FBI files on Richard Feynman   - <AUTHOR> https://www.muckrock.com/foi/united-states-of-america-10/fbi-files-on-richard-feynman-1165/#366875-responsive-documents <comment><USER2> None of the controls on the document viewer are sufficient to see anything but the two-page cover letter. After several minutes of head-scratching, I figured out that you have to click on the tiny, illegible thumbnails under the viewer to see the actual FBI file.

Fantastic UI here.

<comment><USER3> Thanks for the feedback. Would love to hear about better embedded options. As far as we can tell, they almost all have drawbacks.

<comment><USER4> > Would love to hear about better embedded options

How about just posting an image of the first page with an href to the raw pdf? I could then simply read the pdf in my browser. The embedding adds nothing.

</comment></comment></comment><comment><USER5> #178: "the applicant's wife was suing him for divorce charging him with 'playing the bongo drums too much and studying physics the rest of the time'"

#184: "a deeply ingrained belief that he had a superior intellect and that he could do no wrong. <redacted> self-centered, opinionated, dogmatic and extremely egotistical. <snip> She said that her personal feeling is that FEYNMAN is without character or acceptable moral fiber." Seems not everyone was a fan of Mr. Feynman.

Multiple references to The Communist Party and statements from anonymous informants within the party around #170. More about the Young People's Socialist League at #245

<comment><USER6> > Acquaintances state appointee and wife divorced over year ago and have no > reason to question moral character of either. Pertinent news articles re > appointee set forth including article reporting divorce result of > appointee's interest in calculus and African drums and his choking wife and > smashing furniture when interrupted by wife.

I kind of have to wonder if Feynman would have been diagnosed with ADD in this day and age. ADD folks tend to hyperfocus on stuff like that, and unfortunately it jars relationships (ADD people have a 50% higher divorce rate)

<comment><USER7> In the present day war on boys and brains, our institutions would have had Feynman locked up and medicated at age 5.

<comment><USER8> "War on boys and brains" and "locked up" are rather florid characterizations of the ADHD condition and its treatments.

</comment></comment></comment></comment><comment><USER9> Here is the direct PDF link for anyone interested @ [http://s3.documentcloud.org/documents/366921/responsive- docu...](http://s3.documentcloud.org/documents/366921/responsive- documents.pdf)

<comment><USER10> I wonder which prominent physicist tried to throw him under the bus in the letter beginning on page 110? Teller, maybe?

<comment><USER11> Given the following passage

> There are many able and eminent physicists [...] Some of these persons are > practical physicists--with a very thorough knowledge of creative as well as > theoretical physics and of the scientific world--not mere mathematicians as > is the case of theoretical physicists.

(these people, if one reads on, being considered by the author as better candidates than Feynman) I'd have guessed someone with a less theoretical background than Teller. It could just be an attempt to appear impartial, I guess.

<comment><USER12> Accusing someone of being a communist is hardly impartial.

<comment><USER11> I wasn't for an instant suggesting that the person who wrote that anti-Feynman screed _was actually_ impartial, nor that they expected to be thought not hostile to Feynman.

But a theoretical physicist might have thought their attack would look less like a matter of professional jealousy if they couched part of it in terms of how much more appropriate an _experimental_ physicist would be.

(I don't think that's very likely. I think the person who wrote this was probably not a theoretical physicist. That's why I think it was unlikely-ish to have been Edward Teller. I was simply pondering possible reasons why a theoretical physicist like Teller _might_ have written those words about theoretical versus not-so-theoretical physics.)

</comment></comment></comment></comment></comment><comment><USER13> Interesting story on pages 207 and 208. Feynman is giving a lecture entitled, "What one scientist thinks of religion", and gets into a debate with the head of the School of Religion at Caltech.

A few interesting quotes including this one:

"No one can be sure of anything. We must frankly admit we don't know. It keeps our minds open...We must think about what the universe means without man. If we can't, it makes us 'the center of the universe...hard to believe.'"

<comment><USER14> This makes me thankful for digital culture/internet in general. If it were today, that lecture would be available, very likely free for everyone on youtube. Instead, it's lost forever.

</comment></comment><comment><USER15> One of the hazards of extreme paranoia is that occasionally your paranoia will _create_ that which you fear: [http://en.wikipedia.org/wiki/Qian_Xuesen](http://en.wikipedia.org/wiki/Qian_Xuesen)

<comment><USER16> Was good they did as well given the situation with NASA and launch vehicles, at least it means that some folk are going back to the moon.

</comment></comment><comment><USER17> From page 151:

is so unpredictable that "you cannot determine what his reaction would be in any particular set of circumstances." ____ stated that FEYNMAN was known at Los Alamos as a reactionary, because he was so conservative in his ideas and would not go along with the ideas of many of the people there of the same profession who were much less conservative in thetr thinking than he was. ________ stated he considers FEYNMAN to be a person of good character and completely loyal to the United States.

...

____ stated that FEYNMAN is not the type to be influenced by people such _______ as he makes up his own mind concerning every problem and a inclined to make a decision although this decision will not be popular with the group with which he is in contact.

</comment><comment><USER12> All these references to his atheism. As a European, it's hard to believe that that was/is so important.

<comment><USER14> As a South American (Brazilian, biggest catholic nation by numbers), it's the easiest thing for me to believe. Outside intellectual/academic/art circles, stating you are an atheist = stating you are a satanist, almost.

<comment><USER18> No not satanist, communist. The communists had a bit of a "thing" for atheism and the general public is pretty stupid about the use and care of Venn diagrams, so for them its close enough that a commie is an atheist so an atheist must be a commie, right? And even worse, the communists did have operatives in the Manhattan project, it wasn't just paranoia.

The other part that really pisses off law enforcement is church members are expected to provide great references for each other. And every clearance "disaster" involved an agent or whatever clearing a bad guy, which is kinda bad for that agent. So when its review time for the security officer who Fed up, he really, really wants to be able to say something like "Well, yes, he did turn out to be an axe murderer. And yes, there were bloodstains in the carpet of his pleasure dungeon and the neighbors did report occasional screams. But his religious leader is just one step away from God himself, and he said he was a great fellow who tithed generously and who are we to declare ourselves more holy than gods representative on earth so clearly I shouldn't be disciplined because either a direct representative of St Peter was also fooled OR disciplining me would be an insult against religion itself" Just a big exercise in CYA.

</comment></comment></comment><comment><USER19> Read how much paper was spent on trivial and basic details, then imagine how much more and how much easier they'd be able to dig up using the electronic surveilance of today.

</comment><comment><USER20> Skimmed through it, seems fairly routine given the SOP of the time. What I did find interesting that I was previously unaware about was his association with Oppenheimer and what is blanked out but is likely some sort of communist organization. Followed that rabbit hole and learned that Oppenheimer had his security clearance revoked (which is why here his association is referenced as notable.)

<comment><USER21> He and Oppenheimer worked together on the Manhattan project. Why would that be surprising?

<comment><USER22> I've seen interviews where Feynman talks about how everyone else was intimidated by Oppenheimer, while he was too excited about the physics and ideas to realize he should be intimidated. I also think the PBS documentary "The Trials of J. Robert Oppenheimer"[1] was really excellent.

However, I can just easily imagine not having come across either of these before.[2]

[1] [http://www.pbs.org/wgbh/americanexperience/films/oppenheimer...](http://www.pbs.org/wgbh/americanexperience/films/oppenheimer/)

[2] [https://xkcd.com/1053/](https://xkcd.com/1053/)

</comment></comment></comment><comment><USER23> For a site (muckrock) dedicated to transparency I'm wondering why there is no easy way to find out (without apparently signing up) what they charge to make these requests on someone's behalf. [1]

[1] [https://www.muckrock.com/accounts/login/?next=/accounts/buy_...](https://www.muckrock.com/accounts/login/?next=/accounts/buy_requests/)

<comment><USER3> $20/one time to file 5 requests. $40/month for 20 requests plus additional features. Full info here:

[https://www.muckrock.com/accounts/register/](https://www.muckrock.com/accounts/register/)

Slowly working on our registration flow, which is admittedly somewhat confusing now.

<comment><USER23> Thanks.

You should place a link at the top which clearly says "pricing". And putting that link in the faq and all the other obvious places.

Another thing I would suggest (and I can help with this actually) is a different name for the actual requests. I suspect that some people in government might take this more seriously (not that they aren't) if the requests came from a different (more serious) entity name. I can't back this up with anything other than being in business for a long time and knowing human nature and from my own experience.

When I saw the first think you did I though it was some kind of comedy or non serious organization trying to just stir up trouble. Even if only 10% of the recipients feel the same way as I do that's an issue.

</comment></comment></comment><comment><USER24> For those interested in a summary, here's MuckRock's article on these files: [https://www.muckrock.com/news/archives/2012/jun/06/feynman-f...](https://www.muckrock.com/news/archives/2012/jun/06/feynman- files-professors-invitation-past-iron-curt/)

</comment><comment><USER12> "I do not know--but I believe that Richard Feynman is either a Communist or very strongly pro-Communist--and as such is a very definite security risk. This man is, in my opinion, an extremely complex and dangerous person, and a very dangerous person to have in a position of public trust,"

Page 110

</comment><comment><USER25> So how does (did) a special inquiry like the one that was performed on Feynman work? It looks like publications were searched and people were interviewed, but does anyone know how those searches were prioritized? I've googled a bit and haven't been able to determine if there's any established procedure that doesn't rely heavily on the discretion of the officials performing the investigation.

</comment><comment><USER26> So some Christian FBI agents hated him because he was not Christian but atheist?</comment>


Twilio Releases Subaccounts for Multi-Tenant Apps - <AUTHOR> http://blog.twilio.com/2011/02/announcing-twilio-subaccounts.html

<comment><USER2> The documentation suggests basic admin things like transferring numbers to subaccounts require an API call. It would be nice to be able to do this using Twilio's web interface.

<comment><USER3> Last time I played with Twilio (more than 14 months ago, IIRC); i just created a repl for it and started using it instead of the web or naked API. It's a good idea to get in the habit of creating mini shells that expose _just_ the command you need.

I think Norvig's PAIP has a utility for generating shells, if not, write one.</comment></comment>


A Very WebP New Year from Cloudflare - <AUTHOR> https://blog.cloudflare.com/a-very-webp-new-year-from-cloudflare <comment><USER3> > For example, a JPEG image at > [https://example.com/picture.jpg](https://example.com/picture.jpg) that has > been converted to WebP will still have that same URL. The "Content-Type" > HTTP header tells the browser the true format of an image.

So if a visitor tries to download one of those images, are they going to end up saving the image with an incorrect file extension, or is it up to browsers to fix the file extension based off of the Content-Type header?

<comment><USER4> It will have the wrong file extension, but the bigger problem is that when the user tries to open the file in Preview on OSX or whatever their native picture viewing application is, chances are it will fail to open a WebP image.

I recall Facebook experimenting with WebP, but abandoned it because when users saved images from the web to their hard drives, they couldn't work out how to open the files.

<comment><USER5> Indeed Facebook tried this in 2013, and the user misery was immediate and loud [1][2].

[1] [https://www.cnet.com/news/facebook-tries-googles-webp- image-...](https://www.cnet.com/news/facebook-tries-googles-webp-image-format- users-squawk/) [2] [http://arstechnica.com/information- technology/2013/04/chicke...](http://arstechnica.com/information- technology/2013/04/chicken-meets-egg-with-facebook-chrome-webp-support/)

</comment></comment></comment><comment><USER6> I wish cloudflare had better tooling for a/b tests. I'd love to enable this option on our site, but without a/b test evidence that it won't affect conversions I'll never get buy in from management for a feature that likely won't affect our infrastructure. It might improve conversions through faster load times but I can't prove that.

<comment><USER7> That's a very fair point. IIRC WebP uses more cpu than JPEG, so, faster transfers but will it actually enhance my customers experience with their various Android phones?

<comment><USER8> The transfer time saved is almost certainly more expensive than the CPU resources used, especially on modern devices. Depending on your browser, this may even happen off the main thread.

<comment><USER5> A more glaring problem is video, where the widespread lack of hardware acceleration for VP8, VP9, or whatever variant Youtube happens to serve by default today will burn software decoding cycles [3] (and battery life) while H.264 would decode in hardware buttery smooth.

Given that VP9 is in no way superior to H.264 [1][2], this is purely an ideological push to favor their own format over a more widely supported another, and is a clear detriment to users.

[1] [http://www.streamingmedia.com/Articles/Editorial/Featured- Ar...](http://www.streamingmedia.com/Articles/Editorial/Featured-Articles/The- Case-for-VP9-100833.aspx) [2] [https://infoscience.epfl.ch/record/200925/files/article- vp9-...](https://infoscience.epfl.ch/record/200925/files/article- vp9-submited-v2.pdf) [3] [https://news.ycombinator.com/item?id=13226309](https://news.ycombinator.com/item?id=13226309)

<comment><USER9> In no way better? Isn't VP9 free, whereas H.264 requires patent licenses?

<comment><USER5> Not for H.264 made available at no cost on the public Internet [1]:

 _" Internet Broadcast AVC Video (not title-by-title, not subscription) - <USER2> royalty for life of the AVC Patent Portfolio License"_

For any other uses (like Netflix, Youtube RED, and other subscription, pay- per-view and similarly commercial uses), once a company exceeds the yearly cap in license payments, they need not pay more. In 2016 the cap is $8.125 million, from 2017 to 2020 the cap is $9.75 million.

[1] [http://www.mpegla.com/main/programs/AVC/Documents/avcweb.pdf](http://www.mpegla.com/main/programs/AVC/Documents/avcweb.pdf)

<comment><USER10> > _Not for H.264 made available at no cost on the public Internet [1]:_

That's only the content license. You still have to pay for the encoder and the decoder.

> _from 2017 to 2020 the cap is $9.75 million._

So using VP9 saves them $9.75 million per year in licensing fees alone, never mind the bandwidth cost savings from better compression. That's a strong financial incentive to switch to VP9 today and AV1 later when it's ready.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> If I understand this correctly "...removes unnecessary data...", their optimization algorithm strips metadata on the image. This would include copyright information. For every single image that they do this to it would be a crime.[1] And they face a minimum liability of $2500, up to $25,000 + lawyer fees.[2]

[1][https://www.law.cornell.edu/uscode/text/17/1202](https://www.law.cornell.edu/uscode/text/17/1202) [2][https://www.law.cornell.edu/uscode/text/17/1203](https://www.law.cornell.edu/uscode/text/17/1203)

</comment><comment><USER5> Dropbox's Lepton [1][2], an additional _lossless_ compression layer that operates on top of JPEG, would make for a smoother transition.

If a browser natively supported Lepton, you could serve the compressed version over the wire, and still get the bit-exact original .jpg out at the end, if the user wanted to save the file.

Of course, browser support doesn't exist yet. But browser implementors, consider the gains. This isn't promoting an incompatible format, it's getting bandwidth savings while being fully backwards compatible.

[1] [https://blogs.dropbox.com/tech/2016/07/lepton-image- compress...](https://blogs.dropbox.com/tech/2016/07/lepton-image-compression- saving-22-losslessly-from-images-at-15mbs/) [2] [https://github.com/dropbox/lepton](https://github.com/dropbox/lepton)

<comment><USER12> There's not really much point to supporting Lepton directly instead of WebP. It's (approximately) a JPEG converted losslessly into a WebP variant-- it uses a predictor very similar to the VP8 inter-block predictor and the VP8 arithmetic coder. WebP is based on VP8, so it uses the same technologies.

<comment><USER5> I'd argue the exact opposite: the two use nearly equivalent methods, but one of them is completely backwards compatible with JPEG, while the other one... isn't.

<comment><USER12> The ability to losslessly convert it between another format doesn't seem that relevant for a browser-- you still need to deploy new software to support it, at which point you might as well just use something more efficient than JPEG.

Remember, the compression is lossy to begin with.</comment></comment></comment></comment>


JOP: A Tiny Java Processor Core for FPGA - <AUTHOR> http://www.jopdesign.com/ <comment><USER2> This looks neat, but it appears to be an 'academic' exercise. I couldn't find any source code written for the JOP (the only project in the Links section was down) after scanning some of the pdfs. I did, however, notice the 64 journal publications the creator has on the subject.

OTOH, he definitely appears to have put a lot of work into this, and I _would_ like to test it out, if I can figure out how.

<comment><USER3> It doesn't look too hard, if you have an Altera FPGA. Just follow the "Getting Started" link, and it will show you how to download and build the source.

</comment></comment><comment><USER4> There have been a few runs at this problem. I've wondered for ages why it didn't pick up steam because surely you could get some great performance benefits from it. Any ideas?

See <http://en.wikipedia.org/wiki/Java_processor>

<comment><USER5> Azul systems (<http://www.azulsystems.com/>) has a special-purpose Java processor, and they do indeed get some impressive speed benefits from it. For example, having single-instruction write barriers in hardware allows them to have nearly-pauseless garbage collection on gigantic heaps.

<comment><USER6> Here's an excellent google tech talk by Cliff Click of Azul talking about their hardware. Among the firehose of information in that talk, he mentions that the hardware guys wanted to add directly execute JVM bytecode. He told them not to bother since he could JIT it better and they wouldn't be able to support all the bytecodes anyway. I'd love to know more about why that is.

<http://www.youtube.com/watch?v=5uljtqyBLxI#t=20m00s>

<comment><USER7> JITing means you can do dynamic optimisations, e.g. predicting vtable dispatches. Doing this in hardware is tricky.

</comment></comment></comment></comment><comment><USER8> _Java, a popular programming language on desktop system, is seldom used in embedded systems._

What? Perhaps the introduction is just not aging well...

<comment><USER9> heh - the reverse would be true now ;)

</comment></comment><comment><USER10> Could it be that the lack of support for "low level" stuff like uint is holding Java back on embedded systems?

</comment><comment><USER11> Some ARM's have support for JVM bytecode - so what? Anybody heard about them?

<comment><USER12> Cranky much?

Maybe your board doesn't have a jazelle-capable part, or you lack licensing for it (jazelle isn't publicly documented, sadly). Maybe you _do_ have a bunch of gates left over on your FPGA.

I mean, it looks like a cool hack to me.

<comment><USER9> Cranky??</comment></comment></comment>


How to Keep Files Forever  - <AUTHOR> http://pbjbreaktime.com/2011/10/how-to-keep-files-forever/ <comment><USER2> Should we be encouraging use of CD-R anymore? Online and local replication is a much better option.</comment>


Ask HN: What's the website you visit to find "simple, useful software" - <AUTHOR> Quoted in the title are from http://onethingwell.org which I missed a lot for introductions to small useful tools, especially the website focused more on mac and linux. Now it is in hiatus for almost two years, I guess I need new source for this task.<p>Any suggestions? <comment><USER2> It's not updated with great frequency but the suckless list of tools is great.

[https://suckless.org/rocks/](https://suckless.org/rocks/)</comment>


Consumer Reports spearheads new privacy, security standard for electronics - <AUTHOR> https://liliputing.com/2017/03/consumer-reports-spearheads-new-privacy-security-standard-electronic-products.html <comment><AUTHOR> Actual title is "Consumer Reports spearheads new privacy, security standard for electronic _products_ " but HN won't accept it because of the length.

Also, the standard itself is at [https://thedigitalstandard.org/the- standard](https://thedigitalstandard.org/the-standard) but I felt like Liliputing provided a nice summary, so the link points to that for now.</comment>


Node.js - ANSIdom to share HTML templates between the browser and the terminal - <AUTHOR> http://ohh.io/ANSIdom

<comment><USER2> This is really awesome. I don't understand how it works yet.

<comment><USER2> My understanding is that the server sends either ANSI codes or HTML depending on the user agent.</comment></comment>


Ask HN: Do you need a reverse proxy ("RPaaS") in the cloud? - <AUTHOR>

I've worked on numerous web service/sites which needed a reverse proxy either for load balancing, versioning, or deployment. This was usually achieved by using a custom system or nginx; however, it would be great if this was an offering part of EC2, Azure, etc. Would you want a reverse-proxy-as-a-service? If so, how would you use it? <comment><USER2> I am actually already offering a very similar service, although it is optimized for a somewhat different use case.

The service is here: <http://pagekite.net/>

It's useful for all kinds of things. :-)

<comment><AUTHOR> Thanks for the pointer. You should check out Microsoft Windows Azure AppFabric Service Bus ([http://www.microsoft.com/windowsazure/AppFabric/Overview/def...](http://www.microsoft.com/windowsazure/AppFabric/Overview/default.aspx)). It's supported for .NET by MSFT; however, I think there are other implementations for other platforms. Technologically it is very similar. (I used to be a Program Manager on that team not long ago).

I understand the technology quite well; however, (hope I don't sound rude) I'm not clear on what the value is to the customer (presumably developer) of pagekite.net. Please email me; my email address is on <http://www.skierkowski.com/> (I have CAPTCHA on there which is why I don't just give it to you here).

<comment><USER2> Just to answer here as well (I'll be in touch), the easiest pitch is to content creators who want to remove the "deploy stuff to some server in order to show progress to clients and coworkers" step from their work flow. Obviously, this is most applicable to people working on web designs or web app development.

Another way to think of it, is that anyone who uses dynamic DNS today might find PageKite is a better fit for certain tasks. Dynamic DNS only works when a device is immobile and you have a visible, unfiltered IP. PageKite doesn't have those limitations, and is way easier to set up.

There are many reasons to want to be able to run a simple server on a personal computing device, we've just been beaten out of the habit of even considering it by firewalls and NAT. So you are absolutely right that the value is often unclear to people at first - we have a definite up-hill struggle ahead in marketing this. I am optimistic though, because so far most techies who have given it a try found it so convenient all their objections melted away.

</comment></comment></comment><comment><USER3> EC2 has this already: <http://aws.amazon.com/elasticloadbalancing/>

<comment><AUTHOR> The Amazon Load Balancer only performs load balancing... a reverse proxy can be used for a whole lot of other scenarios... here are just a few...

Rolling Upgrades: you have 20 instances of V1 of your app, you want to slowly test them out, so you start with moving 5 instance to V2, then 5 more, etc. To switch from V1 to V2 gradually to make sure there are no major snags.

Versioning: Make a single API available at the address <http://foo.com/V1> and <http://foo.com/V2> but those actually go to two different servers running two different applications.

Sub domain to path rewrite: You want to provide customers with sub-domains at <customer>.foo.com but it actually serves up contents from service.foo.com/<customer> on the back-end.

Virtual Sites on single server: Some providers (i.e. some shared services) only allow you to have one or just a few domains/sub-domains for a single instance of your application. Now you can have <http://foo.com> and <http://bar.com> actually host up pages from <http://foobar.com/> and the original requested address will be in a new HTTP header so your app at <http://foobar.com/> can distinguish the two.

Instance Allocation per customer: Some multi-tenant architectures have a "home" node for each customer. In this case you could setup a rule that states that customer a.foo.com goes to instance x while customer b.foo.com goes to instance y.</comment></comment>


Ask HN: Would you pay to acquire tenants? - <AUTHOR> For tenants who want to move to a different neighbourhood, but are tied up in long-term leases and high cancellation fees (e.g. two months rent)
If you were a landlord would you pay these cancellation fees to acquire tenants?
I am trying to understand if there is a market for such a service, because if there is then a tenant can "subscribe" to this service and have the freedom to move around without being tied up to long-term leases. The cost of this service is a slightly higher "subscription fee" instead of paying rent <comment><USER2> Can't speak for others and this is not indicative of the idea not having merit but...

For me, I wouldn't. I've owned multiple properties and have rented out those properties without much issue. If anything at a certain scale having a reliable yet affordable option for property management makes more sense. I just never got to that point to feel about the existing property management companies in my area.

</comment><comment><USER3> In my area (Los Angeles, CA) landlords have the opposite problem. Tenants are tied up in long term leases and the landlords want them out so they can raise the rent for the next tenant. There are cases where the landlords ate not only waiving any cancellation fees, they are paying to relocate tenants to other areas.

<comment><AUTHOR> wow, never heard of that before. It is interesting though. I think long-term leases are going to disappear things are moving too fast and changing very quickly for anyone to commit to long term leases

<comment><USER3> Plus these penalties for breaking a lease were supposed to compensate the landlord for lost rent while looking for a new tenant. If a new tenant is always around the corner, how can they justify the penalties?

<comment><AUTHOR> True makes 100% sense

</comment></comment></comment></comment><comment><USER4> So your service would effectively be the tenant? Certainly an interesting concept although the landlord would have to agree to sublet.

The lease agreement for my apartment for example says I can sublet but I can't allow my tenants to sublet so I don't think I could use it. I don't know if that's common outside of London.

What's in it for the tenant though? If an individual needs that level of flexibility but want something beyond a hotel then there are options such as serviced apartments in most major cities.

<comment><AUTHOR> Thank you for your comment!

Sorry I was not very clear in the concept, I tried to make it clearer below

A subscription-based rental service company, we break your lease contract and you pay us. We find you apartments and rent it for you. You pay us not the landlord.

That is a great question on whether the landlord will agree to sublet, but for me as a service company my argument is I have a customer with a good credit rating who is ready to move in to your apartment. I know many landlords who are desperate to get tenants.

The problem is some tenants are ready to move in, but they already have a long-term contract with another apartment. I am here to break it for you, but you pay me

<comment><USER4> I've always lived in areas with very high demand for rental property and I always had the opposite problem in that I couldn't stay in the property long enough - landlords often wouldn't agree to 2 year leases for example.

Possibly your proposed service might be useful to users in cities without this demand but it might follow that you are looking at lower income landlords. Perhaps offering a guaranteed rental income as part of the business model would work.

As a former renter I don't think I'd want to sign up to this because (in the UK at least), tenants really don't have a good deal as it is. Why would I want to replace a lease with a subscription?

That is unless you can effectively offer the tenants better rights than you normally get... but then why would a landlord want to give up a system currently rigged in their favour?

This isn't a business model I've heard of and I find stuff like this quite interesting to think about. Let me know your thoughts.</comment></comment></comment>


Schedule – 35th Chaos Communication Congress - <AUTHOR> https://fahrplan.events.ccc.de/congress/2018/Fahrplan/timeline.html <comment><USER2> As it wasnt mentioned yet, like every year, all talks will be recorded and uploaded. Here are those of last year for example

[https://media.ccc.de/c/34c3](https://media.ccc.de/c/34c3)

Also streams

[https://streaming.media.ccc.de/](https://streaming.media.ccc.de/)

</comment><comment><USER3> This year will be my 10th of attending, and to me the CCC is one of few things that continuously inspires me to do creative computer projects.

<comment><USER4> This year will be my first time attending.

The CCC often enough steps in when german officials show blatant lack of computer illiteracy and is somewhat-engrained on german politics now, which is amazing. Whenever I'd think "Is there noone who can do anything against this?" they do. Just the lobby want.

<comment><USER5> Hey solarkraft, also spamming this to you i guess, if you want to join up with a few fellow first timers join my quickly set up mailinglist if you like :D

[https://evolvis.org/mailman/listinfo/ccc35-virgins- discuss](https://evolvis.org/mailman/listinfo/ccc35-virgins-discuss)

<comment><USER4> Thanks!

</comment></comment></comment></comment><comment><USER5> This will also be my first year visiting CCC and I'm really looking forward to it. I'll be traveling alone so if anyone wants to join up, maybe also a first- timer, I'd love to!

<comment><USER6> If you'd like to meet someone new, call me on DECT 5169 once you're there. (If you don't have a DECT phone, ask an angel if you can use theirs.) I'm not a first-timer though. This will be my sixth or seventh congress.

<comment><USER7> First timer also. Will bring my Panasonic KX-TGA110FX to check if it works. They don't list that exact model in the compatibility list, so it may not work. Reserved an extension 8995 for me.

<comment><USER5> I'll see if i can get a DECT to bring as well. For now I've set up a small mailinglist for all the first timers and people who'd like to join a small group:

[https://evolvis.org/mailman/listinfo/ccc35-virgins- discuss](https://evolvis.org/mailman/listinfo/ccc35-virgins-discuss)

<comment><USER7> Great. It seems like gmail treats confirmation email as a spam though.

<comment><USER5> Ah thank you for the warning, can you write a test e-mail so i can check everythign works? :D

<comment><USER7> Done

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> CCC is great event, but the last years has more to do politics, surveillance, gender issues, etc.. than deep-tech content. And Leipzig blah, bring it back to Berlin, please :)

Anyways I look forward to hear Peter Sewell this year, probably his talk* from few years ago is one of my favorite CCC talks overall.

* [https://www.youtube.com/watch?v=MBIHPLFmcgA](https://www.youtube.com/watch?v=MBIHPLFmcgA)

<comment><USER9> That is one of my favorites as well. I always think of his stacked-up-to-the- ceiling garbage bin image when discussing the current state of software.

This year he seems to be continuing with the theme: Taming the Chaos: Can we build systems that actually work? [1]

[1] [https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events...](https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9647.html)

</comment></comment><comment><USER10> Not going to look at that schedule! I don't want to be even sadder I don't attend. I'm sure my friends will tell me their favourites to watch later.

</comment><comment><USER11> Best app to sift through the schedule and bookmark interesting talks?

Bonus if they can provide a link to the video later.

Best I found so far: [https://play.google.com/store/apps/details?id=net.gaast.gigg...](https://play.google.com/store/apps/details?id=net.gaast.giggity&hl=en_US)

<comment><USER12> This one is correctly hooked into the schedule database so changes should be reflected fast. Also should have recording links, at least had them last year.

Congress – 35C3 [https://itunes.apple.com/de/app/congress-35c3/id941205524?l=...](https://itunes.apple.com/de/app/congress-35c3/id941205524?l=en&mt=8)

<comment><USER11> thanks, seems to have an android version too [https://play.google.com/store/apps/details?id=info.metadude....](https://play.google.com/store/apps/details?id=info.metadude.android.congress.schedule&rdid=info.metadude.android.congress.schedule)

<comment><USER13> F-Droid version: [https://f-droid.org/en/packages/info.metadude.android.congre...](https://f-droid.org/en/packages/info.metadude.android.congress.schedule/)

I think I used this one last year, was pretty good.

</comment></comment></comment></comment><comment><AUTHOR> FWIW, I just hardened my memset_s implementation again, after reading [https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events...](https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9788.html)

> This presentation will start off with a simple problem (how do you clear > memory that holds sensitive content). It explores numerous possible > solutions, and presents real live facts and figures. bugs in common > applications will be shown.

Compiler optimizations are getting too tricky, and I'm not sure when memset- like functions are just optimized away.

[https://github.com/rurban/safeclib/commits/smoke](https://github.com/rurban/safeclib/commits/smoke)

</comment><comment><USER14> This is my very first time at the conference, I'm really excited. Don't want to miss the best stuff. Does anyone has some recommendations or want to hang around there?

<comment><USER15> Don't visit the talks unless there is some topic you're dying for, talk to the people outside the presentations and at the workshops instead, as well as the different surrounding venues. There is a lovely hacking CTF competition going on and I assume as usual there will be a large open space where people will show off their hacker project or hackerspaces. You can see all the talks afterwards online on YouTube instead.

<comment><USER13> I enjoy the talks. There is a lot to see and I make sure to see it, but the talks can be very entertaining and/or motivating. Asking questions online is harder compared to in the room, and you can usually also meet the speaker in person if you want to.

I see where you're coming from, but I don't agree with the statement "don't bother with the talks while you're there". Especially for someone who goes the first time, let them find what has value for _them_.

</comment></comment></comment><comment><USER16> "Attacking Chrome IPC: Finding reliable bugs to escape the Chrome sandbox" Yikes! But could be lucrative as well ;)

</comment><comment><USER17> Dammit. One more year not going to the congress. :-( I hope to go someday, and get a copy of "Das Haker Bibel" as well.

</comment><comment><USER18> I live in Australia now so unfortunately I cannot attend. Originally from Europe, CCC were my heroes as a teenager.

<comment><AUTHOR> Just watch it via live stream and you can also use the IRC channel per room. Sometimes even more interesting than being there.

</comment></comment><comment><USER19> Do you have to speak German to attend this? Or do they have translations for English during the talks?

<comment><USER20> All talks will have real time sub titles and some even have live voice translations. And you do Not have to speak German to attend, there will be enough interesting people with whom you can converse.

<comment><USER21> No live subtitles this year: "This year, we'll focus on providing high-quality subtitle tracks for the released videos in a timely fashion. In particular, we will not provide any live subtitles for talks." (Subtitle Angel description @ [https://engelsystem.de/35c3/angeltypes?action=about](https://engelsystem.de/35c3/angeltypes?action=about))

But subtitling work will be done during congress so I imagine they'll be released very quickly.</comment></comment></comment>


Tor Browser 8.0 released - <AUTHOR> https://blog.torproject.org/new-release-tor-browser-80 <comment><USER2> Anyone tested Tor in China recently? Back when I was making regular business trips there, I not only tested and reported bugs, but I shared it with many locals who were interested in what an open Internet experience was like. (Sadly, wanting facebook access as the #1 reason, a reliable gmail/google was #2)

Over the years I watched a fascinating arms race unfold. From it working out of the box, to needing a bridge, then obfs, obfs2, obfs3, obfs4... On my last trip, even obfs4 wasn't working.

<comment><USER3> In Shanghai I'm able to connect through the meek-azure bridge, but everything is incredibly slow. I'm still having the best results using Shadowsocks on a VPS (although I'm on a 200Mbps China Telecom line at home). Commercial VPN offerings, such as ExpressVPN and Astrill, were slow in comparison.

</comment></comment><comment><USER4> Is it supposed to leak OS in the user agent string now? Or is it just a bug?

> "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0"

EDIT: Noscript user experience is also broken, discouraging its use.

<comment><USER5> Yeah, they decided against spoofing user agent anymore: [https://blog.torproject.org/comment/275941#comment-275941](https://blog.torproject.org/comment/275941#comment-275941)

<comment><USER6> That's really unfortunate. It seems like a big loss of privacy with weak arguments in favor.

(1) They could easily spoof one UA for mobile and one for desktop -- user chooses.

(2) Why are they worried about the experience of Google Docs over Tor??? More generally why focus on the use case where people enable all kinds of unsafe javascript to do fancy OS-specific things?

It's like advertising your lightweight speed-focused track racing bicycle, then putting massive tires on it because some users had trouble going off- road.

<comment><USER7> How much of a difference does it make in practice? Just the platform does not seem like that much more information.

Further, I'd wonder if, while the actual OS is fingerprintable (as the various discussions seem to suggest), reporting one OS whilst actually being on another flags the user as interesting/has something to hide (i.e. they are probably using Tor Browser, not just Firefox).

There's also usability to consider - if this results in more people using Tor Browser, or not disabling things to try and work around it, that might be a net gain.

<comment><USER8> > flags the user as interesting/has something to hide (i.e. they are probably > using Tor Browser, not just Firefox).

Tor nodes are known and it's trivial to detect users using Tor.

> There's also usability to consider - if this results in more people using > Tor Browser, or not disabling things to try and work around it, that might > be a net gain.

I'm sorry, but that's just ridiculous. Sharp corners on tabs most certainly won't attract more users.

EDIT: Ok I saw the issue with mobile users and some other edge cases. I would still agree with bo1024, it's a weak argument.

</comment></comment></comment></comment></comment><comment><USER9> Is it just me or did the "New identity" functionality disappear from the Tor Button? That was pretty useful when a certain circuit wasn't working.

<comment><USER10> Yeah, I had to look for it too. It's in the firefox hamburger menu, where you'll find the add-ons, preferences, etc.

<comment><USER11> There's also a blue button if you click the i to the left of the current address.

<comment><USER9> Sometimes there's a problem with the identity which hinders the use of all sites. The solution was usually "new identity" or Tor restart. The first one is a little more accessible.

</comment></comment></comment></comment><comment><USER12> This is probably the worst update I have ever seen. If they fix the NoScript UI and remove the user agent leaking, I'll be happy. I use Whonix, so the Quantum design looks funky.</comment>


Ask HN: Why is it that my submission only shows up when I'm logged in? - <AUTHOR>

<comment><AUTHOR> I'm leaving Hacker News. If things got to be censored, it's got to be done on my desk and not by an algorithm or anyone else. If I got to be called a spammer, it's got to be done by a human being. And I certainly don't want to be tricked into believing I'd participate -- I sense supreme assholiness here with which only people can come up who think they're extra-bright. I'll find myself some more honest and fair news site where I can choose myself what I want to see. Live long and prosper.

</comment><comment><USER2> You submission has been marked "dead". This means nobody can see it unless they have "showdead" turned on in their profile options. Logged out users cannot see "dead" links. Unless i am recalling incorrectly, you cannot see when your own links have been marked dead.

<comment><AUTHOR> And why are submissions marked as being dead by default? I find it hard to believe someone is marking it dead - even this question - within less than three seconds.

I'd rather prefer to be banned instead of wasting my time.

<comment><USER2> they are marked dead on a post by post basis, unless (i believe) the account has a history of only posting spam links.

In this case, your link is a duplicate of an earlier/more popular post. So it got auto-deaded

<comment><AUTHOR> Uh? Is that new? Whenever I posted something already there I got diverted to it. And I believe the older submission got an extra point. That was cool.

Maybe it's different when the older post was marked as being dead? But I hope there isn't such a lack of humour on HN.</comment></comment></comment></comment>


Ask HN: Product manager reading list - m-sed What blogs/sites/communities about product management do you follow? <comment><AUTHOR> Hey! A few links to kick this off:

PS Community – Biggest Slack community for Product Managers [https://productschool.typeform.com/to/yF0A6t](https://productschool.typeform.com/to/yF0A6t)

Massive list of online resources for aspiring Product Managers:

[https://www.productschool.com/blog/how-to- become-2/massive-l...](https://www.productschool.com/blog/how-to- become-2/massive-list-online-offline-resources-to-become-product-manager/)

[https://www.facebook.com/pg/productschool/community/](https://www.facebook.com/pg/productschool/community/)</comment>


Apple Mask unboxing - <AUTHOR> https://twitter.com/markgurman/status/1304539489717583882 <comment><USER2> As always, Apple's effort into presenting and packaging any product they make never ceases to amaze me. Even if it is a mask.

Questions is however: Do I get a reduced AppleCare+ subscription with this and will this be soon obsoleted by an Apple® Mask Pro® Edition? /s

As the saying goes: _We can 't wait to see what you'll come up with.™_ /s</comment>


Ask HN: How do I learn faster? - <AUTHOR> I'm afraid that this sounds like a stupid Quora question but ...
How do I learn faster ?
Things I already do:
- I do sports to stay fit.
- I repeat the things I've learned the next day.
- I do breaks.
- I do things that I enjoy.
- I sleep enough
- I try to connect the thing I'm learning right now with things that I've already learned
- I don't learn too many things
- I batch things, for example: one day: math, physics, CS, the other day something else.
I'm aware of the fact that we are all humans, I'm not trying to accomplish anything impossible, I don't have any weird expectations, I just feel like that I'm not getting my 100%.
What are your tricks ? <comment><USER2> Coursera's learning hoe to learn will mostly cover what you have said here already.

This is something I found recently in another thread and would like to work on this now. "how to learn without a mentor"

[https://codewithoutrules.com/2017/04/17/learning-without- a-m...](https://codewithoutrules.com/2017/04/17/learning-without-a-mentor/)

<comment><USER2> Hi responding to my own comment, it has been some time since I took that course, and reading multiple articles about Learning has muddled my thoughts on what I had learnt and where.

So I went back to refresh my memory about the course 'Learning How to Learn' and realized there is more value to it than what other articles normally outline. I am linking to a few course notes to give anyone who reads this a better understanding of what you will gain from it.

[https://github.com/Espores/Learning-how-to-learn-Coursera- No...](https://github.com/Espores/Learning-how-to-learn-Coursera-Notes)

[https://www.reddit.com/r/GetMotivated/comments/5950tm/text_i...](https://www.reddit.com/r/GetMotivated/comments/5950tm/text_i_just_finished_the_online_coursera_course/)

</comment></comment><comment><USER3> I thought the Learning to Learn course on Coursera was excellent. It covers some of the things you mentioned but a lot more and also explains why in terms of how your brain works. It only took me a few hours to complete the course.

<comment><AUTHOR> Thanks I'll check that out.

</comment></comment><comment><USER4> > \- I try to connect the thing I'm learning right now with things that I've > already learned

That's a big one. You're right on target.

Personally, I try to focus on cross domain topics and heuristics.

Like Sturgeon's law, The 80:20 rule, exponential growth, KISS, etc...

If you're asking about raw memorization I'm sure there's a physical limit to the ratio of usefulness to depth of data.

And don't forget about The Dunning–Kruger effect and the fact that lots of people get stuff done without knowing how to do it at the outset. But that's only if you're learning to do rather than learning to learn.

</comment><comment><USER5> Reflecting one one's mistakes. "The Power of Intuition" by Gary Klein has some good bits on this, but basically look for the cues and patterns you missed, so you know what to look for next time. been doing that with programming ([https://softwareclown.com](https://softwareclown.com)) and the effort of seeing _why_ I made mistake usually gives me much better understanding of what to do better next time.

</comment><comment><USER6> Best approach for me is to make sure I apply what I'm trying to learn to a specific project. If I'm going to learn a new programming language, I cannot just learn it from a book, it does not stick. I always find some project (which may or may not be relevant to what I'm learning) and build the learning up around the project. For me this also works with other things than a programming language.

</comment><comment><USER7> Something I didn't see mentioned yet is putting what you learned into practice. Building even a small program (from scratch) to demonstrate some new tool you learned. Doing this I feel I learn The subject faster and in more depth.

</comment><comment><USER8> My one trick would be to practice a lot. For example, if you are learning math or programming, you won't learn very much by watching ted talks, youtube videos or reading blog posts. Instead you need to spend all your hours typing code and working on progressively more difficult problems. Like if you want to learn graphics programming, start by drawing pixels, then lines, then 3d rotating shit and shading stuff. Active learning is much more important than passive learning.

</comment><comment><USER9> Vocal repetition works for me. I find that everything I try to teach someone else sticks right away. My poor wife has heard a lot of PowerShell cmdlets but she's aware that I learn better like this.

</comment><comment><USER10> By learning more slowly. And not rushing, being mindful and asking questions

that way the info you learn will actually stick</comment>


What Twitter Really Looks Like - <AUTHOR> http://www.theatlantic.com/technology/archive/2013/01/what-twitter-really-looks-like/272583/

<comment><USER2> Obligatory <http://xkcd.com/1138/>

<comment><USER3> I made a visualization that shows the tweets for specific words and can account for population density (only US though): <http://tweetpleth.herokuapp.com/>

</comment></comment><comment><USER4> Direct link: <http://tweetping.net/>

</comment><comment><USER5> This is great. There are agencies that would pay a lot of money for something like this for their brands.

<comment><USER6> Why? To me it seems simple supply & demand problem. Access to fire-hose is not so expensive. Hardware is dirt cheap, code is not complex either so you can go with relatively cheap junior developer for such problem. Also it takes only a little of manager's time.

It would be completely different matter if we were talking about finding patters, predicting trends, etc.

<comment><USER7> For those curious,

<https://dev.twitter.com/docs/api/1.1/get/statuses/sample>

<https://dev.twitter.com/docs/api/1.1/get/statuses/firehose>

</comment></comment></comment><comment><USER8> Let us not forget the granddaddy Twitter visualizer:

<http://twittervision.com>

</comment><comment><USER7> Interface is way too laggy. I don't want to see individual tweets flit by at 10fps. Drop the tweets and hashtags and give me 60fps.

<comment><USER9> There are only about 40 geotagged tweets per second across the world. The extra frame rate isn't going to show much more.

</comment></comment><comment><USER10> This might be fun during the Super Bowl.

</comment><comment><USER11> What the heck is going down in Argentina? Uruguay seems fine but Argentina it's supposed to be 40 million people there and we can hardly see anything. Chile is only 16 million people and way brighter than Argentina.

Ooooh. But I know what's going on in Argentina: ultra-leftist state currently confiscating private properties and private companies and restricting civil liberties (for example rampant inflation and people forbidden to change their money into foreign currencies). Why? Because socialism led, of course, to poverty, inflation and unemployment (Greece is going this way and France and Spain shall go this way too soon if they don't do anything).

Venezuela and it's 28 million people is totally pathetic too.

That's socialism for you guys.

I can't begin to understand how people still want to be socialist when they see what that dangerous ideology does to countries...

And don't get me started on Cuba and North Korea.

Way to go socialo-commies!

<comment><USER12> It's obvious you have never lived in Argentina :-)

<comment><USER13> I was there this summer. martinced's comment made me laugh out loud.

For martinced's information, about a third of the population of Argentina lives in the Buenos Aires metropolitan area which has a nice bright dot. Uruguay is not fine, it has almost nothing. I think you're confusing it with Brazil hahaha.

Of all the people I met in Argentina, if they didn't use twitter it was because they had better things to do. They all used facebook for example.

If you're going to glean any political ideology from this map, you should get off this anti-socialism fetish and look over at Africa...</comment></comment></comment>


Altman and others want to crowdfund 1B masks in the next 180 days - <AUTHOR> https://techcrunch.com/2020/04/10/altman-and-others-want-to-crowdfund-1-billion-masks-in-the-next-180-days/ <comment><USER2> Mask are not hard to make. The usual suppliers are running 24/7 to catch up. In 30-60 days there will be lots and Altman's effort to start at 180 days will run into the huge glut</comment>


VP8 Codec SDK "Aylesbury" Release - <AUTHOR> http://blog.webmproject.org/2010/10/vp8-codec-sdk-aylesbury-release.html

<comment><USER2> For those wondering.

      What's an Aylesbury? It's a breed of duck. We like
      ducks, so we plan to use duck-related names for
      each major libvpx release, in alphabetical order.

Aylesbury is a sleepy dormitory town in Buckinghamshire near where I grew up and is famous for very little except giving its name to a breed of duck. I was pretty surprised to see a codec named after it.

Probably more important:

      Our goal is to have one named release of libvpx
      per calendar quarter, each with a theme.

<comment><USER3> On2 (who Google bought to get the video tech/patents for vp8) were previously known as _The Duck Corporation_.

</comment></comment><comment><USER4> The MPEG LA said that it would assemble a patent pool against VP8, did they manage to do that, or they were just FUD-ing around?

<comment><USER5> I'm not saying they will or they won't, but there is no point wasting resources assembling a patent pool against VP8 if it isn't even popular yet. When it becomes a threat, you can bet then the MPEG LA will assemble something, valid or not.

<comment><USER6> VP8 is used by skype for video and VP6 (which VP8 is based on) was used by youtube for a while on many videos. They could have made millions of dollars by suing huge companies such as Skype and Google. Why didn't they if they had patents on them? Doesn't make sense.

<comment><USER5> When did Skype switch to VP8? As far as I know they still use VP7. What does VP6 have to do with VP8?

<comment><USER6> VP8 is heavily based on VP6 and VP7. If VP8 breaches some patents, they are very high odds that so do they.

<comment><USER5> cite please.

<comment><USER7> Feel free to read the libvpx source, it's based on On2's VP7 codec and mentions it in comments in several places.

You can also compare ffvp56 and ffvp8, although there's a larger time gap between the two implementations.

<comment><USER5> What would that accomplish. The original statement was that skype uses vp8 and youtube used vp6 (which vp8 is heavily based off of). Skype doesn't use vp8, and looking at vp7 or vp8 source isn't going to tell me that vp6 infringes on any patents.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Um, I'm pretty sure that measuring PSNR and SSIM differences in percentage makes no sense at all. PSNR is measured in decibels and SSIM is a log scale. They might as well just have said "it went up".</comment>


Successful private key extraction from OpenVPN using Heartbleed - <AUTHOR> Hi HN,
We have successfully extracted private key material multiple times from an OpenVPN server by exploiting the Heartbleed Bug. The material we found was sufficient for us to recreate the private key and impersonate the server.
As you may know, OpenVPN has an SSL/TLS mode where certificates are used for authentication. OpenVPN multiplexes the SSL/TLS session used for authentication and key exchange with the actual encrypted tunnel data stream. The default TLS library for OpenVPN is OpenSSL. Since OpenVPN uses the OpenSSL library but merely passes through the TLS traffic to OpenSSL, this means that OpenVPN is exploitable using Heartbleed, in theory. However, until now there hasn't been any solid evidence that private key material can be extracted from OpenVPN just like it has from some web servers.
This was the server setup we used: Ubuntu 12.04 (VM using KVM) OpenVPN 2.2.1 OpenSSL 1.0.1-4ubuntu5.11
Our exploit is decently weaponized, and while the code is an abomination that even Eris would be embarrassed to present, we believe it may severely impact those who have not already upgraded. Therefore, we will not be publishing the code. Nevertheless, you should assume that other teams with more nefarious purposes have already created weaponized exploits for OpenVPN. Just to be clear, we don't intend to use this exploit ourselves. We merely developed it to examine the practical impact on OpenVPN as part of our incident investigation.
To our knowledge there is currently one published proof of concept script that checks an OpenVPN server's vulnerability to Heartbleed.
Private questions that are not requests for the exploit can be emailed to firstname.lastname@example.com or firstname.lastname@example.com (PGP: 0x2C62E8AE).
Best regards,
Fredrik Strömberg, Co-founder of Mullvad
(edit: Formatting, because I'm a HN noob.) (edit[?]: Giving up on the formatting.) <comment><USER2> Apologies for the possibly stupid question: Did your OpenVPN server use TLS Authentication (tls-auth option) and, if so, did the attacker have access to that key?

What I have read so far seems to imply that OpenVPN is vulnerable, but only if not used with tls-auth or if the attacker has access to the tls-auth key (as is the case for e.g. clients).

<comment><AUTHOR> No, our target server did not use tls-auth because it would only have added complexity and no valuable information. The threat model for tls-auth is pretty straightforward.

You're correct in your second paragraph. I'll quote James Yonan and myself from last Monday:

Using the tls-auth option should protect against this vulnerability (assuming that your tls-auth key is not known to the attacker).

tls-auth is irrelevant if the attacker knows the key, which is the case for consumer VPN services like ours.

<comment><USER2> Thank you very much for your reply! Of course it is irrelevant if the attacker knows the key, but that naturally depends on the threat model under consideration and your OP wasn't too clear on that, hence my question :)

Thanks again!

<comment><AUTHOR> No problem, I only added the quotes for more clarity. I'm glad I could help :)

</comment></comment></comment></comment><comment><USER3> Interesting. If true, this seems to contradict the statement released here: [http://docs.openvpn.net/important-security-notice- regarding-...](http://docs.openvpn.net/important-security-notice-regarding- heartbleed-vulnerability/)

Have you contacted OpenVPN directly?

<comment><USER4> Note that this statement is about OpenVPN Access Server, the commercial distribution of OpenVPN.

There is a bit more info in the "community" wiki [0]. It seems the key point is that TLS-auth would already mitigate the vulnerability. TLS-auth is on by default in OpenVPN Access Server, but for the vanilla openvpn, you have to configure it yourself.

And, as noted in the community statement, the TLS-auth is a single global pre- shared key. It could leak a bit more easily than personal certificates.

[0] [https://community.openvpn.net/openvpn/wiki/heartbleed](https://community.openvpn.net/openvpn/wiki/heartbleed)

<comment><USER5> Well, TLS-auth should be used _on top_ of a PKI. It is a HMAC key that an attacker would need to know before he'd even be able to initiate a TLS handshake.

Thus, if you have used it in your OpenVPN setup, and if you know that the few users who have access to your VPN wouldn't have heartbleed-attacked you, then yes, you could assume that your private key has been safe from heartbleed despite an exploitable OpenSSL library.

</comment></comment></comment><comment><USER6> As someone who runs a personal OpenVPN server am I correct in assuming that I am not vulnerable to this as long as I have updated my OpenSSL library's through the standard Linux package managers to a recent version that has fixed the Heartbleed bug?

<comment><USER7> Are you sure that OpenVPN is not using it's own bundled openssl lib? I believe that was the case with OpenVPN_AS.

<comment><USER8> That was definitely the case with openvpn-as. I updated my openssl package but my VPS was still testing vulnerable until I updated openvpn-as.

</comment></comment></comment><comment><USER9> I recently learned that SigmaVPN uses NaCl on Android, if anyone needs it.

[https://play.google.com/store/apps/details?id=com.frozenrive...](https://play.google.com/store/apps/details?id=com.frozenriver.sigmavpn)

It seems based on QuickTun, which is where the NaCl implementation comes from:

[http://wiki.ucis.nl/QuickTun](http://wiki.ucis.nl/QuickTun)

<comment><USER10> This looks super cool. Submitted it in hopes of hearing more discussion on it. [https://news.ycombinator.com/item?id=7599091](https://news.ycombinator.com/item?id=7599091) What's its security track record? Have you ever used this? The idea looks nice.

</comment></comment><comment><USER11> Have you considered submitting the attack to hacker one?

[https://hackerone.com/internet](https://hackerone.com/internet)

<comment><AUTHOR> No, I didn't think of any rewards. Thanks for the link though.

<comment><USER11> If you do, and if you get an award, plz, for the love of security, donate the winnings to the openssl project instead of something mindless like the freedom of the press foundation.

<comment><USER12> Please don't donate any winnings, buy yourselves something nice. There's plenty big rich companies out there that should be running OpenSSL.

</comment></comment></comment></comment><comment><USER13> I have read that the client version of OpenVPN, which is also vulnerable to heartbleed, should be upgraded, as well as the server.

I wonder what could be a possible exploitation on the client side? Obviously, one can not send heartbeat packets to grab the secret key!</comment>


Thoughts on Supporting Rump Kernels on RTEMS - <AUTHOR> http://heshamelmatary.blogspot.com/2015/02/thoughts-on-supporting-rump-kernels-on.html <comment><USER2> RTEMS is a great open source realtime OS that's been used in some astonishing systems (I used it myself 15 years ago). It seems to fly below the radar for some reason.</comment>


Propositions Are Not Types (2018) - <AUTHOR> https://medium.com/@rplevy/propositions-are-not-types-naturalizing-information-content-in-computing-e51b94ad6674 <comment><USER2> Initially I thought that this could be one of those automatically generated nonsensical but scientific sounding texts ([https://pdos.csail.mit.edu/archive/scigen/](https://pdos.csail.mit.edu/archive/scigen/))

But upon closer reading I now think it's actually the reverse. The author apparently tried very hard to obfuscate the fact that he does have something meaningful to say by using utterly nonsensical sounding language.

<comment><USER3> I think the author simply uses the vocabulary of his field, and he tries to communicate effectively with it. As a consequence, his language is terse and full of references to concepts that are foreign to a run-of-the-mill SWE like me ("naturalization", "symbol grounding", "intentional-referential behavior").

Effectiveness of communication is relative, of course, and what is appropriate for an audience may not be appropriate for another. A parallel with programming languages can be drawn here: mainstream language programmers often have a knee-jerk reaction to being told "look, in Haskell, this program that took you 80 lines in your favorite OOP language is just 4 lines of almost only special characters that look like I banged my head on the keyboard!" but it's just a matter of easing into a different language and different concepts.

<comment><USER2> I don't disagree with you in principle, but I read a lot of papers from fields I'm not sufficiently familiar with and I know what that is like.

I also know from my own field that some people like to write for effect rather than effectiveness.

<comment><USER3> I see where you're coming from. I sometimes get that feeling too. The way I approach this is by asking myself if the author could have expressed their ideas with simpler words or if some meaning would have been lost had they tried to simplify. Could I have reformulated anything without loss and without paraphrasing or resorting to examples?

It's like Dijkstra's famous quote: "The purpose of abstraction is not to be vague, but to create a new semantic level in which one can be absolutely precise". Did the author need to invoke these abstract concepts and complicated wordings to be absolutely precise or did they throw around abstractions in over-engineered sentences to make themselves look intelligent?

Since I can't claim to understand the topic and the author's message fully, I can't be certain it's one or the other. All I have is a subjective feeling, but I think the author was trying to be precise and that each word had its genuine place at least in the author's point of view.

For example, when I read the last sentence of the introduction "following Hutto & Myin's solution that real-world content depends on shared scaffolded practices that augment basic agents, we explore socially situated computing as an approach to naturalizing information content in computing", my internal bullshit alarm was ringing pretty loud, but it turns out each of the concepts gets expanded upon in the rest of the text.

I think overall this text was a challenging read but one benefit of it beyond the author's message is that I learned of the existence of this topic and line of thought in the first place, and it certainly piqued my curiosity.

<comment><USER2> It's absolutely possible that you are right and I'm not doing him justice.

</comment></comment></comment></comment></comment><comment><USER4> The content of this whole wing of thinking is "you have to have a brain-like system to have a brain-like thing". Which, fair. But what's crazy-making about it is that people have decided this sort of insight says something about mathematics and metaphysics, which it _does not_.

For example, this:

 _This observation which they refer to as the "hard problem of content" or the "covariance-is-not-content principle" is that systems acting on covariance information, while acting on information, do not constitute content-bearing systems, because to bear content is to embody claims about how things stand, when in fact they merely embody capacities to affect the world._

is just complete nonsense, and to extract the charitable reading I put in quotes above, you have to read closely for paragraph after paragrah to see that what's going on is the word "content" is reserved to mean "things brain- like things do in a brain-like way to other brain-like things in a context built for brain-like things."

Again, okay! But: it's _wildly_ misleading to frame this as being about mathematical logic or the metaphysics of symbols, syntax and semantics.

</comment><comment><USER5> the title seems to be an unfortunate pun. from a quick look at the article, it's mostly cogsci stuff, where "proposition" has a very different meaning from the one "Propositions as types" normally refers to:

 _" The proposition is a concept borrowed by cognitive psychologists from linguists and logicians. The propostion is the most basic unit of meaning in a [mental] representation."_ [1]

the article seems to mostly be talking about AI and the problems of making it "actually refer to the real world". so i think title could be paraphrased as sth like "Information about the world ([mental] propositions) is hard to represent with symbolic, digital things (types)".

[1]([http://www.bcp.psych.ualberta.ca/~mike/Pearl_Street/Dictiona...](http://www.bcp.psych.ualberta.ca/~mike/Pearl_Street/Dictionary/contents/P/proposition.html#targetText=University%20of%20Alberta%20Dictionary%20of%20Cognitive%20Science%3A%20Proposition&targetText=The%20proposition%20is%20a%20concept,judged%20either%20true%20or%20false))

</comment><comment><USER6> I'm very confused about what this blog post is trying to argue. Most of what it discusses isn't related to the Curry-Howard correspondence at all?

At the risk of sounding anti-intellectual, perhaps Orwell's "Politics and the English Language" [0] is relevant here?

[0] [http://www.orwell.ru/library/essays/politics/english/e_polit](http://www.orwell.ru/library/essays/politics/english/e_polit)

<comment><USER5> yeah, Ctrl+F "type" gives 4 (non-title) occurrences, all of them in the first two paragraphs. the rest seems to be related to AI and the problems of making it "actually refer to the real world". weird!

EDIT2: i think the author is actually talking about cogsci "mental propositions". (see my other comment)

</comment></comment><comment><USER7> On what grounds is it argued that humanity operates on "content" grounds? If the stuff in my head operates purely on syntactic, formal, biological, chemical, physics methods, then the introduction of semantics or "content" is a red herring, even if you argue that multiple humans is the magic factor, it seems to me.

</comment><comment><USER8> Sorry. This text is absolutely useless to me. What is it trying to say? Don't get it, although I agree that propositions are not necessarily types.

<comment><USER5> > propositions are not necessarily types

could you expand on this?

</comment></comment><comment><USER9> This nonsensicaly-titled article is somewhere between a rehash of "the map is the not the territory / one cannot pass from the informal to the formal by purely formal means" and Sokal-esque gobbledygook.

</comment><comment><USER10> I couldn't follow this. I'm usually capable of following technical papers. The jargon was thick as a jungle, it seems auto-generated. Use plainer language next time, please.

</comment><comment><USER11> Has the author read Brandom?

</comment><comment><USER12> bad title, good article</comment>


Ask HN: I just won $150k. What do I do? - <AUTHOR> I just won $150,000 in cash, and I have no idea what to do with it. This is about a year's worth of salary for me, and I have no outstanding debts or big expenses other than rent.
I'm in my early twenties, have never had this sort of money in the bank before, and I am totally lost.
How do I best use my tiny jackpot?
EDIT: To clarify, I _also_ have a job where I make ~$150k/y, regardless of this jackpot. <comment><USER2> Estimate your tax obligation and pay the IRS before you lose it or spend it all: [https://www.irs.gov/businesses/small-businesses-self- employe...](https://www.irs.gov/businesses/small-businesses-self- employed/estimated-taxes)

Then invest the remainder into an index fund or retirement fund. If you don't know where to start, then look here: [https://investor.vanguard.com/mutual- funds/target-retirement...](https://investor.vanguard.com/mutual-funds/target- retirement/#/)

<comment><USER3> If you are putting this into any kind of security, be that equity or fonds, spread the investment over time to minimise the risk of temporary flux on the markets. Spread it out over a couple of years.

Also, there are even lower risk alternatives you can go for, if you are anything like me, who does not sleep well knowing your investments move with the markets.

Another tip I got for you, is to spend some of the money. As you said, it's a jackpot, you should celebrate. Spend some of it. Travel maybe?

</comment></comment><comment><USER4> General advice without knowing anything about your life.

Your nice $150k a year job could disappear tomorrow.

Put $100k in your savings account.

Put $50k in one of the investment recommendations given here. Index fund, etc.

Save it for a rainy day. Forget about it and move on with your every day life.

You're young. You have your whole life ahead of you. That money could come in handy one day.

Congrats!

<comment><USER5> Why would you put 100k in a savings account that has a real negative yield? It makes no sense, and I'm just going to say, savings accounts are for suckers. The only point is for your bank to earn some extra cash on the money you decided to loan them.

</comment></comment><comment><USER6> You first need to decide what your plans are for the future and what your appetite for risk is, if you desire to own real estate one day, or not, etc.

Research all the different ways you can invest it and come to your own conclusions.

Or blow it on a 5 star round the world trip.

Stock market is volatile and is at all time highs during a pandemic, so think about that and only invest if you are prepared to hold for many years to ride out a big crash. Not saying there definitely will be, but it's a risk.

<comment><USER7> y, I would hold off on investing it till we get a little closer to the end of the pandemic. Now seems like a risky time to invest.

Buy your parents or a mentor something nice.

Buy yourself something nice.

Save the rest and invest once things are more stable.

Congrats!

<comment><USER6> It is not necessarily "don't invest" but do it with eyes open.

The problem is stocks are valued based on macro factors (interest rates, money supply and demand, lack of anything else good to invest in) and sentiment as much as the intrinsic value of the company itself. So a great company could drop in value if money stops being cheap. Let alone will corona virus cause a depression? People say stock market is not the economy, but who will be spending money on Google Ads in a depression, and if they are, what are they selling and who is buying it?

OTOH this could be a cheap time to buys stocks looking back from 2030.

I think if you can hold for a long time and ride it out it's a good time to buy (is that always the case though?). But a better time than January!

</comment></comment></comment><comment><USER8> Put it in Vanguard and forget it.

[https://ritholtz.com/2014/02/the-best-investment-advice- youl...](https://ritholtz.com/2014/02/the-best-investment-advice-youll-never- get-2/)

</comment><comment><USER9> Don't try to over optimize it immediately. My suggestion is to park it in a high yield savings account (e.g. capitalone360 gives almost 2%). Then sit on it for a month or so while you research the best options for YOU.

</comment><comment><USER10> Keep working and dump all of it into a basket of etfs. high quality stocks that pay dividends. the sp500. a little in the russell.

those are retirement and extreme emergency funds.

dont feel bad about buying something fun. just make sure it isnt stupid and fun.

<comment><AUTHOR> What's the process for investing in S&P500/Russel2000? Do I need to pay someone or can I do it myself through my bank?

<comment><USER11> Vanguard / Fidelity are also good options. Look for a low-fee index fund. Also congratulations!

<comment><AUTHOR> Thank you!

</comment></comment></comment></comment><comment><USER12> You got a one-time windfall, the source and form of it doesn't really matter. Use it to pay down high-interest rate debt (e.g. credit card and the like) if you have any, and save the rest.

<comment><USER13> After calculating your taxes I would do something kind of nice for yourself and after that put the rest and put it away in an index/mutual fund.

<comment><AUTHOR> I don't have _any_ debt.

Which index should I use? What are the differences between using an index and a mutual fund?

<comment><USER11> A stupid simple approach: use a Boggle 3-fund portfolio [1]

[1]: [https://www.bogleheads.org/wiki/Three- fund_portfolio](https://www.bogleheads.org/wiki/Three-fund_portfolio)

</comment></comment></comment></comment><comment><USER14> Donate a chunk to your favourite charity/cause. Personally I am a fan of GiveDirectly because their model is simple and efficient.

<comment><USER12> Be careful though, donating is not for everyone and charity should begin at home. By their own admission, OP has never handled this kind of money before so prudence should be the first priority. Maybe they can donate a chunk of it in a few years after it's been sitting in the bank for a while, but not right now.

</comment></comment><comment><USER15> Don't do anything.

Don't touch it until you sure about what should do with that money.

Do not bet or spend money at you don't know well.

Just hold it.

<comment><USER15> Ignore about how to bet/spend about that money. Hold it till to 6? month or more.

</comment></comment><comment><USER16> Since you 'won' this cash (well done btw) and didn't work or earn it, I suggest you save most of it and use some of it in investments.

Otherwise you'd be more likely to spend it on expensive things at once which doesn't sound very good if you're not earning any extra income.

<comment><AUTHOR> I still have my usual income (~$150k/y).

What kind of investments would you recommend?

</comment></comment><comment><USER17> If you want some risk put it all in FB and Google and just hold it for 10 years.

If you want less risk put it all in VFIAX Mutual Fund and hold it for 50 years.

If you want even less risk put it all in a Vanguard Targeted retirement fund and hold it for 50 years.

</comment><comment><USER18> Spread the $150k across a basket of FANG stocks and hold that for 5-10yrs. Those companies will continue winning and you can afford to take this relatively minor risk at such a young age.

</comment><comment><USER19> Its 'free money'. Some folks would consider it outside normal obligations, and spend it freely. Others will advise relieving normal financial pressures. It's really up to you!

</comment><comment><USER20> Take $5k or so and buy yourself something nice to get that out of your system then save/invest the rest.

</comment><comment><USER21> Invest in p2p lending. Maybe you can get between 4 to 10% of interest per annum.

</comment><comment><USER22> I agree with saving most of it. Plus make a budget. I like YNAB.

</comment><comment><USER23> I like tax free Muni bond funds.

Or a high interest savings account.

Or just put it into SPY.

<comment><AUTHOR> How risky are municipal bonds? I feel like I always hear about cities going bankrupt.

</comment></comment><comment><USER24> Congrats! There's been a lot of solid object level advice here...I'll just repeat some basic & meta advice in case anything resonates: \- you can't lose it if you don't spend it (aside from the real small negative yield from inflation outpacing banks' savings interest rate).

\- this is enough money to really provide a lot of investment opportunities, be extremely picky about a number of the first 'good' opportunities that come your way. There's a very good chance that you'll find better opportunities just by waiting a bit longer (where rate of return will make up for the opportunity cost of not investing).

\- this is enough money that's it's probably worth reading at least a few books about investing and wealth management. You spend thousands of hours a year to otherwise earn $150k, it probably makes sense to spend at least 1/100th of that amount of time to really become informed about how to manage an additional $150k.

\- the majority of non-profits and charities suck in terms of their impact/dollar efficiency. If you are actually trying to maximize your impact rather than donate to feel good (which is okay too! Just recognize when you are doing so), I'd hold off on donating to charities until you've done at least X hours of research per say, $1000k that you donate. Considering you make around $100 an hour, a few hours of research per $1000 donated probably isn't unreasonable. Additionally, the best charities aren't just 5 or 10x more impactful than the average ones, but probably 100's, 1000's, or even more times more impactful.

\- don't ignore the peace of mind that a solid runway from a variety of uncorrelated, fairly liquid assets may provide. Regardless of what happens--a solar flare knocks out our electric grid for months, the US defaults, banks can't let you withdraw cash for whatever reason--you want to know that you'll be able to incentivize other's labor and buy goods from other people. Cash, gold, BTC/ETH/Monero/Zcash/etc. in cold storage wallets, and perhaps even other 'currencies' like common caliber bullets or cigarettes in a safe deposit box and/or a safe at home, might be worth storing $5k or even more in.

\- consider using getguesstimate.com, www.causal.app, or at least Excel/Sheets to try to quantify the different risks and returns of all the options you are considering. The first two apps allow you to easily include uncertainty in your estimates of values, as well as do sensitivity analysis, which can help you decide which model inputs are probably most worth reducing your uncertainty about by researching them further.

\- when in doubt about a spending decision, especially if you haven't exhaustively researched and thought about it, just wait a day and sleep it off. And if you don't feel good the next day, just wait again. For most people, it's too easy to spend money and too hard to save it. Don't be like most people.

<comment><AUTHOR> Thanks for the advice!

</comment></comment><comment><USER25> Could you give me $5000 so that I could have a roof for like 4-5 more months?</comment>


50 Cent's tweets move markets - <AUTHOR> http://www.businessinsider.com/50-cents-hnhi-tweets-2011-1# <comment><USER2> Wow, read the Tweet and say he misspelled "their."

Why would anyone buy a stock that 50 cent recommends? Wow...maybe I should get him to promote my app.</comment>


A stethoscope for the next 200 years - <AUTHOR> http://www.wsj.com/articles/eric-topol-and-stephen-r-quake-a-stethoscope-for-the-next-200-years-1420242913

<comment><USER2> What is the point of submitting a story behind a paywall?</comment>


Ask HN: How to build an IoT analytics database? - <AUTHOR> Hello hackernews! My company is launching a new IoT-based product next autumn and we are looking for platform or database to store the data. Product is industrial and it will send telemetry back to cloud regular intervals through MQTT.
We are planning to use some open source visualization tool for the data such as Grafana, but storing the data is still problem.
Ideally we could visualize even large intervals (5 years) of data fast but in the same time we would like to store all data sent to us for 5-10 years timespan. Sometimes it's also good to see high frequency sampled data (~10Hz) for some certain duration when ie. maintenance crew is investigating equipment failures.
Some people have suggested using products such as Elasticsearch but it seems it may get very expensive if we want to store data long times.
Prometheus was also mentioned elsewhere as an option but it seems that it doensn't support high frequency sampled telemetry very well.
I can see cost benefits for archiving the raw data into S3 or other object storage, but then query engine should support fetching from different sources. Is there some open source options? <comment><USER2> I was working on this at my previous employer. We started with Elasticsearch and were planning to move to Timescale ([https://www.timescale.com](https://www.timescale.com)). Another project used Cassandra which had some issues but they were happy with overall.

You might also want to look into Thingsboard ([https://thingsboard.io](https://thingsboard.io)) which supports both Timescale/Postgres and Cassandra.</comment>


Does the Scientific Method Need Revision? - <AUTHOR> https://medium.com/starts-with-a-bang/does-the-scientific-method-need-revision-d7514e2598f3

<comment><USER2> As far as I can tell there is no or not much data from experiments that contradicts existing theories or is unexplained. It is of course worthwhile to probe theories in currently unexplored territories but this is getting more and more expensive. No unexplained data, no new theories based on that. Our current problem is just that we don't completely understand our theories and how they fit together. So unless we are lucky and find some important new experimental data, supersymmetric particles for example, there is not much we can do besides reformulating our theories and looking at them from all possible angles until somebody sees something nobody ever saw before.

</comment><comment><USER3> Sounds more like some profs are struggling to get their research grants in String Theory renewed.

Personally, I can't see any problem with physicists working on hypotheses that aren't directly scientific or have imminent utility. But then again, I don't pay their wages.</comment>


The Rise and Fall of the 'Kill Box' in US Military Strategy - xkcd-sucks http://www.defenseone.com/ideas/2016/02/when-enemy-everywhere-rise-and-fall-kill-box-us-military-strategy/126263/ <comment><AUTHOR> I'm not a military guy, but was surprised that the weapons-free, kill- anything-that-moves zone described in the article could exist in today's warfare. Turns out it kindof doesn't.

After some quick reading, [1] a "kill box" is still subject to the standard rules of engagement. Its purpose was to make sure everyone is aiming at the same stuff, and to make resupply/logistics work smoothly, not to lift fire restrictions.

Maybe the tactic was abused to circumvent ROE in practice, but the intent seems clear.

[1]: DoD publication: [https://info.publicintelligence.net/MTTP- KillBox.pdf](https://info.publicintelligence.net/MTTP-KillBox.pdf)

<comment><USER2> If you still believe the US military obeys the rule of law, international law, common decency, and their own rules of engagement then you have not been paying attention to 1, the Manning leaks, 2 Snowden leaks, 3 recent war crimes involving the bombing of hospitals operated by doctors without boarders, Senate report on torture, Obama refusal to exercise the laws against torture, Gitmo, the 'disposition matrix' aka kill lists without oversight, 'double- taps'. The list so long, extensive, and well documented that I can only question your sincerity.

<comment><USER3> > I can only question your sincerity.

This is the mark of a viewpoint unfettered by exposure to the other side. Assuming malicious intent of someone just because they have an opposing viewpoint is simplistic and naive.

1\. Manning leaks: exposure of one war crime and its coverup. Hardly a trend. Furthermore, Wikileaks edited the Collateral Murder video to imply malicious intent and obfuscate the ambiguity in the situation.

2\. Snowden leaks: where was the U.S. military implicated in any of them?

3\. Hospital bombings: yes, targeting fails happen in wartime. It is tragic and regretful. War zones are dangerous.

4\. Senate report on torture: wasn't that the CIA as directed by Attorney General Gonzalez?

5\. Obama refusal to exercise the laws against torture: this is the first time I'm hearing of this, please discuss.

6\. Gitmo: hardly the U.S. military; this is an artifact of a Congress that refuses to allow any appropriations toward relocating prisoners elsewhere.

7\. Kill lists: how would you approach terminating military commanders engaging in continuous operations (that kill noncombatants) against your country, yet they don't belong to a nation-state?

In the last 100 years, the U.S. military is guilty of much wrongdoing. Compared to other nations, and considering the volume of combat in which the U.S. military has been engaged, the U.S. military fares well when compared to other nations. The reality is that warfare inherently involves the killing of people who should not have been killed, simply because their homes were in a combat zone. You could argue that the U.S. shouldn't have entered most of its wars; that might be true. At the time, it was considered to be the right thing by the U.S. electorate in order to prevent much more bloodshed. World War 2 is the textbook example of a war entered too late to prevent massive bloodshed. This informs U.S. decision makers and cannot be discounted.

<comment><USER2> 1, your willingness to whitewash the calculated murder of a civilian journalist is chilling, it's hard to believe you argue in good faith.

2\. Clapper lying under oath to Congress, numberous illegal programs under the NSA.

3\. Just another isolated example right? Honest mistake, just like the weddings and the explicit double tap strategy that explicitly targets emergency medical responders.

4\. Forget about abu ghraib? Just another isolated example... Seeing a pattern here of your refusal to look past the numerous examples, as if you have your head in the sand.

6\. Gitmo is the result of our Governments decision to violate the Geneva convention on the handling prisoners of war, the Taliban certainly qualified, but our military industrial complex did the legal contortions of enemy combatants instead. Gitmo existence is a clear war crime.

7\. I'd pursue by continuing to respect the rule of law, international law, and our Constitution, apparently trifling concerns to you.

5\. Look it up, Obama violated his oath by refusing to execute the law of land against one of the most henious crimes possible.

<comment><USER4> 1\. His point was that the Manning leaks revealed one war crime, not a trend.

2\. Clapper is/was not a military official.

3\. Being a former US Army infantryman, I have no clue what you are referencing with regard to an "explicit double tap strategy." However, you did describe a well-used TTP of insurgents in Afghanistan.

6\. A "clear war crime" GITMO is not; it is an artifact of civilian policies in a legal grey area. Personally, I think it does more harm than good and should be shut down, but there are real questions (i.e. where do the prisoners go?) that CIVILIANS in Congress can't answer yet.

7\. That sounds lovely, but lacks any real substance.

</comment></comment></comment></comment></comment><comment><USER5> That's not my understanding of the term at all. A kill box is just a region you try to contain or shepherd the enemy into to make your concentrated fire more effective and the enemy's less so. It's a tactical device unaltered since the middle ages at least.

</comment><comment><USER6> The "Joint Doctrine for Targeting" would be a another source of information: [https://www.aclu.org/files/dronefoia/dod/drone_dod_jp3_60.pd...](https://www.aclu.org/files/dronefoia/dod/drone_dod_jp3_60.pdf)

</comment><comment><USER7> When John Kerry ran for President, several news organizations ran clips of him as a twenty-something Vietnam veteran complaining, among other things, of free-fire zones. The Wikipedia article ( [https://en.wikipedia.org/wiki/Free- fire_zone](https://en.wikipedia.org/wiki/Free-fire_zone) ) points to similar tactics from WWII. The idea pre-dates the Gulf War by a lot. And, as described, doesn't require the level of technology that the writer mentions.

There is either more to the story (that distinguishes kill boxes from WWII tactics) or less to the story than what is presented.

</comment><comment><USER8> Why limit yourself to a "kill box" when there are so many useful and charming patterns available: the "kill banana" ("Oops! Slipped!"), the "kill cross"(reserved for non-Christians) and my favorite, the "kill doily"(for the most vile of the unfaithful, cake-haters)?

I can almost see the UI for the "kill design" now: pre-defined patterns + GUI etch-a-sketch (for personalized kill pattern design), a kill pattern library, a website discussing design principles and associated blog, twitter feed ("Killing you softly NOW!"). It will be all the rage.

<comment><USER9> Please don't post such unsubstantive comments as this, especially on a sensitive topic.

<comment><USER10> Distasteful perhaps but I think their comment was almost certainty satirical, and referencing the ludicrous nature of a 'kill box' having existed as a doctrine, rather than simply being grossly insensitive for the sake of it.</comment></comment></comment>