A hiker in Canada was approached by a cougar. She blasted Metallica to scare it - <AUTHOR> https://www.cnn.com/2019/08/02/us/hiker-metallica-cougar-trnd/index.html <comment><USER2> I hope she paid any applicable fees before playing licensed music for a public venue.

<comment><USER3> This is why you should carry around a live recording -- they're fine with that.

</comment></comment><comment><USER4> "That is, until Gallant opened her phone and chose the loudest band she could think of: Metallica."

Clearly, Gallant is not a Motorhead fan.

<comment><USER5> I recommend "Overkill."

<comment><USER6> The Metallica cover version?

</comment></comment></comment><comment><USER7> Cougars in California appear to be afraid of human voices, not surprising as we are their largest threat. Convincingly demonstrated by this research [1] PDF [2].

[1] [https://onlinelibrary.wiley.com/doi/abs/10.1111/ele.13344](https://onlinelibrary.wiley.com/doi/abs/10.1111/ele.13344) [2] [https://wildlife.ucsc.edu/wp- content/uploads/2019/07/Suraci_...](https://wildlife.ucsc.edu/wp- content/uploads/2019/07/Suraci_et_al-2019-Ecology_Letters.pdf)

</comment><comment><USER8> "Don't Tread on Me" is pretty light as far as Metallica goes. I wonder what the cougar would have done if she had unloaded "Battery" or "Dyer's Eve" on it.

</comment><comment><USER5> As a teenager, I had one those humongous Pioneer radio/amps from the early 80's, a pair of heavy 14"'s and high-end Discman that I blasted "Master of Puppets." No mountain lions could be found.

</comment><comment><USER9> Is it wise to antagonize dangerous wild animals like that?

I would've left it alone and hoped that it did the same in return.

Then again, if I were to start hiking, I'd probably read up on these things so I'm not a complete idiot in the wild.

<comment><USER10> I'm a moderately educated on hiking around cougars and bears. But I'm by no means an expert.

Cougars and Black Bears -> when encountered you want to appear as big and menacing as possible. You scare them off. AKA if you have a coat you hold it up like a cape to make yourself appear really big. The best way to approach a cougar is to scare it off.

Brown Bears -> Make sure there are no cubs between you and the mother bear and back the fuck away. They are faster and climb better than you. Don't try to scare them just go away. (Please read up on this before doing it) but with a bear I believe playing dead is the best way to go when attacked. This is similar to a bull I believe. A good deterrent with a bear is bear mace, if Hiking in a place where there is a bear I'd suggest taking some.

Also there's a ton more to avoiding bear meetings but you mostly need to worry if you see a cub bear.

Edit: if you do start hiking please please do read up on this. Cougars and bears can and do kill hikers even when treated properly. While not the biggest risk to your life in the US, it's still a good idea to go forewarned. Also changed wording in first sentence.

Edit 2: Changed advice to specify brown bear and black bear.

<comment><USER11> Also if a cougar ever attacks you are supposed to fight back. You can also throw rocks and sticks at them. With bears you should make noise and if they attack, play dead (not sure if this is different between black and brown bears. )

Should add: the number of actual attacks is really low and deadly ones are even rarer. Probably pretty much every activity you do during a hike is more dangerous than cougars or bears. Things like driving, dehydration or tripping and falling. The most dangerous wild animal is probably a tick.

<comment><USER12> I wrote out a whole response and did a search to double check myself, and honestly this is a much more comprehensive source. It has everything I was going to say and much much more: [https://www.wikihow.com/Survive-a-Bear- Attack](https://www.wikihow.com/Survive-a-Bear-Attack).

Still:

\- stay calm

\- don't run

\- know when you're in bear country, and talk or sing at a good volume, especially in thick foliage

\- brown vs black bears _do_ behave differently, know how to ID them

\- read the guide I linked!

\- talk to rangers if they're available wherever you're going

I've seen bears running and climbing trees, and it's simply incredible what they're capable of. Above all, cultivate a healthy respect of them before going into their home...

<comment><USER11> "I've seen bears running and climbing trees,"

If you have ever considered outrunning or outclimbing a bear watch these to get an idea of what they can do:

[https://www.youtube.com/watch?v=hURgA_BNSGc](https://www.youtube.com/watch?v=hURgA_BNSGc)

[https://www.youtube.com/watch?v=3vIwNyqIceE](https://www.youtube.com/watch?v=3vIwNyqIceE)

</comment></comment></comment></comment></comment><comment><USER3> I thought the spoiler would turn out to be she played "Nothing else matters"

Edit: I hate to explain these, but the joke is that it is (for them) a slow ballad, and not the kind of thing you expect to be scary.

<comment><USER13> I would have gone with "That Was Just Your Life"!

</comment></comment><comment><USER14> Well at lest she had the good sense and empathy for that cougar to not play anything from the St. Anger album.

<comment><USER15> I was just going through and adding ratings to all the Metallica songs I have in Google Play Music the other day.

Not a single other album gets all thumbs down. It's shocking that not only are their worst songs on that album, but also that there's not a single gem in the rough.

I mean, I thumbs upped several songs on Load and Reload, and those albums are rightly considered pretty bad.

<comment><USER13> The title song is alright. No, not their best, but it's alright. The rest of the album though? Yeah, no.

<comment><USER15> It's far too repetitive for me, I find it extremely grating.

It is at least more pleasant to listen to than Frantictictictictictictic tock.

</comment></comment></comment></comment><comment><USER16> I got attacked by a cougar once, but I doubt that I would have ever gotten to 1st base with her if I had played something from Metallica. She almost certainly would have turned away too.

<comment><USER17> Could you please elaborate on your experience -- where and what time of day? did you see it coming? what did you do when you saw it? what did you do that ultimately allowed you to survive?

<comment><USER18> he's just pulling your leg, he's referring to an older woman. they're known as "cougars". but this lil' thread gave me a laugh.

<comment><USER17> -___- I see</comment></comment></comment></comment>


Pi-Hole v4.2 Available with Shared Memory, New Blocking Modes, and More - <AUTHOR> https://pi-hole.net/2019/02/03/pi-hole-v4-2-available-with-shared-memory-new-blocking-modes-and-more/ <comment><USER2> I want separate blocking strategies by IP range. I.e. one for the entire house (just basically block all ads), and different blocking levels for "kids" devices per age group. Right now the only way to do this seems to be to set up several pi-holes (which is not a problem per se, but cumbersome to maintain and monitor).

</comment><comment> move-on-by I updated a couple hours ago, went smoothly.

> In preparation of the new API we are working on, FTLDNS will now store its > data in a shared-memory space, so that the API can come in and read from > that memory to fulfill requests.

I'm looking forward to the new API and the updated admin site that uses the new API.

</comment><comment><USER3> Any luck installing it within a container in a Synology NAS?</comment>


The Forgotten History of Small Nuclear Reactors - <AUTHOR> http://spectrum.ieee.org/energy/nuclear/the-forgotten-history-of-small-nuclear-reactors?ref=hn <comment><USER2> Here I thought it was going to talk about research reactors like the TRIGA but no, its "small" 400MW power reactors.

The links are interesting, especially the times article an the article on Yankee Rowe but it still compares the cost of fossil fuels in the late 60's with nuclear. That cost equation has shifted quite a bit.

Also for _really_ small nuclear reactors (between RTGs and these guys) are ones from Terrapower and Toshiba which are container sized rather than football field sized.

I would also like to see a better breakdown of costs, those are usually missing.</comment>


Fixing impostor syndrome in coding interviews - <AUTHOR> https://www.interviewcake.com/impostor-syndrome-in-programming-interviews <comment><USER2> Maybe the coding interviews which have nothing to do with the job are the problem. I'd say if you're going to be tested on something you don't actually do, for a job you are qualified for, it is rational to have imposter syndrome.

Also just to add - many REALLY good engineers have some form of anxiety disorder, and the standard practice for an interview is to put them in a pressure cooker situation.

<comment><USER3> I agree that many coding interviews don't test on-the-job skills. But pressure-cooker situations do happen on the job, e.g. production outages, major customers being affected by bugs and threatening to cancel, etc. It's not unrealistic to say that people who can't deal with that are unsuitable for many engineering positions.

<comment><USER4> Well fair enough but I don't see the two qualities as being all that related.

"Oh my god, production is down! Quick, someone tell me, from memory, the solution to the N Queens problem!!"

<comment><USER5> "Production is down. Let's put our heads together to fix the problem!"

vs

(raspy voice) "Wanna play a game? You have 45 minutes to parse this html in assembly using only half a keyboard. Otherwise... you will not be able to feed your family. From us, at least."

I would absolutely watch SAW: The Software Interview

<comment><USER6> > (raspy voice) "Wanna play a game? You have 45 minutes to parse this html in > assembly using only half a keyboard. Otherwise... you will not be able to > feed your family. From us, at least."

Don't forget about interrupting the candidate every 5 minutes to ask about the color of a blue moon, effectively preventing him to "get in the zone".

</comment></comment></comment></comment></comment><comment><USER7> I sometimes have a similar experience reading HN, where seemingly every question receives an expertly detailed answer, regardless of topic. I have to remind myself that it's a bunch of people, each with their own (probably small) set of areas of expertise.

It's often fun to read these "oh, I can say a lot about this" posts, though.

<comment><USER8> It's the reason I like HN so much. There is without fail someone who's been in that industry for a while. On reddit comments like those are rare and often gilded, then make their way over to r/DepthHub, but here I can almost expect them. It's great.

</comment></comment><comment><USER9> Regardless of whether you consider yourself an imposter, do ask clarifying questions! They are generally expected from candidates. If you're not asking them, you're probably hurting your chances.

Source: I interview lots of candidates for SWE positions.

<comment><USER10> Questions are often under specified for exactly this reason: to test ability to ask questions when necessary.

Even if the problem is fully specified, asking clarifying questions is considered a good signal in any interview I've ever conducted.

<comment><USER6> > Questions are often under specified for exactly this reason: to test ability > to ask questions when necessary.

Unless you deviate from the script the [incompetent] interviewer expect, in which case, you are toasted.

<comment><USER11> If you can't make yourself understood to the average engineer at a company, I think it's fair to say there's not a good fit between you and the company.

<comment><USER6> s/engineers/managers/... Who probably ended up there to limit their collateral damage to the company, ie. followed the Peter principle.

<comment><USER12> I'd say that if you're in a technical interview with a non-technical manager, you may've chosen the wrong company to interview with. And if it's a non- technical portion of the interview and you have trouble making yourself understood (to a manager), you're back to the "it's not a good fit" conclusion.

<comment><USER6> It was definitively the "technical interview with a non-technical manager", and yes, I do agree with you, but it's difficult to judge companies beforehand.

<comment><USER12> Fair enough; unfortunate that they put you in that situation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Thanks for the post! Original author here. Happy to answer questions here. I love talking about coding interviews!

</comment><comment><USER14> Sometimes impostor syndrome doesn't need to be fixed. I am beginning to think there's one UC system school which is afflicted by Teaching assistants who shouldn't themselves be able to pass a programming job interview.

I've pointed out to interviewees that user input in one problem can result in circular references. I point out, as a hint, that thing A can refer to thing B, then thing B can refer to thing A, and you'd wind up with an infinite looping execution in one part of the code. How can we detect this? So then these 3.8+ GPA Comp Sci grads tell me to write a conditional that detects a 2-element loop. Not an algorithm that can detect the cycle, but just a conditional that only detects the 2-element cycle. Then I have to ask, well what about a 3-element cycle? To the credit of most of the applicants, they then try to incoherently describe an algorithm involving some kind of hash table, but then never give anything which is implementable. Once, the applicant didn't yet realize there can be n-element cycles, then proceeded to literally handwave away all graph algorithms.

These same applicants usually have a hard time writing their own recursive algorithm. Would you want to trust your startup coding to people who don't habitually think at least one step ahead? Come on! These things used to be covered in the first algorithms class! This should be Freshman Year stuff!

<comment><USER15> Depends what it is? Detecting a cycle is something I learned about a long time ago in a Lisp context, but haven't used. It's simple enough once you know it, but I doubt I could have come up with it on my own without thinking about it for a few days; certainly not on the fly.

For many front-end developers, I don't think graph algorithms matter. I suspect they don't matter for machine learning (though I know little about that field). Would you pass up knowledgeable people in these fields?

This is why you need multiple people to ask a lot of different questions and judge people by what they can do, not what they can't do. And try not to entirely forget about hindsight bias.

<comment><USER14> _Detecting a cycle is something I learned about a long time ago in a Lisp context, but haven 't used. It's simple enough once you know it, but I doubt I could have come up with it on my own without thinking about it for a few days; certainly not on the fly._

When I took Comp Sci, you received some very general, broadly applicable tools. What I'd expect from my Comp Sci classmates, would be looking at such a problem for a couple of seconds, then they'd say, ok, you can do [X]. We were educated with a toolset that allowed us to do that. If you are thinking of it in terms of cycle detection being a particular specific obscure thing that you'd never have to do, let me say this. 1) If you think of it like that, and you further tell me that it would take you a couple of days, then that immediately tells me you don't have a particular, very broadly applicable toolset. 2) There are contexts where you have to do the kind of systemic thinking where cycles are something you have to account for.

There have been fields where knowledge has been lost. The British Navy figured out how to stop scurvy, then lost the ability to do so. The Japanese figured out how to stop the beri-beri deficiency disease, then failed to propagate the knowledge. I am starting to wonder if academia in the Bay Area and California can effectively compete with startups and big tech companies for Comp Sci expertise commensurate with teaching. Maybe only the very top institutions can do this?

<comment><USER15> I don't think graph theory is in any danger of being lost. That seems overly dramatic.

Since people can learn from each other, it's hard to say what people really need to know the day they join the team.

<comment><USER14> _I don 't think graph theory is in any danger of being lost. That seems overly dramatic._

The Brits and Japanese had no idea of the underlying mechanisms, and our society has the underlying comp sci knowledge in our case, archived in libraries. If an entire generation of computer science grads just fluffs graph theory, it's not like the knowledge will be lost, but it's definitely not a good thing. It's definitely a step in the wrong direction.

However, it was not graph theory which was lost. It's a body of engineering knowledge for how to do applied graph theory; how to recognize you have to deal with graph theory, then quickly clobber the problem with several broadly applicable tools. Why isn't this being passed down from one generation of profs and TAs to the next?

 _Since people can learn from each other, it 's hard to say what people really need to know the day they join the team._

It's one thing to know a high level overview about something, then to be able to go and bone up on a specific area. It's another thing if someone doesn't know enough to recognize the thing without prompting and clearly has no practice solving problems of that general category, whatsoever.

EDIT: Isn't anyone curious about what these tools are?

<comment><USER16> > EDIT: Isn't anyone curious about what these tools are?

Um, Not when you are making readers feel incompetent for not having them.

</comment></comment></comment></comment></comment></comment><comment><USER17> I always find impostor syndrome interesting. When I was in grad school I was ignorant of a lot of things and didn't try to fool anyone. Same thing with job interviews. I figured that the profs and potential employers were the ones that knew things and there was no way I could fool them because I didn't even know what I didn't know.

<comment><USER18> Just like becoming aware that my parents weren't little gods, I had the same type of enlightenment with professors and other professionals. I'd put them up on a pedestal for a long time without taking account of my own expertise. It took a good while of them asking me questions before I realized they weren't teasing me for my education but asking because they legitimately didn't know.

</comment></comment><comment><USER19> I did an interview a while ago. I first had a 30 to 45 minute chat with the business owner. After that he called his tech-lead into the meeting who was going to ask me technical questions. He was going to do a white board thing, something with a linked list or something. I refused and asked him what the value on the whiteboard interview was. "To see me think". Why wasn't he present during the first 30 to 45 minutes when I talked about all my experience, he could have seen me think then.

I have interviewed quite a bit because I work as a contractor. Most companies I have interviewed with have no idea what to actually do during an interview. They just copy stuff that they have read about on the Internet. Oh, Google does puzzles, well...

Interviewing is broken.

<comment><USER20> But the problem is lots of people can talk a great game but then turn out not to be able to do the code thing.

</comment></comment><comment><USER21> "For me, it was seeing the back end code wizard on my team—the one that always made me feel like an impostor—spend an hour trying to center an image on a webpage." To be fair, before flexbox this was also true of front-end wizards...

<comment><USER22> Came here to say the same. Centering an image is much harder than it should be, pre-flexbox.

</comment></comment><comment><USER23> Why do people study for interviews? I feel like if I have to study for an interview, then I'm clearly not good enough for the position. Is this common in other fields of study?

<comment><USER24> In software, it's full of the bullshit "Cracking the Coding Interview" types of questions that have very little to do with the actual job. You must study for these because you won't really learn about them in your job as they don't really have anything to do with the actual job, and still have a very high impact on wether you'll get hired at top places or not</comment></comment>


Running Firefox in the Cloud - <AUTHOR> http://blog.davidbieber.com/post/102136421012/running-firefox-in-the-cloud

<comment><USER2> See also Docker Desktop[1], which I'd prefer for something like this.

 _This Dockerfile creates a docker image and once it 's executed it creates a container that runs X11 and SSH services. The ssh is used to forward X11 and provide you encrypted data communication between the docker container and your local machine.

Xpra + Xephyr allows to display the applications running inside of the container such as Firefox, LibreOffice, xterm, etc. with recovery connection capabilities. Xpra also uses a custom protocol that is self-tuning and relatively latency-insensitive, and thus is usable over worse links than standard X._

I know X is kind of outdated in some respects these days, but at times I'm amazed at how much foresight went into it to enable things like this to work.

[1] [https://github.com/rogaha/docker- desktop](https://github.com/rogaha/docker-desktop)

</comment><comment><USER3> x2go and an OVH server with LXDE has helped me several times.

</comment><comment><USER4> Firefox doesn't even work on the desktop and they want to run it on the cloud?

I promptly uninstalled the latest version because of the black screen bug.</comment>


The facts around Zoom and encryption for meetings/webinars - <AUTHOR> https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-encryption-for-meetings-webinars/ <comment><USER2> Zoom! What are you doing?!

> To be clear, in a meeting where all of the participants are using Zoom > clients, and the meeting is not being recorded, we encrypt all video, audio, > screen sharing, and chat content at the sending client, and do not decrypt > it at any point before it reaches the receiving clients.

That is _still_ not what "end-to-end encryption" means. From wikipedia[1]:

> End-to-end encryption (E2EE) is a system of communication where only the > communicating users can read the messages. In principle, it prevents > potential eavesdroppers – including telecom providers, Internet providers, > and even the provider of the communication service – from being able to > access the cryptographic keys needed to decrypt the conversation.

The fact that it's _possible_ to decrypt is what makes this not "end-to-end encryption".

Personally, I am totally fine with their implementation, I just wish they'd stop misusing the term. For the vast majority of users, everything being encrypted over-the-wire coupled with a reasonable policy (eg, employees cannot listen in on random meetings) should be totally acceptable.

If there are people that that _actually_ needed true end-to-end encryption and choose Zoom based on their marketing saying they had it, without doing validation, that's on them (though they're probably right to be upset with Zoom, too, for being misleading). Frankly, that set of people shouldn't be choosing anything they don't control and trust completely (code, hosting, updates, etc) which pretty much rules out any SaaS, so I suspect this set doesn't actually exist in the first place.

Bottom line: Don't call it "end-to-end encryption" if you have access to the keys and _can_ decrypt, even if you choose not to. Market that you encrypt everything in transit, and that employees aren't allowed to access streams. Be realistic in the potential weak points (someone hijacking or able to modify the Zoom infrastructure, PSTN interconnects, non-Zoom clients, etc) and what you do to mitigate those risks.

[1] [https://en.wikipedia.org/wiki/End-to- end_encryption](https://en.wikipedia.org/wiki/End-to-end_encryption)

<comment><USER3> > The fact that it's possible to decrypt is what makes this not "end-to-end > encryption".

By that definition, iMessage is also not end-to-end encrypted because Apple can decrypt the messages due to controlling the key servers and the relay servers, but few people bat an eye when Apple claims iMessage is end-to-end encrypted on its privacy marketing page.

[https://blog.cryptographyengineering.com/2013/06/26/can- appl...](https://blog.cryptographyengineering.com/2013/06/26/can-apple-read- your-imessages/)

[https://www.apple.com/privacy/features/](https://www.apple.com/privacy/features/)

<comment><USER4> Oh, come on, that's not the same thing at all. Here Zoom actively decrypts the stream so that it's compatible with non-Zoom clients and then advertises it as end-to-end, a fault in the protocol itself, while you're comparing it to (outdated, FYI) information where Apple could possibly decrypt messages if they sent out fake keys.

<comment><USER3> > Oh, come on, that's not the same thing at all. Here Zoom actively decrypts > the stream so that it's compatible with non-Zoom clients and then advertises > it as end-to-end

I took issue with a specific definition that precludes both products. I _didn 't_ say that both products use the same protocol.

> you're comparing it to (outdated, FYI) information

Has the implementation changed in any way that makes it meet the definition? No? Then the information is not outdated for our purposes.

<comment><USER4> > I took issue with a specific definition that precludes both products.

This isn't the first time you've tried to compare Zoom and iMessage; it's just that I chose this one to respond to.

<comment><USER3> Have I made a false comparison anywhere else, or was the comparison valid as in this case?

<comment><USER4> You keep drawing parallels between Zoom's end-to-end encryption and iMessage's, when there really is little to compare. iMessage is end-to-end encrypted because intermediaries do not have access to decryption keys; your "attack" relies on a malicious actor tampering with key distribution using a technique that requires even more setup than is described in the old article you've linked. On the other hand, Zoom has been actually decrypting traffic _as a key part of their service_ and yet called it end-to-end.

<comment><USER3> > You keep drawing parallels between Zoom's end-to-end encryption and > iMessage's, when there really is little to compare

Once again, in none of my comparisons have I said they are doing the same thing. Please point to a specific comment I have made that you think is misleading.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> If this pisses you off, it's worth noting that Telegram group chats have the same property, and that Telegram argues forcefully (and falsely) that what they're doing _does_ meet the definition of "end-to-end encryption".

<comment><USER6> Wait, I thought Telegram was worse than that - Zoom does (what appears to be) end-to-end encryption if you have four native Zoom clients in a meeting. Telegram doesn't do end-to-end if you have four Telegram clients in a group chat, right?

(I might be missing something about either Zoom or Telegram)

<comment><USER5> I think you're right! I'm more interested in the double standard (and the dynamics of a pile-on) than the details.

<comment><USER6> Yeah, I'm honestly a bit surprised because I personally would agree with Zoom that what they're doing is "end-to-end encryption." (Maybe it'd be nice if they had a "mandatory e2e" checkbox that you had to uncheck to get a dial-in phone number, but, obviously when I call a number by phone I know there's no e2e going on.)

I think the pile-on is mostly because finding security problems with Zoom is the cool new thing to do. There's been no shortage of genuine security problems with Zoom (and an apparent lack of security culture) but I think we've now gotten to e.g. "you can use Zoom to trigger a Windows design flaw that's been around for years" or "when you set up a meeting anyone can join, anyone can join the meeting" or whatever, and the media is happy to pick that up.

<comment><USER7> If what Zoom is doing in the first diagram is end-to-end encryption, what would non-e2e encryption for that set up look like?

<comment><USER6> Data decrypted when it reaches Zoom's servers, e.g., sending video directly over TLS to a webserver that then sends it to someone else over TLS.

This is what Slack, Skype, Google Hangouts, etc. do.

</comment></comment></comment></comment></comment></comment><comment><USER8> > While we never intended to deceive any of our customers, we recognize that > there is a discrepancy between the commonly accepted definition of end-to- > end encryption and how we were using it.

So you knew that your users would misinterpret the term "end-to-end encryption" but chose to use it anyways. And you somehow expect us to believe you "never intended to deceive any of [your] customers"?

> The goal of our encryption design is to provide the maximum amount of > privacy possible while supporting the diverse needs of our client base.

This statement is at odds with the statement that immediately follows.

> To be clear, in a meeting where all of the participants are using Zoom > clients, and the meeting is not being recorded, we encrypt all video, audio, > screen sharing, and chat content at the sending client, and do not decrypt > it at any point before it reaches the receiving clients.

If you do not decrypt it at any point, then you are admitting you have no legitimate need to decrypt it. If you have no legitimate need to decrypt it, but are retaining the ability to decrypt it anyways, then you are not providing the "maximum amount of privacy possible". If you are communicating between two Zoom clients, then there does not seem to be a reason not to use true end-to-end encryption.

I'm 100% fine with Zoom offering solutions without true end-to-end encryption. The way they have described their "Zoom Connector" solution, I think they've already gone above and beyond most of their competitors. _However_ , that absolutely does not excuse how they have deliberately mislead their users.

<comment><USER9> I don't agree there is a common definition of end-to-end encryption. Ask a random, non-technical co-worker what they think it means and you might get an answer that matches Zoom's marketing claims.

<comment><USER8> I feel like "end-to-end encryption" is a mostly self-explanatory term. All data passed from one end to the other is encrypted.

The point of encryption is to ensure that third parties cannot read your data. If a third party has the power to decrypt and read the data, then it's already misleading to advertise it as "encrypted". That would be like advertising a pair of boots as "waterproof" when they only actually prevent water from entering via the soles.

If the data is encrypted by one end, decrypted by a third party, and received at the other end unencrypted, then the encryption is not "end-to-end". I'm not sure how you could possibly interpret that part any other way.

<comment><USER10> But that's not the question here. That's only talking about when there is a connector involved. For a zoom-zoom only chat, if my encryption works by:

* I generate a key * I give it to you and another party * You and the other party then chat through my service * I pass the messages between you but don't bother to decrypt them

Does that count as end-to-end encryption? At any time, I could decide to decrypt the message (even months later if it is logged).

</comment></comment></comment></comment><comment><USER11> How could they guarantee end-to-end if not all gadgets support encryption?!

Let's demand end-to-end encryption for people connecting via FAX machines to read only the comments.

Of course connecting via unreliable machines / protocols means Zoom must have some bridge on their side somewhere.

In light of this post it looks like for the _majority_ of users it is end-to- end encrypted.

I don't even use Zoom, but really, these attacks are starting to be annoying. From what I've seen all Zoom's reply is bang-on and they will come out of this even stronger.

<comment><USER2> > How could they guarantee end-to-end if not all gadgets support encryption?!

They can't. So they shouldn't.

> In light of this post it looks like for the majority of users it is end-to- > end encrypted.

It absolutely is not. What they can say is for the vast majority of users, the streams are encrypted between all clients, and due to policy, Zoom won't view them as they pass through.

The problem is Zoom _could_ intercept and decrypt streams, if they wanted to, which is why you can't call this "end-to-end encryption" [1].

[1] [https://en.wikipedia.org/wiki/End-to- end_encryption](https://en.wikipedia.org/wiki/End-to-end_encryption)

<comment><USER12> > The problem is Zoom could intercept and decrypt streams, if they wanted to

And we have the spirit of encryption to guarantee they, or a third party who infiltrated/hacked them, won't.

>> and in that spirit, we used the term end-to-end encryption

<comment><USER13> The spirit of encryption? What does that mean? End to end encrypted means from one client through all networks and servers to the other client, no one can decrypt the traffic. Anything besides that is not end to end.

<comment><USER12> It means nothing but this is what Zoom tells us we have. Encryption given "in the spirit" of their intentions.

> Zoom has always strived to use encryption to protect content in as many > scenarios as possible, and in that spirit, we used the term end-to-end > encryption.

<comment><USER13> Oh, I missed your sarcasm originally. I agree that it's meaningless.

</comment></comment></comment></comment></comment></comment><comment><USER14> Zoom marketed end-to-end encryption. They didn't have end-to-end encryption. Parroting the "we used the term differently" line is counterproductive. They need to acknowledge the problem, appoint the CEO as the spokesperson and over correct [1].

If Zoom's CEO publicly apologized for the lies, fixed their marketing copy and offered refunds to anyone who felt misled, this problem would go away.

[1] [https://www.youtube.com/watch?v=PB- AyvgE8Ns](https://www.youtube.com/watch?v=PB-AyvgE8Ns)

<comment><USER6> > _Zoom marketed end-to-end encryption. They didn 't have end-to-end > encryption._

My understanding is that they do in fact have end-to-end-encryption between Zoom clients, it's just that when you join via a dial-in phone number, the connection is (of course) not encrypted between your phone and the system you're dialing into. People who wanted end-to-end encryption could just choose to not dial in by phone, and they'd get it. (People who want end-to-end encryption between phone calls from unmodified phones want something self- contradictory.)

I'm not sure I'd call that "They didn't have end-to-end encryption." Would you say that my IRC OTR session with my friend isn't end-to-end encrypted because I connect to irssi running in a screen session on a remote host and the e2e doesn't go all the way to my laptop?

<comment><USER15> > My understanding is that they do in fact have end-to-end-encryption between > Zoom clients, it's just that when you join via a dial-in phone number, the > connection is (of course) not encrypted between your phone and the system > you're dialing into.

Which means, there is no end-to-end-encryption. Zoom _knows_ the key but does not decrypt the data unless they need to to let a member join via phone. You need to trust Zoom that they keep their promise not to decrypt your communication, there is no technical hurdle.

<comment><USER6> How is that meaningfully different from a system like Signal or iMessage where you need to trust Zoom that when they say "this is Bob's fingerprint" they're actually giving you Bob's fingerprint and not their MITM key? They still need to keep their promise, there still is no technical hurdle.

(Signal gives you the option to verify fingerprints out-of-band but their UI discourages using it; iMessage doesn't even do that. I mean, maybe the answer is we collectively decide to stop calling iMessage end-to-end-encrypted....)

</comment></comment></comment></comment><comment><USER16> Is there any evidence that other teleconferencing solutions meet or exceed what's described in this blog article?

I just find the Zoom hate weird. We have no reason to think Teams, Hangouts, or anything else does anything close to or better than this. Lots of reason to suspect they probably don't.

Don't get me wrong, I think the scrutiny is good, and will lead to positive outcomes. But we probably need to scrutinize all these vendors

<comment><USER17> The video must be decrypted to do the scaling, transcoding, and dynamic bitrate adjustment for different platforms and network speeds – there's no way around this.

All of the group video providers will be decoding video on the server to achieve the reliability everyone wants.

<comment><USER18> The clients can dynamically adjust their sending rate and resolution. It is pretty easy to downgrade your video when not talking. Its also possible to number and label the encrypted frames (I frames or B frames), allowing decimation for low bandwidth clients without recoding, which is expensive and slow.

There are also ways to send additive resolution streams -- a base stream and additional detail layers (multiresolution like JPEG2000).

<comment><USER17> Clients already do this yes, but to achieve the reliability that zoom is renowned for you also need to dynamically adjust what is sent _TO_ individual clients

<comment><USER18> Can the clients not advise the server what bandwidth and packet loss rate they are seeing, so the server can adjust their traffic rate? There is no reason not to allow a signalling channel separate to the E2E encrypted data channels.

<comment><USER19> The server would then have to tell the streamer / talker to reduce their quality for that one client while degrading all other clients that have a fine connection right?

<comment><USER18> If you absolutely must have high frame rate for everybody then you might make that choice. But generally you could just drop B frames from the stream for the slow client, so they get a slower frame rate.

If you wanted to be fancy you could do distributed processing, whereby another node downscales and re-publishes the feed.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> >The Facts Around Zoom and Encryption for Meetings/Webinars

Is everyone doing alternative facts now ? This was a relatively simple thing to clear up, if they wanted to clear it up. They _can_ decrypt whatever they want. So it's not end to end. Claiming otherwise was disingenuous, but putting out some PR spin on top of that is doubly so.

</comment><comment><USER21> Does anyone know how this could technically be possible? For a meeting with all Zoom clients they say they use E2E. When a new participant joins, they are immediately added to the meeting.

Is a new pubkey key generated and passed to existing participants? Is there one shared symmetric key that is sent to the new participant? What stops zoom from "adding a participant" and allowing themselves to decrypt the meeting? Is there no server-side transcoding done at all?

It's obvious phone enabled calls can't be E2E

</comment><comment><USER22> If Zoom literally doesn't decrypt the packets in flight to re-encrypt them, it means they don't have peerwise keys for each client. So (as a non-expert) they're either now lying about something else (and in fact, the data is decrypted on the server temporarily in memory, and re-encrypted for each peer using a distinct key, akin to a WebRTC SFU) or there's a shared secret key between all clients, which is a major security deficiency.

<comment><USER23> The article specifically states that they coordinate the key through their servers.

<comment><USER22> So which of the two is it? A shared secret key among all clients, or individual keys per client. If its the latter, which would be smart, this line is a lie:

"...and do not decrypt it at any point before it reaches the receiving clients"

<comment><USER23> It doesn't make sense to encrypt the traffic differently for the individual users, since you would need to send multiple copies of the stream if the server can't do it (which is also a big downside of all the P2P solutions). It's not smart design for large-scale video chat.

A shared key or different keys per sender (which I don't think adds anything, but I might be missing something) both do not require the server to decrypt/reencrypt, and thus fairly sure that's what they are doing if this is anywhere close to accurate.

<comment><USER22> WebRTC SFUs encrypt traffic differently to the individual users. Each outgoing packet needs to be encrypted with the receiver's negotiated keys, is my understanding. If it was a shared key, then presumably that key could be negotiated among the peers using public key exchange, unbeknownst to the server, and then all traffic be e2e encrypted, which it isn't. I have minimal understanding of what protocols Zoom uses out of the box, but if they don't support e2e encryption, it seems to me they need the keys on the servers for a reason, and the only legit reason would be to trans-crypt the packets.

<comment><USER23> It's a lot easier to implement central key management than a fully e2e system, especially if they do need the key for many meetings anyway on some of their systems.

</comment></comment></comment></comment></comment></comment><comment><USER24> In fairness, it sounds like it's end to end encrypted until a legacy device connects.

Am I misunderstanding something? This doesn't seem like it should be controversial.

<comment><USER25> Is the end to end encryption removed for all clients when a legacy device connects?

I don't understand how some devices could be end to end encrypted in a meeting while some legacy devices in the same meeting are not. How could the legacy devices send and receive to the encrypted clients?

<comment><USER18> It is possible if you think about it beforehand -- genrally you use a tone and/or a visual indicator to show that a transmission is in the clear (unencrypted). Other clients can then have a mechanism to allow speaking in the clear (sometimes requiring PTT -- press to talk). When encrypted transmission is ongoing, the gateway to the encrypted net may output a 'talk tone' that indicates the channel is busy. In this way a low grade client can join the conference, but they hear nothing but beeps (for a pure voice circuit) or see a busy indicator (for IP circuits) until someone wants to talk to them. When they talk, it is unencrypted till it reaches a gateway, after which it is either encrypted with the gateway key or passed unencrypted. (For radio broadcasts you just hear crackle or nothing.)

Obviously for un-trained users you often have the problem where someone transmits encrypted when they meant to talk in the clear, and vice versa. This is the reason for the 'plaintext' or 'ciphertext' side tones. If someone starts talking in the clear when they should not, another participant may choose to transmit over them, known as stepping on their transmission.

None of this requires there be a group key known by a central server.

</comment></comment></comment><comment><USER26> Don't all these products need to do this if one of the participants is using a regular phone? It's just impossible to support phone dial in otherwise. They claim to do end to end encryption if there are no phones on the call.

<comment><USER27> it is unclear how key exchanges can be handled securely in these cases. The post seems to suggest Zoom cannot insert itself as middleman ("without showing on the participant list"). But that contradicts directly to how these "connectors" work.

<comment><USER28> The connectors appear in the participant list - this is a pretty common architecture for all kinds of communications bridging solutions. When someone joins a meeting by phone, Zoom spins up a service that 'assumes the identity' of that phone user to join the meeting (incl. negotiating keys). So, the Zoom service is now a participant in the meeting, but you do know that since a user appears in the participant list.

I have no special insight into how Zoom implements it, that's just how this is normally implemented in a number of other situations (e.g. h.323 bridges).

<comment><USER27> Thanks, that makes sense. I am not familiar with Zoom the product to know the connectors show up in participant list.

I think even if proper e2e channel established, without authentication (Zoom just allows you to join any meeting with a token, like every other Hangout product), the key exchanges with other participants will be very automated. There seems to be very limited security guarantee if anyone can send you a public key in exchange for the current session key to participate in a meeting to begin with.

<comment><USER28> Right, and this is kind of the key problem that Zoom is having to solve right now. The only material you (used to) need to know to join a meeting was a 9-ish digit meeting ID, and since that meeting ID entitles you to negotiate keys, it more or less nullifies encryption guarantees (except the post-hoc guarantee of the meeting host being able to see if something was up).

I would point out that this is in no way unique to Zoom, though. In fact, after the changes Zoom made in response to all of these issues, Zoom probably has the highest by-default level of meeting security of just about any product out there.

</comment></comment></comment></comment></comment><comment><USER29> So essentially any time a Zoom Connector is involved, Zoom has access to the meeting contents since they own the keys. It would be interesting then to know what percentage of all Zoom calls involve a Connector.

<comment><USER18> Who says there is not an invisible Connector? They have the keys.

You have to assume every Zoom call is recorded by Zoom.

</comment></comment><comment><USER30> I've gone from a big fan of Zoom to now a skeptic. I'm wondering if Zoom might turn out to be the CPP's version of Crypto AG.

</comment><comment><USER31> Does anyone know if using the "browser client" breaks encryption? I have been trying to use it to avoid issues with the native app, but if it turns on server-side decryption, that's kind of a big tradeoff.

Glad to hear they have the on-premise option anyway.

</comment><comment><USER32> "Zoom has never built a mechanism to decrypt live meetings for lawful intercept purposes"

Is this a lie or have they not heard of CALEA?

<comment><USER23> Are they classified as something falling under CALEA?

<comment><USER32> yes: [https://apps.fcc.gov/edocs_public/attachmatch/FCC-06-56A1.pd...](https://apps.fcc.gov/edocs_public/attachmatch/FCC-06-56A1.pdf)

</comment></comment></comment><comment><USER33> "Zoom has always strived to use encryption to protect content in as many scenarios as possible, and in that spirit, we used the term end-to-end encryption. While we never intended to deceive any of our customers, we recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it."

In other words, "We deceived our customers with false advertising but we're never going to admit that."

<comment><USER34> "We never intended to deceive any customers when we invented a new definition of e2e encryption"

<comment><USER35> "The business and marketing teams, who have never heard of the term e2e before, looked for a term to describe the feature of having every part of leg of the call encrypted, came up with e2e, and used it in the copy."

</comment></comment></comment><comment><USER36> I love that the address one issue and ignore all the other security holes. They have a structural problem with taking security seriously.

<comment><USER37> They had a separate post about privacy/security in general: [https://blog.zoom.us/wordpress/2020/04/01/a-message-to- our-u...](https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/)

</comment></comment><comment><USER38> wow!! zoom you were better off not having written that blog. you guys are some shady assholes.

Everything from the text to the graphics are intended to mislead and obscure. I don't think i've seen a company act in such bad faith since theranos was a thing.

<comment><USER39> In my opinion they seem better off from this blog post. For example yesterday I read this comment[1] and it seemed to say Zoom always decrypts the content on the servers, in which case it's very bad to say it's "end-to-end encrypted". But this blog post explains that if you don't have any external connector attached, it in fact is end-to-end encrypted, no false advertising. When you have an external connector attached it seems to me very difficult if not impossible to make it end-to-end encrypted, so it's reasonable that it's not. The problem is that they continued to say it was end-to-end encrypted even in that case when it's not and not possible to do so.

[1] [https://news.ycombinator.com/item?id=22754699](https://news.ycombinator.com/item?id=22754699)

<comment><USER38> > if you don't have any external connector attached, it in fact is end-to-end > encrypted,

It doesn't say that all.

<comment><USER39> > we encrypt all video, audio, screen sharing, and chat content at the sending > client, and do not decrypt it at any point before it reaches the receiving > clients.

This seems to say it, but I guess as luckylion points out, e2e doesn't mean not decrypted in the middle, it means no one besides the ends has the key. So you're right, the design they say isn't really e2e encrypted.

<comment><USER35> Devil's advocate: if I take any e2e chat system and escrow the keys from the clients to my server is it still e2e?

<comment><USER39> I'm not sure what escrow means in this context. But if the server has the keys, I would say no, it's not e2e.

This aligns with the definition on Wikipedia too

> it prevents potential eavesdroppers – including telecom providers, Internet > providers, and even the provider of the communication service – from being > able to access the cryptographic keys needed to decrypt the conversation.

</comment></comment></comment></comment></comment></comment><comment><USER40> > For those who want additional control of their keys, an on-premise solution > exists today for the entire meeting infrastructure, and a solution will be > available later this year to allow organizations to leverage Zoom's cloud > infrastructure but host the key management system within their environment. > Additionally, enterprise customers have the option to run certain versions > of our connectors within their own data centers if they would like to manage > the decryption and translation process themselves.

So... privacy is a premium feature requiring you to self-host? Why not just run jitsi for free?

<comment><USER41> Doesn't Jitsi have the same problem? The solution is the same: Run your own server. End to end encrypted videoconferencing does not scale easily without a server.

> Is Jitsi Meet end-to-end encrypted? #409

> ... "yes, [https://meet.jit.si/](https://meet.jit.si/) encrypts the > communication, only the two clients and our server has access to them". ... > [1]

[1]: [https://github.com/jitsi/jitsi- meet/issues/409](https://github.com/jitsi/jitsi-meet/issues/409)

<comment><USER40> Yes... but in one case the software is entirely FOSS and readily deployable via a docker image. The Zoom server is not FOSS, or even accessible through their GitHub.

[https://github.com/jitsi/docker-jitsi-meet](https://github.com/jitsi/docker- jitsi-meet)

<comment><USER41> Right. Let's assume I refuse to take on the responsibility of a videoconferencing server. What are my options to get Jitsi Meet? Can I pay a company to set up and maintain it? Or do I have to hunt for a videoconferencing engineer?

<comment><USER40> It's free if you use their servers ([https://meet.jit.si/](https://meet.jit.si/)), but then you're back to square one in that you don't own the encryption keys.

Scaleway shows how easy it is to configure and deploy on a cloud host:

[https://www.scaleway.com/en/docs/deploy-jitsi-meet-with- dock...](https://www.scaleway.com/en/docs/deploy-jitsi-meet-with-docker/)

Whether or not your cloud hosting is secure is a separate issue altogether. :)

I'm not saying that it's E2EE on Jitsi either, but at least the implementation is transparent.</comment></comment></comment></comment></comment>


Meh: Python configuration files in Python - <AUTHOR> https://github.com/PhilipTrauner/Meh <comment><USER2> > Meh is a Python configuration utility. ... Instead of relying on some kind > of data format like JSON it uses something which I can't believe nobody has > thought of yet: Python.

Setuptools thought of it. You can see it in his own setup.py.

<comment><AUTHOR> Removed that paragraph from the readme. While there indeed are projects that have done this before (Django) setuptools is definitely not a config utility and does not define variables on a module wide level.</comment></comment>


California public schools can't suspend students for disobeying teachers - <AUTHOR> https://www.kron4.com/news/california/california-public-schools-cant-suspend-students-for-disobeying-teachers-new-law-says/ <comment><USER2> It's the new way of the left: reduce crime by making more crimes legal.

I would never allow my kids to be in such a school system.</comment>


GUI's still the pinnacle of productivity, let's help them out - <AUTHOR> Ignore specific technologies, standards, and programming languages for a thought experiment. What's the most productive UI design for regular office productivity? The answer is still GUI's, a technique that's several decades old. All the focus on finger-based mobile and social networks hasn't changed this fact.
While it may be possible to build a highly-productive mobile-style UI, it's difficult to get right and/or requires more user training. The mobile UI world is a sub-set of GUI idioms, for the most part. This means you are more constrained; working with a smaller pallet.
Desktop-style GUI's can fit more on a given screen because the pointer is smaller compared to finger aiming, can have roll-over text for cryptic icons, right-click options, nested pop-ups for drilling down into progressively further detail, and others.
Emulating full GUI's in web browsers has proven tricky. The emulation libraries are huge and often break when new browser versions or brands come along.
If the industry faced the fact GUI's are not going away any time soon, perhaps it would form a good GUI-over-HTTP standard. It could roughly resemble Microsoft's GUI XAML, but be cross-platform, "stateful", and interactive. The Tk or Qt engines maybe can serve as the base for a "GUI browser" or browser plug-in. <comment><USER2> XUL (Mozillas XML-based widgets) or JWS (Java WebStart) seem dead, but I don't know why. They could provide exactly what you ask for -- zero install rich interfaces with better performance then HTML-based ones.

<comment><AUTHOR> I found XUL kind of cryptic and round-about. Maybe its philosophy somehow paid off in the longer run, but it's not newbie-friendly, discouraging fiddlers and experimentation.

And Java damaged its client-side reputation via the Applet fiasco. Namely over-extending itself by trying to be an entire virtual OS, and not paying enough attention to security.

Lessons from these: K.I.S.S., don't drift from mission, and security matters.

<comment><USER3> Actually, what killed both is market size.

Internet boom === small simple apps where emphasis is either on looking good or being very responsive.

That meant that vast majority of developers where not in a market for rich GUI stuff, but for better CSS and smaller size.

OTOH desktop never rewarded simple apps. Distribution and marketability asked for more features exposed via GUI, thus most developers where OK with bigger in scope GUI stuff.

As for "next browser breaks your stuff" excuse, I think it wasn't true for a very long time now. Include polyfills, css defaults reset, do transpiling into less features and you are good to go.

OTOH, web underwent multiple groundbreaking shifts in computational models. This is why complex but somewhat encapsulized/localized Angular/Ember won over spaghetti inducing predecessors and why truly encapsulated/localized Reacts eats old Anguler for breakfast.

One last point would be about crazy stuff in programming languages / programming paradigms that was already available in 60's and 70's at least as a statements of need. Those made for very stable platform on which GUI ecosystems could be build. Relative instability of JS with generational changes can explain why it gets a new ecosystem every few years.

<comment><AUTHOR> Big GUI apps don't need a big download packet, assuming a good "GUI browser" that can shift most domain logic to the server. Just make each window/form/panel an independent packet. An application can have say 5,000 forms, but if you only activate 30, then it only downloads 30 (plus a few reference files for constants and defaults. A pre-loading a larger set perhaps can be on option.)

Re: _" As for "next browser breaks your stuff" excuse, I think it wasn't true for a very long time now."_

I'm not convinced yet. It may be improved, but not solved (mostly because IE can finally be considered dead.) The current candidates have long learning curves, are version fragile, or both. Corporate products tend to target specific browser(s) to reduce the version risk, but that's not really solving the problem, it's reliance on a mono-culture just like MS-Windows.

Regardless, IT still needs a stateful GUI markup standard, at least to help desktops be cross-platform. It would improve desktop standardization even if the Internet ends up ignoring it. The X Window System is a useful idea, but is designed for LAN's instead of WAN's and internet, partly because it doesn't buffer UI i/o, creating too much interaction latency.</comment></comment></comment></comment>


The Ecology of Disease - <AUTHOR> http://www.nytimes.com/2012/07/15/sunday-review/the-ecology-of-disease.html?src=me&ref=general

<comment><AUTHOR> "Disease, it turns out, is largely an environmental issue. Sixty percent of emerging infectious diseases that affect humans are zoonotic — they originate in animals. And more than two-thirds of those originate in wildlife."

The Gaia Hypothesis makes more sense when the ecology of disease is considered. Each organism is one cell which collectively network into a planet (body).</comment>


VC Nick Hanauer: Raise Taxes on Rich to Reward True Job Creators - <AUTHOR> http://www.bloomberg.com/news/2011-12-01/raise-taxes-on-the-rich-to-reward-job-creators-commentary-by-nick-hanauer.html

<comment><USER2> I wholeheartedly agree with Hanauer: Without entrepreneurs and investors, you can't have a dynamic and growing capitalist economy. But without consumers, you can't have entrepreneurs and investors. And the more we have happy customers with lots of disposable income, the better our businesses will do.

As Henry Ford put it, "there is one rule for the industrialist and that is: Make the best quality of goods possible at the lowest cost possible, paying the highest wages possible." A smart man, he wanted all his employees to be able to afford a brand new Ford automobile.</comment>


With Gaza in Financial Crisis, Fears That 'an Explosion's Coming' - <AUTHOR> https://nytimes.com/2018/02/11/world/middleeast/israel-gaza-hamas-palestinian-authority-abbas.html <comment><AUTHOR> To whomever flagged this when I posted it earlier, kindly explain your reasoning.

<comment><USER2> If you think something has been flagged in error, I think the most effective thing to do is contact the mods via the Contact link in the footer. They're quite responsive, and can "unflag" a post if they think it's appropriate.

<comment><AUTHOR> Many thanks for sharing this process.

<comment><USER2> No problem. I often see people post comments like "Why was this flagged?" but they rarely include anything why they think it's a good fit for HN. With the guidelines† in mind, may I ask why you think this submission is a good fit for HN?

† [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER3> I'm intensely interested in the quantitative signifiers of political crises, which I think this article captures well.

<comment><USER2> Certainly. I think it's an interesting article as well. I _am_ specifically interested in the feedback of the person who submitted it, however.

<comment><AUTHOR> Sure, user anigbrowl captured my sentiments exactly.</comment></comment></comment></comment></comment></comment></comment>


Show HN: Is Available – CLI Domain Availability Checker - <AUTHOR> https://github.com/rmlewisuk/is-available

<comment><USER2> This is really great but is there a way to get it to not show all the crazy domain hacks before the actual requested domain?</comment>


Lack of awareness despite complex visual processing in selective metamorphopsia - <AUTHOR> https://www.pnas.org/content/117/27/16055 <comment><AUTHOR> This is interesting.

... We describe an individual with a neurodegenerative disease who exhibits impaired visual awareness for the digits 2 to 9, and stimuli presented in close proximity to these digits, due to perceptual distortion. We identified robust event-related potential responses indicating 1) face detection with the N170 component and 2) task-dependent target-word detection with the P3b component, despite no awareness of the presence of faces or target words. These data force us to reconsider the relationship between neural processing and visual awareness; even stimuli processed by a workspace-like cognitive system can remain inaccessible to awareness. We discuss how this finding challenges and constrains theories of visual awareness.

.. was unable to perceive,describe, or copy the form of Arabic digits 2 to 9

... . Furthermore, he was intact in his ability to read and comprehend number words (e.g.,"five") and Roman nu-merals (e.g.,"XIV"); he initially used these alternative forms to write numbers and perform calculations after the onset of his difficulties with digits. R.F.S. was also able to learn novel"surrogate"digits we developed to replace the Arabic digits 2through 9 (SI Appendix, Fig. S1). Because he could do numerical work with the surrogate digits, R.F.S. was able to remain employed as an engineering geologist for several years after the onset of his disorder (until his retirement in October 2014).R.F.S. continues to use the surrogate digits in daily life (e.g., for jotting down phone numbers or working on his computer, which we modified to display numbers in surrogate-digit for</comment>


In a first, chimpanzees seen smashing and eating tortoises - <AUTHOR> https://www.nationalgeographic.com/animals/2019/05/chimpanzees-eat-tortoises-smash-shells/ <comment><USER2> We have chimps and "chimps" using cell phone. [https://www.reddit.com/r/Damnthatsinteresting/comments/b08v5...](https://www.reddit.com/r/Damnthatsinteresting/comments/b08v5c/chimpanzee_scrolling_through_instagram/)

Turtle smashing mental level requirements are not much higher than social media surfing, but there are plenty of examples they can learn complex sequence of steps and pass it on.

<comment><USER3> "Turtle smashing mental level requirements are not much higher than social media surfing" \-- what leads you to this conclusion? It is not clear to me that this is a trivial statement.

<comment><USER4> I'll second this anecdotally because I have no problem browsing hackernews all day but yesterday I fought desperately trying to crack a coconut for half an hour.

<comment><USER5> Smashing a turtle is far easier than cracking a coconut.

<comment><USER6> African or European turtle?

<comment><USER7> Not trying to be overly pedantic but, turtles and tortoises are two very different things

<comment><USER8> Tortoises are a species of turtle ("Testudinoidea")

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> they are apparently delicious [https://www.theguardian.com/books/2004/jul/31/featuresreview...](https://www.theguardian.com/books/2004/jul/31/featuresreviews.guardianreview7)

</comment><comment><USER10> This is cool, but percussive techniques are not limited to chimps. e.g. bearded capuchins use what is essentially a hammer and anvil to break nuts: [https://www.livescience.com/27524-nut-cracking-monkeys- skill...](https://www.livescience.com/27524-nut-cracking-monkeys-skilled-with- tools.html)

<comment><USER11> If I call correctly sone birds do this too, using stones to break nuts. Was probably some kind of corvid.

<comment><USER12> I've seen crows drop walnuts in front of oncoming cars so they'll get run over. Corvids are smart birds.

<comment><USER13> I'll take that and raise you "casual understanding of water displacement by a crow'

[https://m.youtube.com/watch?v=ZerUbHmuY04](https://m.youtube.com/watch?v=ZerUbHmuY04)

</comment></comment></comment></comment><comment><USER14> They've never been documented eating any reptiles? Not even something trivial like lizards? That seems so odd, I don't know why but I assumed they ate just about everything.

<comment><USER15> As far as my brief reading has got me, despite what was my general understanding until now they generally eat very little meat at all [1]. I guess it makes sense in this case that they're never been found eating reptiles.

[1] [https://blogs.scientificamerican.com/guest-blog/how-to- eat-l...](https://blogs.scientificamerican.com/guest-blog/how-to-eat-like-a- chimpanzee/?redirect=1)

</comment></comment><comment><USER16> Well, this is terrible news on World Turtle Day.

</comment><comment><USER17> I'm fascinated that tortoises are in fact _reptilian_ since I'd previously thought that reptiles were a strictly meat-eating class. Also that an ancient battle formation was named after them.

<comment><USER18> Marine iguanas, found on Galapagos, are another counter-example to reptiles being strictly meat-eating:

[https://en.wikipedia.org/wiki/Marine_iguana#Feeding](https://en.wikipedia.org/wiki/Marine_iguana#Feeding)

>The marine iguana forages almost exclusively on red and green algae in the inter- and subtidal zones.

</comment></comment><comment><USER19> Cue _Also Sprach Zarathustra_

<comment><USER20> >You're in a desert and you're walking along in the sand and all of a sudden you look down and...

</comment></comment><comment><USER21> It's fascinating to see evolution unfold before our eyes that may replicate our own evolution circa 5-10 million years ago.

<comment><USER22> Why is this evolution? I imagine this is nothing new, we just hadn't seen it before.

<comment><USER23> I'm a little flabbergasted that the idea of animals using tools is so groundbreaking. I've seen squirrels pick apples up off the ground, climb to the top of a tree, and drop the apple over and over again to break it into small convenient pieces. I've seen birds do the same thing too, with shellfish. You see all kinds of stuff when you have your eyes open.

<comment><USER24> Wait until chimps figure out how to refine oil and use combustion engines.

<comment><USER25> When you consider the effort to get to that stage of locomotion it's amazing that flying birds haven't advanced faster technologically.

<comment><USER26> I guess birds (and most animals) have a hit a local minimum that they'll never climb out of.

<comment><USER27> Humans got lucky with figuring out fire. Fire simplifies everything.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: How do I stop caring about success? - <AUTHOR> I feel that I am overly obsessed with success. Making money. Attaining prestigious degrees and working for the right companies. Having an understated Twitter bio with 200K followers.<p>I recognize that it is a flaw that mostly serves to make me feel needlessly inadequate, even though I know it has also done some good in my life. But it's not exactly a switch that I can turn off. <comment><USER2> From just what you've written, it seems that this has more to do with your measure of success rather than success itself. You're looking for external factors to validate your success - Twitter followers, salary, names of companies on your resume. Ultimately, you have no control over whether someone decides to follow you on Twitter, hires you, or offers you an awesome salary/decides to invest in your startup. Sure, you can do all sorts of things that will motivate others to do those things, but that's not ultimately in your hands.

I think you would be better served if your measure of success came from within. What do you want to do? What goals do you want to accomplish? Which of those are in your power to do? I can make an awesome web app, but I can't make someone buy a subscription to it.

</comment><comment><USER3> i can relate to what you're saying.

perhaps you have been listening to a certain set of messages, too loudly, for too long (the media is good at doing that to us.). you'll have to address this fact if you want to stop caring about external success. be honest with yourself: do you really want a phd bad enough to sacrifice 5 years and put in a lot of hard work? and sacrifice all the other things you won't do in those 5 years? maybe you do, maybe you don't, but it has to be something internal that drives you ultimately.

replace all the inputs going into your brain with some good reads and a journal to take notes in.

A couple good reads: \- Seneca. he talks about not worrying about what fortune can give and take away, and to focus on things like virtues instead.

[http://stoics.com/seneca_essays_book_1.html](http://stoics.com/seneca_essays_book_1.html)

\- James Allen's "From Passion to Peace" \-- he explores the conflict between passion vs aspiration

[http://james-allen.in1woord.nl/?text=from-passion-to-peace](http://james- allen.in1woord.nl/?text=from-passion-to-peace)

And serious fiction is always great too: Hemingway, Raymond Carver.

Hemingway: "There is nothing noble in being superior to your fellow man; true nobility is being superior to your former self."

</comment><comment><USER4> It's not a flaw. It's a drive. It should push you to better yourself and others around you.

Don't fall into a slump, just continue to learn and create until you are that successful.</comment>


For Quebec, a French Woman May Not Be French Enough - <AUTHOR> https://www.nytimes.com/2019/11/08/world/canada/quebec-french-woman.html <comment><USER2> The decision has already been overturned: [https://toronto.citynews.ca/2019/11/09/quebec-overturns- deci...](https://toronto.citynews.ca/2019/11/09/quebec-overturns-decision-to- deny-french-woman-immigration-documents-over-language-issue/)

<comment><USER3> Mistakes like this happen all the time. What's truly telling is how fast it was reversed.

One could argue its only because it got national coverage but I don't think we know for sure.

Ultimately I don't think it matters unless we start seeing a recurring pattern.

<comment><USER4> There already is a recurring pattern. Not exactly like this situation, but a pattern of discriminating against anything that is not French. It's getting completely out of hands. Soon, "non historic anglos" (ie immigrants) won't be allowed to get their hydro bill, correspondence from the government or _any_ service in English.

We moved out of Quebec mostly for the politics 5 years ago and I'm so glad I did. We're never going back.

<comment><USER5> I think it's perfectly normal for people in a small enclave nestled in the heart of the giant Anglo-saxon hegemon to feel insecure about the long-term survival of their unique language and culture and want to take extra steps to preserve it. I'm completely sympathetic with them refusing to provide services in a foreign language when that language is a serious threat to their existence as a cultural group.

Look what happened to French in Louisiana, or Irish in Ireland, or Native American languages across the continent. Quebecers don't want that to happen to them, and I can't blame them.

By the way, always remember that Quebecers never chose to become part of Canada or any English-speaking society; they were conquered by military force.

<comment><USER6> In Quebec City they are loudly proud of how many Anglos they have driven away. They pretty much purged the city of anything non-French in the two last decades and are displaying it as a success story.

For me, displacing large communities based on their mother tongue is nothing to be proud of. Be it either way.

<comment><USER5> Citation needed? I'll concede that I haven't lived there so I could be wrong, but I've been to Quebec city twice, including once with people who spoke no French at all, and never felt any hostility. Again, I'm not disputing that it could be different for the local Anglo minority, but I'd need to see some sources before I believe that you're not exaggerating.

<comment><USER7> There's a difference between a tourist and a local. As a tourist you bring dollars. But try getting any government service in English and you'll get eye rolls and rude behaviour. Even cops in Montreal will not speak English generally.

<comment><USER5> How many governments around the world provide services in a foreign language?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I find this extremely embarrassing. I'm all for the protection of French in Quebec; but stupid decisions like this makes us look bad internationally and make no sense at all. I went to Laval University too, and guess what: my whole thesis, not just one chapter, was in English. Yet, I didn't speak English until I was 18. Am I not French enough for Quebec?

I hope the employee who made this call will get in trouble. English is the language of science at the international level; mandating theses to be written in French (universities don't actually mandate this, but immigrants could now be scared to write it in English) will limit the reach of Quebec's science.

<comment><USER9> I don't support the original decision either, but the blame does not belong on the immigration officer for following an unreasonably strictly worded rule requiring studies to be "entirely" in French.

Yes, most officers don't read this particular rule literally, but immigration rules in general do and should apply literally instead of assuming that officers will always violate what the rule says in favor of contradictory judgment calls.

The fix should include replacing "entirely" with whatever they actually mean in the rules for the program. Most similar eligibility criteria in other contexts use phrases like "main language of instruction", some variation of which would work fine.

</comment></comment><comment><USER10> Quebec language rules and the minions that enforce them can be quite pathetic. Just a couple of months ago, the debate be was about the right of shop-keepers being able to greet their customers in both English and French, or only in French. Totally ridiculous.

I am also a native French speaker from Europe, and left Montreal because of the backward mentality. I totally respect Quebec's need to protect their heritage, but you can't force it down people's throats. It is counter- productive. It wouldn't be so funny, if Quebec French wasn't so hilarious to listen to... they took perfectly good French and turned it into something that is often unrecognizable.

<comment><USER8> Why would _you_ get to decide which French is the _good_ French? Formal register Quebec French is totally fine. Of course, on the street you can hear pretty deformed French, but guess what: in France too. That's just how language registers work.

<comment><USER10> I'm actually from Belgium, which is in a very similar situation as Quebec: (a) heavy accent which the French love to make fun of and (b) where language wars have been raging forever and taken to ridiculous levels. This mentality of wanting to keep a culture 'pure' by trying to control how and where language is used, is a losing battle. Some Quebecers, just like purist francophone Belgians have taken this language obsession to irrational levels, and it has knock-on effects in other aspects of daily-life. I wish Quebecers would just lighten-up about it..

</comment></comment></comment><comment><USER11> I am French, in love with my language which I find to be the most beautiful in the whole universe.

I wrote my PhD thesis entirely in English because this is THE language we communicate in internationally. Sure I world prefer it to be French but it is not.

People who do not see that are still fighting for everything to be in French, in French companies working internationally. The idea is that we are in France and French should not be forced to speak another language in their own country. Yet they choose to work in an international company.

I like the rational approach in Nordic countries who teach English early (we do as well) and do not believe that striking will miraculously make the whole world pamper us.

</comment><comment><USER12> As a French (from Paris ) I have hard time understanding there French and I rather understand when they speak English , but I don't ask them to switch to English because I know that would drive them mad if I do

</comment><comment><USER13> Throwaway; Response posted in case someone Google this and find this thread (Happy to see this is off the front page as this type of content doesn't belong on HN).

What's interesting with this story is to see the different media coverage it received in French and English media. The French ones gave a little more context into why her application was initially denied. Basically she didn't fill the application properly.

I've known multiple people who used the exact same program as her to immigrate. There is no language requirement for courses or thesis. However, having followed all courses in French and written a full thesis in French removes the requirement to pass a standardized French test (think TOEFL). According to the CBC article in French[1] she was warned when she started writing it that unless she translated the chapters written in English she would potentially have to pass the Standardized French test as it wouldn't be adequate to waive the requirement for a test. She ignored this warning and decided to submit her application anyways.

Later, as warned by the university officials, she received a request for evidence. She either had to pass a Standardized test OR demonstrate three years of high school level education in French (from the folks that I know who went through this, a simple copy of a French high school transcript is good enough).

She had two months to give a response but apparently waited 4 months (it's not completely obvious from the article and completely omitted from the English CBC news one [2]) to respond.

The ultimate reason why she was denied is never explicitly stated. It seems that she switched jobs while her application was pending and became a freelance illustrator. The immigration program she applied for specifically prohibits self-employment. Either that or she sent the required evidence too late and they closed her file.

tl;dr : Her paperwork was incomplete. She was warned several times and ignored a request for evidence for several months & switched to a job specifically not covered by the immigration program she was applying to.

Case closed. [1] [https://ici.radio-canada.ca/nouvelle/1378665/immigration- que...](https://ici.radio-canada.ca/nouvelle/1378665/immigration-quebec- francaise-refusee-chapitre-doctorat-anglais-universite-laval) [2] [https://www.cbc.ca/news/canada/montreal/french-thesis- immigr...](https://www.cbc.ca/news/canada/montreal/french-thesis-immigration- caq-1.5351155)

</comment><comment><USER14> I wonder if anyone had a similar experience with English proficiency test</comment>