Lyme Is 'All in Your Head' – A Wake-Up Call to Mental Health Professionals - <AUTHOR> https://www.madinamerica.com/2017/03/lyme-wake-up-call/ <comment><USER2> I'm unclear on why this is on the frontpage of HN. This seems to be another medical advocacy group that are searching for explanation of their symptoms, and have convinced themselves of a cause.

There have been several studies on their claims, none of which show that their symptoms are caused by a persistent infection:

> "The assumption that chronic, subjective symptoms are caused by persistent > infection with B. burgdorferi is not supported by carefully conducted > laboratory studies or by controlled treatment trials. Chronic Lyme disease, > which is equated with chronic B. burgdorferi infection, is a misnomer, and > the use of prolonged, dangerous, and expensive antibiotic treatments for it > is not warranted."

[http://www.nejm.org/doi/pdf/10.1056/NEJMra072023](http://www.nejm.org/doi/pdf/10.1056/NEJMra072023)

It doesn't help that the article is written by someone who apparently is working hard to sell books about how to treat this - [https://lymemadness.ca/](https://lymemadness.ca/)

</comment><comment><USER3> I had lyme for a few months and it was just awful. My brother had it undetected for nearly a decade and had an incredible number of muscle and joint issues, including surgery to burn nerves in his back because the pain was too much and he was on all kinds of drugs. After the 12th doctor he went to over the years, one finally tested him for lyme and he had more than 20 times the highest normal limit for lyme infection. It took 9 months on 8 simultaneous antibiotics (which destroyed him) to finally get rid of it. He's still doing follow up blood tests now a few months later. This is a real problem and it needs to be treated far better than it is now. I only had it for a short while and it completely changed how I thought about myself. My brain was so foggy that I couldn't even remember the names for certain things. I could tell you a steering wheel was round and it turned things, but you could have offered me a million dollars and I couldn't have told you what it was called. Lyme is relatively new in how widespread it is, and it's only going to get worse.

<comment><USER4> 'chronic lyme disease' does not necessarily equal 'sequelae from lyme disease': many people getting treated with fuck-off antibiotics for chronic lyme have never actually gotten a diagnosis of lyme

(that is not good)

</comment></comment><comment><USER5> After nearly 4 years of my battle with Lyme, I finally found a doctor who cured me with an essentially illegal combination of antibiotics (4x the max daily dosage of doxycycline for 18 months). In her words, this will be bad, but not nearly as bad as not treating your Lyme. I haven't had any symptoms for 3 years now and am in best health I've ever been.

Occasionally, however, I am still reminded of how ignorant our medical institutions are about this disease. Recently I switched to Kaiser and during my intake process I mentioned my chronic Lyme, at which point the MD corrected me that there's no such a thing. He explained to me that he has all those years of experience, and that he has had to correct so many people about their misconceptions about Lyme. According to him, Lyme is like fever that you treat once at a time (and no longer than 4 weeks max). After my push back, he called in their in infectious disease specialist, who repeated the same thing, word by word. They even wanted to know the name of my specialist, claiming that it was irresponsible of her to give me that treatment (I didn't share her info).

I don't doubt that these two gentlemen are doing their best to help out their patients. I also realize that some kid in their practice will unlikely be able to shatter their firm beliefs that they had acquired in their decade-long training at prestigious universities. It just makes me sad that hundreds of other kids will be less lucky than I was, and will be left alone trying to figure out what's wrong with them, because obviously it can't be Lyme.

In words of my angel doctor, Lyme is the worst curable disease out there - it's a shame we don't cure more people.

<comment><USER6> Do you think the antibiotics were just a placebo for you? Maybe the pain you went through while taking the drugs knocked the disease "out of your head", so-to-speak.

<comment><USER5> The symptoms of Lyme are very real and in my case had physical manifestations on my skin. I highly doubt that "more positive thinking" fixes that kind of stuff.

Edit: just to be clear - the main issues were "under the skin," and very much in line with what's described in the article.

<comment><USER6> You've never heard of stress rashes? I have a friend who gets them all the time. She gets them after a few weeks of stress, like studying for an exam.

I don't want to diminish your suffering, just that there are other explanations for it. The mind is powerful thing!

<comment><USER5> I should have made it clear that there's never been any doubt about the initial infection. I had the bull's eye and was diagnosed correctly. The point I am making is about what happens once you finish your initial 10-30 day treatment and the symptoms continue to persist.

</comment></comment></comment></comment></comment><comment><USER7> From what I know, there's no sure way of diagnosing Chronic Lyme. There is no real proof that it exist. That doesn't mean that the symptoms attributed to Chronic Lyme doesn't exist.

[http://www.skepticalraptor.com/skepticalraptorblog.php/chron...](http://www.skepticalraptor.com/skepticalraptorblog.php/chronic- lyme-disease-myth-reviewing-the-evidence/)

Now, attributing any symptoms like this to hypochondria should of course only be done by a licenced medical doctor. However I also think that there is a great deal of misunderstanding about hypochondria. I believe that hypochondria is quite akin to synesthesia. It's not really by choice as it affects the perception. Emotional or mental states feed back into the perception in a way that can't be distinguished from "real" perceptions. The pain is felt, not "imagined". But triggered in an unconscious way by the imagination. It might be an evolutionary artefact from developing ways to identify bodily problems in moments of distress. And when the cause of the distress is hard to identify it is attributed to something close by.

</comment><comment><USER4> [https://en.wikipedia.org/wiki/Chronic_Lyme_disease#Controver...](https://en.wikipedia.org/wiki/Chronic_Lyme_disease#Controversy_and_politics)

<comment><USER8> These kinds of articles are dangerous. It doesn't help that the author's livelihood comes from treating people who believe they have this illness.

Good link: "... which noted the diagnosis of chronic Lyme disease is used by a few physicians despite a lack of "reproducible or convincing scientific evidence", leading the authors to describe this diagnosis as "the latest in a series of syndromes that have been postulated in an attempt to attribute medically unexplained symptoms to particular infections."

</comment></comment><comment><USER9> I travel to Old Lyme Connecticut at least once a week. This is the town where Lyme disease was diagnosed as a separate condition for the first time.

Its also where the illness gets its name.

We have a lot of ticks.

Scientists link invasive barberry to Lyme disease:

\- [http://today.uconn.edu/2012/02/controlling-japanese- barberry...](http://today.uconn.edu/2012/02/controlling-japanese-barberry- helps-stop-spread-of-tick-borne-diseases/)

The illness is definitely an imitator which is very scary. I've known people who have drooping faces which resembled a stroke / bells palsy and who eventually got the diagnoses of Lyme. I think the problem with Lyme is that its isolated, its infectious but not contagious (spreadable between humans). This appears to reduce the urgency of research. That said, the bacteria hides and destroys a person mentally and physically.

<comment><USER10> Small nitpick: Lyme doesn't mimic Bell's palsy, it can cause it. Source: my face during initial onset of Lyme, September 2000. Thankfully I got and noticed the bullseye bite mark, and 21 days of amoxicillin took care of it.

</comment></comment><comment><USER11> This reminds me of Morgellan's disease. Insisting something is real doesn't make it real. I don't know anything... can someone share a more evidence heavy article from the same side of the argument?

The medical profession doesn't just turn it's back on treatable (e.g. profitable) diseases.

<comment><USER12> Yes it does, all the time. Before Diabetes was a known condition, it was considered a mental disorder. Then diabetes became widely understood, but for a short time hypoglycemia was considered a mental disorder. Nowadays, hypo and hyperglycemia that are triggered without actual blood sugar level changes, are considered a mental disorder.

I know, because there is someone in my family with that last one. But if you do enough research, it turns out there are specialists out there, who are studying exactly that condition, and claim it to be related to something in the pancreas. But talk to a doctor outside that small circle? Mental disorder.

<comment><USER13> > Before Diabetes was a known condition, it was considered a mental disorder.

That's a disingenuous comparison. Lyme disease is a _known_ condition, with empirical tests to detect it and clinically proven treatments.

<comment><USER7> > with empirical tests to detect it and clinically proven treatments

Yes, but the article is about chronic lyme which is not clinically proven AFAIK.

<comment><USER13> Right, and that's part of what makes chronic lyme so unlikely. We've got a known mechanism for lyme disease, and chronic lyme advocates try to hand-wave away the fact that that evidence of that mechanism can't be found in its alleged sufferers.

<comment><USER12> That was the point of my post though. Its a moving target. First it was diabetes. Then hypo/hyperglycemia. Then hypo/hyperglycemia when it manifests in ways that aren't understood. Etc

This, to me, sounds like more of the same. First lymes wasn't known. Then it was identified, but chronic lyme is a mental disorder. Eventually, given enough study, chronic lyme will be understood, and then people who don't fit into that paradigm will be the ones with 'mental disorders'. Its a moving goalpost.

I'm not trying to invalidate a lot of smart research in the area. I'm saying that when medical science doesn't know enough about an issue to truly identify and treat it, by the nature of the way science works (step 1 is identifying the problem, and likely that hasn't even been done yet) medical practitioners can't do anything about it in good faith. So they'll suggest you find remediation as best you can, perhaps with therapy to help. Or else you're stuck looking for a specialist in your area, or a less-mainstream doctor who's willing to bend rules and provide home remedies with your symptoms, neither of which the medical profession can ethically suggest to you.

Look at it another way: in order for something to be studied, enough people have to get it to create a statistical sample size, and a large enough sample set to be potentially profitable or worth researching. That means, by definition, there are plenty of people out there with ailments that haven't crossed that threshold yet. Or, even more likely, there are plenty of people out there with problems, but due to the unknown nature of the problem, they haven't been successfully grouped together for study yet, even if they are over the threshold. Who's to say chronic lymes doesn't fit into those categories? Lymes itself is still a relatively new ailment.

</comment></comment></comment></comment></comment></comment><comment><USER14> Related article that I enjoyed was "Why Your Dog Can Get Vaccinated Against Lyme Disease And You Can't" [http://legacy.wbur.org/2012/06/27/lyme- vaccine](http://legacy.wbur.org/2012/06/27/lyme-vaccine)

</comment><comment><USER15> Today it is very easy in most U.S. states to order your own blood tests for Lyme. If you think you may have Lyme, order the test online and go to your nearest LabCorp/Quest office. You'll get your results in 2-5 days. No need to convince a doctor that you need the test. If it's positive, you can take it to them and receive treatment.

"Chronic Lyme Disease", as used by some, simply means "untreated Lyme disease". It is not a chronic vs acute form of the disease.

</comment><comment><USER16> I don't see why this belongs in Mental Health. Where I Live patients go to their GP's who then either decides to send people to a "regular" doctor for bloodtest and so forth, or establishes a possible mental condition and you are send to a psychiatrist/psychologist.

The brain is physical in nature, and lyme is far from the only disease to exhibit neurological symptoms. A psychiatrist will be biased towards treating as if the root is mental and not physical/viral in nature. Not to mention, they don't have direct access in many cases to do the required tests themselves.

</comment><comment><USER17> A decade old but not much of the underlying research has dramatically shifted. [http://www.nejm.org/doi/pdf/10.1056/NEJMra072023](http://www.nejm.org/doi/pdf/10.1056/NEJMra072023)

</comment><comment><USER18> a friend of mine spiraled into years of undiagnosed anxiety, depression and fatigue and was told by many doctors it was all in her head. a few years later she was diagnosed with lyme disease, got treatment and now has a new lease on life.

<comment><USER13> The effectiveness of placebo treatment is well documented.

<comment><AUTHOR> Which raises a good? question: "Should we treat people with placebos [without their knowledge] if it might improve their lives?"

</comment></comment></comment><comment><USER19> > Every day, in doctors' offices across the US—as well as in Canada, the UK, > Ireland, Amsterdam, Australia, Sweden, in 80 countries and on every > continent

Amsterdam is not a country. The country is called The Netherlands. Amsterdam is the capital.

<comment><USER20> Well if we want to be difficult about this, Ireland really isn't a country either. It's a geopolitical region with two separate states on the same major island.

<comment><USER21> Pointing out that Amsterdam is a city and not a country isn't really "being difficult."

<comment><USER11> But it's off topic and not constructive.

<comment><USER22> It's a useful tool to determine how well-edited the source is.

</comment></comment></comment></comment></comment><comment><USER23> Terrible article. How do you test for it, and how do you treat it. Neither of those things is addressed at all. She doesn't even make a compelling case for "buy my book".

</comment><comment><USER24> Well now I don't know who to believe.

<comment><USER25> I'd say believe the people and views supported by factual evidence, instead of appeals to emotion - I found the original article to be one long exercise in how to write things that would annoy a debate coach.

<comment><USER26> Or just remain skeptical, open-minded and curious for additional evidence towards either side.

If you don't have sufficient evidence, you don't _have_ to believe either side.

</comment></comment></comment><comment><USER27> If you just assert hard enough, eventually it becomes true! Who needs hard evidence anyway?

</comment><comment><USER28> It's so frusterwting that there's a Lyme vaccine for dogs but no one will make one for humans.

<comment><USER13> [https://www.cdc.gov/lyme/prev/vaccine.html](https://www.cdc.gov/lyme/prev/vaccine.html)

> A Lyme disease vaccine is no longer available. The vaccine manufacturer > discontinued production in 2002, citing insufficient consumer demand.</comment></comment>


Show HN: A collectively generated abstruse binary stream - <AUTHOR> http://www.zeroone.io

<comment><AUTHOR> It seems like my rate limiting is broken, working on it right now.

</comment><comment><USER2> fabulously useless

<comment><AUTHOR> Therefore perfectly essential :)</comment></comment>


Fugazi builds archive with 800 live shows, $5 each or pay-what-you-want - <AUTHOR> http://www.dischord.com/fugazi_live_series/

<comment><USER2> Very cool. Just bought a recording to a show from 1987 for $5. Looks like they send you a zip file from S3.

Interesting idea... If you want to pay a different price (lower or higher) you have to click a link tell them why. "Please tell us why (in 40 characters or more)"</comment>


Stop Saying That There Are Too Many Sauropod Dinosaurs - <AUTHOR> http://tetzoo.com/blog/2020/4/17/stop-saying-that-there-are-too-many-sauropod-dinosaurs-part-1 <comment><USER2> There Are Too Many Sauropod Dinosaurs</comment>


Ask HN: What's the longest your site's title tag should be? - <AUTHOR>

With all the talk about title tags on HN, it got me wondering about length. Can you get penalized for having a title that's too long? If so, how long is too long? <comment><USER2> Anything more than about 65-70 characters will get truncated by the search engines (on Bing and Google 70 characters becomes 67 + "..."). Longer titles also look spammy to users. I usually go with 3-5 keywords plus the site name.

</comment><comment><USER3> Browsers don't display titles in windows, they are truncated by tabs. IE9, Chrome, etc. There's little point in making them much longer. Maybe twice the length that fits in a normal unsqueezed Chrome tab, so that bookmarks can be distinguished from each other, but the one long title that maxes out the bookmark menu width is horrible too.

</comment><comment><USER4> While I don't believe there is a "set" number, the common consensus in the SEO world is between 50-60 characters I think. Personally I have never gone over 60 in my experience, I try to keep them short, to the point, and specific to the page being displayed.

</comment><comment><USER5> W3C used to recommend the title to be less than 64 characters in length: <http://www.w3.org/Provider/Style/TITLE.html>.

</comment><comment><USER6> Long enough to contain the title. No longer.</comment>


1Password GPU brute-force with 3M hash/s - <AUTHOR> http://hashcat.net/forum/thread-2238.html <comment><USER2> Refreshingly honest and clear response from vendor:

[http://hashcat.net/forum/thread-2238-post-13402.html#pid1340...](http://hashcat.net/forum/thread-2238-post-13402.html#pid13402)

Here's a taste:

 _This design flaw is certainly real, and is one of the many reasons why we have started migrating to a new design. In short, when the Agile Keychain Format was designed (in 2008), we weren't aware of all of the various problems that come from using unauthenticated CBC mode encryption._

 _I could plead that we were in reasonably good company in making that kind of error, but as I've since learned, research in academic cryptography had been telling people not to use unauthenticated encryption for more than a decade. This is why today we aren't just looking at the kinds of attacks that seem practical, but we are also paying attention to security theorems._

<comment><USER3> The fact that AgileBit's rep Jeffrey Goldberg is speaking honestly and in plain english about the problem only galvanizes my decision to keep using and recommending their product. It builds trust, as in I trust they will fix the problem and fix it properly.

<comment><USER4> To be honest, it really isn't much of a vulnerability either. Without this attack, the speed would be 800 Khash/sec. It just speeds it up by a factor of four. If your passphrase is sufficiently good, you're safe.

<comment><USER5> No, the attack speeds it up by a factor of two (1 bit).

The other factor of two was a known and expected optimization for HMAC that the OCLHashcat developer(s) discovered the hard way. The defenders (1PW's users) may have already been taking advantage of this optimization, so it really doesn't count as an "attack".

<comment><USER4> Hmm, which is the 1-bit attack you're referring to? I only see one. Also, which is the optimization they might be taking? I don't see any.

<comment><USER5> One of the factors-of-two comes from computing the first input block of the two SHA's in the HMAC calculation and re-using this. This optimization in HMAC was underdocumented, but it ought to have been used by PBKDF2 implementations.

The other factor-of-two, i.e., the 1-bit attack, comes from skipping the generation of the CBC mode IV and only generating 1 output block (160 bits) of PBKDF2 output for the key and using a later ciphertext block to check the candidate password. This saves the attacker half of the PBKDF2 work factor.

This is a weakness in PBKDF2 when used to generate key material longer than the underlying hash function output length. RFC 2898 explicitly endorses deriving multiple keys in the manner 1Password used it:

        For instance, one might derive a
        set of keys with a single application of a key derivation function,
        rather than derive each key with a separate application of the
        function. The keys in the set would be obtained as substrings of the
        output of the key derivation function. This approach might be
        employed as part of key establishment in a session-oriented protocol.

... without mentioning the fact that some of the derived keys would impose more work factor than others.

<comment><USER6> I think you mean CBC mode IV, not CTR mode IV. If they'd been using CTR mode, not having the nonce would be a dealbreaker for the attack; no matter what the cracker did, it would never generate the right keystream.

(I don't think using CTR mode would have made a lot of sense and am not saying the use of CBC mode is a design weakness; it isn't.)

<comment><USER5> D'oh! Thanks, corrected.

And I was just on everyone else for conflating CTR mode nonces and CBC mode IVs...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> This is making the rounds on Twitter. I think the narrative is pretty unfair to 1Password, and that they're bending over backwards to seem reasonable and attentive†.

The problem as I understand it is that 1Pw runs PBKDF2-HMAC-SHA1 _twice_. 1Pw stores encrypted passwords using AES-CBC. It derives a 128 bit AES key from the first run of PBKDF2, and the 128 bit CBC IV from the balance of the first and the first bits of the second. Based on that design, it appears that 1Pw believed that the secrecy of the IV would contribute to the difficulty of cracking the encrypted blob, but of course it doesn't, because the trailing bytes of the blob are known plaintext and an attacker can use the key without knowing the IV to check if their password guess is right.

This is not a great design. But it's bad in a way that wastes cycles for users. The fact that 1Pw does extra PBKDF2 work that doesn't bind on attackers don't make 1Pw meaningfully weaker than any other app that uses PBKDF2, because it was already weird that they were tapping PBKDF2 twice to begin with. A more idiomatic use of PBKDF2 in this situation would be to tap PBKDF2 _once_ , and then expand it (say with SHA2) to 256 bits. That design, which is totally reasonable and would not be the subject of a news story, would be equivalently secure to the "flawed" approach 1Pw took.

There is another problem with the construction 1Pw uses, which is that they chose PBKDF2-HMAC-SHA1. PBKDF2 with SHA hashes are among the easiest KDFs to crack on GPUs††, because SHAx was designed to be fast in hardware. 1Pw would have been much better off with scrypt, or even bcrypt (which is still a pain to implement in GPUs). But PBKDF2 is an industry best practice; to ding someone for using it while the rest of the world still uses "salted hashes" seems unreasonable.

What's happening here, besides the echo-chamber effect, is that the implementation of the brute force cracker for this particular encrypt blob is clever. In a rush to applaud cleverness, Twitter seems to have lept to the conclusion that "clever attack" means "vulnerable target". That's usually a correct assumption, but it isn't in this case.

Corrections more than welcome.

† _They deserve some kind of medal for that, by the way, because I have no dog in this fight at all and I can't seem to shut up about the unfairness of it all._

†† _It turns out there's a clever way to optimize this on a GPU by precomputing the ipad/opad in HMAC, too, which sped the cracker up._

<comment><USER7> In my experience they are pretty awesome at customer service. I emailed them a few months ago after someone published a weakness during the BlackHat Conference ([https://media.blackhat.com/bh-eu-12/Belenko/bh- eu-12-Belenko...](https://media.blackhat.com/bh-eu-12/Belenko/bh- eu-12-Belenko-Password_Encryption-WP.pdf))

Jeffrey got back to me with a way-more-reasonable-than-expected answer:

\</comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>---

Hi Bernardo,

I'm sorry for not getting back to you earlier. I think I answered your question elsewhere, and so failed to get to the email followup.

The Belenko and Sklyorov analysis of a large number of password managers found that many of them (including 1Password) were vulnerable to a "padding oracle" attack.

We discussed the problem the day that the report came out, and released an update to 1Password for iOS (Mac and Windows versions were not affected) within a few weeks.

The specific vulnerability (that pretty much affected everyone who used the standard cryptographic libraries) is fascinating, and I'm hoping to write more about it some day. But for the moment, please see

[http://blog.agilebits.com/2012/11/08/dont-trust-a- password-m...](http://blog.agilebits.com/2012/11/08/dont-trust-a-password- management-system-you-design-yourself/)

which includes some links to the issue and what we did about it. The key paragraph is

"The [New York Times] article cites some of the research behind Elcomsoft's scathing review (PDF) of password managers on mobile devices, which we wrote about last March. That report did included some issues in 1Password on iOS (which we quickly addressed), but it also shows that there is enormous variation in the quality of password managers. 1Password is clearly among the best."

It is hard to stay ahead of potential threats, and we slipped up in that case so had to play "catch up" instead. Although there was never a practical threat to people's data, as developing a practical tool to exploit the vulnerability would take some time. But the design flaw certainly opened the door for people to create such tools, so we did need to get this fixed quickly.

Still we try to look toward the future in our design and defend against potential threats that don't yet exist. We should have defended against all potential chosen ciphertext attacks (CCAs) no matter how "theoretical" before the padding oracle (a type of CCA attack) was actually discovered.

I hope that helps. Please let me know if you have further questions.

Cheers,

-j

–- Jeffrey Goldberg Chief Defender Against the Dark Arts @ AgileBits

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>---

<comment><USER8> That's cool, but it's worth noting that was not a new attack at all. It was known for 10 years before that, and very well known for 2. Elcomsoft didn't even pretend it was new (though they didn't credit previous work or name it, oddly), they just pointed out that 1Password was vulnerable to it.

<comment><USER9> It was only around the time of the Elcomsoft report that we (at AgileBits) became aware of the importance of authenticated encryption. The theorems had been around for more than a decade, but news didn't filter down to application developers (or if it did it went in one ear and out the other). This is a big problem in general.

Part of the problem stems from the fact that application developers are also (correctly) reluctant to use things that aren't in standard libraries and that don't have standards behind them. Even today, Apple's CommonCrypto offers no authenticated encryption modes, and only documents CBC and ECB. (CTR is available, but not documented as such.) And back to the current issue, we would have moved to scrypt from PBKDF2 already if it were readily available in well-reviewed implementations.

But also this stuff is hard (fun, but hard). And not every development team is going to have the expertise on board to really follow this stuff. They are just going to go with what's in the most easily accessible libraries, and if we are lucky, they won't use their encryption keys as IVs for CBC.

Lots of people are talking about how to improve the situation. I'm "cautiously optimistic".

</comment></comment></comment><comment><USER10> I just left a comment on the hashcat forum asking if anyone could offer a better back-of-the-napkin calculation of the real-world implications of this. My understanding is that we're still looking at something like 10^27 years of cracking to exhaust the password space.

Any (more clever) HNers care to offer a interpretation and calcuation?

<comment><USER11> I'd suspect it's a problem for people who think that, since it uses $fancy_encryption_scheme_they_cant_pronounce_or_understand, they can just use a trivially easy password for a computer to guess. Utilizing encryption isn't helpful if your password is still just "password1". I'm not a cryptographer by any means, but my general understanding is that longer is better. Picking some random nonsense sentence like "Correct horse battery staple" and using it as your password, is better than using "p455w0rd!1".

<comment><USER12> @rorrr: You've been hellbanned for almost a month.

\</comment></comment></comment><comment></comment><comment>

His comment:

> It's nearly identical.

> There are around 170,000 english words (including all the obscure ones > you've never heard and have no idea how to spell).

> Number of 4-word combinations:

        170,000^4 = 8.35 * 10^20

> Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 > characters

       98^10 = 8.17 * 10^19

> An order of magnitude difference.

> And if they start bruteforcing with the simpler words (which you used in the > example), there are only 5,000 - 10,000 of them, the number of your > combinations drops dramatically:

        5,000^4 = 6.25 * 10^14

        10,000^4 = 10^16

> So unless you use very obscure words in your password, you are doing much > worse than you think.

<comment><USER13> > You've been hellbanned for almost a month

For good reason; please check someone's comment history before advising them of this.

</comment></comment><comment><USER9> Forgive me for not reading all of the comments, I've had a busy couple of days. (I'm the Chief Defender Against the Dark Arts at AgileBits, the makers of 1Password.)

We didn't explicitly call PBKJDF2 twice. We called it once, but asked for 256 bits of data, while giving it SHA1 to work with. In these circumstances, PBKDF2 acts as if we'd called it twice.

Anyway, there is a blog post about this here: [http://blog.agilebits.com/2013/04/16/1password-hashcat- stron...](http://blog.agilebits.com/2013/04/16/1password-hashcat-strong- master-passwords/) The final part of it contains my analysis of what did and didn't go wrong.

</comment><comment><AUTHOR> The main "problem" seems to be, that increased GPU power and tools just make it easier to brute force the master passphrase. AgileBits will improve the situation in the future.

Please take care and pick a strong master phassphrase!

<comment><USER14> That was the one of the take aways when I first reviewed the password keychain services- use a strong master password.

<comment><USER6> No matter what the construction being used is, you always have to use a strong master password. Nothing can help you if your password is in the dictionary.

<comment><USER15> Really it is unrealistic to expect users to have a sufficiently long password entered on every operation on iOS to provide adequate protection.

There should be some iOS-specific system with a key in protected keystore/keybag on the phone, combined with your encrypted password db potentially living in dropbox/icloud/etc., and then a user passphrase or biometric or whatever to unlock the file. Then you at least are protected against brute force once someone steals the encrypted keyfile from dropbox or some other service.

I've suggested this to them ~10 times. A keyfile format that doesn't rely on the crazy Apple resource forks and works with a user-self-hostable sync server would also be nice.

<comment><USER16> Why not just turn on the emoji keyboard and use unicode symbols instead of regular characters the standard keyboard.

An emoji password like happyface heart pizza devil hospital trafficlight cow moon is probably going to be more secure than any word/number combination that could be dictionary attacked.

This obviously assumes the site properly encodes Unicode, but also somewhat limits use for most people to devices with the keyboard.

<comment><USER15> Interesting idea, but it would be harder for me to remember 30 characters of emoji on a keyboard I don't routinely use than 30 characters of text and symbols which have, to me, some internal order, on keyboards I have used for the past...18 years?

I don't know how you get to the emoji keyboard on iOS. It would also be a little annoying having to do this on multiple platforms (I have considered using 1p on Windows at some point; no real argument that a well configured win 7 or 8 is worse than OSX, now).

</comment></comment></comment></comment></comment></comment><comment><USER17> Regardless of the fact that the master password can be brute forced on a machine running a couple of powerful graphics cards, it's refreshing to see 1Password address the situation so openly without making excuses or denying anything. They've always had great customer support and I have no doubt they'll make this a priority to fix as they've so openly said. This doesn't make me feel any less safe, while the chance is there that an attacker could brute force my data, I find it highly unlikely it'll happen between now and when they implement the new cipher. Bravo to Atom for discovering this and coming up with an exploit that can guess 3 million times per second using a graphics card processing unit.

</comment><comment><USER18> Use scrypt! <http://www.tarsnap.com/scrypt.html>

Denial of hardware attacks is built in.

</comment><comment><USER19> Could the 66 Ghash/s Bitcoin ASIC's be easily repurposed for password cracking? It's something I've been wondering about.

<comment><USER20> When you get into ASICs (Application Specific Integrated Circuits), the answer to 'can it be repurposed?' is almost universally no. It's basically a purpose built circuit, built into a single package. This is cheap and fast, because you only put in the parts you need, but there's non-trivial engineering effort to design them.

I think initially some miners used FPGAs: these are reprogrammable and offer similar performance, but they're much more expensive.

<comment><USER10> I think ajross is (mostly) right, ASICs can be re-purposed for SHA256 calculations. To what extent they have baked in a whole round of SHA256 is a good question, they may just be developed around very parallel XORs (which is why some GPUs are faster at BTC mining than others—they have built in XOR logic).

I do believe seeing that (the mythical) Butterfly Labs intends on releasing software for all sorts of other parallel high-performance applications (or some kind of driver/API type of thing), but I could be hallucinating.

<comment><USER21> _I think ajross is (mostly) right, ASICs can be re-purposed for SHA256 calculations._

I know what you mean, but I think you should be more specific in your statement. _Bitcoin mining_ ASICs might be re-purposable. Not all ASICs.

<comment><USER10> Good point. An ASIC could be completely non-repurposable. The commonly- available (soon) BTC ASICS should be damn good at SHA256 cracking, maybe other XOR-related applications too.

</comment></comment></comment></comment></comment><comment><USER22> I hope they roll out a new 1password version soon. I was just thinking of starting using it, after the linode incident, but now I might wait for the fixed version.

<comment><USER6> That's silly. Even in the least charitable interpretation of what's happened, 1Password's security margin went from N (where N was a hypothetical security level believed to have been achieved by 1Pw, not some objective standard) to N/2. N/2 in this case is still light years past salted hashes.

<comment><USER23> Since N is generally measured in bits, I'd say it's reduced to N-1.

<comment><USER6> Argh I wish I had thought to say that.

</comment></comment></comment></comment><comment><USER24> I'm not a 1Password user. What's a common number of PBKDF2 rounds to have it configured for? What's the default?

<comment><USER5> The RFC spec says 1000 is a minimum, which is what 1PW seems to have been using.

<comment><USER9> We use a minimum of 10000 iterations, and where available we use CCCalibratePBKDF

[http://blog.agilebits.com/2011/12/01/staying-ahead-with- secu...](http://blog.agilebits.com/2011/12/01/staying-ahead-with-security/)

<comment><USER5> Very nice.

</comment></comment></comment></comment><comment><USER25> Can someone explain to me why bruteforce is important if you can not access the password hashes ?

<comment><USER26> Because at some point someone may get access to the hashes?

</comment></comment><comment><USER27> In terms of security, any opinion on how KeePassX for Linux is compared vs 1Password?

</comment><comment><USER28> test</comment>


Ask HN: What are your "I can't live without" Mac Apps? - <AUTHOR> Mine:
HomeBrew - IDK why Apple hasn't acquired them or hope at least support them
iTerm - simply a better Terminal experience
Firefox - (because that doesn't come default)
Bitbar - for putting stuff on Menu bar (free & hack-able) <comment><USER2> I feel like there's not a one-size fits all kind of thing, but I've been happy with HexFiend[1] as far as hex editing goes.

Tiled is a nice map editor; I've used it in 2D and 3D-looking games. [2]

OpenEmu is a nice "iTunes for emulators" setup that require minimal fuss on macOS. Occasionally you might need to go out of your way for something specific, but if you need to try a ROM in a pinch it's a nice way of doing things. [3]

[1] [https://ridiculousfish.com/hexfiend/](https://ridiculousfish.com/hexfiend/)

[2] [https://www.mapeditor.org](https://www.mapeditor.org)

[3] [http://openemu.org](http://openemu.org)

</comment><comment><USER3> * Homebrew, obvs. * Alfred * Bartender * Movist

Not obviously apps but y'know:

* Little Snitch * Backblaze

</comment><comment><USER4> I don't think there's a single app that I'd say is THAT critical, but things I use very often:

Homewbrew

iTerm

Maccy

Itsycal

Alfred

Notable</comment>


Why are Buddhist monks attacking Muslims? - <AUTHOR> http://www.bbc.co.uk/news/magazine-22356306

<comment><USER2> The BBS in Sri Lanka are also agitating against the Christian community. They are essentially making a lot of noise along the lines of how the great Sinhala-Budhist ethnicity is being eroded by minority influences. This is in a country where Sinhalese make up about 70% of the population.

Hair brained conspiracy theories of hidden population control methods are always popping up on the FB pages of these hate groups. An example is the contraceptive laced toffees that are handed out at the counter of a popular clothing store chain owned by a Muslim family.

It's all just mindblowingly ridiculous. People just looking for reasons to be assholes to others.

</comment><comment><USER3> This idea of Buddhists being pacifist vegetarians is very Western - it's nothing I've read or observed in my travels around Asia. Being vegetarian in Thailand is close to impossible (I stopped trying), even though it is a Buddhist country.

<comment><USER4> Not Western at all. I'm an Indian, and I tend to think of Buddhists as pacifists too. Yes, Buddhism spread with the power of Buddhist-sympathizer kings. But when I look at (what little there is of) Indian history, I see Brahmins being frightened by the spread of Buddhism, and challenging them to public debates. The loser would have to become the winner's disciple in some cases, or be exiled, or be put to death in other cases.

What I don't see, looking at Indian Buddhists, is the brutality that's typically associated with other mainstream religions.

<comment><USER5> Hmmm given that you're talking about India, I wonder which "brutal" religion exactly you mean.

From the article: "The global climate is crucial. People believe radical Islam to be at the centre of the many of the most violent conflicts around the world. They feel they are at the receiving end of conversion drives by the much more evangelical monotheistic faiths. And they feel that if other religions are going to get tough, they had better follow suit."

Same phenonmenon there too "Evangelical monotheistic faiths". They don't mean Christians. Note also the generalized "many of the most violent conflicts around the world". The inability to name the obvious.

Why is it racist to point out that islam is involved in pretty much every conflict worldwide (with the west, east, north, south, white, black, yellow, brown, ...), and that this situation has been a constant through history (ever since it exists) ? Islam got started with a campaign of genocide, and everyone can name 5 places the very same thing is happening today. If you study history you will learn that this situation is the norm of the last 15 centuries, not the exception. If people start thinking that that may not be a coincidence, that is a VERY understandable viewpoint.

<comment><USER4> The barbaric religions, in the Indian context, are Hinduism, Islam, and Christianity. Of the three, Christians have lost the power they used to have, and have taken to subtler tactics, i.e. of brainwashing children, etc. (Take kids on a trip. Stop the bus mid-way in the forest. Pretend the bus has broken down. Tell the kids that if we pray hard enough, Jesus will fix it. etc.)

Hindus and Muslims are as brutal as each other. Hindus and Muslims behaved equally badly during the Partition of India. For a more recent example, look at the Gujarat riots. Hindus can be terrorists too, the Government chooses not to see it that way. The media and the people are too damn scared to call it that.

Go ahead, point out that Islam is at the center of every conflict. I will not interpret it as racism. I will merely point out to you that you are inaccurate.

<comment><USER5> > Go ahead, point out that Islam is at the center of every conflict. I will > not interpret it as racism. I will merely point out to you that you are > inaccurate.

I actually like the point that you're making, but the data you use to illustrate it is woefully inadequate.

Your example, the Gujarat riots. The third sentence from the wikipedia article on the subject : "On 27 February 2002, the Sabarmati Express train was attacked at Godhra by a Muslim mob.[2][3][4][5] 58 Hindu pilgrims returning from Ayodhya were killed in the attack." <http://en.wikipedia.org/wiki/2002_Gujarat_violence>

The aftermath of that is what you might expect. The rest of the article has such little tidbits as calls for genocide being broadcast from mosques, in code, which obviously means that muslims were planning a genocide beforehand (or they wouldn't have had time to spread the code).

The gujarat riots were an example of their standard modus operandus : small number of muslims successfully goading a large number of muslims into committing genocide, and losing the battle. I've seen groups try the same in Brussels (thankfully unsuccessfully). But don't worry, they were only trying to get muslims to shoot automatic weaponry at citizens because of graffiti on the mosque (graffiti was related to Europe). Needless to say this was officially declared "an incident of a reaction against religious intolerance". I even know why : because stating the truth had a good chance of making the muslims attack again.

Did "both sides commit atrocities" yes. However, one side can make a VERY strong case it was defending itself. Furthermore given all other incidents, from partition and subsequent genocide in Pakistan but not in India to the many other instances of violence, I would suspect that was the case even without the many indications in the article that this was a coordinated plan for genocide against hindus run from the local mosques that got out of hand.

I think you see why this is unlikely to sway my opinion. Please, do try again, because I really don't want to think islam and muslims are at war with everybody else, which can't end in anything but massive religious intolerance world-wide. But what you've given as examples does the exact opposite you intended.

<comment><USER4> The train was returning from Ayodhya, the center of another religious controversy [1]. It's one thing to serve mob-justice to the people who burnt the train, it's an entirely different thing to "serve" it to all kinds of Muslims who are completely unconnected to the original train-burning, to children, to babies. The Hindus too started violence across the massive state of Gujarat immediately. I doubt that the Hindus were planning genocide beforehand too. But the truth is that sensational news spread quickly, even for some trivial events[2]. Both sides will play the "defence" card, even when attacking children.

Hindu terrorists[3] do not need to be attacked to begin hostilities. The Mangalore case[4] is fairly famous in India. But apart from that, one often hears stories of gift shops getting attacked for selling valentine's day cards, unmarried couples getting attacked on valentine's day for fairly trivial displays of affection, etc.

[1] <http://en.wikipedia.org/wiki/Ram_Janmabhoomi>

[2] <http://en.wikipedia.org/wiki/Hindu_milk_miracle> The news of this idiocy spread, through just word-of-mouth, all over India in just one day

[3] practically no one calls them that

[4] <http://en.wikipedia.org/wiki/2009_Mangalore_pub_attack>

<comment><USER5> You seem to be confused about what I'm claiming happened. You say retaliation against groups because of what other members of the same group did because they were members of that group is not reasonable.

On an intellectual level I concur, but I also realize that such a system is easy to game, and therefore cannot exist. Therefore group attacks, and group retaliation are a necessity, and they will exist regardless of what we rationally or morally feel justice should be. It's not a question of having this morally justified, no more than questioning the morality of a volcanic eruption anyway.

As for [1], that happened during the mughal conquest of India. Again, any violence against muslims during that time was as justified as violence against nazis was in WWII. Muslim invaders were genociding through India at the time, loss of life of that conquest, which included the building of that mosque, run from the hundreds of millions up to a billion dead. Number [4] is such a trivial event I don't get why you even mention it. Drunks do that on a bimonthly basis 200 meter from where I'm sitting. Furthermore I would like to point out that in most muslim countries, those girls would have been slowly stoned to death, as a matter of general policy.

I don't fully get the point your making. When pointing out muslim atrocities, I point to multiple religious genocides, and you say that the other side is "equally guilty" because of the destruction of a building and scaring a few girls. I hope you understand that these things are not comparable.

<comment><USER4> I am not sure what you mean by " Therefore group attacks, and group retaliation are a necessity, and they will exist regardless...", so I'm curious why you are singling out Islam, when group violence has been inevitable across all races, religions and cultures.

The part of [1] that triggered hostilities between Hindus and Muslims was the demolition of Babri Mosque by Hindu fundamentalists. Demolition of that makes about as much sense as the destruction of some university building that the British built when they were here.

[4] was not about drunks beating up girls. It was about some religious activists (who were not drunk, but drugged on religion) entering a pub and beating up girls. Some of them had to be hospitalized. But you know, this fits the definition of terrorism! Also read the justification offered by their leader. Nothing has stopped Hindu terrorists from killing[5]. Hindu terrorists can kill for communal reasons too, not just for religious ones[6].

> in most muslim countries, those girls would have been slowly stoned to death

I am _not_ a fan of Islam. I have openly said that their book is not just stupid, but insane. I would be stoned to death too. My only point was that there is no reason to claim that Hindus and Christians are immune from becoming terrorists.

[5] <http://en.wikipedia.org/wiki/Graham_Staines>

[6] [http://en.wikipedia.org/wiki/19_October_2008_All- India_Railw...](http://en.wikipedia.org/wiki/19_October_2008_All- India_Railway_Recruitment_Board_examination_attack)

<comment><USER5> Since you clearly claim moral equivalence, I seem to have missed your explanation about why the demolition of a building and beating a few girls in a bar is the same thing as committing genocide against millions of people, decades long.

The point I was making with the drunks was not that those Hindus were drunk or not, the point was that their behavior was no worse than what can reasonably be expected to happen (not too often, and other caveats apply of course) where drunk people go out. Muslims would have slowly stoned them to death (and do this regularly), so again it just does not compare :

<http://www.youtube.com/watch?v=VRaLcbxpIsw>

> I am not sure what you mean by " Therefore group attacks, and group > retaliation are a necessity, and they will exist regardless...", so I'm > curious why you are singling out Islam, when group violence has been > inevitable across all races, religions and cultures.

I am not singling out islam. I do not think islam is the only group that exhibits completely unacceptable violent and self-destructive behavior patterns, and I know of a lot of (small) groups that are attacked by the police/"the system", as a group, because of such behavior. Visit western Europe once, where you will find every country has it's political party "the system" attacks (ie. police, army, ... are used against that group). And frankly, they're right to do that in most cases.

Islam is the only really sizable such unacceptable group, and the only one that is a threat to world peace, not because of anything individual members do, but because of the behavior of the group as a whole, and the consequences thereof.

Once the violence grows beyond a certain threshold, the only possible reaction is retaliation against the group. You can call this tragedy of the commons, it's very similar to that. I think you may simply not have considered that such a threshold exist, and what it might be. Visit Delhi and talk to a few people there, and you will know what I mean and that India is not far removed from that threshold.

> I am not a fan of Islam. I have openly said that their book is not just > stupid, but insane. I would be stoned to death too. My only point was that > there is no reason to claim that Hindus and Christians are immune from > becoming terrorists.

And I don't claim that any group is immune from producing a terrorists/criminals. I only claim that, with a few small exceptions, no other religion explicitly causes terrorism, genocide and worse as a matter of general policy, and celebrates it like they do. I claim that there is no choice, and a lot of lives and damage would be spared by attacking islam itself now, before they succeed at creating yet another mass-genocide. Before they cross the threshold.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> "But however any religion starts out, sooner or later it enters into a Faustian pact with state power."

This. The basic fallacies of any religious doctrine when mixed with the desire for power makes for a dangerous cocktail.

</comment><comment><USER6> cool. is Dalai Lama an exception?

</comment><comment><USER7> tl;dr

"If you have a strong sense of the overriding moral superiority of your worldview, then the need to protect and advance it can seem the most important duty of all."

I'll take "What is the definition of succinct for 1000 Trebeck"</comment>


My Journey into Fractals - <AUTHOR> https://medium.com/@bananaft/my-journey-into-fractals-d25ebc6c4dc2 <comment><USER2> If you want to explore 3d fractals, I really recommend you to test this VR experience:

[https://nshelton.github.io/vr/fractals/2017/12/30/RTA.html](https://nshelton.github.io/vr/fractals/2017/12/30/RTA.html)

<comment><USER3> hey thanks for posting! dev here if anyone has any questions about this software or fractals in general. Gregory's work here is really impressive, huge fan. Go fractals!

<comment><USER4> Looks incredible! Can it run on desktop? Are there instructions to build?

<comment><USER3> vive only, there is a build for vive on there. You can also get the source, there is a desktop interface but it's still under development and you probably need to know unity to get it to work

</comment></comment></comment></comment><comment><USER4> I love 3D fractal exploration, especially when it can be realtime.

It's a few years old now, but this is still the best demo I've seen: [http://sub.blue/fractal-lab](http://sub.blue/fractal-lab)

<comment><USER5> Thanks for that link, @gunn! Terrific demo, agreed it holds up! Also, tangentially, given so many people are on their phones, it seems other demo sites showcasing desktop-only experiences really ought to follow sub.blue's lead and embed a video. Sort of comparable to sending documents in pdf.

</comment></comment><comment><USER6> The Mandelbrot set and all its Julia sets are part of a larger, four- dimensional fractal. Explore it here (only JavaScript and WebGL needed):

[https://rawgit.com/MatthiasHu/FractalsWebGL/4d/page.html](https://rawgit.com/MatthiasHu/FractalsWebGL/4d/page.html)

<comment><USER7> Shameless self-promotion, but see also [http://edyoung.github.io/gnofract4d/](http://edyoung.github.io/gnofract4d/)

<comment><USER8> Awesome software!

On the note of self-promotion, here's a simple Mandelbrot explorer to get started with - but this time, it's animated!

Not comparable to anything above, but good to start playing with / coding fractals.

(Web, desktop only.)

[http://romankogan.net/math/processing_js/mandelbrot.html](http://romankogan.net/math/processing_js/mandelbrot.html)

</comment></comment></comment><comment><USER9> If you liked this, you may be interested in Cyril Crassin's Ph.D. Thesis on Gigavoxels, which can be used to do something very similar.

[http://maverick.inria.fr/Members/Cyril.Crassin/](http://maverick.inria.fr/Members/Cyril.Crassin/)

</comment><comment><USER10> This is mind numbingly beautiful. The fractals with lighting and shadows is some of the best digital art I've ever seen.

I would pay proper money for a game that is basically a 6DOF spaceship game like Descent/Overload but in this fractal realm.

<comment><USER11> I've thought about this for a while, complete with HOTAS support.

</comment></comment><comment><AUTHOR> Slightly related to another conversation from yesterday, mentioning Shiffman's Nature of Code: [https://natureofcode.com/](https://natureofcode.com/)

</comment><comment><USER12> really beautiful renders.

I've never seen 3d fractals with moody lighting before.

i would play the hell out of this, even if the whole of gameplay was just bumping around in a ship (with hyper drive).

<comment><USER13> Don't know if you noticed, but you can download and play a build of this on their Itch.io page: [https://bananaft.itch.io/yedomaglobula](https://bananaft.itch.io/yedomaglobula)

Just messing about with it myself and it's unique and fascinating!

<comment><USER12> I hadn't noticed. Thank you! just in time for the weekend. :P

</comment></comment></comment><comment><USER14> I love fractals.

A few weeks ago we were at the UMC Nijmegen for a CT scan (father-in-law; liver-cancer; luckily slow-growing and treatable) they had an exhibition of illustrations from Haeckel of microscopic organisms. It struck me at the time just how much those structures reminded me of fractals as well as how beautiful they are.

You can see some pictures here:

[https://www.mediamatic.net/en/page/370096/the-haeckel- projec...](https://www.mediamatic.net/en/page/370096/the-haeckel-project)

And a book:

[https://www.amazon.com/Art-Science-Ernst-Haeckel- Multilingua...](https://www.amazon.com/Art-Science-Ernst-Haeckel- Multilingual/dp/3836526468/ref=sr_1_1?ie=UTF8&qid=1538756108&sr=8-1&keywords=haeckel)

<comment><USER15> Similarly, on visiting the Sagrada Familia one of my first thoughts was that it was like stepping inside a fractal.

</comment></comment><comment><USER16> I've spent days playing with Mandelbulb 3D and other fractal programs. I was really into the projection of 4D strange attractors onto a 2D plane or printout (my current screensaver). I would burn weeks in FPS mode navigating these Lovecraftian and Fantastic Voyage [1] worlds.

[1] I refer to the original 1966 movie, since the remakes didn't quite make it my opinion! And Raquel Welch.

<comment><USER13> Any chance of a download link for your current screensaver, please? :) Sounds interesting.

</comment></comment><comment><USER17> That's so cool. Reminds me of the work at [http://sub.blue/](http://sub.blue/) \-- especially look at Fractal Lab: [http://sub.blue/fractal- lab](http://sub.blue/fractal-lab)

</comment><comment><USER18> This brings me back to the hours and hours I spent as a kid with VistaPro [1], watching 320px fractal landscapes render, one scanline at a time.

1: [https://en.wikipedia.org/wiki/VistaPro](https://en.wikipedia.org/wiki/VistaPro)

</comment><comment><USER19> Thank you for posting -- I've been super interested in this subject recently after seeing some really great live visuals at a few concerts(1). I'd love to add to my current set of visualizers (2) with something like this.

(1) [https://goo.gl/989gYr](https://goo.gl/989gYr)

(2) [http://whoadude.cool](http://whoadude.cool)

</comment><comment><USER20> A great write up - very interesting to read about your approaches and the various issues I also came up against with my own Fractal Lab experiment.

</comment><comment><USER21> > I am bad at both arting and coding.

Wish I was that bad.

</comment><comment><USER22> Please check out my Fatou.jl julia package, which allows you to share and reproduce 2D fractals with short one-liners written in Julia

[https://github.com/chakravala/Fatou.jl](https://github.com/chakravala/Fatou.jl)

</comment><comment><USER23> This is so cool! I recently just started tinkering with a fractal expressor that results in voxel world in libgdx to roam around in. But secretly in the back of my mind, I think you are building what I really want! Love it. I'll be following your project. :)

</comment><comment><USER24> Beautiful work. I set this: [https://cdn- images-1.medium.com/max/2000/1*y8eAZdMBfXkIB2S8X...](https://cdn- images-1.medium.com/max/2000/1*y8eAZdMBfXkIB2S8XXyksQ.png) as my new desktop background ;)

</comment><comment><USER25> This video linked from the article is very cool: [https://twitter.com/Bananaft/status/894675135260745729/video...](https://twitter.com/Bananaft/status/894675135260745729/video/1)

</comment><comment><USER26> These are absolutely beautiful.

I really like the mood it sets, but I was hoping to see some code for the fractals to be honest :)

Great work!

</comment><comment><USER27> I feel compelled to plug the book Indra's Pearls here, by David Mumford et al.

</comment><comment><USER28> Just stellar. Wow. Whatever game comes out of this, I want to play it!

</comment><comment><USER29> Great trailer at the end.

</comment><comment><USER30> Great stuff. Hope you integrate it into your games.

</comment><comment><USER31> What a delightful journey, thanks for sharing!

</comment><comment><USER32> I studied fractals for years. But it didn't matter how deeply I looked, they still looked just as complicated as ever.</comment>


Professional Masters, Where? - <AUTHOR>

I'm finishing up my undergrad and probably heading to the west coast to work, but I still want to pursue a masters. Right now it looks like I'll be in seattle, so uwashington seemed like a fairly obvious choice, but the curriculum seemed a little lacking. Are there any good distance/part-time C.S. masters programs? <comment><USER2> I think you're better off doing a non-distance program, and UW is a solid second-tier school for CS. I would only recommend a professional masters if you can get your employer to pay for it, though.

</comment><comment><USER3> Where do you think UW is lacking?</comment>