Java blocking queues for concurrency beginners - <AUTHOR> http://www.geek-programmer.com/java-blocking-queues-explained/ <comment><USER2> Not recommended reading... the author consistently misuses the term "blocking," among other sins of ignorance.

<comment><USER3> How so?

<comment><USER2> One thing that stands out is the article's description of a free (non-busy) thread in a thread pool as "blocked." This is IMHO a misuse of the term--in normal usage, a blocked thread is one that is waiting for a call to complete, whether that's IO, computation, trying to add an item to a full bounded queue configured to make its caller wait rather than fail, etc.

<comment><USER3> But you're drawing a distinction where none exists. When a thread in a thread pool is "free", what it's doing is waiting for the next item of work to arrive -- and in implementation terms, that means the thread is blocked in a "take" operation on a currently-empty work queue. So it's totally correct to use the term "blocked" in that situation.

<comment><USER2> It's a free resource in a pool, probably in interruptible wait() or poll(), but don't you think this is an implementation detail and separate topic of discussion from a thread carrying out program logic and stuck on, say, uninterruptible IO?

</comment></comment></comment></comment></comment><comment><USER4> I honestly hope author goes more indepth in next part of the article. Most common use case that I have seen for BlockingQueues is to use them in conjunction with ExecutorService and ThreadPoolExecutor.

In that context you have to use/implement Task rejection policies if queue is full. Blocking operation Put on the queue is not used when submitting task to the service, it uses Offer method instead. It's a bit misleading.

<comment><USER5> A queue cares not where the threads that enqueue/dequeue elements on it , come from.

</comment></comment><comment><USER6> Queues are one of my favorite tools in my programing tool belt.

In Python they make it easier to right thread-safe code. I have written a similar article for Python with a focus on thread safety: [https://lemanchet.fr/articles/learning-python-3-threading- mo...](https://lemanchet.fr/articles/learning-python-3-threading-module.html)

</comment><comment><USER7> This sounds like a WIP implementation of channels[1]. Am I wrong?

[1] [https://en.wikipedia.org/wiki/Channel_(programming)](https://en.wikipedia.org/wiki/Channel_\(programming\))

<comment><USER8> It's not a WIP implementation it's the most common one. The blocking queues in Java behave very similarly to the golang channels for instance.

<comment><USER7> Is there a select() analogue? Maybe under another name?

<comment><USER8> The take() function is equivalent to a bare <\- channel read. the poll(time, timeunit) function is equivalent to a select with a case and a read off the done channel of a context with a timeout. The poll() function is equivalent to a select with a case and a default condition.

To get the behavior of a select composed of several channels and no default case I'd have to dig into the exact behavior of the select statement in go, but it could be accomplished with a loop over if/else if/else statement where the else had a thread sleep/thread yield.

I actually wrote a dsl in Scala a few years back that actually used the keyword select for this operation before I'd ever encountered golang. I used "on" instead of case but the behaviors were nearly identical.

<comment><USER7> I assume the name came from the select syscall, maybe unconsciously in your case :)

Hopefully something comes along to fill this gap officially. Channels are my favorite concurrency primitive by a huge margin. The more languages that support them, the better.

<comment><USER8> It wasn't unintentional that I used select. The dsl actually abstracted over network operations first and I only later added queues to the abstraction.

</comment></comment></comment></comment></comment></comment><comment><USER9> missed synchronous blocking queues i think, a thread queue with size 0

</comment><comment><USER10> Not nice of Java to block the queues. Especially since we're talking about concurrency beginners. It's hard enough for them as it is.

<comment><USER11> Nice thing about Java's verbose naming is the name tells you the behavior. It also has a lot of internal documentation in the Java. Such documentation is easily accessible from their IDe or the web.

As the article points out, you can block the producers or consumers. So while queues and threading are advanced for an entirely new concurrency programmer, the are the most fundamental block of the concurrence developer.</comment></comment>


Windows Mobile 7 - 1 big fail - <AUTHOR> http://wibba.com/L1AD/wibble/120/

<comment><USER2> Here is the direct link to the video:

<http://www.1938media.com/windows-mobile-will-be-a-fail/>

More time is spent talking about Twitter never being profitable than Windows Phone 7 being a failure. I do actually agree with both of his points of view. I don't think Windows Phone 7 will restore Microsoft to mobile glory and I don't think Twitter will ever make any money.</comment>


Rethinking Mental Health with Psychedelics - <AUTHOR> https://thethirdwave.co/podcast/episode-48-anthony-adams/ <comment><AUTHOR> My latest, most vulnerable and in depth interview on my journey of transcending mental illness by deconstructing psychosis and reconstructing my psyche from scratch.

Including the role of psychedelics in the healing process and thoughts on modern mysticism.</comment>


ControlEscape: Have your ESC and Control key, too - <AUTHOR> https://github.com/jasonrudolph/ControlEscape.spoon <comment><AUTHOR> ControlEscape is a plugin, aka "Spoon", for HammerSpoon app for macOS. HammerSpoon[1] is a UI layer scripting tool for macOS. From the README, ControlEscape provides this superpower:

 _With that in mind, we can teach the control key to pull double duty:_

 _– If control is pressed and released in isolation, we can interpret it as escape_

 _– If control is held down and used in combination with another key, then we can let it provide the normal control key behavior_

As someone who's an avid user of vim-style keybindings, this has been a spectacular addition to my workflow. I use it with the standard System Preferences rebinding of CapsLock as Control, which makes it even better. It obviously helps on TouchBar MacBooks, but honestly I find it's fantastic even on my favorite external keyboards.

[1] [http://www.hammerspoon.org/](http://www.hammerspoon.org/) – I could write a bit about HammerSpoon itself. It promises to consolidate a number of smaller "UI utility" apps I've accumulated over the years.</comment>


10 very good reasons to stop using JavaScript (2013) - <AUTHOR> https://www.leaseweb.com/labs/2013/07/10-very-good-reasons-to-stop-using-javascript/ <comment><USER2> The only part of this that seems obviously wrong would be point 8 - (unfortunately) JavaScript has not gone the way of applets or Flash. Yet...

</comment><comment><USER3> If stop using js, then TypeScript, WebAssembly or other alternatives?</comment>


Video Game Reviewer Is Contacting the Mothers of Her Online Harassers - <AUTHOR> http://jezebel.com/video-game-reviewer-is-contacting-the-mothers-of-her-on-1664381934

<comment><USER2> This is brilliant.</comment>


Cracking Minesweeper with Z3 SMT Solver - <AUTHOR> https://yurichev.com/blog/minesweeper/ <comment><USER2> I wrote a language some time ago exploring the use of SAT solvers for these types of problems, trying to make writing solvers easy to reason about, never quite took off, but here's what the minesweeper solution looked like: [http://sabrlang.org/mine/](http://sabrlang.org/mine/).

It basically translates the somewhat more complex rules into the simpler SAT rules using minisat. However sometimes needed a generator in python to make the rules :/. But still kinda nice to see it more visually, language looks like this in the end: [http://sabrlang.org/code/mine/source.txt](http://sabrlang.org/code/mine/source.txt). It basically lists the requirements for middle, edge and corner blocks, than says where those blocks are on the "board."

Kinda fun, though arguably somewhat restrictive. One of the more fun ones I think is the rubiks cube: [http://sabrlang.org/rubik/](http://sabrlang.org/rubik/).

<comment><USER3> How does this contrast with Answer Set Programming (using e.g. clasp)?

<comment><USER2> They are similar, although SABR tends to be more verbose as it keeps a polynomial relationship between size of SABR programs and the underlying SAT. It can in some ways be easier to reason about, but that's sort of in the eye of the beholder. In the past I've prototyped simple examples in SABR then written a generator in python for the full program.

Here's a great resource for those interested in constraint programming: [http://www.hakank.org](http://www.hakank.org)

Sudoku examples: SABR: [http://www.hakank.org/sabr/sudoku.tb](http://www.hakank.org/sabr/sudoku.tb)

ASP: [http://www.hakank.org/answer_set_programming/sudoku.lp](http://www.hakank.org/answer_set_programming/sudoku.lp)

There's the built in construct of transitions which isn't in this example that is preloaded into SABR, but one could easily enough write the restraints required for this in clasp.

SABR envisions the universe as the "Board" and it has a given size consisting of elements and each element can have a specific state as defined by "Symbols". Then you can build on that to say what is legal for a theoretical set of elements, and how that set can transform over time, then you can define which of the Board elements correspond to the defined theoretical set.

Its way more opinionated than most other constraint programming languages, which can be mind bendy.

</comment></comment></comment><comment><USER4> Here we go again. Someone says "minesweeper". I shamelessly plug my js implementation: [http://www.ronilan.com/bugsweeper/](http://www.ronilan.com/bugsweeper/) Don't ask me why.

P.S - it's with bugs instead of mines just because fontawesome didn't have mines. No puns intended.

<comment><USER5> I've got one too [1]. Your's looks much nicer than mine. I'm just an occasional dabbler in JavaScript, so it is not surprising that mine is crude.

I wrote that after reading this HN discussion [2] where someone was describing how they interview. They set the candidate up with a good JS development/test environment that the candidate is comfortable with, and ask them to implement as much of Minesweeper as they can in one hour. They also said no one has ever finished in that one hour.

As expected, I did not come anywhere near doing it in an hour. Wall time was about 7 hours, but I was doing other things during that, so it was about 4 hours working on Minesweeper. About an hour of that was testing and stumbling around the Mac character viewer trying to find good characters for bombs, flags, and such.

I'm kind of surprised no one has done it for the interviewer in an hour.

As I said I'm only a JS dabbler. Basically, every couple of years or so I'll have to do a little bit of basic JavaScript to do some simple DOM manipulation or form validation. That's just enough to keep me sufficiently aware of JS that I can at least do some reasonable guessing and googling.

I'd expect an actual JS programmer to be much faster than me.

[1] [https://github.com/tzs/interview_minesweeper](https://github.com/tzs/interview_minesweeper)

[2] [https://news.ycombinator.com/item?id=10752564](https://news.ycombinator.com/item?id=10752564)

<comment><USER6> I think I'd panic if I got that question in an interview. Where do you start with that? What are the first steps? How did you know what to Google?

<comment><USER7> It sounds like a test of your ability to abstract, componentize, and prioritize. Here's a possible approach to this sort of problem:

Read a brief summary of whatever you are implementing, even if you are already familiar. This will help you understand the breadth of the problem.

Try to list in very broad terms the data structures you will need to store the state of the problem (e.g. for Minesweeper, a grid of tiles, and for each tile some status). Don't worry about whether you are using a list or a vector/array or sparse or dense matrices, just be as generic as possible.

List in very broad terms the logic of the problem. What states exist, what are the beginning/ending conditions (start/playing/win/loss), very roughly how states transition, etc. Again, avoid detail.

Identify the inputs and outputs of the problem, very broadly (e.g. user input, display for game board -- no mention of mouse, keyboard, HTML, or whatever).

Cycle through these phases a few times until they seem to agree.

From there, go wherever your brain takes you, progressively filling in details of your design. You probably still shouldn't start coding.

For a 1hr exercise, let's assume you've used 15 minutes for the design phase. Now you can begin coding. Start with the very core of the problem, writing data structures and logic around those data structures. Then get some way of displaying them and manipulating them so you can debug with feedback.

With a roughly functioning core, start filling in the rest of the design. Focus on what makes the biggest functional difference with the least effort first, if at all possible, but again, follow your brain. Try not to pick fonts before you've got everything running. Go piece by piece, until time is up.

\--

As for what to Google, you'll need to know how to interface with your problem's input and output systems (like a browser), and maybe how to run timers or store your particular data structure, but most of the work is design, not research.

\--

For a personal story, several years ago I failed a similar test in an interview. They asked, "How would you make an elevator?" I got lost in the details like what type of screw terminal to use for electrical contacts, and only later realized the value of prioritizing layers of abstraction. Breadth- first search, not depth-first, if you think of a problem space as a graph.

</comment></comment></comment></comment><comment><USER8> This makes me wonder:

Is there a strategy such that it can consistently solve every minesweeper configuration?

I always assumed that the 50/50 guess was unavoidable on some maps but I don't know if that's true.

<comment><USER9> Consider the basic state - the minesweeper board is built around your first move. If your first move is not a void, but has one or more adjacent mines, all you see to start is a single open square with a number. At that point you're already making a guess. Even if it's a 1, you're guessing about your next move.

<comment><USER10> Not to mention that the first move itself is a guess. I'm not sure about all variants, but certainly on the classic Windows minesweeper there were times that my first click was a bomb.

<comment><USER11> That was definitely not possible on Windows XP version of Minesweeper, they would regenerate the board if you clicked on a bomb in the background and used that one instead.

<comment><USER12> It was definitely not like that on Win98.

<comment><USER10> Definitely not like what the parent said, or what I said? Maybe I'm remembering that rather than XP

</comment></comment></comment></comment></comment></comment><comment><USER13> I wrote a Minesweeper solver a while ago, it uses backtracking search with decent results: [https://luckytoilet.wordpress.com/2012/12/23/2125/](https://luckytoilet.wordpress.com/2012/12/23/2125/)

Now I wonder how does the performance of this SAT solver compare to backtracking? Which one deals better with situations where guessing is required?

<comment><USER14> In Stanford CS221, one of the assignments was to write a Minesweeper solver using backtracking and various propagation techniques. It was exact and ran fairly quickly. Once you've enumerated all possible solutions, you can throw heuristics at guessing.

</comment></comment><comment><USER15> The thing is that in minesweeper you cannot win in a deterministic way. Sometimes you will lose in your first move.

<comment><USER16> I always thought it would be fun to make a version that was soluble every time by making the system reveal extra tiles as required to always allow you to continue play without guessing. I personally found the situations where half way through a large game you were forced to guess quite frustrating. Maybe deep down I just don't like minesweeper ;)

<comment><USER17> Or alternatively one that if you click a tile with the best chance in a unsolvable situation always solves in your favor, adjusting bomb locations as necessary.

</comment></comment></comment><comment><USER18> There's an implementation of a Minesweeper solver in Mozart/Oz too "Playing the Minesweeper with Constraints": [https://www.info.ucl.ac.be/~pvr/minesweeper.pdf](https://www.info.ucl.ac.be/~pvr/minesweeper.pdf)

</comment><comment><USER19> Great project! Made me remember making a Fallout 2 Computer Console cracker in Perl. Great fun!

<comment><USER20> I don't remember any hacking in FO2 (at least, not minigamed).. Do you mean 3?</comment></comment>


YC competitor: how TechStars was born - <AUTHOR> http://www.denverpost.com/business/ci_5933462 <comment><USER4> List of participants

# digitalsoap - St. Louis

# Eventvue - Greenville, S.C.

# Intense Debate - St. Louis; Jacksonville, Fla.; Sweden

# No Sleep Media - <USER2>

# LingoLinko - Philadelphia;

# Berkeley, Calif.

# Tru.Vu - <USER3>

# Villij.com - Homer, Alaska;

# Bellingham, Wash.

# Zemble.com - Los Angeles

<comment><USER5> I think it's cool they funded people in so many different places, although in terms of getting people together to share ideas and have intense mentoring, Y Combinator's strategy is probably better.

That doesn't mean this doesn't have a shot, though - maybe they'll get some good people who simply can't pick up and move to SV or Boston.

It's not a zero sum game in any case, I hope they both do well!

<comment><USER4> There is such an enormous demand for this type of funding that I hope to see many, many more YC style seed stage funding companies. I wish there was a way to make the model work for biotech but I haven't figured it out yet.

<comment><USER6> What is different in the case of biotech? Can you elaborate? Why do you think the model doesn't work? Do you need equipment? Or is your biotech startup purely based on software?

<comment><USER4> #1: Institutional investors in biotech require patents for funding. Period. Without a patent, there is no funding. If you don't have a patent, you're probably stepping on someone else's IP. Unlike software patents, life science patents are real and enforceable.

#2: There are regulatory issues for most biotech startups. This means you may need 3 years of cash to burn before you have a chance of seeing revenue.

#3: Startup costs are all around higher. Just about always, biotech startups need specialized high end lab equipment in very specific lab spaces. The only lab I've found that will take me is in San Jose and is $3,000 a month. The _only_ commercial lab space in Pittsburgh is with a state sponsored institutional investor and they only give space to portfolio companies.

A YC for biotech would need to be a true incubator with office/lab space. And you'd have to give each team $100,000. In biotech, $100,000 is equivalent to the "living expenses only" money that YC gives out.

It could very well work and I'd love to see it but someone would have to put up a very, very large amount of capital for something very risky by the standards of biotech investment.

<comment><USER6> Very interesting. After all these difficulties, what attracted you to biotech so much? I'm really curious. Is it primarily an intellectual/scientific curiosity or a desire to help people or the business aspect of it or...?

<comment><USER4> I'm in biotech because I see a rare opportunity to bring a company to revenue on $10,000. All I have to worry about is being sued.

It also gives me a pathway to this: <http://news.ycombinator.com/comments?id=13464>

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Incredible rip-off of YC. However, it doesn't look like too bad a deal...

They sound like "Mr. Skipper" to YC's "Dr. Pepper". I like to drink rootbeer... not sure what that signifies.

<comment><USER8> This is completely off topic, but I couldn't resist: <http://www.marion.ohio- state.edu/fac/schul/drp/dr.html>

I've had the misfortune of trying Dr Becker and Dr Perky.

Maybe, as in soda, when it comes to early-stage funding you can't beat the original?

</comment></comment><comment><USER9> _Brainchild?_</comment>


One Of Microsoft's Best Kept Secrets: Python Tools For VisualStudio (PTVS) - <AUTHOR> http://www.hanselman.com/blog/OneOfMicrosoftsBestKeptSecretsPythonToolsForVisualStudioPTVS.aspx

<comment><USER2> "There's also a complete REPL inside Visual Studio for each"

Can you set it to use IPython's repl rather than the default repl?</comment>


Infineon RSA Key Generation Issue - <AUTHOR> https://www.yubico.com/2017/10/infineon-rsa-key-generation-issue/ <comment><USER2> Relevant: [https://arstechnica.com/information- technology/2017/10/crypt...](https://arstechnica.com/information- technology/2017/10/crypto-failure-cripples-millions-of-high-security- keys-750k-estonian-ids/)

It's worth pointing out that GitHub apparently revoked affected certs (generated by Yubikey 4), while the 750k affected national ID cards in Estonia will stay in use and certs won't be revoked for now.

<comment><USER3> Oh my. I recently met an Estonian couple and I felt like this national ID was a huge thing for the country.

<comment><USER4> It still is, they'll get new keys and be fine. Meanwhile in the US we're still stuck with social security numbers that aren't secure at all.

<comment><USER3> I guess it is indeed infinitely more secure than SSNs :) even with the current security issues.

</comment></comment></comment></comment><comment><USER5> Many people mentioned that the Estonian ID card is vulnerable. I have an e-residency card, so I tried it out on [https://keychest.net/roca](https://keychest.net/roca)

If I use "pkcs15-tool --read-ssh-key 1" to read out the public key, (in the "ssh-rsa AAAAB3Nza....." format), then I get a vulnerable key warning (2048bit SSH key).

On the other hand, if I use "pkcs15-tool --read-ssh-key 1 --rfc4716" to output in "\---- BEGIN SSH2 PUBLIC KEY ----...." format, then it shows different key tests and tells me it's "safe key".

Is this a weakness of the test, or is there really some difference between the "regular" and the "RFC4716 formatted key (I wouldn't expect that)? What am I missing?

EDIT: using the standalone "roca-detect" (note, Python2 is required), then the first format reports potential vulnerability, while running it on the second format results in "Exception in processing PGP rec file estonia1.asc: Incorrect padding". So I guess it is indeed that the tool does not handle RFC4716 formatted SSH keys correctly?

<comment><USER6> I'm no expert, but a serialization format cannot change any inherent properties about the key in question. It's just a matter of how it's presented. The key is the same (vulnerable or not).

Can anyone tell me if using 3072 bit keys would have made a difference? Everywhere I look, 3072 bit RSA/256 bit ECDSA/256 bit hash functions/128 bit AES (=128 bits of security) seems to be the standard. Why choose 2048 bit keys for a national ID card?

<comment><USER7> I'm not sure where you're looking but around my parts, 1024, 2048, 4096 bit RSA is most common. Most of those are 2048 bit. I can't think of a 3072 bit RSA key I've run into in the wild. That's usually TLS, GPG, SSH keys.

</comment></comment></comment><comment><USER8> I use this functionality on a near-daily basis, and received an email from GitHub this morning informing me that two of my older, backup SSH keys generated on Yubikey 4s had been revoked. I'm going to start the replacement process with Yubico this morning, and probably share my experience with it here.

<comment><USER9> FWIW, I went through Yubico's automated replacement process earlier for a couple of Yubikeys. It took just a moment, was pretty much fully automated, and worked perfectly.

They gave me a coupon code, I went to their online store, and ordered the replacements.

The whole thing took maybe five minutes from start to finish.

<comment><USER8> Unfortunately, since I had previously overwritten the factory OTP configuration, I had to take photos of my affected Yubikeys, including my email address in the photo. A bit longer, but still easy enough. Now to wait, and hope they don't deny my claim (despite having ordered them directly from Yubico in April of this year...)

</comment></comment></comment><comment><USER10> If you bought your Yubikey on Amazon, you can't replace it directly, but have to contact the seller.

As Amazon tends to intermingle supply from different resellers for Fulfillment by Amazon products, you might have a Yubikey whose Serial No is registered to a different reseller than the one you paid - as result, replacement is going to be complicated.

EDIT: Here the message the Yubico website displays: [https://i.imgur.com/FVINcQB.jpg](https://i.imgur.com/FVINcQB.jpg), and the response from the support: [https://i.imgur.com/it8zxgp.png](https://i.imgur.com/it8zxgp.png)

Now I'm left with a Yubikey that's produces broken RSA keys, and Yubico refuses to take responsibility.

<comment><USER9> OTOH, I bought at least one of my affected ones via Amazon and had zero problems with a replacement.

<comment><USER11> It seemed to accept my request (didn't error on entering the serial - but I uploaded a picture instead of giving OTPs) - perhaps because it was sold by Yubico; fulfilled by Amazon.

<comment><USER10> The problem with Fulfilled by Amazon is that while you think you buy directly from Yubico, you might end up with a device from a reseller. Who actually ships your device is entirely random.

That's what happened to me, and it's infuriating.

<comment><USER12> It says on the page and order form who you're buying from. The problem is that reseller agreement not being public — normally the products are the same across sellers but in this case there's a big difference in what you're getting.

<comment><USER10> That information isn't always accurate, but that's not even that relevant here.

It's not made clear at all how you have to handle RMA in such cases, and customers end up confused. I'd never have bought a Yubikey this way if I had known about the RMA and replacement procedure beforehand.

<comment><USER13> Lesson being buy directly from yubicon.

It kind of makes sense to have as few trust points involved as possible when buying a security device like this.

One could argue yubicon should only sell directly, but that would probably hurt business.

<comment><USER12> Or just be careful on Amazon. I avoid third-party retailers for this reason because you never know what they'll do for returns.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> So this is only a problem if you generate a key directly on your card instead of uploading it? Nothing else?

I don't really understand why you would do that since there's no way to extract the key from the token once generated. It means that you have no backup. For this reason I always generate my keys on a trusted, offline computer, make a few backups and then upload it on the token. I guess that's one more reason to do so, at least you don't have to trust the RGN of the device.

<comment><USER15> That is incorrect: you can extract the key _once_ when generated on the device (at least with the OpenPGP applet) and hand it to e.g. paperkey for safekeeping.

<comment><USER16> do you have a source that private PGP keys are exportable?

A statement in a blog-post by YubiKey:

> Note that moving usage of an OpenPGP key to a new YubiKey NEO requires that > you have saved a backup copy of the private key on the card as there is no > way to retrieve the private key from any YubiKey, including the YubiKey NEO.

[https://www.yubico.com/2015/04/yubikey-neo-openpgp- security-...](https://www.yubico.com/2015/04/yubikey-neo-openpgp-security- bug/)

<comment><USER15> I have done this myself several times. That comment is accurate, but it's referring to the general case, post key generation.

</comment></comment></comment></comment><comment><USER17> Remediations so far:

\- Chromebook [https://sites.google.com/a/chromium.org/dev/chromium- os/tpm_...](https://sites.google.com/a/chromium.org/dev/chromium- os/tpm_firmware_update)

\- Windows [https://portal.msrc.microsoft.com/en-US/security- guidance/ad...](https://portal.msrc.microsoft.com/en-US/security- guidance/advisory/ADV170012)

</comment><comment><USER18> If anyone is wondering if they are affected: [https://keychest.net/roca](https://keychest.net/roca)

<comment><USER19> How are they able to test my key within seconds?

<comment><USER20> The affected keys are made by Infineon's weird RSA key generator. This produces keys with weird properties, listed in their 2016 paper and more so in the accompanying Technical Report.

The test they released today just checks for the oddest of those properties, if you divide the modulus (the main part of the RSA public key) by some small primes (e.g. 11) and take the remainder then instead of a random answer other then zero (zero would be super bad) you always get specific answers. So the code checks about two dozen small primes in this way.

This probably had nothing directly to do with the attack, but it finds Infineon keys and only those are affected.

<comment><USER21> I think there's some obfuscation in the tests:-

As you say, the first few test numbers correspond just to simple divisor checks:-

Prime 3 paired with check number 6 (binary 110). So 1 << (n % 3) will only ever be 'safe' if n % 3 == 0, which is 'super bad' as you put it.

(2^3)-2 = 6

(2^5)-2 = 30 so this is a similar division check

(2^7)-2 = 126 ditto

I think these are just here as distractions as it starts to sometimes do different things at p=11

11 is paired with check number 1026, which is (2^10)+2 not (2^11)-2). So under what conditions does:-

( 1 << (n % 11) ) & 1026 != 0

Given 1026 only has two bits set (1024 and 2) it's a rather specific test for (n%11) = 1 or 10. All other residues would be safe.

Don't have time to investigate further for the other primes and check numbers but I can only think of some kind of p-1 or p+1 smoothness they can detect this way.

</comment></comment></comment></comment><comment><USER15> From earlier today, the general bug: [https://news.ycombinator.com/item?id=15482441](https://news.ycombinator.com/item?id=15482441)

Cribbing from my comment there...

You should only be worried about this if you generated keys on a vulnerable device, such as a smart card (e.g. Yubikey) or a TPM embedded in your computer. You can detect if your card is affected with a variety of tools, both online and offline:

[https://crocs.fi.muni.cz/public/papers/rsa_ccs17#detection_t...](https://crocs.fi.muni.cz/public/papers/rsa_ccs17#detection_t..).

Fair word of warning: the offline (as in, on-your-machine) tools use a cornucopia of crypto libraries, meaning that it's nontrivial to build. If you're on macOS and don't know what an LDFLAGS is, you probably want the online checker.

Yubikey has their own tool: [https://www.yubico.com/keycheck/](https://www.yubico.com/keycheck/)

How does the attack work? The paper isn't released yet, but here's an educated guess. The authors have already indicated that this is not another variant of [BCCC13], a paper by Bernstein et al that relied on bugs in the CSPRNG of smart cards to find weak, factorizable keys. It does appear to build on earlier research by the same authors [SNSK16]. The detection tool is released, but that only shows us what the "fingerprints" (symptoms of a weak key) are, not how to factor them.

My best guess is that this is a Coppersmith/Howgrave-Graham [HG] style attack. The difference between this and previous attacks is that the problem results from poor prime selection algorithms, not limited entropy. Briefly:

1\. patterns in the small-prime residues of N tell you who made the key with some accuracy (based on 2016 research; I think they're probably not detecting the weakness directly but rather just detecting _other_ artifacts of a device that would otherwise, incidentally, generate poor primes) 2\. a weak prime generator results in a largely predictable prime 3\. Coppersmith allows factoring if you guess sufficient high-order bits of p correctly.

So far the results I'm seeing appear to be cryptographically catastrophic but not so much operationally catastrophic. (please don't interpret this as me speaking ill of the paper: the paper is awesome) The range of real keys I've seen is currently between $40k and $4T (yes, trillion). That's pretty bad if you're running a company CA off of a $40k key, but probably not so bad you can't afford to wait for a replacement in most cases. If the fingerprints are to be believed, some keys can be factored in a matter of hours -- but I have no idea yet what the distribution of those keys is (i.e. is it 1 in 10 or 1 in 10k?). Cost estimates given in the checker additionally bolster my belief that it's a Coppersmith/Howgrave-Graham attack.

As usual, the issue here is different with signing keys and encryption keys. If you're not using forward-secure ciphersuites and merely signing with a smart card key (as you typically would be with smart card-backed SSH or TLS) and instead are really encrypting with the key itself (GPG), you've lost confidentiality on all messages once that key is compromised. A compromised signing key merely allows for forged signatures, and by then you've hopefully revoked trust in that key.

[BCCC13]: [https://smartfacts.cr.yp.to/smartfacts-20130916.pdf](https://smartfacts.cr.yp.to/smartfacts-20130916.pdf)

[SNSK16]: [https://www.usenix.org/system/files/conference/usenixsecurit...](https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_svenda.pdf)

[HG]: [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.144...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.144.4244&rep=rep1&type=pdf)

</comment><comment><USER22> Infineon still haven't said how their hardware is vulnerable?

<comment><USER23> [https://crocs.fi.muni.cz/public/papers/rsa_ccs17](https://crocs.fi.muni.cz/public/papers/rsa_ccs17) covers that aspect of the issue. Discussion here: [https://news.ycombinator.com/item?id=15482441](https://news.ycombinator.com/item?id=15482441)

</comment></comment><comment><USER24> Discussion overlaps with [https://news.ycombinator.com/item?id=15482441](https://news.ycombinator.com/item?id=15482441)

</comment><comment><AUTHOR> It appears that the blog post was removed shortly after publication. Here's what the text has been:

> Infineon Technologies, one of Yubico's secure element vendors, has informed > us of a security issue in their cryptographic firmware library. The issue > weakens the strength of on-chip RSA key generation, and affects some use > cases for the PIV smart card and OpenPGP functionality of the YubiKey 4 > platform.

> FIDO U2F, OTP, and OATH functions of the YubiKey 4 platform are not > affected. The YubiKey NEO, FIDO U2F Security Key and YubiHSM are not > impacted, nor are the deprecated products YubiKey standard and YubiKey Edge. > Externally generated RSA keys are not affected.

> Yubico estimates that approximately 2% of YubiKey customers utilize the > functionality affected by this issue. We have addressed this issue in all > shipments of YubiKey 4, YubiKey 4 Nano, and YubiKey 4C, since June 6, 2017.

> At this time, we are not aware of any security breaches due to this issue. > We are committed to always improving how we protect our customers and > continuously invest in making our products even more secure.

> We offer customers who are affected mitigation recommendations and optional > YubiKey replacement. For more information please refer to our dedicated > customer portal [1].

> The post Infineon RSA Key Generation Issue [2] appeared first on Yubico [3].

> [1] [https://www.yubico.com/keycheck/](https://www.yubico.com/keycheck/)

> [2] [https://www.yubico.com/2017/10/infineon-rsa-key- > generation-i...](https://www.yubico.com/2017/10/infineon-rsa-key-generation- > issue/)

> [3] [https://www.yubico.com/](https://www.yubico.com/)

</comment><comment><USER25> The article has been re-posted! I don't know if the content is the same, though...

mods: Would it be possible to get this article reset, so that it appears at the top of the new list? I was thinking of resubmitting, but I'd rather cimnine get the votes!</comment>


Show HN: Automatic Twitter Translator - <AUTHOR> http://noupload.com/translatetweet/

<comment><AUTHOR> I put this together really quickly to keep up to date on the Japan earthquake situation from my Japanese friends. They post in Japanese which I can't understand, so by adding the hashtag #en the translator will automatically translate and repost the translated tweet to their stream. Hopefully this will help others out as well.</comment>


Dot RB, work portfolio for Ruby programmers - <AUTHOR> http://dotrb.com/ Are you a Ruby developer for hire? Or one who needs a place to put your portfolio. This is a new Ruby developer community for just those things. <comment><USER2> I don't think that hiding the portfolios behind an authentication wall is a good idea.

* They won't show up in search engine results

* You can't casually point a recruiter/hiring manager to view the portfolio - since it's likely they won't bother to sign up

* If you don't see an example of them, why sign up? Who knows what they look like.</comment>


Study: The Most Common Pain Relief Drug in the World Induces Risky Behaviour - <AUTHOR> https://www.sciencealert.com/the-most-common-pain-relief-drug-in-the-world-induces-risky-behaviour-study-finds <comment><USER2> > The findings add to a recent body of research suggesting that > acetaminophen's effects on pain reduction also extend to various > psychological processes, lowering people's receptivity to hurt feelings, > experiencing reduced empathy, and even blunting cognitive functions.

TIL managers are using paracetamol.</comment>


Court Ruling Against Uber Could Have Huge Effects on the Sharing Economy - <AUTHOR> http://arc.applause.com/2015/06/17/uber-driver-labor-classification/

<comment><AUTHOR> Oh, this could get ugly.</comment>


Ask HN: Are you an information addict? - <AUTHOR> Do you check your phone too much? HN? Digg? Your email?
Are there things you really need to do rather than sit here and read HN?
What are you doing to deal with this? <comment><USER3>
      My friends all think
        that I'm a neb
      Cause I spend much time
        here on the web

      The good things here
        I do not abuse
      Except lots of time
        on hacker news

      I don't read reddit
        I will not digg
      I'm not on facebook
        My work's too big

      I do not text
        I do not tweet
      I just work on
        Things that are neat

      I check email
        throughout the day
      But there are no games
        that I will play

      My phone's on vibrate
        I do not chat
      My work is really
        Where it's at

      Knuth and Turing
        are my big heroes
      I love to move
        Ones and zeros

      My head is down
        I'm in the mode
      Don't bother me
        I have to code

      Those who need me
        leave voicemail
      I'm much too busy
        trying not to fail

      I learn on-line
        and from my schools
      But I must avoid
        all sorts of trolls

      I can't believe
        I wrote this ode
      When I have so much
        I have to code

      I'm not an addict
        I have no drug
      I've got to go
        To fix a bug

<comment><USER4> I know a simple upvote is the way to show appreciation here, but this was too good to leave at it. Excellent! Captures a lot of nuances well.

</comment></comment><comment><USER5> Yes. I find myself consuming more and more material that contains information that is more and more trivial.

Today's haul: found out the name and life story of the guy who played "Hoss" on Bonanza. Read an essay on tax policies in a state several hundred miles from my own. Went through an extended interview (linked from here) about life in North Korea. Researched various types of pulse oximeters. And that's just in the last couple of hours.

At one point in my life I would have thought "I have a voracious appetite for new knowledge. This is a good thing" But lately I'm seeing this in not-as- flattering terms. I'm more or less picking up little shiny things simply because they glitter. There's no depth or follow-through. There's no long- range goal of acquiring knowledge in any one area. It's all just stimulus- response.

<comment><USER6> Sounds similar to pure science, which often ends up finding a use (you know that mathematician who deliberately choose an abstract area with no applications so that it would never end up being used for military purposes - and it was)

It's testable: has anything in the past week (say) turned out to be useful in a way that you didn't expect at the time? (hindsight may obscure how useless it seemed before) Of course it might take much longer for its use to appear. Sometimes indirect, eg you learn concepts/principles from taxes in another state, which later help you understand your own state's tax policies (or something else altogether).

</comment></comment><comment><USER7> I am embracing it. I am trying to create a life that will allow me to gather information all day long and get paid to do it.

<comment><USER8> How are you doing it? Care to elaborate?

<comment><USER7> Sure. I identified the kinds of information I like (business and technology). Then I identified the skills I have (technology). Then I tried to find a niche that seemed underserved and combined my interest, skills and met an additional goal of teaching me something new. I'll be posting a link to my site in a few days here at HN - sort of as an official launch.

</comment></comment></comment><comment><USER9> I am an information addict as well.

I get annoyed, when I've already browsed through the HN frontpage and nothing new turns up upon refresh. At those times I wonder if the amount of really interesting, insightful and fresh(!) material produced on the web is still quite limited or if we aren't doing a good enough job of surfacing it according to everyones individual taste.

</comment><comment><USER10> I like long periods of being offline.

Still, looking for information is a common way of procrastinating. So for me spending too much time on HN is an indication that I'm pushing away something to do which actually bores me.

The best way to deal with it is to finish that boring thing and switch into doing something exciting and get "into the phase" with new task.

Sport helps also.

I like and admire community here, you are talented and insightful people, still I've had the best experience here when I just was absorbing information after long periods of being offline and the time I spent here was planned. Also, it was best when I hang around here at the end of the day, not by the morning coffee.

Reading news/email/whatever by the morning coffee, while tempting, is actually harmful for my focus needed to perform things after the coffee. Sad but true.

</comment><comment><USER11> I'm a massive information addict. The problem is that there are always things that need to be done.

I'm going to google information addiction now, see you in a week.

</comment><comment><USER12> I believe there are different types of information addiction. Checking email and IM too frequently is hardly likely to benefit you, but reading Wikipedia and articles related to your profession, for example, can give you a serious edge.

Be addicted to information "assets" and drop the ephemeral stuff.

</comment><comment><USER13> Definitely an info addict here, in your terms... I like to think I let that information come to me through email, one of the only mediums I check and if not, I let my natural curiousity drive me. However, rather than an addict, which might be acceptable, I prefer to call it a case of being a human sponge. I consider the stimulation of my brain to be a great exercise and therefore of great importance, having learned it from a late family member through anecdotal evidence of them having lived a very long and intelligent life. Of course, even too much of a good thing can be bad, so a healthy balance should be encouraged.

I can't help but point to this: <http://www.ehow.com/how_2070387_keep-aging- brain-active.html>

Scroll down to where it says "Exercise the Brain". While I believe the 1st notation is obvious - exercise both body and brain of which I do to deal with it, not everyone has the energy to keep a regular physical regiment. However, I practically endorse #2: _Keep your brain active every day. Play trivia games, do crossword puzzles, word games or read daily._ and #3: _Start something new to challenge your brain. Take up a brand new hobby, learn a new language or write a book. Get on the computer and research something that interests you, like genealogy or your family history._

To answer your question, sitting here and being an info addict are quite possibly two different things. It's all about prioritization and balance - <USER2> that case maybe a better question might be: could one instead be a HN addict?

</comment><comment><USER14> I accept that some people, perhaps even most people, are fully immune to anything like Internet addiction. If you're one of those people, great. I envy you. But I can say from first-hand experience that compulsive Internet use ("Internet addiction" is a casual misnomer at best) is real. Further, I very strongly suspect that low-latency Internet connections, up-to-the-minute news and blogs, and social sharing of content have exacerbated such compulsions by enabling and rewarding rapid-fire consumption and shallow analysis of content.

I doubt these inventions are the only cause of Internet compulsion, but they encourage it in people who have pre-existing compulsive tendencies. Analogously, gambling addiction is known to be caused by excessive dopaminergic activity in the brain, but that doesn't change the fact there would be less of it if there were no casinos.

Many studies show ( <http://bit.ly/deum0v> ) that compulsive Internet use responds to the same sorts of medications used to treat OCD, namely SSRI antidepressants. You might want to consider speaking with a doctor if your use is really that severe. For me, they have helped considerably.

</comment><comment><USER15> I am an information addict.

I am making things worse by compulsively reading blog posts on low information diet: [http://www.fourhourworkweek.com/blog/category/low- informatio...](http://www.fourhourworkweek.com/blog/category/low-information- diet-and-selective-ignorance/)

</comment><comment><USER16> Information is mostly just noise. The actual useful stuff comes rarely, so I try as much as possible to minimize the external information I get that is not important - for example, the news. The news are mostly totally unimportant and irrelevant. If you read the news twice a week, that's more than fine.

I also believe in using tools that pre/filter the info I get so I don|t have to wade through junk to read the info that could be useful to me.

Information gathering can be a big time waste with no direct benefit. But it\s addictive, and hence dangerous.

<comment><AUTHOR> "I also believe in using tools that pre/filter the info I get so I don|t have to wade through junk to read the info that could be useful to me."

Care to elaborate on your methods?

<comment><USER16> Nothing spectacular - I don't subscribe to blogs or forums or newssites, just to news aggregators that allow some form of voting then only read the highest ranked stuff.

</comment></comment></comment><comment><USER17> I consider myself to be an information addict. I spend probably half of my day, everyday, reading news/blogs/books.

The real trick is to not just consume information, but to digest it. I.e. don't merely eat a lot, make sure you have a high [information] metabolism. Understand what you read and share what you understand.

I decided that I'm happiest when I'm learning, so why fight it? I quit my job a year ago, and since then have managed to channel my information addiction to create a very satisfying lifestyle consulting and building my own companies with the information I've learned (and continue to learn).

</comment><comment><USER18> I guess so: I just read all the comments in this thread :/

</comment><comment><USER19> I'm addicted to the feeling I get when I split my focus into a thousand different streams. Yoga seems to be the only remedy for the 54 tabs I currently have open.

When I'm away from my computer for an extended time I feel better physically and spiritually. I also get nothing done. We need to treat these machines with the respect we give hallucinogens and power tools.

</comment><comment><USER20> "We are drowning in information, while starving for wisdom" - Edward Osborne Wilson

That's something I keep in my mind while I'm coding my one-man-startup project. We have a large amount of information disponible but not enough time to consume it, or even we don't get relevant stuff to read. I've been researching NLP, Semantics and TextMining since university but never faced a real word problem to work with.

My actual project register your interests based on your previous bookmarked/visited websites and suggests summarized content from mainstream information hubs like digg, reddit and HN.

Once I get my cloud/infrastructure done with hackspace, I will release a beta test for the first 2^8 pigraph's twitter follower.

<http://pigraph.com/>

</comment><comment><USER21> I am an information addict as long as there isn't anything more interesting that demands my time. If there's something that I need to work on, it had better be _thrilling_.

</comment><comment><USER22> I am trying to use the Pomodoro technique - focus hard for 25 minutes, then relax for 5. This of course requires closing down mail, Twitter etc apps while a Pomodor is running.

Unfortunately I still have problems, it is far too easy to open up a browser window and start looking at Hacker News, Digg, Engadget etc. I am thinking about making my own Pomodoro script which puts all my favourite timewasting sites in /etc/hosts where I can't reach them.

<comment><AUTHOR> The pomodoro technique seems like allowing yourself a hit of heroin every few days, even though you know it's a problem. I've never been able to follow it for long enough for it to be effective. Any tips?

<comment><USER22> I guess you should try to see every time you fail to do a Pomodoro what it was that caused you to lose focus, and seek to eliminate that distraction.

For me, losing flow due to long compile times, having to download libraries or something is a sure focus killer.

And as I said, just idle web browsing is a problem that I should try to take care of. :)

</comment></comment></comment><comment><USER23> I am definitely an info addict, but I have been working on turning that into being a knowledge addict instead. I've been trying for ~2 months, and so far here is what I am doing:

First I have set up an intense learning regime for myself, my first 'semester' is on the basics in a lot of different subjects. (math, physics, nutrition, fitness, programming theory, gardening, writing, photography, chemistry, taoism, buddhism, carpentry and a few others)

Second I have worked up a basic triage system for dealing with all of the information that I have flowing to me: 1st off is it of interest or not, is yes then why? For entertainment or for knowledge? If it is for entertainment then I will read it if I have accomplished my learning goals for the day, if not, oh well, into the trash. If its for knowledge then does it apply to one of my learning topics? If not, then bookmarked for a rainy day or another semester.

For the stuff that applies to one of my current learning topics I apply the methodology from "How to read a book" (recommended to me by someone here, and I strongly recommend it to anyone who wants to read to go from "understanding less to understanding more") and scan it to see if and where it has a place in my learning network/schedule, then put it into my learning tracking database for integration into this or a later semester depending on how it fits.

Its been an interesting couple of months, and I will start blogging about how this process is coming along. After a bit of a wobbly start, and a hard time finding good resources on how to make self-guided learning more efficient I am starting to see good progress in my learning, feel more comfortable with my online consumption and am really starting to make some progress on my start-up ideas and just my life in general.

</comment><comment><USER24> Define "too much," please. :P

I research things I'm interested in and passionate about. I want to know more. I'm an infosec guy by career and I can tell you that there is no way one can master all aspects of it. This should come as no surprise to entrepreneurs, developers, or geeks in general, really.

I'm currently interested in learning more about computer forensics. I have basic knowledge, but want to familiarize myself better with the methods, tools, and tricks of the trade. As usual, I also want to understand the counter of that -- anti-forensics technologies.

All the while, I surround myself with other bits of infosec news and knowledge, industry thought leaders, document what I play with, and eventually write about it to share it with others. There's no sense being a hoarder of information. Sometimes I come up with something genuinely unique. Other times, I feel like more of a curator.

I have other interests as well: bicycling, mechanical repair (think: automotive, appliance, etc) just to name a few. I'm equally as passionate about those things as well, and spend a good deal of my time learning about those things and putting them to practice.

</comment><comment><USER25> I highly agree with the notion that one shouldn't deny one's weaknesses, and instead try to turn them into strengths (as raheemm and joshkaufman have written in this thread). This question, "Are you an information addict?" came at an opportune time, as I just finished reading this gem from Neil Postman, titled "Informing Ourselves to Death."

The talk looks at disruptive technologies, but points out that there are "losers" as well as "winners" when these emerge, and proceeds to explain why information has become nearly meaningless. His conclusions are in direct conflict with what I imagine many people here believe about the boon computers and information have provided to the world, but his argument is an interesting one, and hopefully it will challenge the way you think about this "Information Age."

It can be read here: <http://www.mat.upm.es/~jcm/postman-informing.html>

[edit: found a better copy to link to]

</comment><comment><USER26> I only consume Hacker News via a summarizing service which gives only "top" Hacker News links. I skim my FriendFeed when I don't have time to read in depth, and don't have a problem _not_ clicking on things. I keep my FriendFeed relatively spartan; if a blog, feed, or tweetstream doesn't provide at least 50% interesting posts, I don't follow it. HN is the only linkroll / news site I follow. At the day job, I set my email client to download new mail only once every hour, so the "you've got mail" systray icon won't distract me too often. If it's important enough, someone will show up in person to ask whether I received the email they sent. Only a small set of people ever phone me with any regularity, and I like it that way.

</comment><comment><USER27> My problem is I read a lot, I am open mind to a very wide variety of subjects. I like reading and I know I am not alone with that, here on HN. The main question is: do you use those information somewhere else or it just sticks in your brain for some later usage? Even if I am focused only on information that I am intrested with it is _too__much_ to gather everything. So, filtering. Still too much. Maybe it's time to switch internet off? There will be always something interesting to read/watch/listen but what will you do on blackout?

</comment><comment><USER28> Two things:

1\. I kinda thought I was, then I left for a one month road trip with limited connectivity. When I did have connectivity, I checked email, local news, and HN, and that was it. I had no urge to keep up with anything else. It was kinda nice.

2\. In his _Technological Society_, Jacques Ellul writes the following: "We are constrained to be 'engaged,' as the existentialists say, with technique." Though this was written over 40 years ago, it very much describes our current information age.

</comment><comment><USER29> The only thing that seems to consistently work for me is disabling my internet connection. Freedom (<http://macfreedom.com/>) is what I've used. Apparently it costs $10 now, but also works on both Windows and OS X.

With linux, I expect it would be fairly simple to write a script that did the same thing, though I don't know how it would get enforced.

</comment><comment><USER30> I absolutely am an information addict. I've known that about myself for a whole, and I've tended to embrace it. Information addiction is a facet of a love of learning; to love information simply for the sake of information is somewhat useless, but to love it for the sake of learning, growing, and enriching oneself is a noble goal, I think.

</comment><comment><USER31> I'm mostly an information addict when I'm coding in long stretches. What works for me is taking breaks from focusing on logic, just any sort of different mental direction. That's where HN comes in really handy, and as a matter of fact it's how I came to be on this thread.

</comment><comment><USER32> I just realized I'm an information addict today while reading The 4 hour workweek.

I think I'm going to start by moving my mail icon away from my iphone homescreen, and setting up a few push reminders to ask whether I am focusing on what I want to do and not wasting time.

<comment><USER32> this said, i've realized that these days I spend more time reading entrepreneurship HN/mixergy/kalzumeus/etc. than checking any local/us news anymore.

</comment></comment><comment><USER33> Yes. In my case, it's an avoidance strategy. Avoiding things I am scared of, but actually enjoy when I get into them. I'm learning a better way to relate to that fear.

</comment><comment><USER34> I read so much and retain so little. Everything new pushes out something old. Jason Calcanis might be a dick. I'm still working on my conclusion about that.

</comment><comment><USER15> I am an information addict, and this is what HN makes me do: <http://www.benjamincoe.com/tetris/>

:-)

<comment><USER35> No, you are not. You're just another professional procrastinator ;)

</comment></comment><comment><USER36> Life's a constant struggle against stimulus.

</comment><comment><USER37> I prefer the term infovore

</comment><comment><USER38> A long time ago I turned from effective use of the Internet into a consuming mood. Consuming information. "Enough is enough" doesn't play any role on the Internet. You will never consume enough information and there's always something new to discover. Most of the time the information you read will not add anything to your knowledge, or your productivity. Don't blame the Internet, understand that it is all your fault. If you are a person who likes to procrastinate, prefer to read than to act, you will easily fell in the traps of the Internets. Personally these are my solutions to handle the problem;

If you think something is an interesting read, skim it(or in other words, scan it for useful information), bookmark it for later. And probably you will never spent a lot of time on the article . And if a need for this article pops in your head, you can easily find it back.

Never use on-line documentation for studying or as a reference when doing something productive on the computer. Always download the necessary files (pdfs online) beforehand. Prepare you for your task, collect the information on line but when starting the task: just switch of the Internet, even better don't have any physical connection with the web.

I love a minimalistic desktop, remove the webbrowsers' icons on your desktop or any menu panel. Just start your browser with a keyboard shortcut. The inviting sweet internet entrances, which you're conditioned to press when you want to avoid a task or need an information kick are gone. Recondition yourself when using the new shortcuts: Think about the purpose you want to use the web and what time you want to spent on that task.

You never spent time a lot of time consuming useful information, because you will directly apply this information to anything productive. With the Internet, you find the stuff you want in a glance. The problem is information you're consuming, the interesting stuff you want to read, all the stuff what's coming in an endless stream.

Don't read any opinionated stuff published on an obscure web blog written by an obscure person without any (productive) accomplishments. Probably you won't miss anything useful.

Just check your favorite websites daily, preferably weekly. Try to optimize the interval between visits. If you follow some interesting people or blogs, which doesn't publish daily, just subscribe to the feed using your email.

Allow yourself time on the Internet to do and read anything you like,after work and just set yourself a time limit. Because overall for me the internet is a great discovery mechanism, which increases my productivity. But do it consciously.

Most of the time I don't use the Internet dominantly when I'm sitting beyond my screen. I always need it for something I want to do.

PS I only use Facebook is an interactive address book, twitter to follow some interesting persons and Gtalk/AOl for colleagues, when working on a project.

</comment><comment><USER39> developing recommendation systems.

<comment><USER40> This seems to be the approach du jour to 'curing information overload', but a recommendation system typically manifests itself as yet another information source. In my experience, they always exacerbate the problem.

</comment></comment><comment><USER41> No.</comment>


Show HN: My side project – Laps – Client, Project and Time management - <AUTHOR> http://app.getlaps.com <comment><USER2> Nice work, UI feels good. Some thoughts: I think in this space integrations are key. For example, I would rather use my accounting software (Xero) to create invoices, so just being able to have an Xero integration that creates invoices in Xero would be more useful than Laps invoices, for me. Syncing contacts with Google apps would also be big. I feel like a lot of time tracking software (for example, Harvest) duplicates the functionality of accounting software / CMS.

<comment><AUTHOR> Thanks for your comment, yes i am thinking to add some import / export / sync features, but currently I concentrate on finishing MVP - that means finish projects and add basic invoicing.

</comment></comment><comment><USER3> Kudos to you buddy on getting it out. There's some hard-work required just to overcome the resistance to getting up to this point. And it motivates me to get mine out quicker. Thanks :)

<comment><AUTHOR> Thanks! Yes - it is much harder as it seems @ the start. :) Good luck with your project!

</comment></comment><comment><USER4> When creating an account, if you use a short password it says 'Field name should be between 8 and 200 characters'. I thought it was trying to tell me my first name should be between a certain length at first, but it's the password field.

Tried to create a project, entered project name and the expected income field, submitting closed the modal with no errors, but no project appeared.

<comment><AUTHOR> Hi, yes i am aware or not so good UX on validation process. But tell me more about that project adding failure. Did the project show'd up when you did browser refresh?

<comment><USER5> I'm seeing the same thing. Doesn't appear after a refresh. The request actually gets a 500 and a response of {"message": "INTERNAL SERVER ERROR"}.

Request: [http://i.imgur.com/DM10H46.png](http://i.imgur.com/DM10H46.png)

<comment><AUTHOR> Thanks! This helped a lot, haven't seen that while testing. The thing is that currently you have to create project for contact, if you don't have contact it won't create project. Will be fixed asap.

</comment></comment></comment></comment><comment><USER6> Typos:

"Never lose client! Easily add your client contact info, rates, links and group them by status." Never lose _a_ client!

"Don't miss an update. Create free account!" Create _a_ free account!

"We want to build best tool possible. Create free account!" We want to build _the_ best tool possible. Create _a_ free account!

Also, really love the design.

<comment><AUTHOR> Big thanks for this, will update first thing @ morning! Glad you like design! :)

<comment><USER7> That background image (2000 x 3225px) makes the scrolling really laggy for me. Please remove it or make it smaller.

<comment><AUTHOR> Thanks, will optimise it.

</comment></comment></comment></comment><comment><USER8> Just one suggestion:

"Useful features coming soon"

this indicates that your service is not really useful at the moment :) I'd rephrase it to something that points towards your vision. Or just replace useful with: kickass, amazing, handy.

Do you see this as a competitor for toggl.com?

<comment><AUTHOR> Yea thanks, will change it! You are not the first who is pointing that out. About toggl.com - it is a well established company. Only way how i can compete with them is build better things than they. Currently i don't even want to think about competing, i just want to build something that people use and are happy with it.

</comment></comment><comment><USER9> Nice colours, logo and name! You should have a look at Toggl. I just love how, in Toggl, you can start tracking something without creating a project first.

<comment><AUTHOR> Hi, i am glad you like it - thanks! Yes i know toggl. Laps will have possibility to track time that is not assigned to specific task or project.

</comment></comment><comment><USER10> Nice work! Honestly the design is fantastic!

I guess you are able to do this in your spare time if you are really good at managing your spare time eh?

<comment><AUTHOR> Hi! Glad you like it! :) Yes, but this initial stage took more than it should. The hardest part for me is not finding the time, but staying motivated for long time.

</comment></comment><comment><USER11> Nice work!

FYI: CTA button for creating an account under the "Useful features coming soon" section doesn't seem to be working.

<comment><AUTHOR> Thanks! Fixing that asap.

</comment></comment><comment><USER12> Great work on releasing your app!

I was clicking through your site and the reset password page looks like the styling went wrong. It looks very different than the login and registration pages styling. Please see the image.

[http://d.pr/i/17sOY](http://d.pr/i/17sOY)

<comment><AUTHOR> Oh, thanks for showing this, will be fixed asap.

</comment></comment><comment><USER13> Hi -

After signing up with Google, I get left on a page that says "Hmm..no contacts? Lets fix that! Start adding now!"

What is a contact? - is that me? Is the hourly rate something I have agreed to pay them? Is it what they have agreed to pay me? What if it's not hourly?

Some example there would be great.

<comment><AUTHOR> Hi! This might help [https://www.youtube.com/watch?v=0Ug2IwNcKD0](https://www.youtube.com/watch?v=0Ug2IwNcKD0) ! I did intro video on how i use Laps. I will record new video tomorrow where i explain how projects work.

</comment></comment><comment><USER14> Time tracking and to-do lists -- a good sign that nobody has really done it well is that people keep trying to recreate it. Or maybe it's just an easy subject for people to use as a project.

This looks nice, but for me nothing beats org-mode in Emacs.

<comment><USER15> I think it is an easy subject for non-imaginative minds.

Not talking about this specific project.

<comment><USER16> Unpopular opinion it seems, but I agree. Not that it is a bad thing. It would be fun to see statistics of how many people here have at some point in their (probably early) career built their own time tracking/project management app.

</comment></comment></comment><comment><USER17> The UI/UX looks slick! What tech stack are you using in the main app for your front-end/backend? Who's your hosting provider?

<comment><AUTHOR> Hi glad you like it!

React + Redux - frontend, Flask & MongoDB - backend, hosted @ digitalocean

</comment></comment><comment><USER18> UX looks very slick.

What sets this apart from the plethora of similar tools?

EDIT: Also crate should be create on the homepage ;)

<comment><AUTHOR> Hi! Thanks! Will fix asap! Let me know if you find something else!

</comment></comment><comment><USER19> Looks nice but the parallax is really jerky for me (OS X Chrome).

<comment><AUTHOR> Thanks! Will try to optimise it. If performance won't improve I will remove it.

<comment><USER6> Works great for me (OS X/Chrome). Very nice job all around.

<comment><AUTHOR> Thanks for the info! On my mac works good too. But not looking cool if mouse has sroll wheel. Will chek how to optimise that.

</comment></comment></comment></comment><comment><USER20> What stack are you using for backend?

<comment><AUTHOR> Hi! It is Flask (Python) and MongoDB

</comment></comment><comment><USER21> wow very impressive, how did you manage to do this in your spare time?

<comment><USER22> Creating a time management system sort of assumes that the creator is good at managing time to begin with! ;-)

</comment></comment><comment><USER23> Agreed, neat UI/UX!

</comment><comment><USER24> >>While in beta Laps is FREE.

This suggests in the future you will be charging but as there is no indication of how much, I can't justify spending any time to see if I like something that might end up being too costly to integrate into my workflow.

<comment><USER25> I see this comment a lot on HN. It's a legitimate concern, but I'm curious about what someone can/should do to alleviate that fear for you. Pricing is....complicated...and for a side project that's still being developed, OP may not have had time to think about it yet. Would providing easy export options help? That way when pricing is announced if it's too high for you, you can easily jump ship?

Just curious, because I've had the same feedback a number of times on my side projects and I haven't figured out a good strategy to handle it yet.

<comment><USER24> I agree it's a tough one, especially on a side project. As time is my most limited resource I effectively want to say "hey looks cool, come back to me when it's out of beta and you might have a customer". If I could sign up to a one time email notification for that, it would suit me fine.

Alternatively have a think about pricing plans and display them as rates for beta users, guaranteed for the first 12 months or some such.

Exports are always useful, but I'm more concerned with the time spent integrating a system only to potentially have to find and learn a new one.

Of course, none of these are reasons not to post a Show HN!

</comment></comment></comment><comment><USER26> UI looks nice.</comment>


New York – Why it was time to say bye to San Francisco - <AUTHOR> https://paulstamatiou.com/new-york/ <comment><USER2> He moved about a year before Covid-19 hit New York City!

NYC has outlived its usefulness as a place to live. It's a gleaming symbolic target for terrorists and 3rd-rate nuclear powers so not only would I not live there, I won't even visit.</comment>


"Lost" Steve Jobs Speech: Wireless Networking,iPad,&App Store (1983) - <AUTHOR> http://lifelibertytech.com/2012/10/02/the-lost-steve-jobs-speech-from-1983-foreshadowing-wireless-networking-the-ipad-and-the-app-store/

<comment><USER2> When I listen to the audio in the article I can't but wonder how Steve Jobs was so much ahead of his time. And he wasn't even a programmer, yet he was able to see a lot of the stuff that was about to happen in the near future.

Link of audio for the lazy: [http://api.soundcloud.com/tracks/62010118/download?client_id...](http://api.soundcloud.com/tracks/62010118/download?client_id=0f8fdbbaa21a9bd18210986a7dc2d72c)

Fun Excerpt:

Steve Jobs: "What is a computer program? Do you know what a computer program is?"

Audience: [Quiet. No answer]

Steve Jobs: "Anybody? No? Sort of?"

Steve Jobs: "It's an odd thing [...] computer programs [...] they're simply ideas expressed on paper." :)

</comment><comment><USER3> Just from reading the summary this is really great. Steve Jobs did a lot for computing and for software. I'm an Android "fanboy" and I really hate what Apple is doing these days, but his contribution to digital life today was significant and undeniable.

<comment><USER4> What I respect the most from him is his persistence. I think most people wouldn't really have that strength to go back to the company who fired them, and revive them from near bankruptcy, and do the things they dreamed about a long time ago.

That's very respectable.

<comment><AUTHOR> This is a great point. Especially seeing him work so hard while he was _Sick_. Very. Driven. And these products were like gifts, when we consider what all of the nay-sayers wanted to force-feed us (lookin at lazy record companies, phone-companies, and box-y PC companies, ect).

</comment></comment></comment><comment><USER5> This is really amazing. Surprised that this doesn't move higher up the HN front page.</comment>


US President Donald Trump and Indian PM Narendra Modi Meets for the First Time - <AUTHOR> http://timesofindia.indiatimes.com/india/pm-narendra-modis-us-trip/liveblog/59321959.cms <comment><USER2> Ugh, a faux businessman and an international criminal turned leader of India meet.

<comment><AUTHOR> Supreme court of India thinks otherwise. And its the guardian of the constitution.

<comment><USER2> Of course they would. The country is as corrupt as America has gotten. You think those justices would have kept their heads attached to their necks if they had ruled otherwise? Hah, nope. You don't mess with the BJP in India like in fascist Germany you didn't mess with the Nazis.</comment></comment></comment>


Rust libraries that need to be written - <AUTHOR> https://mail.mozilla.org/pipermail/rust-dev/2014-June/010139.html <comment><USER2> I don't work with Rust, but in general this is a very nice way to present a project's needs, in order to request contributors to help. I hope it works for them.

I also like the pragmatic approach, instead of saying "date APIs are hard, so we'll think until we've cracked it" they just explicitly plan on copying a popular one (the Joda-Time Java API, [http://www.joda.org/joda- time/](http://www.joda.org/joda-time/)).

<comment><USER3> As of now, copying an API is illegal, no?

[http://www.reuters.com/article/2014/05/09/us-oracle- google-r...](http://www.reuters.com/article/2014/05/09/us-oracle-google- ruling-idUSBREA480KQ20140509)

<comment><USER4> It's not _illegal_ , it's just apparently impacted by copyright. Since Joda- Time is available under the Apache 2.0 license, that doesn't seem like an unsurmountable obstacle.

<comment><USER5> I'm not a legal scholar but it seems like Joda-Time's Apache 2.0 license can be rendered irrelevant if Joda copies API spellings from Oracle Java.

For example, Joda has a member function called .getYear(). Oracle java.util.date also has a .getYear(). At the time the author created Joda, the type of restrictive API copyright ruling that Oracle won wasn't part any programmer's mindset. If it was, maybe Joda would have called it .getAnnum() or .getOffsetfromZeroCE() or .getYYYYComponent().

If a company gets to release their API first with a .ToString() ... the next company has to call it something else such as .ReifyAsString() and then then next company after that has to name their API with yet another synonym such as .Stringify().

Continuing that scenario, could one even publish a blog post listing the _complete_ 1-to-1 translation of Company A's API to Company B's API? Could one legally write a program that automatically converts one source code listing's API calls to another? Would those rosetta stone type of publications and dev tools be in violation of API copyrights?

Joda-Time doesn't copy 100% java.util.date but I don't know what the threshold is.

<comment><USER6> Also not a lawyer, but IIRC Oracle won on the grounds that the "structure, sequence and organization" of their API was a creative and copyrightable work, not just the odd descriptive name here and there.

<comment><USER7> One of the circuit court's stated reasons for ruling that the SSO holds for the Java API was because of the names:

      The evidence showed that Oracle had "unlimited options as to the selection
      and arrangement of the 7000 lines Google copied." Appellant Br. 50.  Using
      the district court's "java.lang.Math.max" example, Oracle explains that the
      developers could have called it any number of things, including
      "Math.maximum" or "Arith.larger."  This was not a situation where Oracle was
      selecting among preordained names and phrases to create its packages.  As
      the district court recognized, moreover, "the Android method and class names
      could have been different from the names of their counterparts in Java and
      still have worked." Copyrightability Decision, 872 F. Supp. 2d at 976.
      Because "alternative experessions [we]re available," there is no merger.
      See Atari, 975 F.2d at 840.

[http://www.cafc.uscourts.gov/images/stories/opinions- orders/...](http://www.cafc.uscourts.gov/images/stories/opinions- orders/13-1021.Opinion.5-7-2014.1.PDF)

pp. 30-31.

<comment><USER6> This is a broader point than "it was because of their names." As I understand it, the court is saying that Google copied the whole package structure of Java, including a whole tree of associated names. It's not just that some names happened to match up, but that the whole structure of the Java libraries was considered a creative work and Google copied that whole creative work. The names are a component of that, but you can't point at a name and say "That was the copyrighted thing," because it was the aggregate API that the court considered copyrightable.

(Again, not a lawyer or legal advice. This is just my layman's understanding.)

<comment><USER7> Yeah, I think you're right. It's the wholesale copying of a large chunk of the Java API rather than just the name of one thing.

Tangentially, I really disagree with the ruling. First, we have to figure out where to draw the line: if you can copyright a big API, can you copyright a small one (like, say, Iterable)? Second, there's legal precedent for allowing partial copies in cases where it's necessary for interoperability (Sega v. Accolade). Finally, the appeal for Lotus v. Borland allowed for wholesale copy of a command hierarchy for _user interfaces_ , which has parallels to _application programming interfaces_ that I think any programmer would find obvious. My favorite quote from that case:

      [51] That the Lotus menu command hierarchy is a "method of operation" becomes
      clearer when one considers program compatibility. Under Lotus's theory, if a
      user uses several different programs, he or she must learn how to perform the
      same operation in a different way for each program used. For example, if the
      user wanted the computer to print material, then the user would have to learn
      not just one method of operating the computer such that it prints, but many
      different methods. We find this absurd. The fact that there may be many
      different ways to operate a computer program, or even many different ways to
      operate a computer program using a set of hierarchically arranged command
      terms, does not make the actual method of operation chosen copyrightable; it
      still functions as a method for operating the computer and as such is
      uncopyrightable.

[http://www.law.cornell.edu/copyright/cases/49_F3d_807.htm](http://www.law.cornell.edu/copyright/cases/49_F3d_807.htm)

Anyway, I know you didn't ask for my opinion on the ruling but I just wanted to rant a little :) The circuit's ruling really pissed me off. Programming is hard enough without having to worry about whether or not our APIs are covered by an existing copyright.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I come from an image and signal processing background so for me one of the most important library features is a) a good support of largish one and multidimensional arrays, b) support for FFT and c) some support for linear algebra.

<comment><USER9> If those are your big requirements, you may want to try Julia. Those are the most mature parts of the Julia standard library are very stable, not to mention fast. Steven Johnson, the author of FFTW, which is _the_ FFT library wrote the Julia FFT code and is Julia core developer. I think that it's safe to say for doing FFTs and linear algebra, there's no better system out there.

</comment></comment><comment><USER10> > We've previously made the decision not to distribute any crypto with Rust at > all, but this is probably not tenable since crypto is used everywhere.

This is pretty much why I haven't used Rust for any serious application development. Any HTTP or TCP connection I'd want to make would be over TLS and there are better options than importing c crypto libraries in Rust.

I get what they're trying to do, and the conservative nature is admirable but I just want to "get things done" and while Rust is nice not having crypto is as is mentioned not tenable for application developers.

Crypto is very critical. Many people do not want their application to send their critical data in the clear.

<comment><USER11> Did you read to the end of the paragraph where they say that they're going to implement crypto?

They're not insecure about being able to make a workable crypto api. They are aware that it's not a good idea to implement crypto in a high level language that's not been engineered for security yet.

Their solution is to wrap a proven C crypto library, which is probably what good Go and JVM languages do also (I wouldn't trust one that doesn't) and it's probably going to be ready within a month or two.

edit: just an aside, why would you terminate your SSL in Go/Java, it's good practice to have a proxy like nginx or haproxy do that for you.

<comment><USER10> > Did you read to the end of the paragraph where they say that they're going > to implement crypto?

I did, they said it would take a very long time.

> Their solution is to wrap a proven C crypto library

This is good. I don't have a problem with that, because that's what you'd have to do yourself right now if you wanted to do any kind of basic crypto with rust, include a C library and wrap it with boiler plate just to get it working.

> which is probably what good Go and JVM languages do

Nope, Go implemented their own crypto:

[http://golang.org/src/pkg/crypto/elliptic/p224.go](http://golang.org/src/pkg/crypto/elliptic/p224.go)

[http://golang.org/src/pkg/crypto/](http://golang.org/src/pkg/crypto/)

<comment><USER12> Golang had subject matter experts to do that work.

</comment></comment></comment></comment><comment><USER13> This is like a checklist of all the most horrific libraries to write. I wish them luck.

<comment><USER14> With the exception of HTTP, I'd say it's more that the libraries are unsexy, not horrific.

<comment><USER15> Time is pretty horrific; I've been using the Clojure wrapping over Joda-Time, and while it's nice, this is an intrinsically _extremely_ messy field. E.g. one that requires frequent updates for Daylight Savings Time changes.

<comment><USER16> Yeah, even at the fundamental level, there are fudge factors that vary from year to year and can only be worked out by astronomical observation.

Just measuring what is meant by 'year' is a tricky problem: [https://en.wikipedia.org/wiki/Year#Sidereal.2C_tropical.2C_a...](https://en.wikipedia.org/wiki/Year#Sidereal.2C_tropical.2C_and_anomalistic_years)

</comment></comment></comment></comment><comment><USER17> looking at these libraries that are non-extant makes me think that Rust won't be production ready for quite a time still...

The List:

1\. HTTP

2\. Crypto

3\. Unicode

4\. I18n & Localization

5\. Date/Time

6\. Generic SQL

These are things you can't just throw together quickly, it takes years to do these things right.

EDIT: I see your points guys, wrapping up C code will make some of these things go pretty quickly, and your also right about a lot of production apps - at least low level systems stuff - not dependening on hardly any of these. I suppose I was thinking of this as an app developer, and if your talking about creating desktop apps in Rust, like a Browser or a SQL-Editor etc, every one of these libs has to be at least pretty darn good - otherwise its just a headache for you as a dev.

<comment><USER18> I wouldn't go so far as to say Rust will not be production ready until we have all of this. First of all, not all apps need all of these things; especially systems-level apps don't need most of this. Second, you can easily bind to C libraries that provide these things, making Rust just as production-ready as C is.

Of course, that isn't to diminish the importance of having high-quality, safe, idiomatic implementations of these things, but that shouldn't stop you from using Rust in production.

</comment></comment><comment><USER19> This is very effective because it basically creates a land-grab for any of those libraries. Most people make a prediction that a library they are thinking of writing will be needed/popular, this outright states it, creating a low risk incentive. (Of course it still has to be well written, which is hard).

</comment><comment><USER20> Poor date/time libraries are a major source of long term pain for developers. Hopefully Rust will get this right early on!

</comment><comment><USER21> It amazes me that this language was supposedly written to be the groundwork for an entirely new html engine and yet there has never been a really nice HTTP library; built in or third party. Look at some of the last language hype parties: Node and Go; they both didn't even hit alpha stage before they had fantastic HTTP/networking libraries built in.

I get that Rust is targeting low-level, "systems" programming, but I really don't see how you can't also be a very performant server language.

<comment><USER22>
      > they both didn't even hit alpha stage before they had
      > fantastic HTTP/networking libraries

Rust is not yet alpha. It's still pre-alpha.

<comment><USER23> In fairness though, it's very unlikely that Rust will be distributing an official HTTP library by 1.0 - it's a big, difficult, library, the type which deserves to prove itself in for awhile before settling on. For these types of libs my planned trajectory is to integrate with Servo, make them installable via the package manager, let them stew in the wild until we're confident, then 'flip a switch' and declare them official.

<comment><USER24> Given that people are working on a high quality package manager, what do you gain when you "flip the switch" and make it official, rather than just having it be the most used HTTP package?

<comment><USER23> You don't gain much at that point, and that's the aim: a process that allows the best libraries to smoothly progress from community projects to official components, without any major disruptive events along the way.

</comment></comment></comment></comment></comment><comment><USER25> SqlAlchemy core _is_ a good system to learn from. Great, in fact. It should be fairly easy to preserve the idioms in a way that feels natural in Rust too.

</comment><comment><USER26> You should talk to the golang core folks about time - I believe they have well-informed opinions.

<comment><USER27> Looking at their language design – probably not.</comment></comment>