using passwords. But if the user and the site are both naive, I don't see who is left to keep the wolves out.

<comment><USER4> Sorry my comment was inarticulate. I am arguing for a collective sense of mistrust regardless of who you are.

</comment></comment></comment></comment><comment><USER6> It seems like this relies on an attacker being able to compromise one machine, but not another. Given that these machines are supposed to be quite similar (they're both password databases running the same software), what makes that a reasonable assumption?

<comment><USER7> The article suggests that the two machines could be running different operating systems and be placed on different networks/locations to reduce the chances of a single attack compromising both systems.

<comment><USER8> It seems really unlikely that any of these leaks has been due to a security flaw in the operating system. I'd think that even in this scheme if an admin account or authentication process is compromised, then the attacker's going to have access to both password stores.

<comment><USER9> Well, no, because it's a write only model. If the admin account becomes compromised there is no way to read the passwords back. That is of course unless you have root access to both machines, in which case the password can be salted + hashed and then split and stored.

</comment></comment></comment></comment><comment><USER10> Why is something like bcrypt not adequate? The article seems to imply that bcrypt could be reversed, but I thought this wasn't the case (with a proper work factor).

<comment><USER11> Bcrypt slows down a brute force attack considerably, but cannot prevent one. If your password is one of the top N passwords in use, then a determined attacker can still break it. For example, if you set your work factor such that it takes 1 second to verify a password using bcrypt on login to your server, then if your password is in a dictionary of the top 100k passwords, an attacker could get to it within (about) a day using equivalent hardware. Using more specialized (or just more) hardware of course drives it further.

<comment><USER10> Good point, I didn't think of that.

</comment></comment></comment><comment><USER12> This sounds a lot like the last level of capture the flag 2.

<comment><USER13> The security flaw highlighted in Stripe CTF2 was that you could check the validity of each independant chunk independantly of the others, which meant reducing the search space for bruteforce attacks.

From what I understand, the technique proposed here would mean you cannot say anything about the validity of just one chunk: each server apply some operation on the password it receives and the chunk it stores, and all these operations have to be combined to say if the password was valid or not. If it's not, you cannot know which chunk was invalid.

</comment></comment><comment><USER14> _These would have to happen in short order, too, because the system periodically refreshes which random half of the snippets of a password are stored on each server._

How long would it take for one of the servers to see every piece of the password, on average? If it's not prohibitively long, and you can silently compromise the server, you could just wait.

Alternatively, how does it decide to refresh, and how does it decide which pieces to redistribute? If there's some way to attack that mechanism, perhaps you could cause it to refresh faster, or maybe even control the distribution process.

<comment><USER15> > How long would it take for one of the servers to see every piece of the > password, on average?

Strong secret sharing schemes are secure against this kind of attack. The schemes are designed so that you cannot infer any information about the original secret from any of the pieces. That holds even if you get a single piece from each of multiple independent "splits" of the same secret.

Some examples of such schemes are on Wikipedia and they fall into the "simple but clever" category: [http://en.wikipedia.org/wiki/Secret_sharing#Trivial_secret_s...](http://en.wikipedia.org/wiki/Secret_sharing#Trivial_secret_sharing)

</comment></comment><comment><USER16> Assume some perfectly secure method of storing passwords existed. Attackers would be forced to shift to compromising them at the point of entry -- i.e. modify code or scrape memory to capture them at the point they are entered on the site.

An improvement (they have to be in motion, not at rest), but not a panacea. The problem is passwords... yeah, easy to state, hard to fix.

</comment><comment><USER15> "Breaking into bits" suggests something about this technique that is not accurate. It does not rely on splitting bits, as in computing n bits and sending each of the n/2 bit halves to different servers.

It is closer to hiding one bit by flipping a coin and sending the bit xor-ed with the result to one server and the result of the flip to the other.

</comment><comment><USER17> Let us not forget an important factor here, don't do things like hashing using SHA-1. While this system sounds awesome, researching common best practices for password storage takes about 2 minutes.

</comment><comment><USER18> I'd added a link and some notes as a comment on a related post here: <http://news.ycombinator.com/item?id=4636655>

Here is a link to an article with a few more details about the technique being used.

[http://productsecurityblog.emc.com/2012/10/split-value- crypt...](http://productsecurityblog.emc.com/2012/10/split-value- cryptographic-authentication-building-advanced-threat-resistant-software/)

</comment><comment><USER19> > attackers have a range of tools that can reverse this encryption

if attacks have a whole range of tools to reverse the "encryption" it either means whoever was in charge of of security is stupid or their attackers have secret or magic weapons

</comment><comment><USER20> Open source threshold crypto project [http://www.utdallas.edu/~mxk093120/paillier/index.php?go=hom...](http://www.utdallas.edu/~mxk093120/paillier/index.php?go=home)

</comment><comment><USER21> Instead of storing half of the bits on a server, why not store them on a smartcard, usb drive, or other physical device, to introduce 2-factor to this system?

<comment><USER4> Or even make a cookie value part of the mix. The cookie could be from another domain and only accessible through a javascript API on the browser.

</comment></comment><comment><USER22> Security by obscurity never works.

<comment><USER23> Security including obscurity works fine. There's nothing wrong with using it as a component, it just can't be the sole defense.</comment></comment>


IQ Scores Falling - <AUTHOR> https://www.sciencealert.com/iq-scores-falling-in-worrying-reversal-20th-century-intelligence-boom-flynn-effect-intelligence <comment><USER2> Bah!! People are letting their kids be educated and addicted to the gaa-gaa box. Brought up without a loving family environment; with overly busy, disinvolved parents - the reasons for the incomplete development of modern children are obvious.

</comment><comment><USER3> It's likely (60-85% confidence interval) that although there is enrichment in adolescence that is more sophisticated and detailed compared to previous generations, the lack of meaningful social mind-sharing environs results in a lack of learning crucial mirror-neuron based skills. The screen is warm and cozy, the screen is not so overwhelming to my receptors as social interaction. In a way, our technological prowess is making us perceptual softies, when we should be striving for more full-consciousness experiences.</comment>


Taskfit Public BETA improving personal productivity awaits testers - <AUTHOR> http://www.taskfit.com <comment><AUTHOR> Tired of multitasking? Had enough of chaos? Longing for an organized work environment? Download Taskfit BETA, the desktop app for small businesses and freelancers helping enhance personal productivity. Start cleaning up the mess in your life!</comment>


Introduction to the a* Algorithm - <AUTHOR> https://www.redblobgames.com/pathfinding/a-star/introduction.html <comment><USER2> This is a very nice introduction. Well done.</comment>


Ask HN: Why does my computer make a faint high-pitched whistling with pandas? - <AUTHOR> My computer is a Microsoft Surface Book 2. When I run mean() on a dataframe with 25k rows and 2 columns I can hear a two successive faint high-pitched whistling that start audible and become inaudible after a second. If I comment out the mean() call I do not hear anything. <comment><USER2> Your CPU draws spectacular transient currents across inductors and capacitors inside your laptop, and these components are or can be microphonic, to varying degrees depending on design and manufacturing variance. Sometimes you can make it stop by disabling all the power saving and performance-boosting features so your CPU runs at the same speed and power all the time. This has a major cost in terms of battery life.

</comment><comment><USER3> Because Pandas makes the Baby Jesus cry.</comment>


e^19709930078 = 0xdeadbeef… - <AUTHOR> http://hardmath123.github.io/a-balance-of-powers.html <comment><USER2> This might get more traction with a less obscure title.

<comment><AUTHOR> Possibly, yeah. Do you have a suggestion?

<comment><USER3> "Pursuing the truth through diophantine approximations"? (some click-baiting is never that bad if the article is good !)</comment></comment></comment>


25 Years After Junk Science Conviction, Texas Admits Sonia Cacy's Innocence - <AUTHOR> https://theintercept.com/2016/11/04/25-years-after-junk-science-conviction-texas-finally-admits-sonia-cacys-innocence/ <comment><USER3> This is something I find extremely scary, because an unusual series of events (accidental fire, accidental drowning, suicide) could be framed to look like something entirely different (arson, murder), which could drag any one of us into a nightmare. If you don't have the money to hire your own experts and a strong legal team, potentially bankrupting yourself, you are at the mercy of a motivated prosecutor with nearly unlimited resources.

In 2009 a scathing report was released by the National Academy of Sciences that essentially says that blood spatter, handwriting, hair, fingerprints, and bite mark analysis are all junk science[0]. If two "experts" can look at the same evidence and come to entirely different conclusions, how is this science? It's opinion wrapped up as scientific fact. Who knows how many people are innocently convicted. It's terrifying.

An excerpt from WikiPedia about hair analysis:

 _The outcry from defense attorneys has forced the FBI to open up on disputed hair analysis matches since 2012. The Justice department began an "unprecedented" review of old cases involving hair analysis in July 2013, examining more than 21,000 cases referred to the FBI Lab's hair unit from 1982 through 1999, and including as many as 27 death penalty convictions in which FBI experts may have exaggerated the reliability of hair analysis in their testimony. The review is still in progress, but in 2015, it released findings on 268 trials examined so far in which hair analysis was used. The review concluded that in 257 of these 268 trials, the analysts gave flawed testimony that overstated the accuracy of the findings in favor of the prosecution. About 1200 cases remain to be examined._[1]

[0] [http://www.nytimes.com/2009/02/05/us/05forensics.html?pagewa...](http://www.nytimes.com/2009/02/05/us/05forensics.html?pagewanted=all)

[1] [https://en.wikipedia.org/wiki/Hair_analysis#Microscopic_hair...](https://en.wikipedia.org/wiki/Hair_analysis#Microscopic_hair_analysis_in_forensics)

<comment><USER4> Something I really _don 't_ understand about the American system (I'm British) is why _anyone_ could possibly think it's a good idea to make Prosecutors and Judges elected offices!

The whole "tough on crime" narrative is toxic when it plays into electoral politics because it gives prosecutors an incentive to pick fights they know they can win (targeting vulnerable people with limited resources to hire an effective defense) and it rewards judges for portraying themselves as the vengeful defenders of the wronged by imposing unduly harsh sentences.

Seriously? Other countries do just fine with prosecutors and judges who are unelected civil servants, and don't seem to have quite the same track record of excessive victimization of the vulnerable.

<comment><USER5> In the United States, we do things a tad differently. The Federal government here is not a government of general jurisdiction. It operates on the principle of a social contract which reserves powers not specifically given to the Federal government to individual provinces.

While this principle is far degraded these days, election of state officials is still fully reserved to the states. Many states have decided that judges are best chosen through election, and their constituents permit such action through the democratic process.

In the Federal system, judges are appointed by the executive. Following the same reasoning as you, Hamilton noted in the Federalist Papers, a series of editorials published anonymously which outlined the reasoning that shaped the constitution, that the executive appointing judges was the best method, because the executive lacks the power of both the "purse and the sword."

Only when states act so egriously as to breach the United States Constition, rather than state law, does the Federal government step in. Our most serious problem is that we generally cannot sue law enforcement officers, prosecutors or judges due to sovereign immunity, which provides almost absolute protection from civil suit.

I believe we inherited "sovereign immunity" from a rather incorrigible previous government. They believed that some sort of divine mandate somehow exempted their highest government official from the law, a particularly absurd idea which has had rather unfortunate consequences for several billion people.

<comment><USER6> Funny that you should mention the system in what was then Great Britain; the Constitution of the modern U.K. and its antecedents in English law are very much part of a live constitutional crisis in the question of the power of the executive versus the power of the legislature.

The ruling below contains in it an extremely fair overview of some of the issues you mischaracterize in your last paragraph. I think it's understandable that you got it wrong; comparative constitutional law is not an especially popular thing, and there are further reasons I'll return to below.

Two of the most senior judges (by rank) in the UK and likely the most highly regarded (by the legal profession generally) public law judge, wrote this ruling that was handed down Thursday. The judges are also justices of the Supreme Court of the United Kingdom, which will hear the appeal, although nobody seriously expects that the UKSC will overturn the judgment unless the parties agree to ask the Court for permission to consider some matters listed in the judgment as "common ground" as in dispute. The parties are the national executive (through a head of the new department for exiting the European Union) and a mechanism which allows public interest cases to be brought against the government by concerned citizens and residents; several individuals are effectively the true claimants.

I'm going to make references to several numbered paragraphs in the ruling, which you can read in full here. Unfortunately the source-text-with-markups version is not yet online, but that will follow in due course as is general practice. The parties agreed that drafts of the rulings would not be made in advance because of the risk of leaks that might harm either party's interests, and that they would agree to a true copy that would go online first, so that there could be no question about the exact wording of the ruling, because the matter was (and is still) virtually certain to be considered by the Supreme Court in December.

[https://www.judiciary.gov.uk/wp- content/uploads/2016/11/judg...](https://www.judiciary.gov.uk/wp- content/uploads/2016/11/judgment-r-miller-v-secretary-of-state-for-exiting- the-eu-20161103.pdf)

The judicial review of executive authority is not novel; this judgment refers (at paragraphs 26, 27, and 28) to case law established in the 17th century.

Just prior to the American Revolution the "Intolerable Acts" complaints made frequent reference to the English Bill of Rights (1688) and most of the American leadership made it abundantly clear before the Revolution began that the unrest was founded in their desire to protect their rights as Englishmen.

What was eroding their rights was not the monarch (again, this was established in the civil wars of the 17th century, and the Glorious Revolution (judgment, para. 26)) but factional politics in the British Parliament. Rival factions were vying for power, and the largest groups coalesced around Frederick North and Charles James Fox. The former was strongly supported in the countryside by rich land owners (with their wealth being generated by tenant farmers) and professionals, merchants, and other cityfolk in the urban centres of the day. As is common even today, the "country" party was highly conservative both socially and economically, while the "city" party was keen on progressive reforms to governance, extension of the franchise, and -- crucially -- equity for Englishmen living outside England. The economic conservatives were trying to preserve the balance of accounts available to the government in the ongoing war with France and its allies and a few other parties (the Seven Years War, which in U.S. history lessons tends to be called the French & Indian War) and were hostile to spending money garrisoning the western frontier of the colonies unless paid for locally, and they were thus intractably opposed by interests in the colonies that favoured expansion Westward into the river valleys that had been won from France, but knew there would be violent opposition by the people already living there who had been France's allies.

The Foxite Whigs were very close with many Americans, especially Benjamin Franklin, and were keen on breaking deadlocks in the British parliament on this and other common matters. They essentially propagandized against the Northites' insistence that the elected legislatures in each of the colonies was the appropriate venue for discussing grievances and raising petitions to the North-led government, with Charles James Fox himself proposing a system whereby Englishmen living in the colonies could elect Members of Parliament directly without owning land directly in metropolitan Britain and without being physically present to cast a ballot. The Northites were intractably opposed to this, as the Colonies would almost certainly provide the Fox faction and its allies a clear and possibly even huge majority in the House of Commons.

The only way the King was involved at all is that he stupidly -- or perhaps because of the porphyria which clouded his mental faculties from time to time, sometimes seriously enough that he went through periods of being called "mad" \-- was playing favourites in pressing North to choose personal friends to head up government departments. He even more foolishly pressured North to formally recommend the appointment of a handful of his favourite courtiers as (mostly, but not wholly, ceremonial) colonial governors.

However, that was essentially a Revolution-enabling error of judgment: Fox and Franklin exchanged letters agreeing that because enough non-Englishmen were living in the colonies, and had moved there to escape actual tyranny by properly absolute monarchists -- especially in the German states -- they should caricature the conflict as between Colonists and the King rather than political factions jostling in the elected House of Commons, and engage them as allies in the escalating political conflict, especially as outright armed rebellion seemed likely. (There was of course a substantial history of armed rebellions just prior to the English Civil War, and riots and other civil disturbances in London in economic downturns as the one caused by the expense of the Seven Years' War and preparing for the likely resumption of hostilities with France, Spain and the Dutch Republic).

George III was also the monarch of a German state (Hannover), and that was used to further convince immigrants -- especially German ones -- to support the Revolution. The North government's decision to hire mercenaries from Hesse-Kassel and other German states rather than draw down on reserves of British soldiers -- it was essentially a cost-saving measure, and was quietly opposed by the King because it significantly enriched German princes that were in competition with his family's interests -- played right into that characterization. (cf. Franklin's 1777 work, "The Sale of the Hessians").

So, the "sovereign" was at the time Parliament, and it was too factionalized to protect itself from challenges in the courts, and that somewhat stayed the hand of the North government -- and especially George Germain and the Earl of Sandwich, who were the government officials in charge of dealing with the rebellion in the Thirteen Colonies. However, it did in 1773-1774 make it even more difficult to bring a lawsuit in a court against the government, so to some extent you are right that 'sovereign immunity' was in play, although not especially successfully. Had open warfare not broken out, it is very likely that the North government would still have collapsed (resulting in a series of uneasy coalition governments), that the Court of Appeal would have held that the ex parte cases for relief against the British executive were in fact valid (the British government mostly defaulted, deliberately, on several court actions brought by Americans).

Additionally, one of the live constitutional issues -- especially in Massachusetts -- was the primacy and authority of the executive of Britain backed by the British parliament over the legislative assemblies of the colonies. The Northites and their country-conservative allies were already losing ground, with Parliament taking powers from the British executive and delivering them to executive councils and legislative councils i many colonies, starting with the Québec Act (1774).

Essentially the American Revolution was triggered by ineptitutes and reactionary decisions taken by a weak proto-Tory government in a very divided Parliament during a brief pause in a world war and in a period where trans- Atlantic trade in raw materials was crucial to their pressing economic needs. (By 1780, the British were again in active warfare, and without allies, against five European powers, with fighting on four continents; they chose to stop fighting in the American Revolution rather than risk losing possessions elsewhere, especially the sugar and rubber plantations they controlled and were fighting to protect from the Spanish and Dutch).

It was the failure of a government which barely controlled the elected House of Commons, and yet was unable to bring itself to share power - <USER2> temporarily and tactically - with other factions both in England and in the English colonies.

<comment><USER5> That's a lovely bedtime story for children at Old Exeter, ending with a British strategic withdrawal rather than humiliating defeat, but we prefer to teach actual history on this side of the pond.

I think you're very confused about what sovereign immunity actually _is._ Sovereign immunity, also known as crown immunity, is the common law right of the monarch not to be sued, from which judicial and investigative immunity descend. My comment had nothing to do with the American Revolution, except to note that the British imposed this terrible concept across their now-defunct empire.

<comment><USER6> Willion v Berkley(1561) 1 Plowden 223, 75 ER 339 (K.B.), "[it is a] difficult argument to prove that a statute, which restrains men generally from doing wrong, leaves the King at liberty to do wrong" (Brown J), with Dyer CJ concurring.

Bracton, De legibus et consuetudinibus Angliae (c. 1235): "Quod Rex non debet esse sub homine, sed sub Deb et Lege".

Case of Ecclesiastical Persons (1601) decided in Parliament, "the king is bound by act of Parliament although he not be named in it, not bound by express words; and therefore all statutes which are made to suppress wrong, or to take away fraud, or to prevent the decay of religion, shall bind the King."

1615) 11 Co Rep 66, 72a, 77 ER 1235, Crown immunity from statute is confined to what in modern terms is the Queen's Consent and the Prince's Consent, and that there is no immunity from judicial review except with respect to the monarch personally (i.e., it is a personal protection rather than a corporate one).

Pawlett v Attorney-General (1688) Hardres 465; 145 ER 550, while consent of the monarch (sua sponte or under formal ministerial advice) is required for suits claiming money judgments against the monarch personally, equitable remedies against the Crown do not require consent.

Pawlett remained the law of England through the American Revolution.

Even though there has been statutory reform recently, this is still reflected in English law, and is one of the reasons why the recent headline constitutional case was listed as R. (Miller et al.) v the Secretary of State for Exiting the European Union.

Canadian law, incidentally, developed differently in the 19th century, and so it would have been listed as Miller et al. v The Queen of Canada.

Indeed the British badly mishandled the fighting in the American colonies, however that doesn't make your claims about the legal system of what was then Great Britain was correct, and your recent argument on that front is not supportable in English law of the time (and Scots constitutional law was not effectively in play during the American Revolution). Neither could whatever developed in the British empire after the Revolution was settled.

</comment></comment></comment></comment></comment></comment><comment><USER7> > In an exceptional move by the notoriously conservative panel, the BPP agreed > that Cacy should be paroled, just six years after she was convicted.

She served 6 years before parole, not 25 years behind bars

I'm far more concerned with Cameron Todd Willingham. Governor Perry had this evidence, that much of the state evidence being used was junk science, and did nothing while an innocent man was put to death. Shameful.

<comment><USER8> The amount of junk science we allow in American court rooms is truly alarming.

I wish more people knew about the case you're reference. Here's an excellent article:

[http://www.newyorker.com/magazine/2009/09/07/trial-by- fire](http://www.newyorker.com/magazine/2009/09/07/trial-by-fire)

And here's a good description about how it's quite common for a "fire expert" (which may simply be a normal firefighter) to misclassify an accidental fire as arson, implicating innocent survivors as murderers:

[https://californiainnocenceproject.org/issues-we- face/fire-i...](https://californiainnocenceproject.org/issues-we-face/fire- investigation/)

<comment><USER9> I also have been thinking of other examples. Imagine someone sued a vaccine manufacturer claiming that the vaccine cause autism. Imagine also that years later it turns out that vaccines can "cause" autism, but only in case of things like leaky gut. Was the court and legal system designed for cases like this?

<comment><USER10> > Was the court and legal system designed for cases like this?

Yes. There's even a law that sets up a _specific_ court with special expertise and powers in vaccine cases. [https://en.wikipedia.org/wiki/Vaccine_court](https://en.wikipedia.org/wiki/Vaccine_court)

<comment><USER11> The fact that vaccines have their own court specifically specified by law suggests that the legal system is not designed for that type of case, and special provisions needed to be added to handle the more common instances.

<comment><USER10> So the legal system's ability to adapt as necessary is thus evidence of the legal system's inability to adapt? OK?

<comment><USER11> The legal didn't adapt in this case. The legislative system applied a patchwork fix. Further, the fix is narrowly narrowly tailored to vaccines, meaning that the legal system is still not equiped to deal with the same kind of issue if it does not involve vaccines.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> "Expert" witnesses for US courtrooms is a special kind of a parallel voodoo- science world. Especially when it comes to arson.

Prosecutors like to pick the same people to testify as "experts" and their top qualification is that they have testified before as "experts". I imagine many have optimized putting up an act and throwing around fancy terms to make it seems really precise and scientific. Their future employment depends on that.

<comment><USER13> In civil cases, where both parties often have a significant budget for hiring experts, the experts often actually are top people from their fields but who are retired.

I watched a patent trial, and an important part of one of the claims was that certain data from a hard disk was cached in a RAM cache.

The side that wanted to see the patent invalidated brought up some earlier patent that involved caching some data on a hard disk, and claimed it was prior art that should have been considered. Their expert said that "RAM" stands for "random access memory", and a disk is random access and it is memory, so that any programmer or engineer who read the patent that called for using a RAM cache would understand that caching that data on a hard disk would count.

That, of course, was one of the most ridiculous things I'd ever heard. However, the expert certainly was a real expert. He was a professor emeritus and former head of the computer science department of a top CS school. In fact, he had been the one who _started_ the CS program there and brought it to its position as a top program. He was a fellow of the IEEE, and his published papers back from when he was an active researcher were some of the seminal papers from the beginning of the modern semiconductor and VLSI era.

So how the hell did this guy think that "RAM cache" is commonly understood to include a cache stored on a hard disk?

I asked the lawyers for the side that was defending the patent, and their expert (another retired professor emeritus, IEEE fellow, yadda yadda...) about that. They explained to me that experts in a trial like this will get paid $50-100k or more to testify in this kind of trial. They basically have to just spend a few hours reading a patent, and then come up with an argument for the side that is paying them that will sound good to a jury and that is not provably a lie. Then they have to come and spend maybe a week at the trial location, being there to help the lawyers out and to spend maybe an hour on the stand. So basically $100k for a couple of weeks of not too strenuous work, two plane trips, and a week in a hotel.

They don't have to worry that colleagues will find out about the dumb things they said at trial and hold it against them or that it might tarnish their legacy or reputation, because everyone in the field knows about these expert witness gigs. When they hear that Professor Soandso said something really stupid about RAM cache at a trial, they just think, "Oh...I guess Professor Soandso wanted a new RV" or "Professor Soandso wanted a new boat". (In the case of the expert for the patent owner, it was to be one of the earliest to own a Tesla).

<comment><USER14> I think you're being too uncharitable to the expert. It sounds like his point was that caching on disk is _conceptually similar_ to caching in RAM, and that therefore, for purposes of prior art, you should probably list inventions that cached in this (similar) way. IOW, an engineer reviewing the literature should have included inventions that cached on disk if they were otherwise similar.

Remember, prior art is intended to demonstrate the extent to which your idea is new. It makes a big difference whether the inventor thought of caching _at all_ vs whether they just used an existing caching scheme and swapped out the implementation for a faster one.

Posters on HN make a big deal about obvious patents being granted because someone took an existing invention and added "...on a computer/the internet". Well, it's a similar problem when someone takes an existing mechanism and says "... but on a faster storage medium instead".

</comment></comment></comment><comment><USER15> Similar junk in the UK has put many innocent parents away for "shaking baby syndrome" just based on a theory, not proven by scientific evidence. Expert witnesses who don't agree with the consensus establishment, have even been banned from practicing medicine, thus most now refuse to testify.

<comment><USER16> You might want to read the papers those banned doctors refer to, because the doctors often mangle the science.

Here's one case of a doctor who had been struck off by the GMC. The judge overturned that decision, but has maintained the ban on her acting as an expert witness because she mangles the science so badly.

[https://www.judiciary.gov.uk/wp- content/uploads/2016/11/squi...](https://www.judiciary.gov.uk/wp- content/uploads/2016/11/squier-v-gmc-protected-approved- judgment-20160311-2.pdf)

</comment></comment><comment><USER17> The nightmare is also that in some countries, when the police knocks on the door to arrest you, you might get killed in a gruel archaic ritual called "execution" at the end, even if you did nothing wrong, just the odds were against you. Here in Germany I do not have to fear the police. If if the judges wrongly sent me to jail "for life", at least I'd have some hope that one day I can convince them they were wrong and get to freedom again.

<comment><USER18> > If if the judges wrongly sent me to jail "for life", at least I'd have some > hope that one day I can convince them they were wrong and get to freedom > again.

Is your German government any more able to restore your lost decades than my government is able to restore lost life?

For some crimes execution is unjust; for others it is just. It is just as unjust to allow someone who deserves death to live as it is unjust to execute someone who deserves life.

<comment><USER19> > It is just as unjust to allow someone who deserves death to live as it is > unjust to execute someone who deserves life

It's long been a general principle of criminal law, at least in the US, that convicting someone who is innocent is in fact more unjust than acquitting someone who is guilty. The sentiment has been expressed by Voltaire, Blackstone, Ben Franklin, and a good number of others, going back to at least the 18th century.

This is why (again in the US) conviction requires proof "beyond a reasonable doubt".

</comment></comment></comment><comment><USER20> The other case mentioned, the Willingham case is even more horrifying. A man was convicted of murdering his children and sentenced to death on bogus evidence. When presented with evidence to the contrary, the state of Texas under Rick Perry ignored it and allowed the man to be executed. This is state sanctioned murder of an innocent man. Why is the Governor not on trial for this?

</comment><comment><USER21> We need a pretext for what we want to do, which in America is to lock people up. If we can fool ourselves with something that sorta looks and smells like science, that fits the bill perfectly.

<comment><USER22> I don't think it's fair to say we "want to lock people up". We need to believe that we can make ourselves safe from criminals. We need to believe can do some science magic and tell the difference between the criminals and the regular people so we can sleep at night. Admitting we can't calls in to question the whole premise of locking the bad people up. A judge or politician can't come out and say, "we have no reliable way of deciding guilt or innocence." That is reality but we can't allow ourselves to admit it.

<comment><USER21> All I have to say is, look at our prison population vs any other country's.

</comment></comment></comment><comment><USER23> Is junk science in court rooms a root cause or just a symptom?

<comment><USER24> I always despite this question so much; mainly because everything is a cause of something and a symptom of something at the same time; there is nothing isolated in this world. So you have to give a lot of context to see if -in that context- it is a cause or an effect.

I'm this particular case you could say stupidity is the root cause, but saying so it's too abstract to be usefu/actionable.

</comment></comment><comment><USER25> This reminds me of a New Yorker article on the same topic (covering an even greater injustice, also in Texas -- in fact referred to in this article)

[http://www.newyorker.com/magazine/2009/09/07/trial-by- fire](http://www.newyorker.com/magazine/2009/09/07/trial-by-fire)

</comment><comment><USER26> Got a friend currently doing time in Texas for basically the same thing. Here's hoping this gets the case some notoriety. [http://thearsonproject.org/case-studies/curtis- severns/](http://thearsonproject.org/case-studies/curtis-severns/)

<comment><USER27> Wow. 27 years for burning down your business and claiming insurance, even when it doesn't kill or seriously injure anyone, and the value is only ~$200,000. Guilty or innocent, that's a completely obscene sentence!

How can anyone in Texas safely make an insurance claim for fire when the risk of misunderstanding is so great?

In this particular case, it all seems to hinge on people's opinions of whether a flying can could have jumped over some barrier or shot a plume of flame in some direction and other subtle details about the scene that can't possibly be known without actually reconstructing or simulating the whole thing.

</comment></comment><comment><AUTHOR> Somethings the main qualification of some so-called experts is a certification from a 6-hour or 6-week class. From then on, they are eligible to testify as an _expert_ in serious criminal cases.

</comment><comment><USER28> Question is: what is considered 'junk science' at the time it was used in court?

Because I'm sure we are using some 'junk science' we just don't understand at the present time.

</comment><comment><USER29> Gerald Hurst and Chris Connealy are true heroes.

</comment><comment><USER30> Making a Murderer season 2

<comment><USER31> Except this person appears to be innocent.

<comment><USER32> Uh, the whole point of making a murderer was to show that he could potentially have been innocent as well.

</comment></comment></comment><comment><USER9> Anti-discrimination laws are even worse in that discrimination can happen with no evidence at all. One of the methods used to enforce them (particularly in things like hiring) is statistics, most of which assumes employees are interchangeable commodities. They were designed back in the 1960s for things like manual labor jobs. I am willing to suggest a compromise to limit them to these kinds of jobs.

<comment><USER33> I think you meant to reply to a different post.</comment></comment>


Are TLD's Necessary? - <AUTHOR>

Seeing things like http://to/ and Tim Berners-Lee apologizing for the slashes makes me wonder about top-level domains. Would it be feasible for urls to look like http:google rather than http://google.com, or are TLD's necessary for nameserver load balancing or something? <comment><USER2> I'm not sure what TLDs have to do with slashes or vise versa.

<http://to/> is using _only_ a TLD, it's not that it doesn't have a TLD.

Many of the URL components are optional and if not specified designate relative URLs to be filled in with parts from the base URL. For example, if all your internal URLs in a document are //domain/whatever, that is they don't specify a protocol, then the page is completely viewable on both HTTP and HTTPS protocols without having the browser indicate mixed security contexts. Without the double leading slashes indicating the hostname, you'd be unable to recognize that a URL is relative to the protocol vs relative to the dirname of the current document. In the same way, http:/file fills in the hostname from the current base URL.

TLDs don't really mean much technically, they were created for human consumption. There may be load balancing issues that are made easier because of TLDs, but it's not technically a requirement. On your own name server, you can create a zone that ends with anything (try it).

There have been recurring attempts/suggestions to get rid of TLDs, somewhat as a response to the needlessly ever-expanding TLD list, and somewhat as a response to break up the monopoly that exists in determining them ("If only more people could make their own TLDs, the world would be a better place, woes is us!"). More TLDs mean more costly trademark enforcement and continual attempts to corral different kinds of services/websites into predictable naming schemes (.xxx, .sex, .travel, .biz, and the super-stupid .tel, .name, and .mobile) -- people have specifically been against .xxx or .sex TLDs with the argument that it would be easier to convince law/policy makers to _force_ people to use them for adult sites and thus limit free speech, for one example.

I don't really mind TLDs, I'm not convinced that lack of TLDs would be any kind of significant win. In the same vein, I don't like San Francisco's apparently random street numbering scheme and fake grid system (random streets that run for a block start at 0, no matter what the surrounding addresses are, or a single block is bounded by different address ranges (check out the block that Sanchez Elementary School is on [http://maps.google.com/?ie=UTF8&hq=&hnear=San+Franci...](http://maps.google.com/?ie=UTF8&hq=&hnear=San+Francisco,+California&ll=37.763442,-122.429543&spn=0.003728,0.005944&t=h&z=18) this block is bounded by the 300 and 400 on the west and east, and 3400 and 3700 on the north and south), which disturbs this boy's sensibilities being a nerd who grew up in Chicago, which is on a strict grid system), but I'm not going to suggest that it change either.

<comment><AUTHOR> I realize <http://to/> is a TLD and slashes don't really have much to do with TLDs; they just got me thinking about URLs in general. Relative URLs with the protocol specified is something that hadn't occurred to me before. Thanks!

One question- I'm not too sure how a DNS lookup works from start to finish, but creating your own arbitrary zones wouldn't work for most people, would it?

<comment><USER2> Well, you'd do that for internal purposes. Anyone could set one up, so in that sense it would "work" for most people, but it wouldn't resolve for people who don't use the name server that the zone is setup on. I can see a use for it, but I think it's easier, conceptually, to create a private subdomain within an already established and registered publicly accessible domain and limit its access with views (a capability/feature of ISC bind (and perhaps others) where different zones are made available based on the source address of the DNS query).

The .local TLD, which is where zeroconf/rendezvous hosts end up is a standardized example of that. It is resolved not via regular name servers, but rather a network-segment limited distributed broadcast (an oversimplification), however.</comment></comment></comment>


File format wiki - <AUTHOR> http://fileformats.archiveteam.org/ <comment><USER2> I worked in video games reverse engineering for several years, so I'll take the occasion to quote a recent tweet from a friend/colleague of mine:

> _At HandmadeCon @mike_acton brought up the game data format problem. I 've > reverse engineered hundreds of proprietary formats from games, and he's > right that all I would need to make things simple is a basic description of > the file data. Just struct declarations are enough. No encryption has > stopped me, I always find the data I need, and your data all has the same > general architecture, so there's no reason a game developer should be afraid > of the public knowing how their game's data is laid out. This zeitgeist of > closely guarding that information is doing you more harm than good — > moddability is a key feature of many successful games, and all modders want > is docs._

\--

There's a lot of other industries that could stand to learn from this. Reinventing the wheel sucks. Doing your own, proprietary thing in your corner, taking on extra maintenance work, extra work to modify existing tools to make them compatible with your own image/archive/whatever format... it all sucks and nobody wins.

<comment><USER3> Any good sources you'd use to get off the ground running with file format reverse engineering?

I have a couple small projects on the backburner at work that require me to reverse engineer file formats. I've been able to decode a few basic details out of the files by looking for patterns in a hex editor but the finer details are still escaping me.

<comment><USER2> I'm self-taught so I won't be much help there. The usual path starts with learning assembly. If you have skills in reverse-engineering the actual executables, reversing the file formats is as simple as tracing back what happens when the files are read.

It gets tougher when there are anti-debugging protections in place but that generally happens only in the video games industry.

If the format is simple enough though, you will be fine with a good hex editor and some pattern recognition.

<comment><USER4> Along with learning assembly, find an active project looking for help. I cut my teeth on deconstructing\modding Oni (see [http://wiki.oni2.net/ONCC](http://wiki.oni2.net/ONCC) for example) and it was great to have other people to bounce ideas off of.

</comment></comment></comment></comment><comment><USER5> FileFormat.info probably deserves a mention, given that has pretty much the same objective: [http://www.fileformat.info/format/a.htm](http://www.fileformat.info/format/a.htm)

<comment><USER6> Doesn't FileFormat.info already 'solve the problem'? What does the new wiki offer that FileFormat.info lacks, and which couldn't be added to FileFormat.info?

<comment><USER7> _You may not publish, copy, display, distribute, transmit, perform, modify, create derivative works from, or sell any Materials, information, products, or services obtained from this Site, except as otherwise expressly permitted under applicable law and as described in these Terms of Use. FileFormat.Info retains all right, title, and interest to the Materials._

</comment></comment></comment><comment><USER8> You can also help the Archive Team by running the warrior which archives websites that are closing: [http://www.archiveteam.org/index.php?title=ArchiveTeam_Warri...](http://www.archiveteam.org/index.php?title=ArchiveTeam_Warrior)

</comment><comment><USER9> A bit off topic, but I would like to know why did they choose mediawiki as a platform?

Under my limited experience working with wikipedia and wikidata I've seen it's not the best option to a) store structured data and b) edit the pages (markdown is, imho, much better for that).

<comment><USER2> Mediawiki is honestly the only option when it comes to _user-friendly_ wiki platforms.

[Last time I said that, someone recommended Moin. I hope this won't happen this time - Moin is a UX joke]

<comment><USER6> Dokuwiki's UI is fine. Also, what about TWiki/FOSSwiki?

<comment><USER10> I think it's hosted somewhere that has automated tools for installing common software, and Mediawiki is what you get.

</comment></comment></comment></comment><comment><USER11> This reminds me of the Xentax wiki: [http://wiki.xentax.com/](http://wiki.xentax.com/)

</comment><comment><USER12> Good share, but why is this Show HN? Did you create it? It's not new...... etc

</comment><comment><USER13> Has anyone an idea what happened to wotsit.org?

</comment><comment><USER14> To be honest, I expected a bit more from the site, considering its name. It is good, don't get me wrong, covering a lot of file formats, but you have limited it to things on your computer. For me, if it were an all inclusive wiki, you should expand it to include things like financial file formats. Banks tend to use formats like ach and edi (for example). Those formats are extensive and can get quite complicated, but their file specs are published and available. The site is a great start, but I would love to see it expanded to include anything file format related. Even having the most obscure formats will make the site more appealing to people as a reference. Sort of 'the place to go' for file formatting. Just my .02.

<comment><USER15> Then get editing.

</comment></comment><comment><USER16> Like many ambitious wiki-based projects, this site seems to suffer from lack of focus. Look at these pages:

[http://fileformats.archiveteam.org/wiki/Dendrochronology](http://fileformats.archiveteam.org/wiki/Dendrochronology)

[http://fileformats.archiveteam.org/wiki/Quantum_computer](http://fileformats.archiveteam.org/wiki/Quantum_computer)

[http://fileformats.archiveteam.org/wiki/TLD_.mobi](http://fileformats.archiveteam.org/wiki/TLD_.mobi)

[http://fileformats.archiveteam.org/wiki/Endianness](http://fileformats.archiveteam.org/wiki/Endianness)

How is any of these things a file format? Because the definition of a file format in the FAQ (<[http://fileformats.archiveteam.org/wiki/FAQ:File_Format>](http://fileformats.archiveteam.org/wiki/FAQ:File_Format>)) is so broad that it can be made to encompass basically everything. The manifesto that started this site is a rambling sermon that doesn't clarify anything in this respect: it just repeats "let's solve the problem" without even properly defining what the problem is.

There are also other issues. The classification scheme is often Procrustean and confused. Error messages were until recently mixed up with error detection codes, which conflates two different meanings of "error". Similarly FUSE shares a category with HFS+, even though the former is an API, and the latter a disk format; distinct things which just happen to share the name of "file system". The pages are rather short and consist mostly of lists of links. Given the above-mentioned lack of clearly defined scope, I suspect many pages seem to be created about topics just because they're in the news and/or just to have a place to put a link to a "neat" blog post: see for example <[http://fileformats.archiveteam.org/wiki/Facebook#Links>](http://fileformats.archiveteam.org/wiki/Facebook#Links>).

Last but not least, the whole site is rather ugly, and the logo is awfully non-descriptive of what it's supposed to contain; what am I supposed to do with this thumb, stick it up my arse?

It's a shame, really, because documenting file formats is a hard and valuable endeavour. But I don't think these people are going to do a good job of it.

<comment><USER17> Endianness is extremely relevant to file formats. The others certainly seem like irrelevant nonsense; "organic file formats"?

<comment><USER10> Archive Team is backing up DNA, just in case.

</comment></comment></comment><comment><USER18> Thanks for this. I write file parsers for language translation at my day job, so this could be a nice resource to have on hand.

<comment><USER2> Out of curiosity, are you familiar with Translate Toolkit? [https://github.com/translate/](https://github.com/translate/)

If you're not and are interested by it or in contributing to it, you should email me - I'll put you in touch.

<comment><USER18> I have not worked with the Translate Toolkit yet, but I'm a little familiar with a few of the tools. I'm always interested in learning or contributing where I can.

I currently work on a proprietary l10n/i18n system, so a lot of what I do is under an NDA. However, I'm slowly gaining traction in moving us, at least in part, to a more open model.

If you let me know your email, I will reach out.

<comment><USER2> My email is on [https://leclan.ch](https://leclan.ch) \- Translate was my previous job.

</comment></comment></comment></comment><comment><USER6> What is the name of your wiki?</comment>


'Finally, a virus got me': Scientist who fought Ebola and HIV reflects - <AUTHOR> https://www.sciencemag.org/news/2020/05/finally-virus-got-me-scientist-who-fought-ebola-and-hiv-reflects-facing-death-covid-19# <comment><USER2> _" Many people think COVID-19 kills 1% of patients, and the rest get away with some flulike symptoms. But the story gets more complicated. Many people will be left with chronic kidney and heart problems. Even their neural system is disrupted. There will be hundreds of thousands of people worldwide, possibly more, who will need treatments such as renal dialysis for the rest of their lives."_

There have also been reports of people in China with significantly reduced lung capacity even months after recovery. Still so many scary questions about the long-term effects of this virus, possibly the biggest ones being about the post-recovery immunity. How long does the immunity last and how encompassing is it?

<comment><USER3> There is so much we donot know about the long-term effects. It shocks me to Silicon Valley icons like Elon Musk, Paul Graham, and Justin Kan pushing to reopen and spreading conspiracy theories over building tools to understand the long term effects.

<comment><USER4> We know for sure that if we force Americans to stay at home, tens of thousands will kill themselves or be the victims of domestic violence as a result. An untold number of people will go hungry or become homeless. These are certainties. If you want to make a real cost benefit analysis (as opposed to a fear-motivated choice to stay inside), then provide some good data about the long term effects of covid19. Sorry, but saying "it could have terrible effects 5 years after you get infected" isn't good enough. Try again.

<comment><USER5> I'm all for proper cost benefit analysis of a lockdown, but the fact that you're asking for good data on the long term effects of a disease that is six months old shows me that you are not interested in it.

Any decision has to be made considering uncertainties. You either accept the risk or you don't.

BTW, this is what we know for sure can happen when you risk normalcy:

[https://twitter.com/jburnmurdoch/status/1258031434981392389](https://twitter.com/jburnmurdoch/status/1258031434981392389)

<comment><USER6> While the exact long term effects are obviously unknowable, we can make some reasonable predictions by looking at patients who survived similar viruses such as SARS and MERS.

<comment><USER7> No, you cannot. Regular colds are also caused by weaker coronaviruses, and leave no serious long-term consequences.

<comment><USER8> I don't know if you caught this, but I think that's exactly what the parent comment was driving at.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> How are people catching COVID-19?

It would be good to hear plausible scenarios of how people still catch it despite of masks and social distancing. There is something to learn from each story. And I see a distinct lack of focus on anecdotal stories of how people think they caught it. How the fuck are people catching this disease?

<comment><USER10> I expect mostly poor hygiene when it comes to touching contaminated things and faces. I basically can't go out in public without seeing someone with their mask pulled down to talk/eat/smoke. You should be sanitizing your hands every single time you don or doff a mask.

<comment><USER11> > I basically can't go out in public without seeing someone with their mask > pulled down to talk/eat/smoke.

Many countries that have lifted their lockdowns and are now requiring masks in the post-lockdown stage, require those masks to be worn only on public transportation or in shops. Overall, public-health authorities do not believe that people pulling down their mask in the open air to eat or talk on their phone, will significantly change the infection curve for the worst.

Let us remember that the public-health goal here is not to prohibit any and all behavior that could potentially, under very ideal circumstances, result in transmission. Rather, the goal is to institute a few general rules that will flatten the curve to the point where contact tracing is effective. People should heed their local authorities on what to do, but I am troubled by the moral panic where posters such the above are insisting on even more stringent behavior than required by the public-health authorities.

With regard to hand-washing, touching things is now seen as so relatively unlikely a form of transmission, that some countries which initially required supermarkets to provide gloves and hand sanitizer, have decided to lift that requirement (while keeping the mask requirement). Of course hand washing in general is a good thing, but authorities in many countries do not think that obsessively doing so will make a real impact on COVID-19 transmission rates across society.

<comment><USER12> > Overall, public-health authorities do not believe that people pulling down > their mask in the open air to eat or talk on their phone, will significantly > change the infection curve for the worst.

No. "Public health authorities" are all really clear: if you're going to wear PPE you need to do it properly. DIY cloth masks are not PPE, they're theatre, so it doesn't really matter whether you wear it or not.

> With regard to hand-washing, touching things is now seen as so relatively > unlikely a form of transmission

This is untrue. Some people on HN are fixated on droplets and aerosols, but we know that fomites are a significant risk.

[https://www.nejm.org/doi/full/10.1056/NEJMra032498](https://www.nejm.org/doi/full/10.1056/NEJMra032498)

> The primary mode of transmission appears to be through direct or indirect > contact of mucous membrane (eyes, nose, or mouth) with infectious > respiratory droplets or fomites.3,26,27 The use of aerosol-generating > procedures (such as endotracheal intubation, bronchoscopy, and treatment > with aerosolized medication) in hospitals may amplify the transmission of > SARS-CoV, and outbreaks have involved more than 100 patients on > occasion.3,26-28 SARS-CoV survives for many days when dried on surfaces and > in feces at an alkaline pH.33 Although data from direct comparisons are not > yet available, a review of previously published data suggests that SARS-CoV > may be far more stable than other human respiratory viruses, such as > respiratory syncytial virus. The role of fecal–oral transmission is unknown > but may be important, given that profuse watery diarrhea is a common feature > of the disease and that SARS-CoV is shed in large quantities in stool.

<comment><USER11> > "Public health authorities" are all really clear: if you're going to wear > PPE you need to do it properly.

You are confusing two things here. For preventing certain people in certain contexts from being infected, PPE is important. For preventing the average person walking around from infecting others to the point of upsetting curve- flattening efforts, any kind of face covering (even if it be a scarf or a Buff) will satisfy the requirement in most countries now.

Indeed, the public health authorities – at least in Europe which is presently my main concern – are very clear here: the authorities overall are calling for masks to be required only in shops or on public transportation. Countries like Poland and the Czech Republic which require masks to be worn at all times in public are outliers. (And I expect their rules to soon be harmonized with the less strict countries. De facto in Poland the outdoor requirement is not even being strictly enforced outside the major cities).

</comment></comment></comment></comment></comment><comment><USER13> There's so much conflicting information out there right now that I'm not even listening to it. I'm wearing masks and avoiding people, because my wife has bad lungs and I have a 6 month old. Until there's more facts that are rock solid, all anyone is doing is speculating. The real issue here is lack of consistency and leadership from the top levels of government (USA here). If we had a consistent message from the experts and politicians _together_ , then there would be less speculation, less fighting over lockdowns, less misinformation, and less grasping at straws guessing what the virus is doing. Instead, we (Americans in aggregate) have lost trust in both the experts and politicians, which is resulting in major issues. The deadliness of the virus isn't the major issue, it's the infighting that's preventing us from fixing it that's the issue now and will result in more dead.

<comment><USER14> When you walk around outside, are you also carrying an umbrella? Because cloth masks aren't that effective at protecting the wearer and I don't see how else you can prevent someone else from getting close to you.

<comment><USER13> I had n95 masks saved from the fires around me in previous years, but i generally don't run into people where i live so i can skip the mask when outdoors. People generally stay away from each other where i live, too. I don't live in a big city, so it's easier for me.

But like i said before, I don't care about what people say about the efficacy of masks, i will wear one anyways. Your comment had no bearing on my plan to keep doing so, because, like i said, i don't trust any "facts" about this virus right now, so i default to the most safe choice: wearing a mask.

<comment><USER14> oh sure. And good that you aren't finding it hard to keep distance.

Stay healthy fellow human.

</comment></comment></comment></comment><comment><USER15> The German hospital Universitätsklinikum Hamburg Eppendorf (UKE) performed more than 190 autopsies of patients who died with COVID-19. In a study (where they covered the first 12 cases) they found an unusually high number of of thromboembolic events. Therfore they are now recommending a prophylactic heparin treatment (a commonly uses blood thinner to prevent thrombosis), even for ambulantory care.

Here is the study: [https://annals.org/aim/fullarticle/2765934/autopsy- findings-...](https://annals.org/aim/fullarticle/2765934/autopsy-findings- venous-thromboembolism-patients-covid-19-prospective-cohort-study)

And for those who speak German, here is their press conference: [https://www.youtube.com/watch?v=VvH3mG-v0Ms](https://www.youtube.com/watch?v=VvH3mG-v0Ms)

<comment><USER16> Interesting, natural sunlight is also a strong blood thinner - can it be used as a treatment?

<comment><USER17> I had never heard that about sunlight before, but if true, it seems impractical to roll out ICU beds into the sun. (Not sure if patients outside of hospital would need blood thinning of course.) Edit: read too quick when typing "outside of hospital", ambulantory care has nothing to do with ambulances.

</comment></comment></comment><comment><USER18> > It turned out I had severe oxygen deficiency, although I still wasn't short > of breath.

I've read about this pitfall before. It might be an idea to have a blood oxygen saturation meter at home to keep an eye on this.

<comment><USER19> They to be about $25 and now they're about 70, Thanks to price gouging

<comment><USER20> What's the difference between price gouging and price increases due to shortages?

<comment><USER21> IANAL (or economist), but I'd say price gouging is when hoarders raise prices to profit from artificial shortages that they created.

As a people, we did not run low on hand sanitizer. As a free market, we ran low on hand sanitizer because a small minority decided they needed 10,000 bottles in their garage.

When there exists plenty of product for everyone, and there are distribution networks by which we can get it to everyone who needs it, and yet opportunists insert themselves in the middle for no purpose other than to make a quick buck, I call that price gouging.

<comment><USER22> I'm pretty sure we actually did run low on hand sanitizer.

Yes, there were some hoarders, but people also started buying and using a lot more sanitizer, the supply chain was overwhelmed. Companies didn't have huge excess warehouses of the stuff ready to ship when demand suddenly spiked over the period of a few days.

<comment><USER23> I think he's referring to the feedback loop that hoarding causes.

If you're confident you'll be able to buy the good in the future, you'll buy less now. If a hoarder clears out the supermarket, that means that everyone that shops at that supermarket and doesn't get what they want is more liable to make a larger purchase when do find it at another store. This chain reaction leads to shortages. It's impossible to prove the direct amount of causation (and of course organic demand spiked), but the relationship is clearly there.

<comment><USER22> Sure, but people also just used up what they had.

I had a box of mini hand sanitizer in the closet i purchased 2-3 years ago, I brought it out at the beginning of march and began to use it. I ran out and there was no more to be found in any store. Still have only seen it once or twice in a store, behind the counter now 2 months later.

Even if we had all just tried to buy 1 bottle of hand sanitizer each that would have been 330 million bottles, I don't think store shelves had that many in march.

(Edit: It's the same thing as happened to stuff like toilet paper - we usually make just enough toilet paper for everyone, between commercial and retail toilet paper sales. Suddenly commercial toilet paper became unsaleable with industries shuttering their doors, and the existing supply of home toilet paper wasn't enough anymore since now all the bum-wiping that would have been done with commercial toilet paper needed to be done with the different rolls that are sold to home goods buyers)

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> > That's why I get so annoyed by the many commentators on the sidelines who, > without much insight, criticize the scientists and policymakers trying hard > to get the epidemic under control. That's very unfair.

Do viral epidemiologists have much insight about the effects of economic depression, combined with all-but-unprecedented fear and social isolation, on public health? Do they have any at all? This comes across as incredibly arrogant, and just as unfair.

<comment><USER25> There's a huge difference between criticizing the people/science and criticizing the decision. We collectively need to have a real conversation about the pros/cons/risks of reopening parts of society. However, we're stuck in this rut of just calling the science bad (it's not) in order to avoid talking about the harsh reality of increased death rate.

</comment></comment><comment><USER26> In Slovenia we did random sample testing. Out of this we concluded that 3% of population had covid-19. This is 60000 people of which ~100 people die. This gives death rate around 0.17. Majority were people in elderly homes with many other diseases.

<comment><USER27> NYC has population fatality ratio of 0.17% to 0.23%. 8.4 million people and 14,753 confirmed COVID-19 deaths [0]. They have also 5,178 probable COVID-19 deaths. In other words, around 1 person per 500 overall died due COVID-19. Serology tests shows that only one in 5 people had the disease [1]. So the population fatality rate could still go up to 1 in 200. Imagine a wedding party, then imagine one person dead and 5 hospitalized, that's how bad it can get. There are very similar statistics in Bergamo, Italy and on board of Diamond Princess. Well, Diamond Process has infection fatality rate of 1.8% - 13 people out of 712 infected died.

[0] [https://www1.nyc.gov/site/doh/covid/covid-19-data.page](https://www1.nyc.gov/site/doh/covid/covid-19-data.page) [1] [https://www.nytimes.com/2020/04/23/nyregion/coronavirus- anti...](https://www.nytimes.com/2020/04/23/nyregion/coronavirus-antibodies- test-ny.html)

<comment><USER26> I am just pointing this out because severe seasonal flu that appears in some years has reportingly ~0.1 fatality rate. Then my explanation would be that those two are comparable. Except covid spreads faster and therefore we see more death in shorter period?

Please poke holes in my theory:) I would like to se poking holes in my theory:)

<comment><USER28> I'm on the edge of what I know here but. I think the flu is innately self limiting because the virus only infects cells in the respiratory system, and generally only the upper part. It tends to kill people who are frail.

Covid19 most of the time mimics the flu. But because the receptors it uses are wide spread in the body it can an does cause systemic illness. In particular I see more and more comments from doctors about clotting and vascular issues.

Consider strep. You have step throat. And then you have scarlet fever. Covid19 is similar, presents at a mild respiratory disease mostly, or as a serious one with pnumonia, or deadly systemic.

</comment></comment></comment></comment><comment><USER29> I'm so, so sad.

</comment><comment><USER30> "Let's be clear: Without a coronavirus vaccine, we will never be able to live normally again. The only real exit strategy from this crisis is a vaccine that can be rolled out worldwide."

Worldwide? It is fair to expect this will take years.

In the mean time what does normalcy look like? Sweden?

<comment><USER31> With the death rate is so slow for large portions of the population, the vaccine will have basically no margin for error. How do you convince parents to vaccinate kids for a disease that has say a .001% fatality rate for those under 17 unless the vaccine is even safer?

<comment><USER32> The complete details on the pathophysiology of the disease are far from known yet. For instance "The death of a five-year-old boy in New York of inflammatory complications possibly linked to Covid-19 has prompted Andrew Cuomo, the state's governor, to warn of "an entirely different chapter" of a disease that had been believed to cause only mild symptoms in children."

"Cuomo later tweeted that there have been 73 reported cases in New York of children falling severely ill with a toxic shock-like reaction that displays symptoms similar to Kawasaki disease."

[https://www.theguardian.com/world/2020/may/09/children- coron...](https://www.theguardian.com/world/2020/may/09/children-coronavirus- death-kawasaki)

<comment><USER33> In the same hospital?</comment></comment></comment></comment>


The war on the internet - <AUTHOR> http://cultureandempire.com/#/

<comment><USER2> Shame this isn't getting any traction here. It's pretty interesting and insightful. This is the kind of thing I read and think about PG's "Live in the future" admonition, start to think about a world in which the trajectory of Cost Gravity is traced forward and you will be doing it.

<comment><AUTHOR> I stumbled upon it while reading the ZGuide from ZeroMQ and thought it was amazing, thought I should at least share if it hasn't been already

</comment></comment><comment><USER3> Not a very grabbing blurb. Who's the author, why does his opinion mean anything? Why are there 3 articles? Who are the authors of the other article? In short - why should someone read this that doesn't already agree fully with the conclusions presented?

<comment><AUTHOR> I don't mind that the blurb isn't grabbing. There are enough grabby titles and blurbs that fail to deliver on the internet/IRL.

</comment></comment><comment><AUTHOR> Forgive the click-baity title -- figured it was the most tantalizing part of the blurb.</comment>


Google-Backed Study: Self-Driving Cars Have a Better Crash Record Than Humans - <AUTHOR> http://hothardware.com/news/self-driving-cars-have-a-better-crash-track-record-than-humans <comment><USER2> Well sure they do. They drive super-conservatively.</comment>


Ask HN: Review our new bug tracker - <AUTHOR>

We're launching our pet project today - bugrocket.
It's a small, lean bug tracker meant for small teams. We trimmed and trimmed the spec down over the course of development and what we've got is the core of what we think will be great.
We're looking for some constructive feedback to fuel our first major iteration after launch.
Some stuff that's high on the list:

  - A live demo with real-looking data to play with
  - A video, or several very short ones showing off some of the UI
  - A full API (for doing imports and so on)
 What do you think oh wise HN populace?
https://bugrocket.com <comment><USER2> Looks very nice. I'd also like a demo to try.

Pricing seems way out of whack IMO. I wouldn't try it because I don't think your pricing model is sustainable. What if a 1000-person company comes to you and signs up? You'll instantly be in the red from a usage/cost standpoint (i.e. what you pay for storage/servers). What if you sign up 100 10-person teams and all 100 use 10GB of storage? You'll go bankrupt paying the usage/meter fees and there goes all of our bug reports/tracking.

I think it's fine to promote simple but "one size fits all" doesn't seem viable to me.

And why reinvent the wheel ("no credit card required")? There's a reason that 100,000 other web startups require a credit card to start the free trial. Why would you buck the trend? I guess another way to say it is, "What is it that those other companies have learned in the past 10+ years of marketing apps on the web that you think is wrong?"

<comment><AUTHOR> Hey thanks a lot for the feedback.

On pricing: This is a real concern, so I hear you. We've considered the cost of data storage and are fairly confident in the model. In the unlikely event that 100 accounts use 10GB each, we'll be doing fine. A 1000 person company is also way out of our target demographic here, the app is purposefully not designed for that many users. What your comments on this subject say to me, at the core, is that we need to prioritize a full API so that one can easily take their data with them if an unfortunate situation like you describe ever arises.

On no-credit-card-for-signup: This is a big one. We argued and debated about it for a long time. It comes down to the fact that while requiring a credit card in order to start a free trial is common, we just don't like it. Conversion is harder, to be sure, but we feel that letting people try the service without a credit card is a good way to encourage as many people as possible to actually try it. Also, there's a great discussion on this at [http://www.braintreepaymentsolutions.com/blog/negative- optio...](http://www.braintreepaymentsolutions.com/blog/negative-option) that heavily influenced our decision here.

Appreciate the comment!

</comment></comment><comment><USER3> I built/launched a very similar product a few months back. Even has the same plan for the same price, and targeted at the same market:

<http://trackjumper.com>

Honestly, it's been a slog to get people to sign up and stay. AdWords is dominated by the giants who can pay more and SEO is competitive as hell for even a trickle of traffic. I've got a few tricks up my sleeve, but this is a tough niche.

</comment><comment><USER4> I like the animation between the screens of the tour, but I'd like even more to be able to try out a demo of the bug tracker.

Also, I'd avoid using a quote from a bugrocket founder as a testimonial.

<comment><AUTHOR> Hey, thanks. My testimonial on the page is a bit of a joke at the moment. Since we're really early in the process here there aren't many people to get testimonials from :)

As for the demo, as I mentioned, that's definitely on our radar. Have some cool ideas on the subject, stay tuned.

</comment></comment><comment><AUTHOR> Clickable: <https://bugrocket.com></comment>


Thialfi: A Client Notification Service for Internet-Scale Applications - <AUTHOR> http://sigops.org/sosp/sosp11/proceedings/abstracts.html#10-adya

<comment><AUTHOR> Here is the PDF: [http://static.googleusercontent.com/external_content/untrust...](http://static.googleusercontent.com/external_content/untrusted_dlcp/research.google.com/en//pubs/archive/37474.pdf)</comment>


Fitbit – I don't get it, please explain it to me - <AUTHOR>

My wife has one, and I looked at the dashboard.  I get that it tracks all your activity and sleep, but I'm not convinced that it has long term appeal.  If you think otherwise, fire away. <comment><USER2> Gamification aside, the benefit that I see is that there's a clear, quantifiable metric for how active I've been on any given day. Simply setting a goal for myself to "be more active" without some way to quantify it won't yield any results because I'll essentially lie to myself and say "Yeah, I got enough exercise today" without knowing if that's actually true. With a fitbit (or similar), I can say "Yes, I got at least 10,000 steps today" (or, "No, I didn't, I'll go for a walk.")

<comment><USER3> This. And besides this, the trend of corporate wellness programs is booming, and a large portion of these is quantifying the activity levels of participant employees. Wearables like Fitbits make this trivial (as do API hooks into services provided by Garmin/Polar/Suunto/etc). In these cases, there's a financial interest for employees to use and like their activity tracker.

</comment></comment><comment><USER4> Look at it like a computer game. You do things and you get points. You can then use those points to 'unlock' certain achievements, beat your old high score or try to beat your friends score.

Some people like turning things into games as a mechanism to achieve certain goals.

</comment><comment><USER5> Like dagw said it gamifies health. This makes a big difference for some people.

For me I use it more for convenience. There is good evidence that logging your behaviour promotes healthy behaviour. With fitbit I can log my food intake and it will automatically log my activity and weight. In the past I would have logged weight manually in an excel spreadsheet and probably just not tracked activity as closely.

</comment><comment><USER6> Keeping track of your health is a life-long thing, so I would say it definitely has long-term appeal. For example, to lose weight, you must burn more calories than you eat. But once you get to your target weight, and you want to maintain it, you must make sure to keep them around the same level everyday.

Being able to enter your meals from a shared database makes this process so much smoother, and having a rough idea of how many calories you've burnt so far lets you make smarter choices about food.

Also, one of the things that the Surge model can do is track your runs via GPS. This is awesome. At first it was the only reason why I even got it, but I think the whole feature set is really helpful toward reaching your fitness/health goals.

</comment><comment><USER7> You are correct. It has no long time appeal! It is interesting enough at the start but quickly gets boring because of its uselesnes. Especially for the average person. I can see how bringing fitnes awarenes into the minds of people again is good. But if youre not an active person you will not use it and if you are you will not need it. Gathering Information off your activitys in General can be usefull fore several things but you will not need to know if you have walkt 100 steps more or fewer then last week.

<comment><USER8> I wonder how well the secondary market could be used to gauge the long term appeal. Would people sell it because they stop using it or it is like those skinny jeans you keep because one day you will use it again?

I will say that it was neat and then lost interest, but later once I had some "fitbit friends" the gamification went up a major notch as has the stickiness.

But within a few years either FitBit bands will turn into watches or users will replace their FitBit with a watch. So from the FIT perspective it hardly seems like a stable investment especially at the current market cap.

</comment></comment><comment><USER9> I'd add that it matters which model you get - the HR and the Surge are the only ones worth looking at IMHO, as they monitor heart rate while the others don't.

Seeing the data from my workouts and activity, even if not 100% accurate, helps me quantify the work I put in and the results I get. Removing some of the abstraction and seeing the numbers makes the hard work more rewarding.

</comment><comment><USER10> Gamification is a plus, however from my point of view, its just nice to be able to get some data on activity levels and sleep. When it comes to Fitbit -I 'feel' that it is too expensive. cost vs reward is not right.

I use a Xiaomi MiBand, the battery lasts for 30+ days and it is cheap. Just wear it and forget it kinda.

</comment><comment><USER11> I use Fitbit for a while and it motivates me to move more. Engage in challenges with your friends and that will make it more appealing and engaging.

</comment><comment><USER12> I think otherwise.</comment>


13% improvement in performance from people working at home - <AUTHOR> https://www.gsb.stanford.edu/insights/why-working-home-future-looking-technology <comment><USER2> I know I'm more productive working at home, most days.

The downside of working at home is that family and friends think I don't actually work. They like to call in the middle of the day and shoot the breeze, or stop over for an unannounced visit. That can be nice, but it can also be a huge PITA.

The upside is there are days when I feel dumb as a box of rocks and can't write a single line of code without struggling or mucking something up and on those days I can clean the house or mow the lawn or some other chore that I don't really need to think much about.

And on those days with I'm feeling bright I can code until the wee hours and get a ton of work done and afterwards sleep in until I'm truly rested.

But the best part is not having to drive to work. Back in the late 1980s I was spending at least 2 hours a day, 5 days a week, sitting in traffic sucking exhaust fumes on the way to and from work in Los Angeles. After about 10 years of that I finally did some math while stuck in traffic on the Ventura Fwy one hot and smoggy day.

I didn't live far from where I worked but it was as least an hour drive each way in rush hour traffic. I was honestly shocked when I realized I would be spending at least a 10,000 hours of my life sitting in traffic over the next 20 years.

As soon as I got home I started planning my escape from that misery.</comment>


K and Software Engineering - <AUTHOR> http://www.reddit.com/r/programming/comments/8cckg/arthur_whitney_on_apl_k_q_and_elegant_code/c08ukiu

<comment><USER2> I reckon a good number of us could be K5 refugees.. but for the remaining, here's a nice overview of what K is capable of:

<http://www.kuro5hin.org/story/2002/4/12/21757/8647>

<http://www.kuro5hin.org/comments/2002/4/12/21757/8647/33#33>

There're responses posted in various languages, for comparison.

I played with it for a while, but the brevity is a little daunting. To me at least, a 100 line C# program and a 4 line K script takes equal amount of time to parse.

<comment><USER3> My dad uses J in his work (very similar to K), and it makes my head hurt just looking at it. It's all ^^$:#//;"'3 or something...

He also makes junkloads of money with his J programs, so there's that.

<comment><USER4> I've heard that K is used a bit in the finance industry; is J in a similar position?

<comment><USER3> I'm not sure if it is generally, but he does use it for finance.

<comment><USER4> Thanks.

</comment></comment></comment></comment></comment><comment><USER5> Wow, that's a lot of hot air. Show me the code of a real-world K application and then let's see. Preferably something that doesn't just do data mining, e.g. a K version of the Java Pet Store.

Once you actually have to communicate the results of your clever algorithms, things look slightly different.

The APL languages seem very suited to the constraints of the finance industry, but that doesn't necessarily transfer a lot to other fields (number-heavy science might benefit, too. But why would you write GMail in J/K/A+?)

<comment><USER6> <http://nsl.com/> (start with the "Tools" heading and go down).

A spreadsheet that works in 2 lines, and one that's significantly nontrivial in 20. A database that works in 14 lines. A chat server. a 15-puzzle game. Eliza. A simplifier for algebraic expressions.

All of them in extremely concise code, that you are going to ignore with a SEP field.

You're welcome.

<comment><USER5> Thanks. I do have to say that most of the programs you mentioned didn't exactly help me get a better view of semi-large-scale projects in K, the Krav Maga tracker is at least a step in the proper direction (non-trivial GUI, configuraiton, storing and reading data etc.). I'll work through that after work a bit...

</comment></comment></comment><comment><USER7> I've done some first steps in J and it's really mind blowing. It's hard to get into it and you have to learn a lot before you can read programs. (Since I had too little practice, I can't read it.) But the underlying concepts are not too difficult, even to someone like me with not-so-good math knowledge.

I bought the e-book version of "Fractals, Visualization and J" by Cliff Reiter to improve my understanding. It's only ~7€ at lulu.com and I bought if to learn more about the impressive visualizations possible with J.

</comment><comment><USER8> [http://www.reddit.com/r/programming/comments/8cckg/arthur_wh...](http://www.reddit.com/r/programming/comments/8cckg/arthur_whitney_on_apl_k_q_and_elegant_code/c08umdl)

It doesn't appear to be all good news over there.

Nevertheless, I have added this to my ever-expanding "things to further investigate" list.</comment>


USB True Random Number Generator - <AUTHOR> http://www.entropykey.co.uk/# <comment><USER2> I don't know if things are improved, but the last time I looked into HW random number generators, it was RS-232 connected ones, and the quality control was _terrible_ a fairly high percentage of them generated very low quality random numbers. You would think you could mitigate this by xoring two of them together, but this made things much worse since 2 connected to the same outlet tended to be somewhat correlated!

My impression of the HW random number generator industry was that it was all snake oil, only the people selling them didn't necessarily know that was true.

Se also: [http://web.archive.org/web/20011027002011/http://dilbert.com...](http://web.archive.org/web/20011027002011/http://dilbert.com/comics/dilbert/archive/images/dilbert2001182781025.gif)

[edit] The technical section of the webpage[1] directly addresses most of the problems that the RS-232 devices I looked into a number of years ago had; namely it detects when the diodes are going bad, and tries to not exceed the estimated entropy rate (the RS-232 devices just blindly XORed them together at a predefined bitrate; boxes typically had 4 diodes, since 1 or more was bad in almost all shipping boxes). My experience was so bad with those devices though that I would want to spend a lot of time with any HW device before trusting it.

1) <http://www.entropykey.co.uk/tech/>

<comment><USER3> >fairly high percentage of them generated very low quality random numbers

How do you judge the quality of a series of random numbers?

<comment><USER4> You run a bunch of Diehard tests on them:

<http://en.wikipedia.org/wiki/Diehard_tests>

<comment><USER4> The best part of testing random number generators is playing 200,000 games of craps. My boss protested, but I just questioned his commitment to security…

</comment></comment></comment></comment><comment><USER5> Is the lack of entropy really a bottleneck in a server?

<comment><USER6> If the application running on the server needs to generate a lot of random numbers, yes.

<comment><USER7> Only if they need to be cryptographically secure - a PRNG, occasionally seeded with "real" entropy, is sufficient for almost all uses.

</comment></comment></comment><comment><USER8> In the past, I used random numbers from: <http://www.fourmilab.ch/hotbits/> sourced from radioactive decay. The only issue I could see was the daily limit, but I only needed several kilobytes of randomness at any one time.

</comment><comment><USER9> This is silly. The whole reason that cryptographic random number generators exist is to avoid the need for lots of entropy. You can start from 80 bits and "bootstrap" it to whatever quantity of random bits you need (and the seed entropy needed is available from /dev/random). PRNGs come with the guarantee that telling the difference from "true" random numbers is a hard problem.

You might claim that the hardness guarantees of PRNGs are not enough for you -- they are based on some assumptions after all -- but that is a specious objection, because those are the same assumptions that underlie all of digital security and e-commerce.

<comment><USER10> what are these guarantees you refer to? most pass a battery of tests e.g., diehard: <http://www.stat.fsu.edu/pub/diehard/> but if you give a PRNG x bits of entropy, then it can produce at most x bits of entropy over its entire output.

all PRNGs have cycles: that is, they'll produce random numbers x[1], x[2], ... , x[n], then random number x[n+1] = x[1], x[n+2] = x[2], .... often n isn't as big as you'd like, and sometimes there are correlations among x[i] and x[i+k] you really don't want (linear congruent generators have this problem).

<comment><USER11> Run the output through a hash function, and also get another 80 bits of entropy before you get to the critical n where your generator repeats.

<comment><USER10> are you sure?

the PRNG is a deterministic function of its seed. the hash is a deterministic function of the output. if you do the math and calculate the entropy (this isn't hard) you'll see that the total entropy is still 80 bits because the distributions of the PRNG output given the seed, and of the hash given the output have no entropy. the marginal entropy of the PRNG is 80 bits if you don't observe the seed.

another way of seeing this is via the data processing inequality: <http://www.neng.usu.edu/classes/ece/7680/lecture3/node2.html>

<comment><USER11> Did you misread my statement as saying hashing the output will magically give another 80 bits of entropy? No, I'm saying to get another 80 bits before your PRNG repeats. I know you can infer things like linear congruential generators. I implemented such an inference program in grad school from someone else's thesis, then demoed it on a crypto USENET newsgroup. The hash is going to make inferring the seed much harder. Using a cryptographic PRNG will make even the unhashed output hard to infer. Using both is going to be way beyond the ability of most attackers.

<comment><USER10> why hash the output then? this is introducing a dependence in the PRNG that you seem not to need (nor want).

if you're going to generate another 80 bits of entropy, then simply use this as the seed for another PRNG. this, sure, i agree, will get you more entropy, because you're adding more entropy to the system from an external source (such as the advertised device).

<comment><USER11> Hashing the output makes the seed harder to infer from the output and also tends to make the output look better on randomness tests.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Quantity 1 £36.00 with plenty of quantity discounts. Might be just the thing to make sure your VMs have enough entropy (I've read this can be an issue when they start up).

</comment><comment><USER13> I like this one ([http://www.idquantique.com/true-random-number- generator/quan...](http://www.idquantique.com/true-random-number- generator/quantis-usb-pcie-pci.html)) better.

If I understand both correctly, the Quantis one generates a random number that didn't exist before generation due to quantum measurement principles, whereas the Simtec one uses a high noise environment in which the number does exist before measurement.

<comment><USER14> You're repeating nonsensical marketspeak. What does "a number that didn't exist before ..." even mean? And what does "quantum measurement principles" mean? I'll tell you: it means diddly squat.

The device the article is about measures electron flow through an electronic component through which 'usually' no electrons flow. That electrons flow in this device, is because they _tunnel_ through the potential barrier. That's a quantum effect if there ever was one.

Converting the presence of electron flow into a number means you construct these numbers on the fly. The numbers did not 'exist before', for any reasonable meaning of that term.

</comment></comment><comment><USER15> One of their prime arguments is about the 4KB bucket available for random numbers on a standard Linux installation. Couldn't/Shouldn't that be raised to 1MB or so for server installations and that would solve the bandwidth problem if not the randomness problem?

<comment><USER15> Does anybody know configuration options for managing this BTW?

</comment></comment><comment><USER16> A GPL hardware RNG, using a bunch of ring oscillators in a CPLD:

<http://warmcat.com/_wp/whirlygig-rng/>

</comment><comment><USER11> What about collecting microphone input and running it through a hash?

<comment><USER17> That is a recognised method but it does have it's own failings. Certainly in server rooms although it seems noisy to us there are patterns that can still be generated.

Another similar method is to take static from radio waves. While random it's unfortunately hackable by someone who has a radio transmitter and can get close enough to your antenna (the same can be done with the microphone).

I worked at a poker startup and sourcing random numbers is both a political and mathematical nightmare.

<comment><USER11> Add another noisemaker with a chaotic component, like a Pacinko ball game with an automatic ball feed. Hashing the output will obliterate the patterns.

</comment></comment></comment><comment><USER18> Notice on how they use "high-quality" in the first three paragraphs?

</comment><comment><USER19> Considering the ultimate doom of the universe is very possibly infinite entropy, sometimes it bemuses me on a philosophical level that we try so hard to accelerate the process.

<comment><USER20> The only thing that I could come up with for 'infinite entropy' in Google was a piece about how 'big bangs' start from nothingness in empty space when the Universe 'cools off' or becomes 'too thin.' In that case, it seems like infinite entropy isn't necessarily the 'doom' of the Universe.

<comment><USER19> It is in the sense that nothing will be left, and the space-wide temperature will be arbitrarily close to zero K

I mean, the Universe wouldn't vanish or explode. We'd just all be dead, and it'd stop being interesting, the same way your magnesium strip is pretty boring and useless once it's finished burning.

</comment></comment></comment><comment><USER21> It never says that it generates true random numbers, just a "better" random

<comment><USER22> From the 'tech' page:

> _"...it has a pair of devices that are wired up in such a way that as a high > potential is applied across them, where electrons do not normally flow in > this direction and would be blocked, the high voltage compresses the > semiconduction gap sufficiently that the occasional stray electron will > quantum tunnel through the P-N junction. (This is sometimes referred to as > avalanche noise.) When this happens is unpredictable, and this is what the > Entropy Key measures."_

'Unpredictable' would qualify as random.</comment></comment>